At CornCon 2024, experts debunk myths, explore SaaS vulnerabilities, and highlight how human connections shape the future of cybersecurity innovation.
The post CornCon X: Powering Cybersecurity Innovation Through Human Connection appeared first on Security Boulevard.
Passwordless Authentication without Secrets!
divya
Fri, 10/11/2024 - 08:54
As user expectations for secure and seamless access continue to grow, the 2024 Thales Consumer Digital Trust Index (DTI) research revealed that 65% of users feel frustrated with frequent password resets. This highlights an increasing demand for advanced authentication methods like passkeys and multi-factor authentication (MFA), which provide robust security for most use cases. However, industries reliant on shared devices—such as healthcare, retail, and manufacturing—face unique challenges. These fast-paced environments need a more flexible approach to balance security, speed, and user privacy.
The Challenges of Shared DevicesIn industries where shared devices are the norm, such as healthcare workers accessing patient records or retail employees operating point-of-sale systems, security must remain a priority without sacrificing efficiency. Traditional methods, like password resets or multi-factor prompts, slow down workflows and create friction for users who need quick transitions between devices.
For example, in healthcare, constant authentication interruptions can impact both patient care and productivity. Similarly, in retail and manufacturing, delays caused by authentication procedures reduce overall efficiency. These sectors require an authentication solution that delivers fluidity and security without compromising user experience.
Integrating Thales’s User Journey Orchestration with Badge’s Passwordless Authentication without secretsThe Thales OneWelcome Identity Platform offers advanced user journey orchestration, seamless integration, and robust compliance with data privacy regulations like GDPR and CCPA. Its ability to manage complex identity requirements on validation, consent, and progressive profiling for large infrastructures across diverse industries and use cases makes it the ideal to integrate Badge Inc.’s unique "identity without secrets" approach that uses fuzzy extraction, a cryptographic method that consistently derives a secure key from biometric data, eliminating the need to store passwords or personal information. The Thales Consumer Digital Trust Index (DTI) research, reveals that more than four in five (87%) expect some level of privacy rights from the companies they interact with online.
The Growing Demand for Scalable, Secure Shared Device SolutionsThe need for scalable, secure solutions for shared device access is skyrocketing as shared devices are the new normal across multiple industry verticals such as healthcare, manufacturing, or retail. CISO and Operation Managers are increasingly attentive to the security and efficiency returns of frictionless onboarding and authentication for professionals working in dynamic, multi-user environments.
This integration improves user experience by allowing for frictionless transitions across devices, reducing costs related to device loss, while ensuring privacy compliance by eliminating the need to store personal data.
The industry has key gaps and areas for improvement. At $9.5 trillion, cybercrime is the world's third largest economy1 , with 70% of organizations experiencing significant disruption to their business resulting from a breach. According to the IBM 2024 Cost of a Data Breach Report, "Breaches involving stolen or compromised credentials took the longest to identify and contain (292 days) of any attack vector," and are among the most prevalent and costliest attack type. By eliminating stored credentials and biometrics, Badge ensures there is nothing to breach.
Account recovery is traditionally highly vulnerable—a weak spot for the industry and a common vector for credential theft. With Badge, there is no credential recovery because there is no credential. Thales is augmenting its identity offering by adding Badge to the integrated solution, authenticating that you are you all along the identity lifecycle.
Thales serves customers around the world with a variety of needs, and therefore optionality is critical. Badge's technology allows organizations to use face, fingerprint, PIN, device characteristics, contextual, and other factors for authentication. A standout feature of Badge is that it maintains high accuracy in recognizing users without increasing errors, and organizations can adjust how strict or lenient the system is, ensuring both security and user convenience.
Improving Shared Device Management with Badge Inc.’s Passwordless AuthenticationThe integration of Badge Inc.’s unique passwordless authentication enhances identity management for shared devices. The integration allows multiple users to authenticate efficiently, without the delays caused by password resets or complex credential management, ensuring secure, uninterrupted access to shared devices.
In healthcare the integration provides comprehensive IAM capabilities that ensures secure patient and clinician authentication to leading healthcare systems on shared devices without centrally storing biometric templates. In finance and payments, the integration offers robust authentication to secure bank teller, back office, and customer data without requiring added friction and liability such as push notifications to trusted devices. Retail and manufacturing sectors benefit from streamlined operations and improved user experiences across shared devices such as kiosks.
Stay tuned for more updates on how our partnership will drive innovation in IAM. To learn more about how Thales OneWelcome and Badge, Inc. can support your organization, visit us at the Thales booth at Authenticate 2024 Conference, October 14-16, in Carlsbad, CA.
Access Control Identity & Access Management Cloud Security Compliance Marco Venuti | IAM Enablement & Acceleration Director
More About This Author >
Schema
{
"@context": "https://schema.org",
"@type": "BlogPosting",
"headline": "Passwordless Authentication without Secrets",
"description": "Explore how Thales integrates Badge Inc.'s passwordless authentication technology for shared devices, improving security and user experience in industries like healthcare and retail.",
"author": {
"@type": "Person",
"name": "Marco Venuti",
"url": "https://cpl.thalesgroup.com/blog/author/mvenuti"
},
"publisher": {
"@type": "Organization",
"name": "Thales Group",
"description": "The world relies on Thales to protect and secure access to your most sensitive data and software wherever it is created, shared, or stored. Whether building an encryption strategy, licensing software, providing trusted access to the cloud, or meeting compliance mandates, you can rely on Thales to secure your digital transformation.",
"url": "https://cpl.thalesgroup.com",
"logo": "https://cpl.thalesgroup.com/sites/default/files/content/footer/thaleslogo-white.png",
"sameAs": [
"https://www.facebook.com/ThalesCloudSec",
"https://www.twitter.com/ThalesCloudSec",
"https://www.linkedin.com/company/thalescloudsec",
"https://www.youtube.com/ThalesCloudSec"
]
},
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://cpl.thalesgroup.com/blog/access-management/passwordless-authentication-without-secrets"
},
"datePublished": "2024-10-11",
"dateModified": "2024-10-11"
}
The post Passwordless Authentication without Secrets! appeared first on Security Boulevard.
Microsoft has recently identified a threat actor known as Storm-0501 targeting government, manufacturing, transportation, and law enforcement sectors in the United States (US) in a cloud ransomware attack campaign. In this article, we’ll dive into the details of the campaign and determine how such attacks are carried out. Let’s begin! Cloud Ransomware Attack Campaign Hacker […]
The post Cloud Ransomware Attack: Microsoft Sees Storm-0501 As Threat appeared first on TuxCare.
The post Cloud Ransomware Attack: Microsoft Sees Storm-0501 As Threat appeared first on Security Boulevard.
Ensuring seamless operations in even the harshest environments is a necessity today. For organizations operating within the Department of Defense (DoD) space, identity resilience and continuity are essentially non-negotiable — as the stakes are high and often involve life-and-death scenarios. Missions demand resilient systems capable of functioning even in the most extreme conditions. Military environments...
The post Resilience in extreme conditions: Why DDIL environments need continuous identity access appeared first on Strata.io.
The post Resilience in extreme conditions: Why DDIL environments need continuous identity access appeared first on Security Boulevard.
Austin, TX, Oct. 10th, 2024, CyberNewswire — SpyCloud, the leader in Identity Threat Protection, announced that its SaaS Investigations solution has been enhanced with identity analytics that illuminate the scope of digital identities and accelerate successful outcomes of complex investigations … (more…)
The post News alert: SpyCloud accelerates supply chain risk analysis with new ‘IDLink’ correlation capability first appeared on The Last Watchdog.
The post News alert: SpyCloud accelerates supply chain risk analysis with new ‘IDLink’ correlation capability appeared first on Security Boulevard.
As part of the DevOps and DevSecOps track during Sonatype's 9th All Day DevOps (ADDO) event, AWS Senior Developer Advocate Guillermo Ruiz presented his session titled "Building Observability to Increase Resiliency." Well-applied observability helps you find early signs of problems before they impact customers and makes it possible to react quickly to disruptions.
The post ADDO session: Building observability to increase resiliency appeared first on Security Boulevard.
3 min read The collaboration automates workload-to-workload access, simplifying security for API connections and reducing the risks associated with credential management.
The post How the Auth0 and Aembit Integration Boosts Non-Human Access Security appeared first on Aembit.
The post How the Auth0 and Aembit Integration Boosts Non-Human Access Security appeared first on Security Boulevard.
Organizations are constantly faced with the challenge of addressing vulnerabilities and threats to maintain a secure environment. Two common strategies to aide in this are remediation and mitigation, both of which aim to reduce risk but with different approaches and timelines. Understanding the distinction between these strategies—and knowing when to apply each—can be crucial for […]
The post Remediation vs. Mitigation: The Choice Between Instant or Indirect Action appeared first on VERITI.
The post Remediation vs. Mitigation: The Choice Between Instant or Indirect Action appeared first on Security Boulevard.
Authors/Presenters:Yazhou Zu, Alireza Ghaffarkhah, Hoang-Vu Dang, Brian Towles, Steven Hand, Safeen Huda, Adekunle Bello, Alexander Kolbasov, Arash Rezaei, Dayou Du, Steve Lacy, Hang Wang, Aaron Wisner, Chris Lewis, Henri Bahini
Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.
The post USENIX NSDI ’24 – Resiliency at Scale: Managing Google’s TPUv4 Machine Learning Supercomputer appeared first on Security Boulevard.
Last month marks 25 years of operation for the CVE (Common Vulnerabilities and Exposures) program, launched in September 1999. It’s difficult to imagine a world without CVEs. Much of the “vulnerability management” activities, before the CVE program became popular, relied on matching version numbers from remote scans and executing shady exploits found in dark places on […]
The post Vulnerability Prioritization & the Magic 8 Ball appeared first on Eclypsium | Supply Chain Security for the Modern Enterprise.
The post Vulnerability Prioritization & the Magic 8 Ball appeared first on Security Boulevard.
In 2021, the Log4j vulnerability catalyzed the industry to take action to boost the security of open source components. The development community is leading this movement, but governments are also taking notice and writing legislation to regulate how organizations approach software transparency.
The post ADDO session: The state of SBOM, what’s coming in standards and regulations appeared first on Security Boulevard.
via the comic humor & dry wit of Randall Munroe, creator of XKCD
The post Randall Munroe’s XKCD ‘CIDABM’ appeared first on Security Boulevard.
Schedule jobs via the Structural UI, customize your sensitivity scan with expanded options, and process multiple languages in Tonic Textual!
The post Tonic.ai Product Updates: October 2024 appeared first on Security Boulevard.
Chief Information Security Officers (CISOs) should always anticipate questions that might arise during presentations to senior leaders and corporate boards. Below, we present some typical questions that CISOs should be prepared to answer. We hope these questions help you prepare for the next important presentation you are asked to give to your executive team. What …
The post Top 11 Cybersecurity Questions Every CISO Should Be Ready to Answer appeared first on Security Boulevard.
This is a joint post with the Hugging Face Gradio team; read their announcement here! You can find the full report with all of the detailed findings from our security audit of Gradio 5 here. Hugging Face hired Trail of Bits to audit Gradio 5, a popular open-source library that provides a web interface that […]
The post Auditing Gradio 5, Hugging Face’s ML GUI framework appeared first on Security Boulevard.
Qualys this week added a risk operations center (ROC) to its portfolio to make it simpler to identify potential threats to the business and centrally manage remediation efforts.
The post Qualys Unfurls Risk Operations Center Platform appeared first on Security Boulevard.
Authors/Presenters:Ziheng Jiang, Haibin Lin, Yinmin Zhong, Qi Huang, Yangrui Chen, Zhi Zhang, Yanghua Peng, Xiang Li, Cong Xie, Shibiao Nong, Yulu Jia, Sun He, Hongmin Chen, Zhihao Bai, Qi Hou, Shipeng Yan, Ding Zhou, Yiyao Sheng, Zhuo Jiang, Haohan Xu, Haoran Wei, Zhang Zhang, Pengfei Nie, Leqi Zou, Sida Zhao, Liang Xiang, Zherui Liu, Zhe Li, Xiaoying Jia, Jianxi Ye, Xin Jin, Xin Liu
Our sincere thanks to USENIX, and the Presenters & Authors for publishing their superb 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI '24) content, placing the organizations enduring commitment to Open Access front and center. Originating from the conference’s events situated at the Hyatt Regency Santa Clara; and via the organizations YouTube channel.
The post USENIX NSDI ’24 – MegaScale: Scaling Large Language Model Training to More Than 10,000 GPUs appeared first on Security Boulevard.
A user authentication database was stolen from the nonprofit , which also was been beset by a series of DDoS attacks, and a pro-Palestinian threat group has taken credit for the attacks and the data breach.
The post Internet Archive is Attacked and 31 Million Files Stolen appeared first on Security Boulevard.
Security Field Day 12 will take place October 16-17, 2024. You can watch the live-streaming video right here on the Techstrong family of sites or on the Tech Field Day website.
The post Understanding Security Needs at Security Field Day 12 appeared first on Security Boulevard.
IntroductionDarkVision RAT is a highly customizable remote access trojan (RAT) that first surfaced in 2020, offered on Hack Forums and their website for as little as $60. Written in C/C++, and assembly, DarkVision RAT has gained popularity due to its affordability and extensive feature set, making it accessible even to low-skilled cybercriminals. The RAT’s capabilities include keylogging, taking screenshots, file manipulation, process injection, remote code execution, and password theft. In July 2024, Zscaler ThreatLabz observed attackers using DarkVision RAT alongside PureCrypter. In this blog, we will break down the attack chain behind these DarkVision RAT infections, and provide an in-depth analysis of the RAT’s functionality, including its core features, network communication protocol, commands, and plugins.Key Takeaways In July 2024, ThreatLabz uncovered a new malware campaign distributing DarkVision RAT.The campaign used PureCrypter as a loader to deploy DarkVision RAT.DarkVision RAT communicates with its command-and-control (C2) server using a custom network protocol via sockets.DarkVision RAT employs various evasion and privilege escalation techniques, including DLL hijacking, auto-elevation, and process injection.DarkVision RAT supports a wide range of commands and plugins that enable additional capabilities such as keylogging, remote access, password theft, audio recording, and screen captures.Technical AnalysisThe following sections offer a technical analysis of an attack chain used to deploy DarkVision RAT, as well as an in-depth examination of the RAT itself.The figure below illustrates the attack chain for the DarkVision RAT campaign discussed in this blog.Figure 1: An example attack chain distributing DarkVision RAT as the payload in the final stage. First stage: Shellcode decryption in DarkVision RAT attackThe initial stage in this attack chain is a .NET executable file, protected using .NET Reactor. Upon execution of the .NET file, the first stage runs the following command:cmd /c timeout 10After the brief 10-second delay, the .NET file moves on to its next phase, where it decrypts the second stage shellcode.The .NET executable uses Triple Data Encryption Standard (3DES) to decrypt the second stage shellcode. The key and IV are encoded in Base64 format. The Base64-encoded strings are xwmyVxHV39B5ns41HJtzRQ== for the key and SzD5abWvrRk= for the IV. The .NET executable file decodes these strings back into their original binary form. The decoded key and IV are then fed into the 3DES algorithm to decrypt the shellcode.The decrypted shellcode is written to a block of memory that is made executable using VirtualAlloc and VirtualProtect. The .NET executable then uses the API EnumCalendarInfo’s callback function to execute the shellcode leading to the second stage.Second stage: Donut loaderThe decrypted second stage shellcode is the open source Donut loader. This x86 position-independent shellcode is designed to load .NET assemblies directly into memory. Donut loader uses the Chaskey block cipher to encrypt its modules.We won’t be covering the specifics of Donut’s loading process, as several excellent write-ups already exist on the topic. Instead, to proceed with our analysis, we used Donut Decryptor to extract the third stage payload.Third stage Loading DarkVision RAT with PureCrypter The third stage of the attack chain is a .NET assembly, identified as PureCrypter, which has been previously analyzed by ThreatLabz. The main function of the PureCrypter injector starts by decompressing (gunzip) and deserializing an object into a protobuf structure, as shown in the figure below.Figure 2: PureCrypter protobuf structure.One of the key members in this protobuf structure is gr2pwD82LI which contains an element named Uoepndv4TW. This particular element holds the DarkVision RAT payload portable executable (PE) content, which is encrypted using Advanced Encryption Standard (AES) in Cipher Block Chaining (CBC) mode.Another important part of the protobuf structure is a member named IUQ99bXImZ, which contains the startup settings for DarkVision RAT.Windows Defender exclusion and persistence tactics in PureCrypterPureCrypter executes a PowerShell command that has been encoded in Base64 format. When decoded, this command tells PowerShell to add malicious file paths and process names used by the RAT to the list of exclusions in Windows Defender. The example below shows the PowerShell commands used to add Windows Defender exclusions for malicious file paths and process names used by DarkVision RAT.Add-MpPreference -ExclusionPath C:\yknoahdrv.exe;
Add-MpPreference -ExclusionProcess yknoahdrv.exe;
Add-MpPreference -ExclusionPath C:\Users\REDACTED\AppData\Roaming\Siguhl.exe; Add-MpPreference -ExclusionProcess Siguhl.exePureCrypter doesn't stop at evading detection as it also helps DarkVision RAT achieve persistence. PureCrypter writes the current file to %APPDATA%\Sighul.exe and adds persistence for this file as per the protobuf struct by using the Auto-run registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run with the name set to Sighul. Then, according to the values in the protobuf struct, the decrypted DarkVision RAT file is injected into itself (current process), and execution is transferred to the entry point of DarkVision RAT, leading to the fourth stage.Fourth stage: Persistence and C&C protocolDarkVision RAT first dynamically resolves APIs using GetProcAddress and LoadLibrary. The RAT always reloads the libraries again using LoadLibrary to avoid userlands hooks placed by antivirus and endpoint detection and response (EDR) software. The API names used by the malware are stored in XOR-encoded form and are decoded using the XOR key [19 72 19 72]. DarkVision RAT also uses XOR encoding to store important strings. From here, DarkVision RAT starts to parse the command-line arguments.Command-line parsing in DarkVision RATAfter decoding the necessary strings, DarkVision RAT starts to parse any command-line arguments. The command-line arguments used by the DarkVision RAT are Globally Unique Identifiers (GUIDs). These GUIDs serve as names in various places such as registry keys, folder names, and file names. When investigating other samples of DarkVision RAT, we noticed that these GUIDs differ from one sample to another, indicating a level of randomness in each instance of the RAT ensuring these cannot be used to create detection logic for DarkVision RAT.Here are two GUIDs and how they were used in this sample:{B8B1DC5F-E2FC-41FF-A2D1-DB3800909230}:Conditions: The action below is carried out if the user is not a local administrator and the Windows version is greater or equal to 10.Action: Under these conditions, DarkVision RAT attempts to gain elevated privileges using a technique called DLL hijacking. DarkVision targets WinSAT.exe, a legitimate Windows process, and DXGI.DLL, a dynamic link library file to attempt auto elevation.{14C43BB8-A5DF-4F5D-A77A-E8BB32DEE41F}:Conditions: The Actions below are carried out if the user is a local administrator and the Windows version is greater or equal to 10.Action: In this scenario, DarkVision RAT adds an exclusion rule to Windows Defender to avoid detection. The RAT achieves this by running the command cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath, which tells Windows Defender to ignore the RAT file path.Adding DarkVision RAT data to the Windows registryDarkVision RAT creates a registry key under HKEY_CURRENT_USER\SOFTWARE\ and adds three values, each named using a hardcoded GUID. The values stored are the following:RAT file content: The command opcodes 0x2BD and 0x2BE (discussed later) use this value to write the RAT file to disk.RAT file path: Based on a flag, the RAT deletes the file stored in this file path. This flag is related to deleting artifacts.Current system time stored in a FILETIME structure: This value is stored in a FINGERPRINT_INFO1 struct (discussed later) which is sent to the C2 server.The figure below shows the data being added to the Windows registry.Figure 3: DarkVision RAT data added to the Windows registry.Persistence mechanisms leveraged by DarkVision RATDarkVision RAT employs three different methods to ensure persistence on an infected system. Like most of the features in DarkVision RAT, there are flags for each persistence technique, which store a boolean value that decides which persistence mechanism should be used in the sample. Since these flags are hardcoded into the binary, we concluded that they are configurable options available to the attacker when a DarkVision RAT sample is created using a builder.The three persistence methods are as follows:Startup folder - In this method, DarkVision RAT creates a batch script that contains a command to execute the RAT executable. After creating this script, DarkVision RAT then creates a shortcut to the batch script and places this shortcut in the Windows startup folder.Autorun keys - Another method DarkVision RAT leverages is autorun keys. DarkVision RAT adds an entry that points to its executable file in one of the autorun keys located at Software\Microsoft\Windows\CurrentVersion\Run. The exact location of this key can be under either HKEY_CURRENT_USER (for the current user) or HKEY_LOCAL_MACHINE (for the system), depending on the flags set within the RAT. Task Scheduler - DarkVision RAT uses the ITaskService COM interface to schedule a task to execute the malware.After setting up persistence mechanisms, DarkVision RAT checks if it is currently running from a specific location, namely %APPDATA%\photos\System.exe (we refer to %APPDATA%\photos as the RAT folder and the full path as the RAT file path moving forward as this path varies across samples).If DarkVision RAT is not running from this designated folder, it copies itself to this path and then uses the newly copied file to create a child process. This ensures that the RAT is running from a consistent and expected location.Next, the RAT creates a new folder in C:\ProgramData, which we refer to as the plugin parent folder. This folder is used to store additional encrypted plugins in its subdirectories (discussed later).Process injection techniques employed by DarkVision RATDarkVision RAT uses the NtCreateSection and NtMapViewOfSection APIs to perform process injection, which is used in multiple places to perform RAT functionalities. DarkVision RAT creates a remote process in a suspended state. The RAT then creates a new memory section, mapping one view of this section to the local process and another view to the remote target process. The view mapped in the local process is populated with a function that the RAT needs to execute. This process is repeated to fill the structure used by the function in another mapped view. The thread context of the remote process is then modified: the Instruction Pointer (RIP/EIP) is set to the function's address, and the first parameter (RCX/ESP+4) is set to the address of the structure. Finally, the thread is resumed, leading to the execution of the function.DarkVision RAT communication protocolOnce executed, DarkVision RAT needs to connect to the C2 server to receive instructions and respond with information. The C2 communications use a custom binary protocol. Based on the flags set, the C2 address is parsed in one of two different ways:Retrieve the C2 information: The RAT utilizes WinHTTP libraries to connect to a URL stored in plain text. The returned data contains the C2 information in the format c2address:port.Hardcoded C2 Information: The C2 address and port are stored in plain text within the binary. For example, the C2 address embedded in the binary analyzed by ThreatLabz was severdops.ddns[.]net:8120.RegistrationThe first action DarkVision RAT takes is to register itself with the C2 server by sending a unique Bot ID. To create this Bot ID, the RAT generates a random GUID and combines it with an MD5 hash of the Unicode string "P@55w0rd!". This string, "P@55w0rd!", is stored in plain text within the RAT’s code and varies across different samples.Receiving the acknowledgment (ACK) packet After sending its unique ID, DarkVision RAT waits for a response from the C2 server. The server replies with a specific data packet { 01 00 00 00 }. The received data is compared to the value 1, and the RAT will only proceed with sending the next data if this comparison is successful. This packet functions similarly to an ACK packet in the TCP protocol, so we will refer to it as an “ACK packet” moving forward. The RAT client then sends the data { 00 00 00 00 }, to which the server responds with an ACK packet. The figure below shows the network communication between a system infected with DarkVision RAT and the C2 server.Figure 4: Network communication between a system infected with DarkVision RAT and the C2 server.Device fingerprintingThe RAT client then performs device fingerprinting and collects system information. This information is sent in two packets. Before each packet, the size of the structure is sent, followed by the structure containing the system information. After receiving the first structure, the server sends an ACK packet. Upon receiving the second structure, the C2 server sends two ACK packets. The two structures sent are shown below.struct FINGERPRINT_INFO1{
uint32_t hardcoded_value; // set to 0x10017
wchar_t botnet_name[40]; // set to AppleX
int32_t is_localadmin; // TRUE = 1 , FALSE = 0
wchar_t pname_followedby_pid[260]; // RAT process name followed by pid %s [%d]
uint32_t hardcoded_value2; // set to 0x40
FILETIME system_time; // current system time
};struct FINGERPRINT_INFO2{
uint32_t geocode; // geocode of the victim country
wchar_t computer_name[16]; // victim computer name
wchar_t user_name[258]; // victim username
uint32_t system_ip[54]; // victim h_addr_list in network byte order
int64_t system_uptime; // victim system uptime in milliseconds
ULONG os_info[4]; // victim os info
};DarkVision RAT then creates a new socket and sends its unique bot ID to the server. The server responds with an ACK packet. The client then sends an ACK packet in return, and the server replies with another ACK packet. After this exchange, the RAT client waits for commands from the C2 server.Commands supported by DarkVision RATThe command's opcode, function address, and other related data are stored as an array of 12 elements (12 commands). Each element is a struct of size 0x28, which we will refer to as a COMMAND_STRUCT. If the opcode matches the data received from the server, the corresponding func_address is executed by creating a thread. The COMMAND_STRUCT is shown below.struct COMMAND_STRUCT{
uint64_t opcode; // opcode of the command
uint64_t event_handle; // handle of event created when the command is run
uint64_t thread_handle; // handle of thread created which executes func_address
void *func_address; // address of the function to be executed
uint64_t socket; // socket descriptor of the socket
};The table below lists the commands supported by DarkVision RAT.OpcodeDescription0x2BDWrites the RAT file content stored in the Windows registry to the RAT's file path.0x2BEWrites the RAT file content stored in the Windows registry to the RAT's file path and executes it.0x2BFReceives a file from the C2 server via socket, writes it to disk, executes it, and then deletes all RAT artifacts, including persistence entries from the registry and file system.0x2C0Deletes all RAT artifacts, including persistence entries from the registry and files from the disk.0x2C1Runs the RAT executable as an administrator using the runas verb. If this attempt fails, create a RAT process that does not require administrator permissions.0x2C2Performs DLL hijacking via WinSAT.exe and DXGI.DLL to achieve auto-elevation.0x2C3Receives a URL and user agent from the C2 server via socket. Downloads the file from the URL using the user agent provided, writes the file to disk, executes it, and then deletes all RAT artifacts.0x519Receives a compressed plugin from the C2 server, decompresses it using LZNT1, and loads it into memory. Encrypts the plugin with Salsa20 (the key and nonce are hardcoded) and writes it to disk. The C2 server sends data in the following order: plugin ID, plugin compressed size, and plugin data in compressed form.0x51AUnloads the specified plugin ID. The plugin ID follows the data received from the C2 server after the opcode.0x51BRetrieves the status of all plugins (whether loaded or not).0x51CDeletes the encrypted plugin from the disk and registry based on the data received from the C2 server. If the data received is the value 1, deletes all plugins. Otherwise, the RAT deletes the specified plugin ID received from the C2 server.0x51DReceives the specified plugin ID from the C2 server. Encrypts it using Salsa20 (using the same hardcoded key and nonce used in opcode 0x519), then writes it to both the registry and the disk.Table 1: Commands implemented by DarkVision RAT.There is another set of commands used to execute plugin ordinals. For all previously mentioned commands, the upper 16 bits are set to 0, and the lower 16 bits contain the opcode ID of the command to be executed. In the next set of commands, the upper 16 bits contain the plugin ID to be executed, while the lower 16 bits contain the ordinal number to be executed.Plugins available in DarkVision RATMost of the DarkVision RAT's features are implemented through plugins. These plugins remain as plain text only in memory, while they are stored as encrypted data on disk and in the registry. When a plugin is loaded, ordinal 0x65 of the plugin is executed using a thread. The thread takes a struct as an argument, which contains important information about the plugin. Below is the structure used for this purpose.struct PLUGIN_STRUCT{
wchar_t plugin_parent_folder[0x8000]; // folder containing all plugin sub folders
wchar_t plugin_filename[0x8000]; // plugin file name
wchar_t plugin_filepath[0x8000]; // plugin file path
void *plugin_base_address; // plugin base address in memory
int32_t plugin_size; // size of plugin
void *rat_folder; // RAT folder
void *plugin_array; // array containing all plugin id's
};The plugins are executed in the same manner as the initial set of commands. The table below shows the plugin ID and its description.Plugin IDPlugin Description0x1Captures webcam footage.0x2Displays messages using MessageBox.0x3Retrieves the process list and terminates processes based on PID.0x4Edits the registry.0x5Provides file system access.0x6Views victim screen via screenshots.0x7Lists and manages system windows.0x8Performs system control activities such as locking the workstation, shutting down, or restarting.0x9Retrieves and sets desktop wallpaper.0xDEstablishes a reverse proxy using SOCKS.0xEActs as a dropper to download a file from a URL and write it to disk.0xFOpen a remote shell.0x10Captures microphone audio.0x11Records keystrokes live (live keylogger).0x12Steals passwords.0x13Provides remote access using VNC.0x14Provides remote access using hVNC.0x15Records keystrokes offline (offline keylogger).0x16Locks the workstation or shut downs the system for protection when the victim is away from the keyboard.0x17Retrieves the process list and creates a minidump of processes based on PID.Table 2: Plugins loaded by DarkVision RAT.ConclusionIn conclusion, DarkVision RAT represents a potent and versatile tool for cybercriminals, offering a wide array of malicious capabilities, from keylogging and screen capture to password theft and remote execution. This versatility, combined with its low cost and availability on Hack Forums and their website, has made DarkVision RAT increasingly popular among attackers. The recent campaign uncovered by ThreatLabz, where DarkVision RAT is paired with PureCrypter, showcases how threat actors leverage malware families together to bypass security software. By shedding light on the inner workings of DarkVision RAT, this analysis aims to equip security teams with the insights they need to defend against these evolving threats. The Zscaler Cloud Sandbox has consistently detected this campaign with high accuracy. Zscaler ThreatLabz will continue to monitor and track both PureCrypter and DarkVision RAT, sharing any new findings with the wider security community.Zscaler Coverage Zscaler’s multilayered cloud security platform detects indicators related to DarkVision RAT at various levels. The figure below depicts the Zscaler Cloud Sandbox, showing detection details for DarkVision RAT.Figure 5: Zscaler sandbox report for the DarkVision RAT sample.In addition to sandbox detections, Zscaler’s multilayered cloud security platform detects indicators related to this campaign at various levels with the following threat names: Win32.RAT.DarkVisionWin32.Downloader.PureCrypterWin32.Trojan.DonutIndicators Of Compromise (IOCs) Host IndicatorsTypeIndicatorDescriptionSHA256cd64122c8ee24eaf02e6161d7b74dbe79268f3b7ffb7a8b0691a61ff409f231dThe first stage of the campaign is protected with .NET Reactor to decrypt and inject Donut loader.SHA2566e3346d47044d6df85a07aeda745d88f9cd46b20d22028d231add555bf00bf41Donut loader shellcode used as the second stage.SHA25627ccb9f336282e591e44c65841f1b5bc7f495e8561349977680161e76857be5dPureCrypter is used as a third stage loader.SHA2567aa49795bbe025328e0aa5d76e46341a95255e13123306311671678fdeabb617DarkVision RATNetwork IndicatorsTypeIndicatorDescriptionURLnasyiahgamping[.]com/yknoahdrv.exeThe URL which hosts the first stage.Domainseverdops.ddns[.]net:8120DarkVision C2 serverMITRE ATT&CK TechniquesIDTechnique NameDescriptionT1053.005Scheduled TaskDarkVision RAT uses ITaskService interface to create scheduled tasks.T1547.001Registry Run Keys / Startup FolderDarkVision RAT uses autorun keys and the startup folder for persistence. PureCrypter uses autorun keys for persistence. T1055Process InjectionDarkVision RAT uses the NtCreateSection and NtMapViewOfSection APIs to perform process injection.T1140Deobfuscate/Decode Files or InformationThe strings used in DarkVision RAT are XOR encoded.T1562.001Disable or Modify ToolsDarkVision RAT and PureCrypter have functionalities to add Windows Defender exclusions.T1539Steal Web Session CookiePassword stealer plugin steals cookies from browsers.T1010Application Window DiscoveryWindows list plugin lists and manages windows in the system.T1057Process DiscoveryMultiple plugins retrieve the process list.T1082System Information DiscoveryDarkVision RAT collects system information and sends it to the C2 server.T1083File and Directory DiscoveryFile Explorer plugin performs file and directory discovery.T1123Audio CaptureMicrophone capture plugin performs audio capture.T1125Video CaptureWebcam capture plugin performs video capture. T1113Screen CaptureScreen capture plugin performs screen capture.T1056.001Input Capture: KeyloggingDarkvision RAT supports live and offline keylogging.T1219Remote Access SoftwareDarkvision RAT uses VNC and hVNC for remote access.T1571Non-Standard PortC2 communications are through a non-standard port.T1529System Shutdown/RebootSystem control plugin performs system shutdown/reboot.
The post Technical Analysis of DarkVision RAT appeared first on Security Boulevard.
