We’re migrating product documentation to docs.vmware.com, starting with Carbon Black Cloud. Learn more.

Just Don't Ask: Steps To Take In Light of The Latest Ask Partner Network (APN) Compromise

Just Don't Ask: Steps To Take In Light of The Latest Ask Partner Network (APN) Compromise

Today we are announcing details of an investigation by Carbon Black’s Threat Research team that uncovered a second supply-chain compromise of the Ask Partner Network (APN).  This latest compromise brings to light how attackers are leveraging widely used general tools, such as toolbars and browser extensions, to conduct sophisticated targeted attacks, distribute malicious code, and maintain persistence in enterprises.

The latest APN compromise, detailed in this post, highlights how the continued ubiquity of potentially unwanted programs (PUPs) is increasing organizations’ attack surface and creating the need for better user education, more robust security hygiene, and immediate removal of unwanted programs.

The information below describes how you can detect and defend against these threats with each of our products.

How to Stop the Attack with Cb Protection

The hashes seen in this attack have already been added to SRS via the Collective Defense Cloud, so you will receive a malicious file alert if they exist in your environment.

For CbP deployments in High and Medium enforcement, unknown executables will be blocked or alerted on, which would mitigate many components of this attack. For CbP deployments in “Low” enforcement, and customers who want added security, here are some extra steps you can take.

You can ban APN and other unwanted applications by banning the Publisher name, or banning each certificate individually. For blacklisting, we recommend banning by Publisher name, as that will cover many different certificates by the same publisher.

Banning by publisher:



Banning by certificate:

In addition to banning unwanted applications by publisher, Version 8 of Cb Protect allows you to create custom rules that can search for specific command line arguments, such as encoded PowerShell.

A sample rule:

Platform: Windows

Rule Type: Advanced

Operation: Execute

Execute Action: Report Process Create

Path or File: Specific Path

<OnlyIf:Bit9Version:Atleast:8.0.0.0><CmdLine:*Enc*>powershell.exe

Process: Any process

User or group: Any user

For increased visibility in both CbP 7.2 and 8.0, you can create Report Execute rules to look for legitimate shell commands that are frequently used by attackers. These rules will have some level of false positives from your IT administrators, but by excluding specific users or policies, you can customize them to your environment and reduce false positives. Our Services team can assist you in customizing the below rule to suit your environment:

How to Detect the Attack with Cb Response

Our First Party behavioral threat feeds already contain queries that detect a number of the behaviors exhibited by this attacker, such as:

  • PowerShell executed with encoded instructions (Advanced Threats)
  • PowerShell Executing Hidden, Encoded commands (Community)
  • Use of legacy task scheduler (Endpoint Visibility)
  • Execution of quser.exe (Suspicious Indicators)
  • Possible persistence regmod - run/runonce key (Suspicious Indicators)
  • System Profiling (Suspicious Indicators)

In addition, the Known IOCs feed contains all of the static indicators seen in this incident and will alert you on those.

Here are some additional watchlists to detect attacker behavior, which we are testing prior to inclusion in the feeds. Because our customer environments vary wildly, we encourage you to test and refine all watchlists to suit your particular deployment. You can ask the Services team for assistance, or post on the User eXchange to get feedback and tips from other community members.

Typical Recon/Enum Commands:

This watchlist looks for standard OS commands run together, in a way frequently associated with attackers who’ve just gained access to a host. While an IT administrator may run any of these commands, it’s very unusual for all of these commands to be run at the same time.

Childproc_name:whoami.exe and childproc_name:quser.exe and childproc_name:net.exe and childproc_name:systeminfo.exe and childproc_name:find.exe and childproc_name:dsquery.exe and childproc_name:reg.exe and childproc_name:ipconfig.exe

Run Key Added With Suspicious Value:

This watchlist looks for a Run key being added to the registry which points to an executable stored in an unusual location.

cmdline:"reg add" cmdline:"currentversion\Run" (cmdline:"Appdata" or cmdline:"temp" or cmdline:"programdata" or cmdline:”system32”)

Powershell writing binary to disk

This watchlist looks for powershell writing binaries to disk.

Process_name:powershell.exe is_executable_image_filewrite:"true"

APN files writing unsigned executable

This watchlist looks for files signed by APN that write unsigned and invalidly signed binaries to disk.

digsig_publisher:APN -digsig_result_filewrite:Signed

APN files launching unsigned executable

This watchlist looks for files signed by APN that launch unsigned and invalidly signed binaries.

digsig_publisher:APN -digsig_result_child:Signed

How to stop the attack with Cb Defense

All malware types (Known malware, suspect malware, and potentially unwanted programs) should be blocked from running with “tries to run or is running” “deny” rules. To block later stages of the attack we recommend powershell.exe and not-listed applications be prevented from reading the memory of other processes and PowerShell is prevented from executing code from memory buffers. If particular applications are found to be involved in similar incidents, they should be added to the company blacklist by hash.

Ways to mitigate this beyond our products

Check your environment for APN binaries with the filename apnmcp.exe, and examine any files that apnmcp.exe might have written to disk. If you have tools with the ability to connect network activity to specific processes, examine apnmcp.exe and its child process network activity.  The indicators to look for are in the table below

Observed Name

SHA256 Hash

Apnmcp.exe

b31e8146b37b6c54068437086e9bd4ed6a64f4cb65374dc71e88d9896457e89f

ApnUpdateMgr.exe

d01c7abc39e1b24a76641b597426aa377db0e27369f32dfe3522f364cec4495b

System.bat

083cf77766ce9e0c7378da74a1a729b380629b875fc791c37890850f5ecbf508

system.bin

a3255ad4099745e791d85dc1a9b0917909a6b2e91d32b96911cb488e18a601d8

But keep in mind that it’s easy for an attacker to change IPs and hashes. Carefully consider any running processes and their relevant behavior. Reduce risk by banning or removing PUP/PUA from your environment.






Article Information
Author:
Creation Date:
‎03-16-2017
Views:
1274