While some cyber security attacks focus on destruction and damage to reputation, more common in this decade has been the widespread and rampant theft of data creating challenges in maintaining appropriate levels secrecy and data protection. To complete the theft once the data has been compromised, a successful attack will need to exfiltrate the data to the attacker for further exploitation. Here are the 5 scenarios of data exfiltration.
The Scam
Today we call it social engineering, at one time it was called, “the con” short for “con man” which in turn is short for “confidence man.” In this scenario, the attacker does his research using the freely available data source to determine his targets. He then waits for his target to be on holiday or at a conference, and calls his administrative assistant with profound urgency demanding at the request of her supervisor, that the sensitive information is electronically mailed to him at his gmail account immediately or risk the collapse of the development effort. Gmail is important because it as a brand that is trusted, but in reality the owner can be anonymous. Note that this method was made famous by Kevin Mitnick’s famous exploit of the Motorola Startac phone. The tools used for this attack are a simple phone and the victim’s email system. For good measure, the attacker may have the victim use PKZIP with a password providing seemingly innocuous compression, but with the AES-256 encryption available in the compressed file, the benefit to the attacker is further assurance that the data will traverse the corporate controls undetected.
Front Door Injection
Like the previous example, this exploit is almost as old as exploits themselves. As opposed to all the trickery of the previous example this scenario uses common application weaknesses to manipulate the application into revealing lucrative information from a data store. The exploit, commonly known as SQL (pronounced see-quill) injection (SQLI), relies on the trusted connection from the application to the data source by ‘injecting’ commands into the user input fields and exfiltrating data through the application’s trusted path. Detection is almost always too late to thwart the loss of data, as seen by the rash of successes, particularly on busy applications. For this attack to be successful, the application will need to be vulnerable to SQLI attacks and front-ended to a lucrative data source. On an externally facing application, the attacker will use the standard HTTP or HTTPS protocol through the TOR network or other Dar Web connectivity to obfuscate his identity. If the application were compromised internally, the application would need to be collected similarly as above; then leveraging the corporate VOIP network (which typically has less controls than the data network), encode the stolen data into bytes on a 16 distinct octaves, playing each ‘note’ for a period of .25 seconds and then leverage that network to send the encoded message tonally to an attacker-owned system (Advanced Data Exfiltration, 2012). Note that the software for encoding data streams as tones called Data Sound Modulation is available at https://github.com/iiamit/data-sound-poc.
Hidden in Plain Sight
Although this method can be used with other means to compromise data, this scenario assumes an insider threat has been activated. Internal actors were responsible for 43% of data loss [in 2014], half of which is intentional, half accidental (Grand Theft Data, 2015). Using trusted data hosting sources and file types not generally associated with data transfers, such as sound and images, this method encrypts data using a technology known as “steganography.” Steganography is the act of hiding a message (or stolen data) inside of a larger one where it cannot be detected, much as a golden thread could be woven discretely into the hem of an otherwise mundane tapestry. The stolen data is stored as images either on the local machine or network attached storage that the user has access and then trusted hosts are then used to receive the stolen information, generally bypassing most if not all traditional controls. This method relies on the inherent trust of two primary vectors: a) image files are generally trusted and un-scannable, and b) access to trusted Internet hosts on well-known ports for HTTP and HTTPS such as file sharing sites (for example, dropbox or onedrive) are allowable for most user environments. Basic obfuscation such as Base64 is strong enough as even unencrypted in the image file, the stolen data will be encoded and not readable by typical or even advanced traffic analysis tools.
The Kill Chain
Although almost as old as data exfiltration itself, this classic type of attack became most famous during the retailer attacks of 2013 flag-shipped by Target, but in essence has been the foundation for almost every significant breach of data for the last decade. Much like ‘the scam’ this attack ignores all types of fancy attacks on the steel doors of the victim’s Internet-facing architecture, and prey’s on the user’s ignorance, lust, or greed, with a small twist of targeting the most lucrative target through a segment of their supply chain with weaker controls. An email with a malicious payload is sent to the user of a vulnerable system who then unwittingly installs the package which in turn establishes a connection to trusted sources. Using standard tools he uses the user credentials to gain access to the target through the trusted RDP protocol and then covert packet sniffing tools, the attacker monitors traffic for user names with elevated privileges, passwords, and other target systems – his reconnaissance is largely passive and will avoid detection and that which is not, will likely go undetected as it originates from trusted users and systems. Encryption may or may not be needed; McAfee reported that in 2014, only 32% of data exfiltrations were encrypted (Grand Theft Data, 2015). Exfiltration becomes an exercise in creating a repository server inside the trusted network to encrypt, transmit, and collect information until ready and then transfer the data back through the initial compromised system using a trusted protocol like HTTPS or P2P to send the file/s in order to trick the controls analyzing network traffic that the traffic is legitimate.
Down the Escape Tunnel
Rather than leveraging trusted systems or Internet services, this attack uses trusted protocols. Although HTTP is the most common protocol used to encrypt and tunnel secret information to so-called trusted sites on the Internet, it is also typically the most heavily monitored. However, DNS is typically extremely noisy in any environment and a good candidate for exfiltration as it is impractical to monitor the contents of DNS requests and answers. Once the payload has been installed on the victim host, it now sends DNS requests that are routed to the C2 server (the Authoritative Name Server for whatever domain name is being used). The encrypted UDP traffic goes undetected to the internal DNS server who then does the attacker’s dirty work by forwarding the request through the perimeter sending commands to the compromised host for further data collection or exfiltrating data. This method can be very effective because the traffic is not included in threat intelligence feeds (known bad domains/IP’s), will not show up in DNS sinkholes (a server that deliberately gives bad DNS information), and will evade outlier or payload analysis due to the sheer volume of DNS requests. This attack assumes an email system is in place where the user with access to a system with sensitive information has been targeted.
Conclusion
Exfiltration methods increase in complexity as the security infrastructure is assumed to be more robust. In other words, as the control infrastructures tighten, more ways to circumvent these controls emerge. Access controls and secure perimeters aren’t enough; particularly as cloud-based services swell and the perimeter moves from the local infrastructure to the Internet itself. Data is safest when compartmentalized and physically separate, but even then, once the authorized user and authorized workstation are compromised, many typical controls become irrelevant.
References
Advanced Data Exfiltration. (2012, January 9). Retrieved from I Am Security: http://www.iamit.org/blog/2012/01/advanced-data-exfiltration/
Grand Theft Data. (2015). Retrieved from McAfee: http://www.mcafee.com/us/resources/reports/rp-data-exfiltration.pdf
