Brandon Kovacs: welcome everyone to this month's episode of the Red Team Podcast. we had a little delay past couple of weeks with project work coming up and all sorts of cool things happening internally here on the Red Team, but we're happy to be joined today alongside Thomas and Rob. ⁓ we are missing some people from the team who unfortunately couldn't make it today, but as they say, this show goes on. What's up, guys?
Thomas: Yo yo. They keep us busy, but they can't keep us away from the pod.
Rob Antonucci: What's going on?
Brandon Kovacs: They can't keep us away. Yeah, how how are your ⁓ cortisol levels ⁓ today, Thomas?
Thomas: Yeah, I I would say they're they're lower than they were last week. ⁓ Brandon and I had ⁓ had a physical breach that we were doing together, ⁓ which, you know, we found a lot of good stuff. the the blue team found us, which obviously always makes things more exciting. but I'm I'm calmer. I'm calmer, you know. I feel ⁓ I feel nice and relaxed behind my desk this week.
Brandon Kovacs: don't have ⁓ eight police officers and a bunch of guns putting at our face. ⁓ there's a lot going on in the offensive security space these days. I mean we had a news article that came out not too long ago about how Microsoft has been ⁓ attributing threat actors. what are you guys thoughts on that?
Thomas: Exactly, exactly.
Rob Antonucci: Yeah.
Thomas: yeah. So that you're I assume referring to the G D I D attribution? Yeah, so I personally think this one's really interesting. you know, a lot people I think in the hacker community, more of like the gray hat kind of community, were initially really concerned about the GDID attribution because it was tied very closely to ⁓ Peter Stokes' arrest. It was mentioned in the ⁓ unsealed docs or, you know, public court docs about ⁓ his arrest, who, you know, is one of the guys from Scattered Spider. But GDIDs themselves, pretty pretty normal thing. I think it was kind of interesting that a lot of people were like, ⁓ my god, Microsoft knows every single thing that you're doing, when in reality the GDIDs, while they're kind of hard to shed on one machine, it's hard to get them completely reset. kind of a standard, you know, device identifier. And ⁓ you're ⁓ the internet like with ⁓ and it's voluntarily submitting your GDID, then of course your attribution's gonna be a lot easier to connect back to you. ⁓ that's how I felt about it. I thought it was you know
Rob Antonucci: Did you guys actually know about that? I always assumed there was something like, specifically like that, but I never actually knew what it was or what it was called.
Thomas: Yeah, I didn't know what it was called either. I think this is like one of the first I think a big part of the issue is that like why people were worried is this is the first time that Microsoft has talked about it. Like it's on their Azure docs mentioned as an optional internal like telemetry signifier. Right, yeah. And it's like but nobody really knew what it was. It's kind of functionally the same as I guess passport UIDs, which are more discussed
Brandon Kovacs: Optional.
Rob Antonucci: Yeah.
Thomas: But yeah, it I it was really odd that it was like, ⁓ this is the first time we were actually hearing about this publicly, and it's not even from Microsoft, it's from a court document.
Brandon Kovacs: Yeah, it makes you think that you wonder, you know, a lot of the activities that you Pursue online you think are fully anonymous, but not so much, especially when it's tied to your device at the hardware level. And then when you start doing know, you start investigating and attributing that GD ID to where ⁓ you know other telemetry that exists out there on the open web, we're not it's not so as anonymous as you think it is. Even yeah, I I was reading the article earlier today, you know, even though he was using a VPN to obscure his IP, that GDID was associated to ⁓ some that he had like put like his Facebook or Snap. chat or he had like logged into. Yeah, it was like really bad opsec. I mean I th I I saw I guess he like posted ⁓ on his Snapchat a picture of his like test because yeah the guy was like 16 years old. So he like posted you know whatever ⁓ whatever exam was like taking at the time with his full name and because they attributed that to the GD ID and it was or to the IP and the IP the GD ID and that to other nefarious activity he was doing
Rob Antonucci: Just bad on sec all around.
Thomas: Yeah, yeah. Yeah. Please, nineteen.
Rob Antonucci: you
Brandon Kovacs: over the span of his ⁓ cyber criminal career, that's kinda how he got busted.
Thomas: I mean totally anecdotally, like, from what I know about a lot of the cyber criminal groups that like I've heard about and you know tangentially encountered in the wild. Like he's from the comm, but like it seems like a lot of people who do that sort of like big OPseck fails ⁓ a non-affiliated hacking group, a lot of them tend to be young kids, which is kind of interesting, you know, people who are mastering the skill but then are like, where can I use this? ⁓ guess just on anything that's broken.
Brandon Kovacs: Yeah.
Rob Antonucci: Yeah.
Brandon Kovacs: And it goes to show that, you know, the motives of attackers have changed over the years. when I was that younger as well, the motives for ⁓ hacking companies for financial game. It was like, look at what I can do for the lulls, ⁓ right? ⁓ right?
Rob Antonucci: Yep. That was the whole vibe back then.
Thomas: Right. Yeah.
Brandon Kovacs: but now like, you know, as our as our reliance on technology ⁓ increased. Everything's becoming digital digitized. the motives of attackers changed a as a ⁓ And it's
Thomas: Yeah, it's it's interesting to me with again, also like young kids, ⁓ right? It seems like young kids are part of shiny hunters 'cause, you know, the Pokemon reference in the name. But ⁓ I feel like ⁓ I feel like a lot of the techniques between shiny hunters and
Brandon Kovacs: I didn't know that.
Thomas: a scattered spider are similar because like they both have been associated with like associated with the technique of you call into an IP ⁓ IT team or you call into an individual for a company, you impersonate IT or that individual, and then you reset their password and from there they're kind of everywhere in the network, right? Because a lot of the places that you target, either they can get some sort of VPN access or they don't need it to do what they want to do ⁓ for basically extortion, right? And ⁓ it's interesting because Because we have seen that as a thing that you know, clients are interested in and we are interested in modeling, which is, hey, can we just call people and reset the passwords? And I feel like like you have had you have had a lot of success with that, Brandon. I feel like you've done a lot of those calls before.
Rob Antonucci: Thank
Brandon Kovacs: Yeah. Yeah, it's ⁓ it's pretty wild 'cause like at the end of the day, you could have all the bells and whistles in the world. if you could literally go to Black Hat or go to RSA, buy one of every product from every vendor, ⁓ but at the end the day, like the human will always be the weakest link. And all it takes is one it i you can call a million times, but you only need to get one person to do it, right? Whether it's resetting a password or downloading a file and opening it on their workstation. The human will always be the weakest link. And it goes to show you that you don't need to have sophisticated malware and backdoors and all sorts of along those lines. ⁓ attacks are becoming less and less technical. And because the barriers to entry have are lower, it enables threat actors who are 13, 14, you know, 15, you know, in their teenage years to easily just catch on and just pick up a phone and just BS their way through, you know, the IT.
Thomas: Yeah.
Brandon Kovacs: help desk to claim someone they're not and yeah if you pop the right guy's account you have you know you essentially have the keys to the kingdom like the MGM hack. I think they went on LinkedIn found you know people's names found the guy who is like a network engineer or whatever whatever his like actual title was ⁓ yeah he was highly privileged in the organization called the IT help desk saying hey I reset my password due to I guess gaps in their you know technical process
Thomas: Yeah.
Brandon Kovacs: You know, in their processes that either they didn't have established or they just didn't adhere to. they were able to reset the guy's cred because he didn't have MFA enabled, which is crazy if you're like that high in the high that like privilege in the network, you would imagine you'd have MFA enabled on your account. Or or or at least like or at least like separation of privileges, at least like move his domain admin account onto something else that is secure to have his normal account, but
Rob Antonucci: Thank Yeah.
Thomas: You'd imagine, right? Yeah, not always.
Rob Antonucci: That's why we have a job, Brandon.
Thomas: Ha ha ha.
Brandon Kovacs: Yeah, I guess, you know, just by exploiting that human factor and also a lapse of proper technical controls, they had the keys to the kingdom to, you know, pull off this and brought an organization as large as MGM is to their knees. Like people couldn't check into their hotels, couldn't gamble, couldn't just yeah, shut down their business.
Rob Antonucci: you
Thomas: So I have a question for both of guys. like I think a lot of like the way the ⁓ of these sorts of issues has been presented, like in the news, especially after AI, like ⁓ AI accelerated vulnerability research. I think there's a lot of talk about like a kill chain and like time to compromise also shrinking. ⁓ I don't know if that's really necessarily true ⁓ it comes to like taking over a whole network. Because obviously, like once you get into a network,
Rob Antonucci: Yeah.
Thomas: you know, you have access to whatever the user that you're in that network has has has access to. But I feel like The real time constraint is like if you're going after something specific is like mapping the network's topography and finding out where you want to go, and there's still a lot of attackers, I would imagine, that are sitting low and slow. And I think I feel like we kinda do both models, right? Like sometimes we are trying to move really fast, sometimes we're trying to sit back. What do you guys feel about that? Like do you feel like that seems true that the time to kill ch like kill chain time is going down? Killchain, I hate I hate that term, but you know what I mean.
Rob Antonucci: Yeah. I will say that with AI and stuff, it's incredibly helpful. It's like having a whole team of people working with you. So like you trying to research stuff, you trying to figure out all of these tools, work building tools on the fly, like all of that time is completely gone. So I would say it definitely accelerates it when you want it to be accelerated. Sometimes, like you said, you don't want to be fast. You want to be slow, but in that slow time, now you have time to do research and do other things and figure out your next steps before actually executing them. So I think it kind of works.
Thomas: Yeah. Yeah.
Brandon Kovacs: Yeah, it it's really it's really compressing the ⁓ attackers' timelines.
Thomas: Yeah.
Brandon Kovacs: Right. I feel like feel like obviously when I'm harnessing AI to do whatever it is I'm doing, I feel like Superman these days. It's like the superpower unlocked. ⁓ especially like it yeah, I mean if you know how I mean if you understand like the fundamental technology, how it works under the hood, and then you you know, it it really acts as a force multiplier and enabling you to just do more and less time. when you apply that operationally towards whatever it is we're working on, engagement or tool development or exploit research or whatever it is, ⁓ i i I feel like super
Rob Antonucci: Yeah, seriously. It's addicting.
Thomas: Yeah. Yeah. Yeah. I really do like the go go ahead, Ron.
Rob Antonucci: Yeah. I was going to say it also makes me feel like we're getting lazier at the same time. Like how often you guys actually like reviewing PRs and stuff and like looking at the code that it's writing, like it's getting like smaller and smaller every time, but more stuff to push out.
Thomas: Right. Yeah. I I feel like I intentionally it like as it's become so easy to like look up the latest and greatest like you know, hey here's a voam that just dropped, here's a PSC for it. Like I feel like I now actually like am forcing myself to read more, maybe even than I did before. Cause I I think a lot of us have that fear that like, hey, if we're not the masters of our domain, what's the point of, you know, interacting with the AI, you know? Maybe the AI could just do the thing we're doing if we're not actually doing the proper research to steer it correctly.
Rob Antonucci: Yeah. Yeah, we also can tell it to explain this to me. How does this work? Like, you teach me. That's how I like to use it. I don't like having to do everything for me. You know what mean?
Thomas: Yeah. Yeah. I I do like the analogy of like, you know, working with AI as if it's like a team of, you know, either juniors or experts potentially depending on how well trained it is, right? Like being able to ask a question and have an answer to it is more valuable I think than like, hey, write this ⁓ for me, right? Like being able to say, What is this service that I'm talking to? Like, where are the API docs for that?
Rob Antonucci: Yeah. Yeah. So.
Brandon Kovacs: really fascinating too if you put it into like the appropriate harness or like a loop essentially grades itself, right? AI generated code I have goes into like a you know a loop that reviews it, tests it, validates it against an entire rubric and yeah, you know, it runs itself at this point for the most part. ⁓
Rob Antonucci: Yeah, that's the only way to use it. So that's actually interesting that you brought that up, because literally that's pretty much what I'd do too. But I did find a use case where that would not work. So me and Raf are actually working on fixing our Red Team EDR lab. So we basically ran out of space and we needed to change the partitions, move stuff around, like a lot of very tedious, tedious work. And if you did one thing wrong, the entire thing's going to blow up and it's going to be really hard to fix it. So basically had to follow the script, here's all this stuff, log in, check all the things, give me all the exact commands, give me a playbook, and I want to run it myself. His drafts like, I'm not letting cloud do it. want to run this myself. So give me the actual commands. We'll look at all the double checker. And sure enough, all the commands are almost perfect except it gave us the wrong like, um, device name. It was supposed to be like zero one instead of zero two. So literally if we let him do it, it would have blew up the entire thing and went broke. There would be no loop. There would be no easy way to go back and fix it.
Thomas: ⁓ god. Yeah.
Brandon Kovacs: Make no mistakes.
Rob Antonucci: Yeah.
Thomas: one failed. ⁓
Rob Antonucci: You gotta be careful.
Brandon Kovacs: You gotta add them, make ⁓ no mistakes in the prompt. Rule number one.
Rob Antonucci: Hmm.
Thomas: I saw an interesting thing, this is a total aside about AI, but I did see an interesting thing where somebody ran into that exact same problem where they had Claude delete like their entire database or something and they asked five point six, they're like, Hey, what what did I do wrong? And it's like, well, first up you didn't make backups of anything and it's like, you really needed the AI to tell you that? Like I feel like you could have puzzled that one out yourself.
Rob Antonucci: Yeah.
Brandon Kovacs: Ha ha ha.
Rob Antonucci: Yeah, actually that's a good point. So our first Claude plan did not have a backup. And I actually did a cross review with GPT and it's like, yeah, the first thing you should probably do is back all this stuff up and take it off this verse. That's smart. But like we're just offloading it.
Brandon Kovacs: A new approach a new approach I've been doing is ⁓
Thomas: Ha ha ha.
Brandon Kovacs: Essentially having the two coding harnesses work together. One cross-check well, like taking a prompt of whatever the prompt is, throwing it at the other harness, and they both cross-check and evaluate each other's work and then take that and synthesize the results and have an adver take an adversarial agent review that word to cross-check and ensure it's accuracy. I found a lot of success in that and ensuring 'cause you get like both perspectives, right? Each model was each well, each coding harness obviously acts a little bit differently, but the underlying models are trained differently. ⁓ they
Rob Antonucci: Yeah, same.
Brandon Kovacs: different training data sets and allows them to have different perspectives and how they approach things. but yeah taking that like dual harness ⁓ approaches I I personally have found it'd be really effective in like things I work on.
Rob Antonucci: Yeah, I've been using the Codex plugin for quad coders. been really nice. It makes it super easy.
Brandon Kovacs: So what do you
Thomas: So, I mean, Rob, you gotta tell us about the testing harness for Mythic, right?
Rob Antonucci: Yeah, yeah. So I have definitely been spending quite a bit of time in our private mythic fork. So recently I wrote up a blog to kind of go through, you know, the pain and the sorrow and the joy that this whole process has brought us. So this is almost a year ago today we started this. So I'll just try to get you guys to TLDR. It's a little bit long, but I'll just try to get to the good stuff. Okay. So basically go back like a year.
Brandon Kovacs: ⁓ we got time.
Rob Antonucci: The problem we were having is essentially our existing loaders, the commercial C2, everything we were using was all getting flagged. know, we were doing kind of service level customization, was working for a little bit and eventually it just didn't work. So we were getting stuck. We had nothing to send clients. had nothing, you know, everything was just broken. So we had a big Hardin's financial client coming up and they basically told us what the EDR was. They told us they have app waitlisting. We're just like, we have nothing that's going to work against this. Like we have two weeks to figure something out.
Thomas: Yeah. We we knew we knew going in like this is dead in the water, like we don't have a solution for it. And this is like what like February last year.
Rob Antonucci: Yeah. Yeah. So our options at the time were start, you know, Greenfield do something totally brand new, which we just didn't have the time to do a test and make it actually work. the other option was to, know, maybe do an internal fork of sliver. I looked at that and I was like, it's not really going to be as easy because I wanted something very small, like a stage zero with like, no, you know, very, very minimal IOC used the very basics. And to do that with sliver would pretty much had to rewrite the entire thing. So was like, all right, that's, that's kind of out. So the other thing I looked at was, it was Mythic. So one of our colleagues went over to SpectorOps and like, you have to check out Mythic, it's super cool. Modular architecture, extensible, full ecosystem of agents, so I checked it out. Super complicated, very hard to set up. Once I actually dug into like one of the main agents, which was Apollo, it was a .NET agent, and it had some really, really cool features. I was like, we can definitely use this. So for like app-wide listing specifically, we tried app-to-main manager injection in MSBuild XML payloads. So that would have worked perfectly. Uh, so the next thing was basically getting this open source agent to actually work against like modern EDR, which was not easy. Um, so basically, yeah, I was like, this is the boy when I first looked at it, was like, Oh, this is going to be easy. It was like, let's, had elastic in the lab at the time. So we just spun that up, tried to test it again. So it's like, all right, here's the things that are getting caught elastic. know, they literally publish all the, our rules were like, all right, let's just go download the rules. Change all the strings shipping.
Thomas: Yeah, all the good stuff was not out there for us to just pick up and use.
Rob Antonucci: Uh, you know, with the strings, we weren't cosmetic. These, these were load bearing strings. So the actual mythic protocol structures. So we had to go back and actually change the mythic server code versus a whole other thing. So I had to learn just, you know, the server code. had to learn the new.net code, make it all work, modify it, hopefully, you know, try to try to fix it. Kind of worked a little bit. Um, then we hit the future velocity problem. So essentially how Apollo works is it compiles the task module server side. So it just pushes DLL bytes to the agent via load assembly.load. So all the, new capability we tried to do, you know, had to be manually bedded. There was no systematic approach. It was inconsistent. Like we're just trying to build these new things and it was just breaking all the time. Um, so we also found out things like the namespaces, like the word Apollo itself was a trigger. So like, can't just manually change this stuff every single op, know, mainly it's just not going to work. So the solution at the time was we need to build some kind of obfuscation paths, like a build time obfuscation. So something that's programmatic, consistent, repeatable. So that's when I started to work on the .NET obfuscator repository. So that was my first real big vibe coding project. That's kind of where this whole thing started. Um, so why did we do that? Because you can't use, you know, there's a bunch of different diamond obfuscators, know, EDR vendors are trained on their output. So if you just take Apollo and send it through something like Confuser X, it doesn't look like Apollo anymore, but it just looks like malware that was processed by Confuser X. So it doesn't really help you at all. So the whole design principle of trying to obfuscator was essentially, know,
Thomas: Yeah.
Brandon Kovacs: That's not gonna work.
Thomas: Yeah.
Rob Antonucci: obfuscate this, also make it look like a legitimate dotnet enterprise app, not like malware. So high level for the obfuscator, it did things like symbol renaming. So instead of giving it like random hex names, we use like a realistic name generator. it like 450 plus lists of actual names that probably would show up in binaries. did things like string encryption, like rolling XOR with per-random build seeds and all that stuff to basically hide all the C2 traffic and all that. We metadata cleanup.
Brandon Kovacs: Yes.
Rob Antonucci: So stripping compiler attributes, removing IELT repack artifacts, rewriting the PE version, like pretty much everything. So when this was done, the files actually looked like real programs. So the key point here is it was per build randomization. Any output is just a signature with extra steps, essentially. So like I said.
Thomas: At that point I was just curious, at that point while you were working on it, were you already were you like doing any packing or compression or were you or compression or were you basically just saying like I'm gonna get this as thin as possible without doing anything like that at all?
Rob Antonucci: Yeah. So I was just trying to get as soon as possible about that. I didn't want to pack it. didn't want to encrypt it. All, you know, malware pretty much all looks the same. So if you do all these things, it's going to look like malware. And the thing with, with, with Apollo was it had the, the dynamic loading feature. lot of agents didn't have that. So you didn't have to put all your Kerberos and LDAP and all this stuff in the base agent. You could just load it later, which is really cool, but it turned into being an absolute nightmare to actually integrate obfuscation with that feature. the next problem was the assembly merge problem.
Thomas: Right. Yeah. Yeah.
Rob Antonucci: So Apollo was initially shipped with Custura. So essentially that just embeds all the dependencies. So all the DLLs all that stuff gets embedded as compressed resources. When we ran that through the obfuscator, we had, we saw a huge problem. You know, the only, the outer assembly got transformed. So essentially, you know, the main binary actually got obfuscated with all the DLLs and stuff inside still had Apollo.interop and all this other stuff. So you didn't actually, you didn't really gain much. So initially I tried just obfuscating each DLL separately.
Thomas: Awesome. Yeah.
Rob Antonucci: You know, but there was at the time there was no shared rename maps. So all the types diverged between assemblies, the runtime resolution broke. was a nightmare. So things like, you know, component one, two, three would look for, you know, Apollo interops, still calling I agent instead of, you know, calling her up or whatever. So the solution there was get rid of Castora and I replaced it with I'll repack. So that essentially takes all of the DLLs after they're compiled and it merges them into one single binary. So then when you actually run an obfuscation on it, it obfuscates everything. So that was one problem that we solved. Uh, but then.
Thomas: Yeah.
Brandon Kovacs: Nice.
Thomas: Is that is that around the time that I remember because we we ⁓ pretty much at the time had only like DLL side loading or, you know, MS build as a mechanism for deploying stuff. And I remember at the time you were like, hey, I think ⁓ single binary for some of these payloads is is gonna be functional. Is that around that time? Gotcha.
Rob Antonucci: Yeah, I think it was around that time. Yeah. I, yeah. Um, basically once you've got that all kind of figured out and working, then we figured out that all the dynamic loading broke. So when you basically compile these DLLs, you know, against the non-obfuscated binary, you can't load them into it. They all have to be able to match each other because all the namespace are going to be obfuscated differently. So the solution there was to build a whole obfuscation map system. So it's basically a big JSON file that persisted in the Mythics database. And that was called every time a DLL got re, you know, got compiled to actually ingest correctly into the, the main assembly. Yeah. ⁓ so that, yeah, that was like a whole thing. That was like, that was probably one of the single, like hardest parts of this entire journey was trying to get that complicated thing to work. But yeah, so lessons learned was basically, you know, Apollo was designed as a training tool, know, readable names, namespace based discovery, reflection by name, all reasonable for that specific purpose.
Thomas: Got it. Yeah, to tell it where to go. Yeah yeah. Got it. Yeah.
Rob Antonucci: But they were literally all load bearing walls that we had to try to retrofit heavy obfuscation into. So was kind of a nightmare. So the big takeaways from the whole blog is, know, design obfuscation from day one, know, define the symbol contracts before you write the first handler. Treat the obfuscator as detection service. know, looks obfuscated is itself a detection. So you can't really just, you know, obfuscate everything. Per build randomization. So yeah, consistency is your enemy. If you build the same thing every time, it's very easy to signature that stuff. And the other two, you know, budget for the pipeline, just not just payload. So we basically budget for the payload and it really, really kicked us at the end. Uh, we didn't really think about like putting a full engineering CI TV process behind this. We do now, but like back then we just didn't even have the force to do that. And the last thing is just knowing when to stop fighting the forks. So we probably crossed that line a lot earlier than we admitted. Um, but when we did, we figured it out and we moved on. So the whole blog post number two is going to be kind of talking about the engineering side of this.
Thomas: Yeah. Yeah.
Rob Antonucci: And we're probably going to be releasing an open source MCP server suite that I use for my, my really tight dev loops. So essentially that was basically, you know, it was kind of a pain to constantly make changes, then, you know, rebuild the container and test it, rebuild the container testing. It was all very manual. So all of that was all automated. And now you can literally just give, you know, Claude say, Hey, add this new LDAP feature to Apollo and it'll just build it, test it, deploy it, execute it, run it, and just go into a loop until it works.
Thomas: Nice.
Rob Antonucci: And then when it's done, it's like, here you go. Here's your PR.
Thomas: Man, I remember
Brandon Kovacs: It's amazing.
Rob Antonucci: Yeah
Thomas: I also remember when you got the ⁓ 'cause like of the stuff that you did for Apollo and then our, you know, you know, private agents incredible on the window side. I remember I loved like at the time I was trying to find like script payload like scripting language payloads like Medusa that would work in an environment because that to me has always been so easy it flies under the radar of a lot of EDRs. And when you got Medusa working too, because that's another thing that Rob was doing as part of this was just like kinda tweaking all the different payloads that were
Rob Antonucci: Yeah.
Thomas: bog standard in mythic, when you got that sox proxy working so well, I was like, ⁓ my god, I've fallen in love with this payload. Like I I have to just use the ⁓ there is Python, I will use Medusa and and Hera as well. Because it's just like, ⁓ come on, why not?
Rob Antonucci: Yeah. Thank Yeah. And the sock stuff, I spent probably more time on getting the socks like performing and working under our crazy red team conditions with like the NGX forwarder and all this other stuff we have to do in there. But yeah, that was not easy, it did pay off because it pretty much did it once for Apollo and it pretty much worked for all the rest of them. The same design.
Thomas: I know. Yeah. Yeah.
Brandon Kovacs: It's amazing how far this has matured. I mean, remember like what, a year ago or so you helped build a payload for me. I think it was like a loader a loader or whatever it was. And yeah, we were just like renaming like the variable names from like a to I think yours was like ⁓ let's do fruits, apples, bananas, vegetable, tomatoes. ⁓ And here we are fast forward, just a year later and now we have an entire pipeline.
Rob Antonucci: Yeah. Yeah, and pretty much, just finished our whole actual end end suite. So now we add a new task or whatever. We basically spin it up in the lab, run it through. It runs every single command, every single output option, all the things and comes back and reports like, task worked. Or yeah, this one feature broke this. So now we've got to fix it before we push it out to Prague. So that was our thing. We were basically fixing the airplane while we were flying it, which wasn't fun.
Thomas: So quite Question for you, so in doing this, there anything the different EDR solutions, cause we our lab, you know, we test against everything that we can. is there that you realize while doing this that like all of them are doing really well compared to like, you know, what our setup was before you implemented this? Like is there anything that like EDR jumped up at that was really kicking our butt specifically?
Rob Antonucci: Yeah, I would probably say, you know, anything that looks like malware, can detect it very easily. So don't look like, don't look or act like malware anymore. Don't inject into processes if you don't have to. There's not really a lot of processes that do that normally. That's going to be something that's very easy to detect. You know, don't try to dump LSAS, know, nothing does that anymore. It's a super, you know, highly watched thing now. just other ways of doing all these things now, instead of dumping the Kerberos tickets, that's a little bit quieter.
Thomas: Yeah. Yeah, true.
Rob Antonucci: I was trying to blend in, I would say EDR is getting good. So it's really hard. Yeah.
Thomas: Yeah. Yeah. Any any that are particularly I feel like I know which ones I feel like are particularly annoying, but any that you feel like are particularly like yeah.
Brandon Kovacs: Tad a mouse game.
Rob Antonucci: Oh, I think elastic is probably one of the best, even though I've never seen it on a real op before, but it consistently catches like everything.
Thomas: Same. Yeah. I was gonna say that like Sentinel One seemed like the one that like had the hardest like threshold to clear, but it seems like it might be elastic.
Rob Antonucci: So I would say it did until we got to actually hands on it and then we can actually play with it just like anything else. You can test against it, you can get around it.
Thomas: Yeah. man. It was it was projects in a row that I think, you know, we were working on together and it was like, how on earth are we getting like, we need to do s we need to retool here. ⁓
Rob Antonucci: Yeah. Yeah. And like, and we had like the exact attack pass. We just did not have a payload to actually execute that. was so frustrating.
Brandon Kovacs: Ha ha ha.
Thomas: Yeah. Yeah, I mean I think that's like probably another thing that like realistically like big businesses are just assuming now that, hey, I've got that EDR that does that thing super kick ass. There's no way around it. When it's like, you know, you've demonstrably proven like if you put your mind to it, you can still get around a lot of the EDR stuff and it's like Yeah.
Rob Antonucci: Yeah. And I will say it would definitely would not have been possible without AI. So I pretty much was operating at like, you know, we're running this payload. run this thing like fraud strike caught something. So let's fix it right now and fly while it's fresh and then test it again before we lose access to this client. You know, same thing in another environment. S1 caught it. All right, let's fix it now before we lose access. That would never be possible without AI.
Thomas: Yeah. Right. Yeah.
Brandon Kovacs: Yeah, it's really compressing attackers' ability or I I guess in our case, you know, our ability to emulate attackers.
Rob Antonucci: Yeah.
Thomas: Yeah, in our case specifically, I feel like a lot of people who work in like consulting, a focus on like jump from one project to the next, and the people who are doing that consulting work are maybe different from the people who are actually like working on the tools. And it's cool that we ⁓ our team we're we do both of those things. But you know, we had AI coding assistance, it was hard to actually spend all that time to really up things to the next level. Yeah.
Rob Antonucci: Yeah, impossible.
Brandon Kovacs: We need to get like a dedicated dev guy to just do our engineering, you know, twenty-four not twenty-four-seven, but nine to five, right? But now
Thomas: Yeah. Yeah. Yeah. All right.
Rob Antonucci: I mean, some shops have that, yeah, that's the thing. But again, it's a lot of money and it's hard to prove business value.
Brandon Kovacs: Yeah.
Thomas: Right. it's cool to be able to be ⁓ both of those teams merged into one now, especially where it's like, you know, ⁓ think pretty much everybody on the team does a little bit of deaf of some kind, which is a really awesome ⁓ to work in.
Rob Antonucci: I like in our industry, have to, you have to be able to do dev work. We can't use off the shelf tooling at all, ever.
Brandon Kovacs: That's one.
Thomas: Yes, yeah No
Brandon Kovacs: Yeah, we'll get we'll get burnt. But yeah, it it's good 'cause I I I feel like a lot of well and pretty much everyone in our team ha i we have Very ⁓ diverse backgrounds. I mean Rob, you're our payload specialty guy. We have ⁓ Lauron who couldn't make it today, he's our like a Windows expert. anything cloud and Azure, he's the go-to. ⁓ so yeah, we have like a very diverse pool of consultants on the team and everyone offers their unique perspective ⁓ and that, applying it to whatever dev work they're working on. But when you fuse everyone together, it creates a pretty, ⁓ pretty kick-ass team.
Rob Antonucci: I like our team. We some good guys and girls.
Thomas: It was it was funny, Rob it was funny, Rob, that you were mentioning the ⁓ man, like I could rewrite sliver, but I don't wanna do that and then later I'm like, ⁓ man, maybe AI can help me rewrite sliver it did it did a pretty decent job, ⁓ of but I think ⁓ I think still kinda the the mythic stuff that you've got going is the the gold standard for us at the moment. ⁓ yeah. Yes, yeah.
Brandon Kovacs: I like our team.
Rob Antonucci: Yeah. Yeah, I think that the 40 meg binaries were just too much. And it's like, have all of your, your payload, you know, all of your tooling in one binary, which I didn't love. I couldn't think of an easy way to like, you know, do that and go where you can actually load things dynamically. I feel like Sliver wasn't really made for like very specific, like stealthy red team. That's more of like a pen testing thing. You know, it's easy to set up and use, but to actually make it customizable and stuff. It's not, not so much.
Thomas: Yeah. Right. Yeah. Like you said with Apollo, like the the version of Silver that I think we have on our you know, public repository, very much feels like a learning tool. And I think it is a very great learning tool. Real EDRs, when they're looking at Sliver as it stands in the repository, of course they'll be able to catch it. So even when we have used it and even when we use the variant that, you know, I've been working on, it's gotta be completely different. Like it can't be anything like ⁓ way it looked, you know, even just three or four years ago.
Rob Antonucci: Yeah, exactly. And there's a lot of surface to cover in that giant binary to cover your tracks.
Thomas: Yeah.
Brandon Kovacs: Yeah, it's more than just c customizing the C two profile config.
Rob Antonucci: Yes. Yep. And people have tried it. There was definitely some like GitHub repositories where they gave like, you know, scripts to actually reset everything and change all like the protobuf. think it was the main one protobuf stuff.
Thomas: Yeah. ⁓ Yeah. Pro debuff gets s signatred pretty aggressively. Yeah. Claude, rewrite this in Rust, make no mistakes.
Brandon Kovacs: Yeah, yeah.
Rob Antonucci: Yeah. So yeah, make no mistakes.
Brandon Kovacs: Make no mistakes.
Thomas: I f I find when I tell it to make no mistakes it aggressively makes more mistakes and I feel like that's it's not working for me.
Rob Antonucci: Yeah.
Brandon Kovacs: That's hilarious.
Rob Antonucci: What else is going on? I don't know. What have we been doing? You guys been working on anything cool? Any projects?
Thomas: Well, I mean, did have that physical ⁓ ⁓ a result, I think, you know, ⁓ of the things that I've been curious about coming out of that was ⁓ basically like what w ⁓ we know about like Wygand, what I know, challenging my own assumptions about what I know, but then like what are the tools that we're using for scanning low frequency and high frequency badges? A lot of what I've encountered anecdotally has been ⁓ low frequency badges or like really weak eye class, which is high frequency badges. Not so often that you see SEOS, which is ⁓ a badge type where, you know, ⁓ correct me if I'm wrong about any of this, Brandon, but it's a badge type where it has high frequency that's encrypted, but the low frequency is very encrypted, basic standard low frequency badge data. But I'm kinda like been interrogating this, like, okay, like ⁓ what can do? What kind of tooling can we get so that we don't have as much friction ⁓ encountering a in the wild where we don't know what type it is, ⁓ and just the YGAND. data, why can't we just mathematically immediately determine what it's gonna be? and I I think that some of that stuff already exists out there, but ⁓ yeah, I mean we've we've got some tooling that I think we're we're we're working on. I don't know.
Brandon Kovacs: Yeah, there's definitely it's definitely challenging 'cause ⁓ I mean, A, there's identifying the type of credential the technology that's in use. That's obvious usually step one, right? Looking the bat you know, if we can get visual on the badge itself, find some sort of you know, the markings with the blue markings in the bottom left corner of hit hid, ⁓ it'll ⁓ suggest what type of credential type or in use, ⁓ it's SEOS and then there's additional markings that'll say if it's some sort of like dual frequency or dual class badge ⁓ hit SEOS and procs, SCOS and I class, SEO with class and procs or MyFair, there's Deathfire, there there's a few variants. And then, yeah, attacking the badge implementation itself, right? Sometimes with some clients, you'll have know the high frequency badge and the low frequency frequency side to it. ⁓ or at least the majority of the times, the low frequency credential material ⁓ is used to authenticate, especially in the context of like multi-built multi-tenant buildings. the LF material is used to get into like you know the front door of the building, ⁓ but lot of the client suites are protected by whatever's on the high. high frequency side of the cards. But yeah, it's definitely a challenge, right? Especially when you're going into a lot of physicals, you're going into a blind, right? It's very ⁓ it's it's a very black box approach. You know, sometimes on some on most occasions with physicals, we try to ask the client what type of badges you're using in advance, just because we have I mean, as you can see, I've like four pelican toolkits behind me of all sorts of crap. I try to save them money because once you go past the second check bag, it's like $200 a bag ⁓ $400 round trip. So I try to bring the things that we need for.
Rob Antonucci: Great work.
Brandon Kovacs: But then there's some occasions where they're like, no, bring everything, figure out yourself. so that's definitely challenging. But ⁓ yeah, attack
Thomas: Yeah. That that I I was just gonna say that I think was one of the hardest parts of the most recent physical that we were on is going with multiple panels, knowing that there's gonna be different types of badges, having like standard I class keyed into the high frequency reader, but then also getting, you know, not necessarily good reads off of things. You don't necessarily know when you're looking at a good read versus a bad read. And you know, I think we can we can write tools that will take the YGAN data and be able to use the parity to validate, hey, this is ⁓ this is a valid facility code.
Brandon Kovacs: Yeah.
Thomas: Because, you know, if we're out there for, you know, an hour or two and we've got a bunch of unclear data, I think, you know, being able to sort through that and ultimately, you know, I feel like we typically do end up with a valid badge just might take some time to determine which one is actually going to be valid. And I think speeding up that process would save us, you know, a an enormous amount of time. Yeah.
Brandon Kovacs: ⁓ yeah. ⁓ yeah, it wasn't till like I think the last day or the la second to last day we're like, ⁓ crap. That badge would have gotten us in the building had we tried at this door.
Rob Antonucci: Thank
Thomas: Yeah, n not to not to mention, a few a few card numbers over, we can get into every single door in the whole building. ⁓
Brandon Kovacs: Yeah, that was that wa y dude, you like you Yeah, so Rob, Thomas basically Thomas we should have bought lottery tickets right after what Thomas pulled off there. Like he played ⁓ RFID Like just spinning the wheel. ⁓
Rob Antonucci: No.
Thomas: Ha ha ha. Yeah, I I love I any time I get on a physical, anytime I get a badge into the flipper, I just will go to the most sensitive room that I can go to and brute force. Because, you know, you assume there's probably gonna be some sequential badge IDs. And you know, if I have to be there for too long then leave, right? But man, we got into this door in twenty twos ⁓ maybe like twelve seconds. Yeah, four abuse. It was it was very short ⁓ and we determined afterwards that that was, you know, a ⁓
Rob Antonucci: brute force it. Yeah.
Brandon Kovacs: Dude, it took four seconds. I heard four beeps. Beep, beep, beep, beep, bing.
Rob Antonucci: That's awesome.
Thomas: ⁓ a fire department ⁓ keyed badge. So it I think that I've b I've been caught one time doing brute forcing, ⁓ but it wasn't somebody who actually validated that I was a pen tester. They're like, huh, what's going on over here? and I
Rob Antonucci: So has that ever gotten you guys caught brute-forcing like that?
Brandon Kovacs: Chucking the doors.
Thomas: I think like usually it's pretty noisy inside a sock, so it's a last a last resort. But if you can go and do that and then leave with valid badge data without being stopped and then you have a valid badge that you can pass to somebody else, that's value. That's really high value because people won't really understand why did I get a bunch of like bad reads and then one good one. They're not gonna think, ⁓ that badge is now compromised necessarily. Because a lot of the people who are working in these socks, you know, they don't they're not from a technical background, right? Like they're not working with the technical teams. They have more of Physical security background and I think, huh, that's weird.
Brandon Kovacs: Usually s ⁓ find that those badge scans happen so quickly, or at least on the logs, like it's like a little sliver of their UI where the b ⁓ the log entries are appearing and it and if it's like a large if it's like a skyscraper in New York City, right? ⁓ these things are just flying past to where their their ability to actually detect no notice and detect it is slim to none. ⁓ Whereas if you're like out in the suburbs of middle middle America, ⁓ obviously, you know, you don't have as much volume per se. So you're ⁓ hi ⁓ than likely to get caught. ⁓
Thomas: Yeah. Yeah.
Brandon Kovacs: Yeah, we were with a very advanced client with a very in ⁓ a good security posture and they they busted us, which is it ⁓ it was definitely interesting. Yeah, we had ⁓
Thomas: Yeah. Yeah.
Brandon Kovacs: Our little decoy readers, right? I don't know if the camera can see this or not. So it looks like a yeah, it's the the blur or the focus on my camera. Yeah, it looks like a real reader, right? They're they look like real hit readers. This one says present badge here at the top. And yeah, they have magnets on the back, so you can just stick them on, you know, a ⁓ a piece of metal, you know, next to the real badge reader. And the idea is to essentially get the employees to put their badges up to it. And, you know, we try to entice them some way, shape, or form. You know, new reader, you know, s new reader, stand badge here, training it for whatever reason. in this case, ⁓ came down to ⁓ that like if you see something, say something, which I think was baked in Yeah, I think that w you know, that also had to do with like the region in which we did this physical. It's just baked into that culture there. If you see something, you say something. the guy said something and because of that, you know, the security started looking at footage and
Thomas: We had we had one guy. Yeah.
Brandon Kovacs: Notice me, and I got a ⁓ WhatsApp f ⁓ from the from the clients, Hey by the way, nice shirt. ⁓ here here's here our security team found you. It's like, ⁓ great, but they haven't found Thomas yet, so let's let's keep going.
Rob Antonucci: you
Thomas: They had they had a they had a good photo of Brandon. ⁓ and we were like, Okay, okay, maybe we're fine. next day we're going in, ⁓ they ha they have a photo of me too. ⁓ ⁓ they're like, By the way, there's gonna be undercover cops here and we're like, Okay, seems like this might be a good time for us to call things off. ⁓ yeah. We were to walk up on the property and then we're like, hey, they have a photo of you got you both and there's cops. ⁓ and we're like, All right
Rob Antonucci: Hahaha Whoops.
Brandon Kovacs: Go to the Soon Bridge. Literally we're driving there. Like right down the street.
Rob Antonucci: Hahaha
Thomas: But good good thing you guys texted us now. This seems like the right time for us to stop.
Brandon Kovacs: Yeah, it could've it could have gone s s it yeah, i that ⁓ that would have been a first ⁓ for us and the team. But ⁓ no i in the end it went really well. The client's very happy and as long as we you know, the client's happy that's what matters. Right? We we we're here to f you to emulate their greatest adversary and that's exactly what we try, that's exactly what we did.
Rob Antonucci: Hold off on handcuffs.
Thomas: Yeah.
Rob Antonucci: Yeah.
Thomas: That that plus me walking away from another ⁓ on-site without handcuffs ⁓ on on my wrists. That makes me happy as well. So far, so far, perfect record of not being arrested during an engagement, so
Brandon Kovacs: ⁓ but no, it was good.
Rob Antonucci: Yeah
Brandon Kovacs: Yep. And we're gonna keep it that way, of course ⁓ Yeah, we're gonna keep it that way. But
Thomas: We're gonna keep it that way.
Brandon Kovacs: Yeah, definitely some lessons learned, right? Especially now, you know, looking at how we can improve our badge capture technology, the tooling around that. now, you know, we obviously have these ⁓ RP40 readers. ⁓ gonna start I've already gone ahead and started sourcing additional readers off of eBay. They're like twenty dollars each, where we're then gonna, you know, stick our hardware implants behind it. That will give us the ability to emulate all sorts of readers and capture that WagN data. And yeah, at the end of the day, you know.
Rob Antonucci: Ahem.
Brandon Kovacs: your SEOS badges or your deskfire badges, whatever. But if you're not implementing this technology correctly behind the scenes, like for example, you could have great badge technology that encrypts the communications between your badges and the readers. But if there's nothing protecting the the line of communications between the the readers and your access control panel themselves, what's stopping an an an attacker from taking a Phillips screw head screwdriver, ⁓ the thing off the wall, inserting a man in the middle, intercept behind you on the cables right behind to Intercept that YGAN data, which is unencrypted, and then just pulling creds that way, right? How'd that go?
Rob Antonucci: And that's what we did on my last physical. It went really good. mean, we basically used the ESP key. So we found out that they weren't even using cards. They were all using their mobile devices to batch them. So we couldn't even skim them or anything. So we had to fall back to that basically. But the client was very, very impressed. And we walked over and just like pressed a button on the phone and the door just opened.
Thomas: I'm I'm pretty confident. Nice.
Brandon Kovacs: Yeah.
Thomas: Mm.
Brandon Kovacs: ⁓ transmit. ⁓
Thomas: Nice. D were you able to to clone to badges in that case or was it just not necessary? Okay. Nice. And they took the readers would take low frequency as well, huh? See, this is the thing, like, that's the thing that I feel now very confident telling basically anybody who is
Rob Antonucci: Yeah, we collected like 60 or 70 actual badges. So we pretty much had all the good ones. Yeah, I think so.
Thomas: Manning a physical security program is if you've got if you paid all the money for these dual-class cards, ditch the low frequency at the very least for sensitive rooms. Right? Like if you got like a data center and you've got low frequency accepted all around the campus, at least in the data center, upgrade that reader to only support high frequency. Because you don't want people just cloning a badge from Wigan data they pull off with an ESP key.
Brandon Kovacs: Use them.
Rob Antonucci: Yeah.
Brandon Kovacs: And also roll over to OSDP just to mitigate the use of a of an ESP key to begin with, because then that'll encrypt the cons between the readers and the panels themselves so that way an ESP key is no longer effective. But yeah, definitely a lot of lessons learned.
Thomas: Yeah. And then of course hire us to make sure that we, you know, we ⁓ that you did it, right? Because Yeah.
Brandon Kovacs: Yes. Just just don't send the p send eight police cars looking for us. yeah, I I I on this last one I forgot to put it on my hand. You know, I have a little microchip in my left hand. I caught the I caught the open sesame trick, just walking up, just like waving the hand. ⁓ I I did an assessment Alith back in October.
Rob Antonucci: Thank
Thomas: ⁓ yeah.
Brandon Kovacs: And yeah, we did our walkthrough. I like, hold on, let's see if this works at the data center. Wave my hand, the door clicks open and everyone's like, Huh? That's crazy. Only four people have access to this. And the guy like calls downstairs. I'm like, here, call downstairs to your security desk. See whose badge that was. So the guy like he he calls and he goes, Hey, whose badge was that? And I guess the guy the
Rob Antonucci: Thank
Thomas: I mean
Brandon Kovacs: person downstairs like it was yours, sir. I di is a I didn't realize, but I guess like I got this guy's badge on like the first day, ⁓ twice. Like once in the morning, one in the afternoon. And I obviously decided to use that 'cause I've never caught the same one twice. And it just happened to be someone one of one of the four people that had had access to that room, which yeah.
Rob Antonucci: That's awesome.
Thomas: I mean, like, we're we're all physical enjoyers or at least physical doers here. Like, is there more of a rush than the tactile experience of opening a door without even touching it with credentials that you harvested somewhere, right? Like that feeling of just walking up to a door, no contact, and the door unlocks, just it feels so powerful. It's very fun.
Rob Antonucci: Yeah, it's
Brandon Kovacs: I just think there's no greater high than just like walking into a place where you do not belong. Especially when we're like blending in, like, you know, we just we buy their t-shirts online or source someone from eBay or in this case we went to old navy, bought the shirts, got the emblem, went to some like embroidery hat embroidery place in at the mall and just made our own.
Thomas: Ha ha ha.
Rob Antonucci: Yeah.
Thomas: See, I think I have to I have to maintain my internal flight or flight response, fight or flight response whenever I'm in that scenario. Otherwise I'd be bad at ⁓ into places, you know what I mean? ⁓ have to be afraid. Yeah. I have to operate with a little bit of fear. ⁓ look at me, I'm normal. ⁓
Rob Antonucci: Yeah.
Brandon Kovacs: You gotta do cold plunges.
Rob Antonucci: Just walking around sweating, just like, is there been staring at me?
Brandon Kovacs: Ha ha ha. Yeah y that that's my secret trick, ⁓ for the record. Cold plunges. It just like helps you regulate that adrenaline rush so when you are put in that position, it's just like Yeah, like the guy said he goes, I don't know how you did it, you just walked around so comfortably. I'm like, Yeah, just like another day at the office. I don't know.
Rob Antonucci: Yeah.
Thomas: He really did ⁓ the compliment that we got, I think, was being called professional criminals. ⁓ which, you know, I think I like to think of us as professional criminals in in a sense.
Brandon Kovacs: Yes. It's like when someone says, ⁓ you guys are hackers like no, we are cybersecurity professionals.
Thomas: Exactly.
Brandon Kovacs: So, all right. Well, I guess this is the end ⁓ this month's ⁓ Team Podcast. we look forward to speaking with all you guys and hearing all the latest and greatest of whatever it is you know we're working on here at Bishop Fox next month. My name's Brandon, ⁓ joined Rob and Thomas, and we speak to you next month.
Rob Antonucci: Thanks guys. Later.
Thomas: See ya.
Brandon Kovacs: Bye everyone.
Thomas: Yo yo. They keep us busy, but they can't keep us away from the pod.
Rob Antonucci: What's going on?
Brandon Kovacs: They can't keep us away. Yeah, how how are your ⁓ cortisol levels ⁓ today, Thomas?
Thomas: Yeah, I I would say they're they're lower than they were last week. ⁓ Brandon and I had ⁓ had a physical breach that we were doing together, ⁓ which, you know, we found a lot of good stuff. the the blue team found us, which obviously always makes things more exciting. but I'm I'm calmer. I'm calmer, you know. I feel ⁓ I feel nice and relaxed behind my desk this week.
Brandon Kovacs: don't have ⁓ eight police officers and a bunch of guns putting at our face. ⁓ there's a lot going on in the offensive security space these days. I mean we had a news article that came out not too long ago about how Microsoft has been ⁓ attributing threat actors. what are you guys thoughts on that?
Thomas: Exactly, exactly.
Rob Antonucci: Yeah.
Thomas: yeah. So that you're I assume referring to the G D I D attribution? Yeah, so I personally think this one's really interesting. you know, a lot people I think in the hacker community, more of like the gray hat kind of community, were initially really concerned about the GDID attribution because it was tied very closely to ⁓ Peter Stokes' arrest. It was mentioned in the ⁓ unsealed docs or, you know, public court docs about ⁓ his arrest, who, you know, is one of the guys from Scattered Spider. But GDIDs themselves, pretty pretty normal thing. I think it was kind of interesting that a lot of people were like, ⁓ my god, Microsoft knows every single thing that you're doing, when in reality the GDIDs, while they're kind of hard to shed on one machine, it's hard to get them completely reset. kind of a standard, you know, device identifier. And ⁓ you're ⁓ the internet like with ⁓ and it's voluntarily submitting your GDID, then of course your attribution's gonna be a lot easier to connect back to you. ⁓ that's how I felt about it. I thought it was you know
Rob Antonucci: Did you guys actually know about that? I always assumed there was something like, specifically like that, but I never actually knew what it was or what it was called.
Thomas: Yeah, I didn't know what it was called either. I think this is like one of the first I think a big part of the issue is that like why people were worried is this is the first time that Microsoft has talked about it. Like it's on their Azure docs mentioned as an optional internal like telemetry signifier. Right, yeah. And it's like but nobody really knew what it was. It's kind of functionally the same as I guess passport UIDs, which are more discussed
Brandon Kovacs: Optional.
Rob Antonucci: Yeah.
Thomas: But yeah, it I it was really odd that it was like, ⁓ this is the first time we were actually hearing about this publicly, and it's not even from Microsoft, it's from a court document.
Brandon Kovacs: Yeah, it makes you think that you wonder, you know, a lot of the activities that you Pursue online you think are fully anonymous, but not so much, especially when it's tied to your device at the hardware level. And then when you start doing know, you start investigating and attributing that GD ID to where ⁓ you know other telemetry that exists out there on the open web, we're not it's not so as anonymous as you think it is. Even yeah, I I was reading the article earlier today, you know, even though he was using a VPN to obscure his IP, that GDID was associated to ⁓ some that he had like put like his Facebook or Snap. chat or he had like logged into. Yeah, it was like really bad opsec. I mean I th I I saw I guess he like posted ⁓ on his Snapchat a picture of his like test because yeah the guy was like 16 years old. So he like posted you know whatever ⁓ whatever exam was like taking at the time with his full name and because they attributed that to the GD ID and it was or to the IP and the IP the GD ID and that to other nefarious activity he was doing
Rob Antonucci: Just bad on sec all around.
Thomas: Yeah, yeah. Yeah. Please, nineteen.
Rob Antonucci: you
Brandon Kovacs: over the span of his ⁓ cyber criminal career, that's kinda how he got busted.
Thomas: I mean totally anecdotally, like, from what I know about a lot of the cyber criminal groups that like I've heard about and you know tangentially encountered in the wild. Like he's from the comm, but like it seems like a lot of people who do that sort of like big OPseck fails ⁓ a non-affiliated hacking group, a lot of them tend to be young kids, which is kind of interesting, you know, people who are mastering the skill but then are like, where can I use this? ⁓ guess just on anything that's broken.
Brandon Kovacs: Yeah.
Rob Antonucci: Yeah.
Brandon Kovacs: And it goes to show that, you know, the motives of attackers have changed over the years. when I was that younger as well, the motives for ⁓ hacking companies for financial game. It was like, look at what I can do for the lulls, ⁓ right? ⁓ right?
Rob Antonucci: Yep. That was the whole vibe back then.
Thomas: Right. Yeah.
Brandon Kovacs: but now like, you know, as our as our reliance on technology ⁓ increased. Everything's becoming digital digitized. the motives of attackers changed a as a ⁓ And it's
Thomas: Yeah, it's it's interesting to me with again, also like young kids, ⁓ right? It seems like young kids are part of shiny hunters 'cause, you know, the Pokemon reference in the name. But ⁓ I feel like ⁓ I feel like a lot of the techniques between shiny hunters and
Brandon Kovacs: I didn't know that.
Thomas: a scattered spider are similar because like they both have been associated with like associated with the technique of you call into an IP ⁓ IT team or you call into an individual for a company, you impersonate IT or that individual, and then you reset their password and from there they're kind of everywhere in the network, right? Because a lot of the places that you target, either they can get some sort of VPN access or they don't need it to do what they want to do ⁓ for basically extortion, right? And ⁓ it's interesting because Because we have seen that as a thing that you know, clients are interested in and we are interested in modeling, which is, hey, can we just call people and reset the passwords? And I feel like like you have had you have had a lot of success with that, Brandon. I feel like you've done a lot of those calls before.
Rob Antonucci: Thank
Brandon Kovacs: Yeah. Yeah, it's ⁓ it's pretty wild 'cause like at the end of the day, you could have all the bells and whistles in the world. if you could literally go to Black Hat or go to RSA, buy one of every product from every vendor, ⁓ but at the end the day, like the human will always be the weakest link. And all it takes is one it i you can call a million times, but you only need to get one person to do it, right? Whether it's resetting a password or downloading a file and opening it on their workstation. The human will always be the weakest link. And it goes to show you that you don't need to have sophisticated malware and backdoors and all sorts of along those lines. ⁓ attacks are becoming less and less technical. And because the barriers to entry have are lower, it enables threat actors who are 13, 14, you know, 15, you know, in their teenage years to easily just catch on and just pick up a phone and just BS their way through, you know, the IT.
Thomas: Yeah.
Brandon Kovacs: help desk to claim someone they're not and yeah if you pop the right guy's account you have you know you essentially have the keys to the kingdom like the MGM hack. I think they went on LinkedIn found you know people's names found the guy who is like a network engineer or whatever whatever his like actual title was ⁓ yeah he was highly privileged in the organization called the IT help desk saying hey I reset my password due to I guess gaps in their you know technical process
Thomas: Yeah.
Brandon Kovacs: You know, in their processes that either they didn't have established or they just didn't adhere to. they were able to reset the guy's cred because he didn't have MFA enabled, which is crazy if you're like that high in the high that like privilege in the network, you would imagine you'd have MFA enabled on your account. Or or or at least like or at least like separation of privileges, at least like move his domain admin account onto something else that is secure to have his normal account, but
Rob Antonucci: Thank Yeah.
Thomas: You'd imagine, right? Yeah, not always.
Rob Antonucci: That's why we have a job, Brandon.
Thomas: Ha ha ha.
Brandon Kovacs: Yeah, I guess, you know, just by exploiting that human factor and also a lapse of proper technical controls, they had the keys to the kingdom to, you know, pull off this and brought an organization as large as MGM is to their knees. Like people couldn't check into their hotels, couldn't gamble, couldn't just yeah, shut down their business.
Rob Antonucci: you
Thomas: So I have a question for both of guys. like I think a lot of like the way the ⁓ of these sorts of issues has been presented, like in the news, especially after AI, like ⁓ AI accelerated vulnerability research. I think there's a lot of talk about like a kill chain and like time to compromise also shrinking. ⁓ I don't know if that's really necessarily true ⁓ it comes to like taking over a whole network. Because obviously, like once you get into a network,
Rob Antonucci: Yeah.
Thomas: you know, you have access to whatever the user that you're in that network has has has access to. But I feel like The real time constraint is like if you're going after something specific is like mapping the network's topography and finding out where you want to go, and there's still a lot of attackers, I would imagine, that are sitting low and slow. And I think I feel like we kinda do both models, right? Like sometimes we are trying to move really fast, sometimes we're trying to sit back. What do you guys feel about that? Like do you feel like that seems true that the time to kill ch like kill chain time is going down? Killchain, I hate I hate that term, but you know what I mean.
Rob Antonucci: Yeah. I will say that with AI and stuff, it's incredibly helpful. It's like having a whole team of people working with you. So like you trying to research stuff, you trying to figure out all of these tools, work building tools on the fly, like all of that time is completely gone. So I would say it definitely accelerates it when you want it to be accelerated. Sometimes, like you said, you don't want to be fast. You want to be slow, but in that slow time, now you have time to do research and do other things and figure out your next steps before actually executing them. So I think it kind of works.
Thomas: Yeah. Yeah.
Brandon Kovacs: Yeah, it it's really it's really compressing the ⁓ attackers' timelines.
Thomas: Yeah.
Brandon Kovacs: Right. I feel like feel like obviously when I'm harnessing AI to do whatever it is I'm doing, I feel like Superman these days. It's like the superpower unlocked. ⁓ especially like it yeah, I mean if you know how I mean if you understand like the fundamental technology, how it works under the hood, and then you you know, it it really acts as a force multiplier and enabling you to just do more and less time. when you apply that operationally towards whatever it is we're working on, engagement or tool development or exploit research or whatever it is, ⁓ i i I feel like super
Rob Antonucci: Yeah, seriously. It's addicting.
Thomas: Yeah. Yeah. Yeah. I really do like the go go ahead, Ron.
Rob Antonucci: Yeah. I was going to say it also makes me feel like we're getting lazier at the same time. Like how often you guys actually like reviewing PRs and stuff and like looking at the code that it's writing, like it's getting like smaller and smaller every time, but more stuff to push out.
Thomas: Right. Yeah. I I feel like I intentionally it like as it's become so easy to like look up the latest and greatest like you know, hey here's a voam that just dropped, here's a PSC for it. Like I feel like I now actually like am forcing myself to read more, maybe even than I did before. Cause I I think a lot of us have that fear that like, hey, if we're not the masters of our domain, what's the point of, you know, interacting with the AI, you know? Maybe the AI could just do the thing we're doing if we're not actually doing the proper research to steer it correctly.
Rob Antonucci: Yeah. Yeah, we also can tell it to explain this to me. How does this work? Like, you teach me. That's how I like to use it. I don't like having to do everything for me. You know what mean?
Thomas: Yeah. Yeah. I I do like the analogy of like, you know, working with AI as if it's like a team of, you know, either juniors or experts potentially depending on how well trained it is, right? Like being able to ask a question and have an answer to it is more valuable I think than like, hey, write this ⁓ for me, right? Like being able to say, What is this service that I'm talking to? Like, where are the API docs for that?
Rob Antonucci: Yeah. Yeah. So.
Brandon Kovacs: really fascinating too if you put it into like the appropriate harness or like a loop essentially grades itself, right? AI generated code I have goes into like a you know a loop that reviews it, tests it, validates it against an entire rubric and yeah, you know, it runs itself at this point for the most part. ⁓
Rob Antonucci: Yeah, that's the only way to use it. So that's actually interesting that you brought that up, because literally that's pretty much what I'd do too. But I did find a use case where that would not work. So me and Raf are actually working on fixing our Red Team EDR lab. So we basically ran out of space and we needed to change the partitions, move stuff around, like a lot of very tedious, tedious work. And if you did one thing wrong, the entire thing's going to blow up and it's going to be really hard to fix it. So basically had to follow the script, here's all this stuff, log in, check all the things, give me all the exact commands, give me a playbook, and I want to run it myself. His drafts like, I'm not letting cloud do it. want to run this myself. So give me the actual commands. We'll look at all the double checker. And sure enough, all the commands are almost perfect except it gave us the wrong like, um, device name. It was supposed to be like zero one instead of zero two. So literally if we let him do it, it would have blew up the entire thing and went broke. There would be no loop. There would be no easy way to go back and fix it.
Thomas: ⁓ god. Yeah.
Brandon Kovacs: Make no mistakes.
Rob Antonucci: Yeah.
Thomas: one failed. ⁓
Rob Antonucci: You gotta be careful.
Brandon Kovacs: You gotta add them, make ⁓ no mistakes in the prompt. Rule number one.
Rob Antonucci: Hmm.
Thomas: I saw an interesting thing, this is a total aside about AI, but I did see an interesting thing where somebody ran into that exact same problem where they had Claude delete like their entire database or something and they asked five point six, they're like, Hey, what what did I do wrong? And it's like, well, first up you didn't make backups of anything and it's like, you really needed the AI to tell you that? Like I feel like you could have puzzled that one out yourself.
Rob Antonucci: Yeah.
Brandon Kovacs: Ha ha ha.
Rob Antonucci: Yeah, actually that's a good point. So our first Claude plan did not have a backup. And I actually did a cross review with GPT and it's like, yeah, the first thing you should probably do is back all this stuff up and take it off this verse. That's smart. But like we're just offloading it.
Brandon Kovacs: A new approach a new approach I've been doing is ⁓
Thomas: Ha ha ha.
Brandon Kovacs: Essentially having the two coding harnesses work together. One cross-check well, like taking a prompt of whatever the prompt is, throwing it at the other harness, and they both cross-check and evaluate each other's work and then take that and synthesize the results and have an adver take an adversarial agent review that word to cross-check and ensure it's accuracy. I found a lot of success in that and ensuring 'cause you get like both perspectives, right? Each model was each well, each coding harness obviously acts a little bit differently, but the underlying models are trained differently. ⁓ they
Rob Antonucci: Yeah, same.
Brandon Kovacs: different training data sets and allows them to have different perspectives and how they approach things. but yeah taking that like dual harness ⁓ approaches I I personally have found it'd be really effective in like things I work on.
Rob Antonucci: Yeah, I've been using the Codex plugin for quad coders. been really nice. It makes it super easy.
Brandon Kovacs: So what do you
Thomas: So, I mean, Rob, you gotta tell us about the testing harness for Mythic, right?
Rob Antonucci: Yeah, yeah. So I have definitely been spending quite a bit of time in our private mythic fork. So recently I wrote up a blog to kind of go through, you know, the pain and the sorrow and the joy that this whole process has brought us. So this is almost a year ago today we started this. So I'll just try to get you guys to TLDR. It's a little bit long, but I'll just try to get to the good stuff. Okay. So basically go back like a year.
Brandon Kovacs: ⁓ we got time.
Rob Antonucci: The problem we were having is essentially our existing loaders, the commercial C2, everything we were using was all getting flagged. know, we were doing kind of service level customization, was working for a little bit and eventually it just didn't work. So we were getting stuck. We had nothing to send clients. had nothing, you know, everything was just broken. So we had a big Hardin's financial client coming up and they basically told us what the EDR was. They told us they have app waitlisting. We're just like, we have nothing that's going to work against this. Like we have two weeks to figure something out.
Thomas: Yeah. We we knew we knew going in like this is dead in the water, like we don't have a solution for it. And this is like what like February last year.
Rob Antonucci: Yeah. Yeah. So our options at the time were start, you know, Greenfield do something totally brand new, which we just didn't have the time to do a test and make it actually work. the other option was to, know, maybe do an internal fork of sliver. I looked at that and I was like, it's not really going to be as easy because I wanted something very small, like a stage zero with like, no, you know, very, very minimal IOC used the very basics. And to do that with sliver would pretty much had to rewrite the entire thing. So was like, all right, that's, that's kind of out. So the other thing I looked at was, it was Mythic. So one of our colleagues went over to SpectorOps and like, you have to check out Mythic, it's super cool. Modular architecture, extensible, full ecosystem of agents, so I checked it out. Super complicated, very hard to set up. Once I actually dug into like one of the main agents, which was Apollo, it was a .NET agent, and it had some really, really cool features. I was like, we can definitely use this. So for like app-wide listing specifically, we tried app-to-main manager injection in MSBuild XML payloads. So that would have worked perfectly. Uh, so the next thing was basically getting this open source agent to actually work against like modern EDR, which was not easy. Um, so basically, yeah, I was like, this is the boy when I first looked at it, was like, Oh, this is going to be easy. It was like, let's, had elastic in the lab at the time. So we just spun that up, tried to test it again. So it's like, all right, here's the things that are getting caught elastic. know, they literally publish all the, our rules were like, all right, let's just go download the rules. Change all the strings shipping.
Thomas: Yeah, all the good stuff was not out there for us to just pick up and use.
Rob Antonucci: Uh, you know, with the strings, we weren't cosmetic. These, these were load bearing strings. So the actual mythic protocol structures. So we had to go back and actually change the mythic server code versus a whole other thing. So I had to learn just, you know, the server code. had to learn the new.net code, make it all work, modify it, hopefully, you know, try to try to fix it. Kind of worked a little bit. Um, then we hit the future velocity problem. So essentially how Apollo works is it compiles the task module server side. So it just pushes DLL bytes to the agent via load assembly.load. So all the, new capability we tried to do, you know, had to be manually bedded. There was no systematic approach. It was inconsistent. Like we're just trying to build these new things and it was just breaking all the time. Um, so we also found out things like the namespaces, like the word Apollo itself was a trigger. So like, can't just manually change this stuff every single op, know, mainly it's just not going to work. So the solution at the time was we need to build some kind of obfuscation paths, like a build time obfuscation. So something that's programmatic, consistent, repeatable. So that's when I started to work on the .NET obfuscator repository. So that was my first real big vibe coding project. That's kind of where this whole thing started. Um, so why did we do that? Because you can't use, you know, there's a bunch of different diamond obfuscators, know, EDR vendors are trained on their output. So if you just take Apollo and send it through something like Confuser X, it doesn't look like Apollo anymore, but it just looks like malware that was processed by Confuser X. So it doesn't really help you at all. So the whole design principle of trying to obfuscator was essentially, know,
Thomas: Yeah.
Brandon Kovacs: That's not gonna work.
Thomas: Yeah.
Rob Antonucci: obfuscate this, also make it look like a legitimate dotnet enterprise app, not like malware. So high level for the obfuscator, it did things like symbol renaming. So instead of giving it like random hex names, we use like a realistic name generator. it like 450 plus lists of actual names that probably would show up in binaries. did things like string encryption, like rolling XOR with per-random build seeds and all that stuff to basically hide all the C2 traffic and all that. We metadata cleanup.
Brandon Kovacs: Yes.
Rob Antonucci: So stripping compiler attributes, removing IELT repack artifacts, rewriting the PE version, like pretty much everything. So when this was done, the files actually looked like real programs. So the key point here is it was per build randomization. Any output is just a signature with extra steps, essentially. So like I said.
Thomas: At that point I was just curious, at that point while you were working on it, were you already were you like doing any packing or compression or were you or compression or were you basically just saying like I'm gonna get this as thin as possible without doing anything like that at all?
Rob Antonucci: Yeah. So I was just trying to get as soon as possible about that. I didn't want to pack it. didn't want to encrypt it. All, you know, malware pretty much all looks the same. So if you do all these things, it's going to look like malware. And the thing with, with, with Apollo was it had the, the dynamic loading feature. lot of agents didn't have that. So you didn't have to put all your Kerberos and LDAP and all this stuff in the base agent. You could just load it later, which is really cool, but it turned into being an absolute nightmare to actually integrate obfuscation with that feature. the next problem was the assembly merge problem.
Thomas: Right. Yeah. Yeah.
Rob Antonucci: So Apollo was initially shipped with Custura. So essentially that just embeds all the dependencies. So all the DLLs all that stuff gets embedded as compressed resources. When we ran that through the obfuscator, we had, we saw a huge problem. You know, the only, the outer assembly got transformed. So essentially, you know, the main binary actually got obfuscated with all the DLLs and stuff inside still had Apollo.interop and all this other stuff. So you didn't actually, you didn't really gain much. So initially I tried just obfuscating each DLL separately.
Thomas: Awesome. Yeah.
Rob Antonucci: You know, but there was at the time there was no shared rename maps. So all the types diverged between assemblies, the runtime resolution broke. was a nightmare. So things like, you know, component one, two, three would look for, you know, Apollo interops, still calling I agent instead of, you know, calling her up or whatever. So the solution there was get rid of Castora and I replaced it with I'll repack. So that essentially takes all of the DLLs after they're compiled and it merges them into one single binary. So then when you actually run an obfuscation on it, it obfuscates everything. So that was one problem that we solved. Uh, but then.
Thomas: Yeah.
Brandon Kovacs: Nice.
Thomas: Is that is that around the time that I remember because we we ⁓ pretty much at the time had only like DLL side loading or, you know, MS build as a mechanism for deploying stuff. And I remember at the time you were like, hey, I think ⁓ single binary for some of these payloads is is gonna be functional. Is that around that time? Gotcha.
Rob Antonucci: Yeah, I think it was around that time. Yeah. I, yeah. Um, basically once you've got that all kind of figured out and working, then we figured out that all the dynamic loading broke. So when you basically compile these DLLs, you know, against the non-obfuscated binary, you can't load them into it. They all have to be able to match each other because all the namespace are going to be obfuscated differently. So the solution there was to build a whole obfuscation map system. So it's basically a big JSON file that persisted in the Mythics database. And that was called every time a DLL got re, you know, got compiled to actually ingest correctly into the, the main assembly. Yeah. ⁓ so that, yeah, that was like a whole thing. That was like, that was probably one of the single, like hardest parts of this entire journey was trying to get that complicated thing to work. But yeah, so lessons learned was basically, you know, Apollo was designed as a training tool, know, readable names, namespace based discovery, reflection by name, all reasonable for that specific purpose.
Thomas: Got it. Yeah, to tell it where to go. Yeah yeah. Got it. Yeah.
Rob Antonucci: But they were literally all load bearing walls that we had to try to retrofit heavy obfuscation into. So was kind of a nightmare. So the big takeaways from the whole blog is, know, design obfuscation from day one, know, define the symbol contracts before you write the first handler. Treat the obfuscator as detection service. know, looks obfuscated is itself a detection. So you can't really just, you know, obfuscate everything. Per build randomization. So yeah, consistency is your enemy. If you build the same thing every time, it's very easy to signature that stuff. And the other two, you know, budget for the pipeline, just not just payload. So we basically budget for the payload and it really, really kicked us at the end. Uh, we didn't really think about like putting a full engineering CI TV process behind this. We do now, but like back then we just didn't even have the force to do that. And the last thing is just knowing when to stop fighting the forks. So we probably crossed that line a lot earlier than we admitted. Um, but when we did, we figured it out and we moved on. So the whole blog post number two is going to be kind of talking about the engineering side of this.
Thomas: Yeah. Yeah.
Rob Antonucci: And we're probably going to be releasing an open source MCP server suite that I use for my, my really tight dev loops. So essentially that was basically, you know, it was kind of a pain to constantly make changes, then, you know, rebuild the container and test it, rebuild the container testing. It was all very manual. So all of that was all automated. And now you can literally just give, you know, Claude say, Hey, add this new LDAP feature to Apollo and it'll just build it, test it, deploy it, execute it, run it, and just go into a loop until it works.
Thomas: Nice.
Rob Antonucci: And then when it's done, it's like, here you go. Here's your PR.
Thomas: Man, I remember
Brandon Kovacs: It's amazing.
Rob Antonucci: Yeah
Thomas: I also remember when you got the ⁓ 'cause like of the stuff that you did for Apollo and then our, you know, you know, private agents incredible on the window side. I remember I loved like at the time I was trying to find like script payload like scripting language payloads like Medusa that would work in an environment because that to me has always been so easy it flies under the radar of a lot of EDRs. And when you got Medusa working too, because that's another thing that Rob was doing as part of this was just like kinda tweaking all the different payloads that were
Rob Antonucci: Yeah.
Thomas: bog standard in mythic, when you got that sox proxy working so well, I was like, ⁓ my god, I've fallen in love with this payload. Like I I have to just use the ⁓ there is Python, I will use Medusa and and Hera as well. Because it's just like, ⁓ come on, why not?
Rob Antonucci: Yeah. Thank Yeah. And the sock stuff, I spent probably more time on getting the socks like performing and working under our crazy red team conditions with like the NGX forwarder and all this other stuff we have to do in there. But yeah, that was not easy, it did pay off because it pretty much did it once for Apollo and it pretty much worked for all the rest of them. The same design.
Thomas: I know. Yeah. Yeah.
Brandon Kovacs: It's amazing how far this has matured. I mean, remember like what, a year ago or so you helped build a payload for me. I think it was like a loader a loader or whatever it was. And yeah, we were just like renaming like the variable names from like a to I think yours was like ⁓ let's do fruits, apples, bananas, vegetable, tomatoes. ⁓ And here we are fast forward, just a year later and now we have an entire pipeline.
Rob Antonucci: Yeah. Yeah, and pretty much, just finished our whole actual end end suite. So now we add a new task or whatever. We basically spin it up in the lab, run it through. It runs every single command, every single output option, all the things and comes back and reports like, task worked. Or yeah, this one feature broke this. So now we've got to fix it before we push it out to Prague. So that was our thing. We were basically fixing the airplane while we were flying it, which wasn't fun.
Thomas: So quite Question for you, so in doing this, there anything the different EDR solutions, cause we our lab, you know, we test against everything that we can. is there that you realize while doing this that like all of them are doing really well compared to like, you know, what our setup was before you implemented this? Like is there anything that like EDR jumped up at that was really kicking our butt specifically?
Rob Antonucci: Yeah, I would probably say, you know, anything that looks like malware, can detect it very easily. So don't look like, don't look or act like malware anymore. Don't inject into processes if you don't have to. There's not really a lot of processes that do that normally. That's going to be something that's very easy to detect. You know, don't try to dump LSAS, know, nothing does that anymore. It's a super, you know, highly watched thing now. just other ways of doing all these things now, instead of dumping the Kerberos tickets, that's a little bit quieter.
Thomas: Yeah. Yeah, true.
Rob Antonucci: I was trying to blend in, I would say EDR is getting good. So it's really hard. Yeah.
Thomas: Yeah. Yeah. Any any that are particularly I feel like I know which ones I feel like are particularly annoying, but any that you feel like are particularly like yeah.
Brandon Kovacs: Tad a mouse game.
Rob Antonucci: Oh, I think elastic is probably one of the best, even though I've never seen it on a real op before, but it consistently catches like everything.
Thomas: Same. Yeah. I was gonna say that like Sentinel One seemed like the one that like had the hardest like threshold to clear, but it seems like it might be elastic.
Rob Antonucci: So I would say it did until we got to actually hands on it and then we can actually play with it just like anything else. You can test against it, you can get around it.
Thomas: Yeah. man. It was it was projects in a row that I think, you know, we were working on together and it was like, how on earth are we getting like, we need to do s we need to retool here. ⁓
Rob Antonucci: Yeah. Yeah. And like, and we had like the exact attack pass. We just did not have a payload to actually execute that. was so frustrating.
Brandon Kovacs: Ha ha ha.
Thomas: Yeah. Yeah, I mean I think that's like probably another thing that like realistically like big businesses are just assuming now that, hey, I've got that EDR that does that thing super kick ass. There's no way around it. When it's like, you know, you've demonstrably proven like if you put your mind to it, you can still get around a lot of the EDR stuff and it's like Yeah.
Rob Antonucci: Yeah. And I will say it would definitely would not have been possible without AI. So I pretty much was operating at like, you know, we're running this payload. run this thing like fraud strike caught something. So let's fix it right now and fly while it's fresh and then test it again before we lose access to this client. You know, same thing in another environment. S1 caught it. All right, let's fix it now before we lose access. That would never be possible without AI.
Thomas: Yeah. Right. Yeah.
Brandon Kovacs: Yeah, it's really compressing attackers' ability or I I guess in our case, you know, our ability to emulate attackers.
Rob Antonucci: Yeah.
Thomas: Yeah, in our case specifically, I feel like a lot of people who work in like consulting, a focus on like jump from one project to the next, and the people who are doing that consulting work are maybe different from the people who are actually like working on the tools. And it's cool that we ⁓ our team we're we do both of those things. But you know, we had AI coding assistance, it was hard to actually spend all that time to really up things to the next level. Yeah.
Rob Antonucci: Yeah, impossible.
Brandon Kovacs: We need to get like a dedicated dev guy to just do our engineering, you know, twenty-four not twenty-four-seven, but nine to five, right? But now
Thomas: Yeah. Yeah. Yeah. All right.
Rob Antonucci: I mean, some shops have that, yeah, that's the thing. But again, it's a lot of money and it's hard to prove business value.
Brandon Kovacs: Yeah.
Thomas: Right. it's cool to be able to be ⁓ both of those teams merged into one now, especially where it's like, you know, ⁓ think pretty much everybody on the team does a little bit of deaf of some kind, which is a really awesome ⁓ to work in.
Rob Antonucci: I like in our industry, have to, you have to be able to do dev work. We can't use off the shelf tooling at all, ever.
Brandon Kovacs: That's one.
Thomas: Yes, yeah No
Brandon Kovacs: Yeah, we'll get we'll get burnt. But yeah, it it's good 'cause I I I feel like a lot of well and pretty much everyone in our team ha i we have Very ⁓ diverse backgrounds. I mean Rob, you're our payload specialty guy. We have ⁓ Lauron who couldn't make it today, he's our like a Windows expert. anything cloud and Azure, he's the go-to. ⁓ so yeah, we have like a very diverse pool of consultants on the team and everyone offers their unique perspective ⁓ and that, applying it to whatever dev work they're working on. But when you fuse everyone together, it creates a pretty, ⁓ pretty kick-ass team.
Rob Antonucci: I like our team. We some good guys and girls.
Thomas: It was it was funny, Rob it was funny, Rob, that you were mentioning the ⁓ man, like I could rewrite sliver, but I don't wanna do that and then later I'm like, ⁓ man, maybe AI can help me rewrite sliver it did it did a pretty decent job, ⁓ of but I think ⁓ I think still kinda the the mythic stuff that you've got going is the the gold standard for us at the moment. ⁓ yeah. Yes, yeah.
Brandon Kovacs: I like our team.
Rob Antonucci: Yeah. Yeah, I think that the 40 meg binaries were just too much. And it's like, have all of your, your payload, you know, all of your tooling in one binary, which I didn't love. I couldn't think of an easy way to like, you know, do that and go where you can actually load things dynamically. I feel like Sliver wasn't really made for like very specific, like stealthy red team. That's more of like a pen testing thing. You know, it's easy to set up and use, but to actually make it customizable and stuff. It's not, not so much.
Thomas: Yeah. Right. Yeah. Like you said with Apollo, like the the version of Silver that I think we have on our you know, public repository, very much feels like a learning tool. And I think it is a very great learning tool. Real EDRs, when they're looking at Sliver as it stands in the repository, of course they'll be able to catch it. So even when we have used it and even when we use the variant that, you know, I've been working on, it's gotta be completely different. Like it can't be anything like ⁓ way it looked, you know, even just three or four years ago.
Rob Antonucci: Yeah, exactly. And there's a lot of surface to cover in that giant binary to cover your tracks.
Thomas: Yeah.
Brandon Kovacs: Yeah, it's more than just c customizing the C two profile config.
Rob Antonucci: Yes. Yep. And people have tried it. There was definitely some like GitHub repositories where they gave like, you know, scripts to actually reset everything and change all like the protobuf. think it was the main one protobuf stuff.
Thomas: Yeah. ⁓ Yeah. Pro debuff gets s signatred pretty aggressively. Yeah. Claude, rewrite this in Rust, make no mistakes.
Brandon Kovacs: Yeah, yeah.
Rob Antonucci: Yeah. So yeah, make no mistakes.
Brandon Kovacs: Make no mistakes.
Thomas: I f I find when I tell it to make no mistakes it aggressively makes more mistakes and I feel like that's it's not working for me.
Rob Antonucci: Yeah.
Brandon Kovacs: That's hilarious.
Rob Antonucci: What else is going on? I don't know. What have we been doing? You guys been working on anything cool? Any projects?
Thomas: Well, I mean, did have that physical ⁓ ⁓ a result, I think, you know, ⁓ of the things that I've been curious about coming out of that was ⁓ basically like what w ⁓ we know about like Wygand, what I know, challenging my own assumptions about what I know, but then like what are the tools that we're using for scanning low frequency and high frequency badges? A lot of what I've encountered anecdotally has been ⁓ low frequency badges or like really weak eye class, which is high frequency badges. Not so often that you see SEOS, which is ⁓ a badge type where, you know, ⁓ correct me if I'm wrong about any of this, Brandon, but it's a badge type where it has high frequency that's encrypted, but the low frequency is very encrypted, basic standard low frequency badge data. But I'm kinda like been interrogating this, like, okay, like ⁓ what can do? What kind of tooling can we get so that we don't have as much friction ⁓ encountering a in the wild where we don't know what type it is, ⁓ and just the YGAND. data, why can't we just mathematically immediately determine what it's gonna be? and I I think that some of that stuff already exists out there, but ⁓ yeah, I mean we've we've got some tooling that I think we're we're we're working on. I don't know.
Brandon Kovacs: Yeah, there's definitely it's definitely challenging 'cause ⁓ I mean, A, there's identifying the type of credential the technology that's in use. That's obvious usually step one, right? Looking the bat you know, if we can get visual on the badge itself, find some sort of you know, the markings with the blue markings in the bottom left corner of hit hid, ⁓ it'll ⁓ suggest what type of credential type or in use, ⁓ it's SEOS and then there's additional markings that'll say if it's some sort of like dual frequency or dual class badge ⁓ hit SEOS and procs, SCOS and I class, SEO with class and procs or MyFair, there's Deathfire, there there's a few variants. And then, yeah, attacking the badge implementation itself, right? Sometimes with some clients, you'll have know the high frequency badge and the low frequency frequency side to it. ⁓ or at least the majority of the times, the low frequency credential material ⁓ is used to authenticate, especially in the context of like multi-built multi-tenant buildings. the LF material is used to get into like you know the front door of the building, ⁓ but lot of the client suites are protected by whatever's on the high. high frequency side of the cards. But yeah, it's definitely a challenge, right? Especially when you're going into a lot of physicals, you're going into a blind, right? It's very ⁓ it's it's a very black box approach. You know, sometimes on some on most occasions with physicals, we try to ask the client what type of badges you're using in advance, just because we have I mean, as you can see, I've like four pelican toolkits behind me of all sorts of crap. I try to save them money because once you go past the second check bag, it's like $200 a bag ⁓ $400 round trip. So I try to bring the things that we need for.
Rob Antonucci: Great work.
Brandon Kovacs: But then there's some occasions where they're like, no, bring everything, figure out yourself. so that's definitely challenging. But ⁓ yeah, attack
Thomas: Yeah. That that I I was just gonna say that I think was one of the hardest parts of the most recent physical that we were on is going with multiple panels, knowing that there's gonna be different types of badges, having like standard I class keyed into the high frequency reader, but then also getting, you know, not necessarily good reads off of things. You don't necessarily know when you're looking at a good read versus a bad read. And you know, I think we can we can write tools that will take the YGAN data and be able to use the parity to validate, hey, this is ⁓ this is a valid facility code.
Brandon Kovacs: Yeah.
Thomas: Because, you know, if we're out there for, you know, an hour or two and we've got a bunch of unclear data, I think, you know, being able to sort through that and ultimately, you know, I feel like we typically do end up with a valid badge just might take some time to determine which one is actually going to be valid. And I think speeding up that process would save us, you know, a an enormous amount of time. Yeah.
Brandon Kovacs: ⁓ yeah. ⁓ yeah, it wasn't till like I think the last day or the la second to last day we're like, ⁓ crap. That badge would have gotten us in the building had we tried at this door.
Rob Antonucci: Thank
Thomas: Yeah, n not to not to mention, a few a few card numbers over, we can get into every single door in the whole building. ⁓
Brandon Kovacs: Yeah, that was that wa y dude, you like you Yeah, so Rob, Thomas basically Thomas we should have bought lottery tickets right after what Thomas pulled off there. Like he played ⁓ RFID Like just spinning the wheel. ⁓
Rob Antonucci: No.
Thomas: Ha ha ha. Yeah, I I love I any time I get on a physical, anytime I get a badge into the flipper, I just will go to the most sensitive room that I can go to and brute force. Because, you know, you assume there's probably gonna be some sequential badge IDs. And you know, if I have to be there for too long then leave, right? But man, we got into this door in twenty twos ⁓ maybe like twelve seconds. Yeah, four abuse. It was it was very short ⁓ and we determined afterwards that that was, you know, a ⁓
Rob Antonucci: brute force it. Yeah.
Brandon Kovacs: Dude, it took four seconds. I heard four beeps. Beep, beep, beep, beep, bing.
Rob Antonucci: That's awesome.
Thomas: ⁓ a fire department ⁓ keyed badge. So it I think that I've b I've been caught one time doing brute forcing, ⁓ but it wasn't somebody who actually validated that I was a pen tester. They're like, huh, what's going on over here? and I
Rob Antonucci: So has that ever gotten you guys caught brute-forcing like that?
Brandon Kovacs: Chucking the doors.
Thomas: I think like usually it's pretty noisy inside a sock, so it's a last a last resort. But if you can go and do that and then leave with valid badge data without being stopped and then you have a valid badge that you can pass to somebody else, that's value. That's really high value because people won't really understand why did I get a bunch of like bad reads and then one good one. They're not gonna think, ⁓ that badge is now compromised necessarily. Because a lot of the people who are working in these socks, you know, they don't they're not from a technical background, right? Like they're not working with the technical teams. They have more of Physical security background and I think, huh, that's weird.
Brandon Kovacs: Usually s ⁓ find that those badge scans happen so quickly, or at least on the logs, like it's like a little sliver of their UI where the b ⁓ the log entries are appearing and it and if it's like a large if it's like a skyscraper in New York City, right? ⁓ these things are just flying past to where their their ability to actually detect no notice and detect it is slim to none. ⁓ Whereas if you're like out in the suburbs of middle middle America, ⁓ obviously, you know, you don't have as much volume per se. So you're ⁓ hi ⁓ than likely to get caught. ⁓
Thomas: Yeah. Yeah.
Brandon Kovacs: Yeah, we were with a very advanced client with a very in ⁓ a good security posture and they they busted us, which is it ⁓ it was definitely interesting. Yeah, we had ⁓
Thomas: Yeah. Yeah.
Brandon Kovacs: Our little decoy readers, right? I don't know if the camera can see this or not. So it looks like a yeah, it's the the blur or the focus on my camera. Yeah, it looks like a real reader, right? They're they look like real hit readers. This one says present badge here at the top. And yeah, they have magnets on the back, so you can just stick them on, you know, a ⁓ a piece of metal, you know, next to the real badge reader. And the idea is to essentially get the employees to put their badges up to it. And, you know, we try to entice them some way, shape, or form. You know, new reader, you know, s new reader, stand badge here, training it for whatever reason. in this case, ⁓ came down to ⁓ that like if you see something, say something, which I think was baked in Yeah, I think that w you know, that also had to do with like the region in which we did this physical. It's just baked into that culture there. If you see something, you say something. the guy said something and because of that, you know, the security started looking at footage and
Thomas: We had we had one guy. Yeah.
Brandon Kovacs: Notice me, and I got a ⁓ WhatsApp f ⁓ from the from the clients, Hey by the way, nice shirt. ⁓ here here's here our security team found you. It's like, ⁓ great, but they haven't found Thomas yet, so let's let's keep going.
Rob Antonucci: you
Thomas: They had they had a they had a good photo of Brandon. ⁓ and we were like, Okay, okay, maybe we're fine. next day we're going in, ⁓ they ha they have a photo of me too. ⁓ ⁓ they're like, By the way, there's gonna be undercover cops here and we're like, Okay, seems like this might be a good time for us to call things off. ⁓ yeah. We were to walk up on the property and then we're like, hey, they have a photo of you got you both and there's cops. ⁓ and we're like, All right
Rob Antonucci: Hahaha Whoops.
Brandon Kovacs: Go to the Soon Bridge. Literally we're driving there. Like right down the street.
Rob Antonucci: Hahaha
Thomas: But good good thing you guys texted us now. This seems like the right time for us to stop.
Brandon Kovacs: Yeah, it could've it could have gone s s it yeah, i that ⁓ that would have been a first ⁓ for us and the team. But ⁓ no i in the end it went really well. The client's very happy and as long as we you know, the client's happy that's what matters. Right? We we we're here to f you to emulate their greatest adversary and that's exactly what we try, that's exactly what we did.
Rob Antonucci: Hold off on handcuffs.
Thomas: Yeah.
Rob Antonucci: Yeah.
Thomas: That that plus me walking away from another ⁓ on-site without handcuffs ⁓ on on my wrists. That makes me happy as well. So far, so far, perfect record of not being arrested during an engagement, so
Brandon Kovacs: ⁓ but no, it was good.
Rob Antonucci: Yeah
Brandon Kovacs: Yep. And we're gonna keep it that way, of course ⁓ Yeah, we're gonna keep it that way. But
Thomas: We're gonna keep it that way.
Brandon Kovacs: Yeah, definitely some lessons learned, right? Especially now, you know, looking at how we can improve our badge capture technology, the tooling around that. now, you know, we obviously have these ⁓ RP40 readers. ⁓ gonna start I've already gone ahead and started sourcing additional readers off of eBay. They're like twenty dollars each, where we're then gonna, you know, stick our hardware implants behind it. That will give us the ability to emulate all sorts of readers and capture that WagN data. And yeah, at the end of the day, you know.
Rob Antonucci: Ahem.
Brandon Kovacs: your SEOS badges or your deskfire badges, whatever. But if you're not implementing this technology correctly behind the scenes, like for example, you could have great badge technology that encrypts the communications between your badges and the readers. But if there's nothing protecting the the line of communications between the the readers and your access control panel themselves, what's stopping an an an attacker from taking a Phillips screw head screwdriver, ⁓ the thing off the wall, inserting a man in the middle, intercept behind you on the cables right behind to Intercept that YGAN data, which is unencrypted, and then just pulling creds that way, right? How'd that go?
Rob Antonucci: And that's what we did on my last physical. It went really good. mean, we basically used the ESP key. So we found out that they weren't even using cards. They were all using their mobile devices to batch them. So we couldn't even skim them or anything. So we had to fall back to that basically. But the client was very, very impressed. And we walked over and just like pressed a button on the phone and the door just opened.
Thomas: I'm I'm pretty confident. Nice.
Brandon Kovacs: Yeah.
Thomas: Mm.
Brandon Kovacs: ⁓ transmit. ⁓
Thomas: Nice. D were you able to to clone to badges in that case or was it just not necessary? Okay. Nice. And they took the readers would take low frequency as well, huh? See, this is the thing, like, that's the thing that I feel now very confident telling basically anybody who is
Rob Antonucci: Yeah, we collected like 60 or 70 actual badges. So we pretty much had all the good ones. Yeah, I think so.
Thomas: Manning a physical security program is if you've got if you paid all the money for these dual-class cards, ditch the low frequency at the very least for sensitive rooms. Right? Like if you got like a data center and you've got low frequency accepted all around the campus, at least in the data center, upgrade that reader to only support high frequency. Because you don't want people just cloning a badge from Wigan data they pull off with an ESP key.
Brandon Kovacs: Use them.
Rob Antonucci: Yeah.
Brandon Kovacs: And also roll over to OSDP just to mitigate the use of a of an ESP key to begin with, because then that'll encrypt the cons between the readers and the panels themselves so that way an ESP key is no longer effective. But yeah, definitely a lot of lessons learned.
Thomas: Yeah. And then of course hire us to make sure that we, you know, we ⁓ that you did it, right? Because Yeah.
Brandon Kovacs: Yes. Just just don't send the p send eight police cars looking for us. yeah, I I I on this last one I forgot to put it on my hand. You know, I have a little microchip in my left hand. I caught the I caught the open sesame trick, just walking up, just like waving the hand. ⁓ I I did an assessment Alith back in October.
Rob Antonucci: Thank
Thomas: ⁓ yeah.
Brandon Kovacs: And yeah, we did our walkthrough. I like, hold on, let's see if this works at the data center. Wave my hand, the door clicks open and everyone's like, Huh? That's crazy. Only four people have access to this. And the guy like calls downstairs. I'm like, here, call downstairs to your security desk. See whose badge that was. So the guy like he he calls and he goes, Hey, whose badge was that? And I guess the guy the
Rob Antonucci: Thank
Thomas: I mean
Brandon Kovacs: person downstairs like it was yours, sir. I di is a I didn't realize, but I guess like I got this guy's badge on like the first day, ⁓ twice. Like once in the morning, one in the afternoon. And I obviously decided to use that 'cause I've never caught the same one twice. And it just happened to be someone one of one of the four people that had had access to that room, which yeah.
Rob Antonucci: That's awesome.
Thomas: I mean, like, we're we're all physical enjoyers or at least physical doers here. Like, is there more of a rush than the tactile experience of opening a door without even touching it with credentials that you harvested somewhere, right? Like that feeling of just walking up to a door, no contact, and the door unlocks, just it feels so powerful. It's very fun.
Rob Antonucci: Yeah, it's
Brandon Kovacs: I just think there's no greater high than just like walking into a place where you do not belong. Especially when we're like blending in, like, you know, we just we buy their t-shirts online or source someone from eBay or in this case we went to old navy, bought the shirts, got the emblem, went to some like embroidery hat embroidery place in at the mall and just made our own.
Thomas: Ha ha ha.
Rob Antonucci: Yeah.
Thomas: See, I think I have to I have to maintain my internal flight or flight response, fight or flight response whenever I'm in that scenario. Otherwise I'd be bad at ⁓ into places, you know what I mean? ⁓ have to be afraid. Yeah. I have to operate with a little bit of fear. ⁓ look at me, I'm normal. ⁓
Rob Antonucci: Yeah.
Brandon Kovacs: You gotta do cold plunges.
Rob Antonucci: Just walking around sweating, just like, is there been staring at me?
Brandon Kovacs: Ha ha ha. Yeah y that that's my secret trick, ⁓ for the record. Cold plunges. It just like helps you regulate that adrenaline rush so when you are put in that position, it's just like Yeah, like the guy said he goes, I don't know how you did it, you just walked around so comfortably. I'm like, Yeah, just like another day at the office. I don't know.
Rob Antonucci: Yeah.
Thomas: He really did ⁓ the compliment that we got, I think, was being called professional criminals. ⁓ which, you know, I think I like to think of us as professional criminals in in a sense.
Brandon Kovacs: Yes. It's like when someone says, ⁓ you guys are hackers like no, we are cybersecurity professionals.
Thomas: Exactly.
Brandon Kovacs: So, all right. Well, I guess this is the end ⁓ this month's ⁓ Team Podcast. we look forward to speaking with all you guys and hearing all the latest and greatest of whatever it is you know we're working on here at Bishop Fox next month. My name's Brandon, ⁓ joined Rob and Thomas, and we speak to you next month.
Rob Antonucci: Thanks guys. Later.
Thomas: See ya.
Brandon Kovacs: Bye everyone.
