China state-sponsored cyber actor living off the land to evade detection [pdf] | Hacker News Reader

China state-sponsored cyber actor living off the land to evade detection [pdf]

media.defense.gov

107 pointsmmwelt50 comments

For the Linux variant of LOLBINs, see GTFOBINS https://gtfobins.github.io/

"Living off the land" in the context of this document means using readily available command line tools and utilities on infected devices?

Kind of disappointing. I was hoping for a story about Chinese cells homesteading in Middle America to avoid detection between their cyber exploits.

Same. I felt clickbaited.

They're mostly in big cities like Vancouver and NYC. And more concerned with intimidating foreign nationals.

Given the recent news about Chinese hacks of Guam, I was thinking sailboat live aboard spies.

Yes, see for example [1].

[1] https://github.com/LOLBAS-Project/LOLBAS

Thanks, that makes more sense. Reading the document as an outsider was confusing :p

For a minute, I was worried there were some crazy nationalistic Chinese dudes living in the woods behind my house.

There might be.

This exactly what I thought as well. Glad I am not the only one.

No, they’re at your local research university.

On Linux servers I always uninstall the compiler and dev tools. I actually wrote a little script to dry-run uninstall every single package on the server one by one, and if uninstalling it doesn't remove anything important I'll go ahead an uninstall it.

I'm left with only a bare minimum of stuff, even things like man pages or simple utils I'll uninstall.

If the intruder as gotten far enough to be in a position to run a compiler, he'll just upload it if it isn't there.

Maybe, maybe not. Compilers are quite large, especially once you include dev versions of system libraries.

if you're uploading a compiler you could just upload a binary. unless it's a very specific system you can probably just put it together "at home" and slap it in there.

I think you entirely missed my point. Because there is no compiler they have to upload something.

With a compiler they can compile something locally which is easier to do.

summary pgh 3 [One of the actor’s primary tactics, techniques, and procedures (TTPs) is living off the land, which uses built-in network administration tools to perform their objectives. This TTP allows the actor to evade detection by blending in with normal Windows system and network activities, avoid endpoint detection and response (EDR) products that would alert on the introduction of third-party applications to the host, and limit the amount of activity that is captured in default logging configurations. Some of the built-in tools this actor uses are: wmic , ntdsutil , netsh , and PowerShell .]

ntdsutil does not ship with windows by default

yeah it seems to be a very hot term in cyber security atm.

Here I thought this was about human spies on US soil avoiding leaving a digital trace of their real identities…

Maybe it should be called living on the sand (silicon) instead

Oh wow, so living off the land is the same as "hands-on-keyboard" activity now? They used impacket ffs! This is a very typical post-compromise playbook many actors use. A lot of this might even be considered bad opsec.

This is why it is said that APTs are usually not very sophisticated, they just have a lot of resources.

Yeah, this seems like a classic case of "random mundane thing" + "namedrop China" = "srs bsns" + someone getting promoted

Are LOLBINs still an issue for most companies? I was under the impression that most endpoint detection products simply trace all syscalls, and therefore can somewhat accurately extract information about exploitation events without relying on a "foreign" file artifact.

LOLBINs are very much an issue at pretty much every company there is, just because there's a way to detect them doesn't mean they're actually detected, or that an alert is made, or that the alert is triaged correctly, or that EDR is even turned on, etc

it's a needle in the haystack issue. plus most EDR products do not actually alert on benign looking syscalls as it'll quickly cause an false positive overload

I would be very surprised if EDR products didn't use some form of anomaly detection (e.g. autoencoders[1], ANN embeddings etc.)

I've gotten into trouble with employers over editing system configuration files and trying to start reverse shells, and I can't imagine execve() or connect()+dup2() are malicious either.

[1] https://www.evilsocket.net/2022/08/15/Process-behaviour-anom...

Some are working on it (SentinelOne is a notable player with the capacity), but ML domain experience in the Cybersecurity space is severely lacking as a lot of Cybersecurity PMs and Founders are ex-Networking types who view ML/AI as marketing hype.

Source: am a PM in the space who has been banging heads with these types of people

They might and some definitely do, but at large enough scale maintaining a good anomaly detection signal to noise ratio becomes very difficult.

A single ubuntu terminal spawn will generate something like 20 system calls. Now multiply that with however many actions you take during 8 hours of using a computer with your generic corp of over 10k hosts.

They do, it just doesn't work very well.

Every SOC should have simple usecases for these basic lolbins. Such an attack usually lights up the SIEM/SOAR like an xmas tree.

> Are LOLBINs still an issue for most companies?

Depends. The TS/SCI enclave at Raytheon R&D is probably locked down. However, most of the (sub)contracting work is done by small-medium business America and they've never even heard of lolbins.

lolbin is the trash can for all these meaningless technoblab alerts that you laugh at right?

This is not about CCP spies setting up a tent in the wilderness and using public wifi to launch hacks, this is about "living off the land" meaning using existing system admin tools to hack systems. Although the other explanation would be more cyberpunk.

I believe even an expert security researcher would have a hard time using windows as a personal machine without getting hacked. There are so many attack vectors and the security updates+guidance from Microsoft is completely lacking.

Most serious security researchers use an airgapped laptop with a wireless card pulled or otherwise disabled. There's far fewer ways to compromise a laptop where the only comms are on a USB stick physically transported between two computers, though it's not necessarily impossible.

Irony; NSA, CISA, and DOJ release cybersecurity bulletin as a pdf attachment

If you're concerned about LOLBINs then you're the kind of person they want to get to open a random pdf...

No mention of Unix, MacOSX, or Linux.

Is there an un-equal hardening of such tools or is it more of the popularity of MS Windows in the marketplace?

I heard that IoT devices can be (and were) exploited in the same way and used in DDoS attacks. Fascinating work on both sides for $laymen.

> Is China doing the same kind of spying on CIA agents?

> If so, then it's nothing new

Is this really warrants getting flagged? care to explain?

Not a single mention of Linux. Hope the windows community comes together and finds ways to harden these exploits

There are mentions of Linux right at the beginning:

>The actor has leveraged compromised small office/home office (SOHO) network devices as intermediate infrastructure to obscure their activity by having much of the command and control (C2) traffic emanate from local ISPs in the geographic area of the victim.

None of those devices are running Windows.

All of the recommendations I saw were based on windows

the cynic in me thinks the bad linux activity is there, but the targets do not have any kind of linux monitoring in place to spot activity

If you're just running a random linux server that isn't an otherwise "interesting" target the only times I've seen those get compromised is by some ludicrously dumb configuration mistakes, such as running databases with a default admin password and no firewall, etc.

It's a less interesting target for a lot of widespread attacks. Consider the surface area of Linux machines vs Windows? Most big corporations run on windows, even if devs rock Linux, that's not usually what these types of attacks are after.

That said you are right. Most Linux users ride on insecure machines. I remember talking to someone who had no idea they had to set up a firewall. They had switched from Linux 2 years prior under the guise that it was more secure than windows out of the box. I wish Linux security was talked about more. The people who know how to do it assume everyone does, and the people who don't... don't know what they don't know.

Run a SSH honeypot. You can capture plenty of Linux malware.

Yeah lots of really, really low quality malware

Oh for sure. Just saying in this specific bulletin there's no mention of Linux or macos targets.

Reply on news.ycombinator.com