Andrew Brandt

### Overview In this presentation, malware researcher Andrew Brandt discusses the surprisingly simple, flawed, and "stupid" techniques attackers frequently use to compromise systems, as well as the operational oversights made by defenders and public systems. While advanced persistent threats often dominate headlines, the vast majority of day-to-day cybercrime relies on crude social engineering, basic delivery mechanisms, and careless operational mistakes. Despite their lack of sophistication, these attacks remain extraordinarily successful against regular users and administrators alike.

### Key Topics - **Real-World Operational Security Lapses**: Brandt shares public encounters with misconfigured display systems—such as airport status monitors in Denver exposing taskbars, installed applications, driver installations, and VNC services, or an IKEA point-of-sale terminal revealing network information and internal OS details. - **Malicious Spam (Malspam) Tactics**: Attackers frequently rely on emotional triggers (e.g., fake speeding tickets, police alerts about fugitives, or free pizza coupons from brands like Pizza Hut) to provoke immediate clicks. Delivery techniques have shifted from raw executable files packed in ZIP archives to weaponized Office documents carrying malicious macros. - **Obfuscation and Evasion Tricks**: Attackers use double extensions (e.g., embedding ".pdf" into an executable name), process hooking into native processes like `svchost.exe`, arbitrary or non-existent User-Agent strings (such as "Windows NT 9.0"), word-salad domain and certificate generation, and embedding Base64-encoded files inside HTML. - **C2 Communication and Exfiltration**: Malware variants like Dyre (Dyreza) use public STUN servers to bypass NAT and map internal networks, alongside regular SSL rotation on non-standard ports (e.g., port 4443). Other actors leverage public services for IP lookup, outbound SMTP for password exfiltration, or even Microsoft SQL Server instances (port 1433) for both command exfiltration and payload delivery.

### Technical Details & Demonstrations - **Dyre and STUN Profiling**: Brandt details how Dyre pioneered the abuse of voice-over-IP STUN protocols to determine external IP addresses and profile NAT configurations (e.g., identifying symmetric NATs), subsequently funneling stolen data over SSL with certificates rotating every five minutes. - **Multi-Stage Infection Chains**: Brandt illustrates complex infection paths using real examples: a weaponized document dropping the Pony downloader, which retrieves CryptoWall ransomware, followed by a proxy Trojan routing spam-sending commands back and forth to Russia via webmail platforms. - **Live Document Detonation**: In a live demonstration running on a 64-bit Windows 7 VM, Brandt executes a targeted malicious Word document. With Office macro protections disabled, the macro runs and drops the Pony downloader executable (named with nonsensical words), demonstrating how easily code executes when security alerts are dismissed. - **Analysis Tools**: The speaker highlights specific tools used in the research lab: Security Analytics (for full-packet capture and metadata search), SSL Visibility appliances (for man-in-the-middle SSL decryption via installed root CA certificates), Malware Analysis Appliance (MAA) sandboxes, and Sysinternals Process Explorer.

### Takeaways & Defensive Guidance - **Distrust by Default and Visual Hygiene**: Administrators should configure Group Policy to turn off the "Hide extensions for known file types" setting in Windows so double extensions are readily spotted. - **Egress Filtering and Anomaly Detection**: Enforce strict outbound firewall rules. Organizations should block unnecessary outbound database traffic (port 1433), restrict STUN traffic to authorized VoIP hardware, monitor outbound SMTP from non-mail servers, and watch for anomalies such as IRC traffic from Linux web servers. - **Enforce Macro and Identity Protections**: Macro execution in Microsoft Office documents should remain disabled by default. For credential theft prevention, multi-factor authentication (2FA) is vital. - **Backup Hygiene Against Ransomware**: Brandt stresses that ransomware threats can be largely neutralized by maintaining regular, disconnected backups on external physical storage rather than relying on perpetually connected mapped network shares.