Hiroshi Takeuchi: Beyond Attack Surface Management (ASM) | CONFidence

### Overview In this presentation at CONFidence, Hiroshi Takeuchi, a security researcher at Macnica, analyzes how cyber espionage threat actors exploit various attack surfaces beyond traditional perimeter boundaries. While internet-facing edge devices account for roughly 50% of observed cyber espionage attack surfaces, adversaries continue to leverage vectors such as email, USB drives, and physical Wi-Fi access points. Takeuchi examines detailed threat campaigns across each vector, shares findings from external attack surface management (EASM) assessments of major enterprises, analyzes zero-day edge exploitations, and outlines architectural and detection counter-measures.

### Key Topics - **Email Vector (MirrorFace / APT10):** Examination of MirrorFace (also tracked as Earth Krahang / Asnarök), an actor targeting Japanese, Taiwanese, and Indian entities. The group relies on spear-phishing emails delivering the RoarInfo backdoor, a tool maintained for over four years across more than 20 versions that features file manipulation, screenshotting, and an unexecuted AES-256/RSA-2048 ransomware command. - **USB Vector (TA410 and Mustang Panda):** Case studies illustrating USB tradecraft. TA410 subgroup FlowingFrog delivered FlowCloud via USB (dubbed Operation USB Flowing) using multi-stage loaders, alternate data streams, and an expired 2014 rootkit installed by rolling back system time to 2013. Mustang Panda propagated a PlugX variant (PlugDisk) via USBs that hides files in hidden directories, auto-infects newly connected removable media, and infects environments through opportunistic vectors such as print shops and hotels. - **Wi-Fi Access Point Exploitation (Tropic Trooper):** Discussion of physical-proximity intrusions, including Tropic Trooper deploying rogue access points mimicking legitimate SSIDs to steal wireless credentials and deploy Cobalt Strike on an unmanaged host. - **Internet-Facing Edge Devices & EASM:** Statistical findings from EASM research assessing randomly selected Tokyo Stock Exchange Prime-listed enterprises, showing that 40% of headquarters (and up to ~90% when including overseas branches) exposed severe risks such as end-of-support software and exposed RDP ports.

### Technical Details - **Fortinet FortiOS Exploitation:** Investigation of an intrusion likely tied to Volt Typhoon leveraging CVE-2023-27997 (XORtigate), a heap-based buffer overflow in `sslvpnd`. The actor bypassed client certificate authentication, uploaded webshells, and moved internally via RDP without deploying malware. SSL VPN certificate success logs were absent, and `sslvpnd` crash logs provided evidence of exploitation. - **Ivanti Connect Secure Zero-Day Implants:** Analysis of compromised appliances involving WireFire, ZipLine, Sliver C2, and DS-Backdoor. Takeuchi highlights an implant named **ProstDoor** (`libnrs.so.1`), a passive back door that hooks `accept` and `accept4` in the `web` process by hijacking `libnspr4.so`. ProstDoor validates incoming C2 commands via 4-byte XOR checks, decrypts traffic using RC4, and supports arbitrary command execution and library loading.

### Takeaways - **Account for Physical Attack Surfaces:** Physical-adjacent vectors like USB auto-infection and rogue Wi-Fi access points remain effective tools for espionage groups and require explicit security controls. - **Proactive EASM:** Organizations must find and prioritize exposed assets (via commercial products, managed services, or internal tooling) before threat actors identify them. - **Defense Against Zero-Days:** Organizations should isolate edge appliances (sandwiching edge devices between dual firewalls to restrict inbound/outbound traffic), centralize and retain appliance logs (including process crash logs such as `sslvpnd`), implement internal microsegmentation, enforce multi-factor authentication, and deploy EDR broadly.