#HITBGSEC 2017 KEYNOTE D2 - The State Of Cyber

## Overview

This HITB 2017 keynote examines how sophisticated attack techniques pioneered by nation-states are rapidly commoditizing and trickling down to cybercriminal groups, making advanced attacks accessible to actors with minimal resources. Drawing on CrowdStrike's telemetry from 60 billion daily events across 176 countries, the speaker illustrates an emerging convergence where the lines between state-sponsored and e-crime operations blur, with criminal groups now operating as formal organizations complete with help desks and HR departments.

## Attack Landscape Evolution

The threat landscape has evolved from basic network exploration to intellectual property theft (exemplified by design theft for military equipment), election interference and data manipulation, and weaponization of breached information. The speaker discusses CrowdStrike's 2016 DNC breach investigation, identifying Russian actors involved in both theft and influence operations that combined data leaks with disinformation campaigns. Nation-states like North Korea have increasingly turned to cybercrime and wire fraud as revenue streams, while data breaches are now weaponized for extortion, public embarrassment, stock manipulation, and political influence.

## The Trickle-Down Effect and Commoditization

A central thesis is that previously expensive, state-level attack capabilities are becoming commoditized. The Shadow Brokers' leak of NSA exploits—particularly EternalBlue—exemplifies this; once-classified tools are now freely available and rapidly integrated into e-crime operations. Underground markets now offer ransomware-as-a-service kits (listing products like Dragon, Bricker, Jigsaw), delivery Trojans, exploit kits, and bulletproof hosting for hundreds of dollars monthly. This economic accessibility has eliminated the skill barrier; sophisticated campaigns incorporating EternalBlue and PowerShell techniques are now accessible to minimally-trained operators.

## Malware-Free and Living-Off-The-Land Tactics

A critical observation is industry overemphasis on malware signatures. Adversaries increasingly avoid creating detectable malware, instead exploiting legitimate Windows tools. Sandbox proliferation drove this shift; attackers now abuse built-in utilities like PowerShell, Windows utilities from the Microsoft Resource Kit, and administrator tools—techniques documented in "Hacking Exposed" (1999) but remain highly effective when properly chained.

## Technical Attack Vectors

**Link File Exploitation:** Windows .lnk files are created with base64-encoded PowerShell payloads appended to the binary, disguised with Word icons. Clicking executes the embedded code as a dropper, bypassing file-based detection.

**UAC Bypass:** Base64-encoded PowerShell impersonates explorer.exe (a whitelisted process), using UAC bypass techniques to gain administrative privileges without user prompts or authentication.

**OneDrive Persistence:** In a real incident, adversaries embedded PowerShell in VB startup scripts that dumped credentials via mimikatz, encrypted them over SSL using OneDrive with burner accounts, and exfiltrated them. Despite password resets, the backdoor persisted in startup scripts, evading login-based detection.

**BITS Service Abuse:** Word macros abuse Microsoft's Background Intelligent Transfer Service (legitimately whitelisted for Windows updates) to download and execute arbitrary payloads, bypassing firewall restrictions.

**Chopper Web Shell:** A 72-byte ASP file provides full code execution, file operations, and command access on web servers. It generates no malware signatures yet enables complete system compromise.

**Sticky Keys Backdoor:** Registry modifications redirect the Windows accessibility sticky keys feature (Shift pressed 5 times) to launch cmd.exe with system privileges, creating a pre-login backdoor requiring no credentials.

## E-Crime Market and Ransomware Trends

Criminal organizations operate as legitimate businesses with hierarchies, help desks, and multilingual victim support including Bitcoin purchase tutorials and payment facilitation. Ransomware-as-a-service pricing and market dynamics are fluid and accessible. WannaCry and NotPetya exemplify how leaked state exploits enable mass campaigns. The speaker discusses CrowdStrike's technical achievement in partially decrypting NotPetya's master file table using Salsa20 cryptography analysis and known plaintext attacks.

## Defensive Strategies

**Graph-Based Detection:** Rather than signature-based detection, mapping discrete events (file execution, enumeration, backup deletion, encryption calls) into graph databases enables behavior-based detection independent of malware variants. Attack sequences remain consistent even when payloads change.

**Artificial Intelligence and Machine Learning:** Drawing analogy to AI reconstructing a Rembrandt painting by extracting features from known works, ML can classify good/bad behavior by analyzing multidimensional feature spaces in both supervised (known malware) and unsupervised (anomaly detection) modes.

## Key Takeaways

Three pillars support modern defense: (1) cloud-based threat intelligence processing massive telemetry to understand adversary tactics, techniques, and procedures (TTPs); (2) threat intelligence sharing to distinguish targeted attacks from commodity malware, fundamentally affecting response scope; (3) dedicated threat hunting teams proactively searching for adversaries already on networks to prevent breaches from becoming catastrophes. The core message: defenders must shift from malware-focused approaches to behavioral analysis, leverage cloud scale, and adopt AI-driven prediction to counter an increasingly commoditized yet sophisticated threat ecosystem.