Lina recently posted on LinkedIn that she’d published another blog post. Her blog posts are always well written, easy to follow, fascinating, and very informative, and this one did not disappoint.
In short, Lina says that she found a bunch of Chinese blog posts and content describing activity that Chinese cybersecurity entities have attributed to what they refer to as “APT-C-40”, or the NSA. So, she read through them, translated them, and mapped out a profile of the NSA by overlaying the various write-ups.
Lina’s write-up has a lot of great technical information, and like the other stuff she’s written, is an enthralling read. Over the years, I’ve mused with others I’ve worked with as to whether or not our adversaries had dossiers on us, or other teams, be they blue or red. As it turns out, thanks to Lina, we now know what they do, what those dossiers might look like, and the advantage that the eastern countries have over the west.
For me, the best part of the article was Lina’s take-aways. It’s been about 30 yrs since I touched a Solaris system, so while I found a lot of what Lina mentioned in the article interesting (like how the Chinese companies knew that APT-C-40 were using American English keyboards…), I really found the most value in the lessons that she learned from her review and translation of open Chinese reporting. Going forward, I’ll focus on the two big (for me) take-aways:
There is a clear and structured collaboration…
Yeah…about that.
A lot of this has to do with the business models used for DFIR and CTI teams. More than a few of the DFIR consulting teams I’ve been a part of, or ancillary to, have been based on a utilization model, even the ones that said they weren’t. A customer call comes in, and the scoping call results in an engagement of a specific length; say, 24 or 48 hrs, or something like that. The analyst has to collect information, “do” analysis and write a report, eating any time that goes over the scoped time frame, or taking shortcuts in analysis and reporting to meet the timeline. As such, there’s little in the way of cross-team collaboration, because, after all, who’s going to pay for that time?
In 2016, I wrote a blog post about the Samas (or SamSam) ransomware activity we’d seen to that point. This was based on correlation of data across half a dozen engagements, each worked by a different analyst. The individual analysts did not engage with each other; rather, they simply proceeded through the analysis and reporting of their engagement, and were then assigned to other engagements.
Shortly after that blog post was published, Kevin Strickland published his analysis of another aspect of the attacks; specifically, the evolution of the ransomware itself.
Two years later, additional information was published about the threat group itself, some of which had been included in the original blog post.
The point is that many DFIR teams do not have a business model that facilitates communications across engagements, and as such, analysts aren’t well practiced at large scale communications. Some teams are better at this than others, but that has a lot to do with the business model and culture of the team itself.
Overall, there really isn’t a great deal of collaboration within teams and organizations, largely because everyone is silo’d off by business models; the SOC has a remit that doesn’t necessarily align with DFIR, and vice versa; the CTI team doesn’t have much depth in DFIR skill sets, and what the CTI team publishes isn’t entirely useful on a per-engagement basis to the DFIR team. I’ve worked with CTI analysts who are very, very good at what they do, like Allison Wikoff (re: Mia Ash), but there was very little overlap between the CTI and IR teams within those organizations.
Now, I’m sure that there’s a lot of folks reading this right now who’re thinking, “hey, hold on…I/we collaborate…”, and that may very well be the case. What I’m sharing is my own experience over the passed 25 yrs, working in DFIR as a consultant, in FTE roles, running and working with SOCs, working in companies with CTI teams, etc.
This is an advantage that the east has over the west; collaboration. As Lina mentioned, a lot of the collaboration in the west is through closed, invite-only groups, so a lot of what is found isn’t necessarily shared widely. As a result, those that are not part of those groups don’t have access to information or intel that might validate their own findings, or fill in some gaps. Further, those who aren’t in these groups have information that would fill in gaps for those who are, but that information can’t be shared, nor developed.
…Western methodologies typically focus on constructing a super timeline…
My name is Harlan, and I’m a timeliner. Not “super timelines”…while I’m a huge fan of Kristinn (heck, I bought the guy a lollipop with a scorpion inside once), I’m a bit reticent to had over control of my timeline development to log2timeline/plaso. This is due, in part, to knowing where the gaps are, what artifacts the tool parses, and which ones it doesn’t. Plaso and it’s predecessor are great tools, but they don’t get everything, particularly not everything I need for my investigations, based on my analysis goals.
Okay, getting back on point…I see what Lina’s saying, or perhaps it’s more accurate to say, yes, I’m familiar with what she describes. In several instances, I’ve done a good bit of adversary profiling myself, without the benefit of “large scale data analysis using AI” because, well, AI wasn’t available, and I started out my investigation looking for those things. In one instance, I could see pretty clearly not just the hours of operation of the adversary, but we’d clearly identified two different actors within the group going through shift changes on a regular basis. On the days where there was activity on one of the nexus endpoints, we’d see an actor log in, open a command prompt/cmd.exe, and then interact with the Event Logs (not clearing them). Then, about 8 hrs later (give or take), that actor would log out, and another actor would log in and go directly to PowerShell.
Adversary profiling, going beyond IOCs and TTPs to look at hours of operation/operational tempo, situational awareness, etc., is not something that most DFIR teams are tasked or equipped for, and deriving that sort of insight from intrusion data is not something either DFIR or CTI teams are necessarily equipped/staffed for. This doesn’t mean that it doesn’t happen, just that it’s not something that we, in the West, see in reporting on a regular basis. We simply don’t have a culture of collaboration, neither within nor across organizations. Rather, if detailed information is available, many times it’s thought to be held close to the vest, as part of a competitive advantage. In my experience, it’s less about competitive advantage, and more often the case that, while the data is available, it’s not developed into intel, nor insights.
Conclusion
I really have to applaud Lina for not only taking the time to, as she put it, dive head-first into this rabbit hole, and for putting forth the effort and having the courage to publish her findings. In his book Call Sign Chaos, Gen. Mattis referred to the absolute need to be well-read, and that applies not just to warfighters, but across disciplines, as well. However, in order for that to be something that we can truly take advantage of, we need writing like Lina’s to educate and inspire us.
Source: Read MoreÂ
