Researchers use ‘fingerprints’ to track Windows exploit developers

guest · Oct 2, 2020

Researchers use ‘fingerprints’ to track Windows exploit developers
October 2, 2020
https://www.bleepingcomputer.com/ne...erprints-to-track-windows-exploit-developers/

Researchers can now find the developer of a specific Windows exploit using a new "fingerprinting" technique specifically devised to keep track of exploit developers' activity.

More to the point, Check Point security researchers Itay Cohen and Eyal Itkin were able to track 16 Windows Kernel Local Privilege Escalation (LPE) exploits to two different exploit developers known as Volodya (or BuggiCorp) and PlayBit (or luxor2008).
15 of the exploits Check Point successfully matched to a known exploit dev were created between 2015 and 2019, potentially making up a notable share of the overall Windows LPE exploitation market at the time.
Click to expand...

"Assuming that exploit authors work independently, and only distribute their code/binary module to the malware authors, we decided to focus on them for a change," Check Point says in a report shared earlier this week with BleepingComputer.

"By analyzing the exploits embedded in malware samples, we can learn more about the exploit authors, hopefully distinguishing between them by studying their coding habits and other fingerprints left as clues on their identity, when distributing their products to their malware writing counterparts."
By matching samples to the vulnerabilities they exploited, the researchers were able to track the author of 10 different 0-day and 1-day Windows LPE exploits, later exposed by public reports [1, 2] as Volodya, an exploit developer known for selling 0-days to cybercrime and Russian APT groups.

"The list of Volodya’s clients is diverse and includes banker trojan authors such as Ursnif, ransomware authors such as GandCrab, Cerber and Magniber, and APT groups such as Turla, APT28 and Buhtrap (which started from cyber-crime and later shifted to cyber-espionage)," the reports reads.
Click to expand...

By pinpointing an exploit's author using a technique similar to that used when tracking APT groups and malware devs, researchers can also:

Detect the presence of exploits written by these exploit developers in specific malware families.

Detect additional exploits written by the same developer, as they share a common “fingerprint”. Potentially, detecting 0-days written by these developers.

Block all malware families that bought a given exploit from a developer that is studied and fingerprinted.

"This research provides rare insight into how the 'black exploit market' works," Check Point malware researcher Itay Cohen said.
Click to expand...

Check Point: Graphology of an Exploit – Fingerprinting exploit authors to help with hunting zero-day exploits in the wild
Check Point Research: Graphology of an Exploit – Hunting for exploits by looking for the author’s fingerprints

During this research, we focused on the exploits that are used by or embedded in different malware families, both in APT attacks and in commodity malware (especially ransomware). Although they are widespread, we often found detailed malware reports that neglected to mention that the malware at hand also uses an exploit for escalating its privilege.

The fact that we were able to use our technique, repeatedly, to track 16 Windows LPE exploits, written and sold by two different actors, was very surprising.
Click to expand...

Nation-state actors are less likely to get caught and thus the infosec community does not have clear visibility to their ammo crate. That said, we can still get insights by looking at the exploits that were caught, while remembering this survivorship bias.
Click to expand...

Log in or Sign up

Researchers use ‘fingerprints’ to track Windows exploit developers

guest Guest

Log in or Sign up

Researchers use ‘fingerprints’ to track Windows exploit developers

guest Guest

Useful Searches