{"id":3388,"date":"2015-11-09T18:04:18","date_gmt":"2015-11-09T18:04:18","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=3388"},"modified":"2015-11-09T18:07:38","modified_gmt":"2015-11-09T18:07:38","slug":"why-puapup-are-bad-for-you-a-k-a-the-evil-of-environment-fingerprinting","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2015\/11\/09\/why-puapup-are-bad-for-you-a-k-a-the-evil-of-environment-fingerprinting\/","title":{"rendered":"Why PUA\/PUP are bad for you a.k.a. the evil of environment fingerprinting"},"content":{"rendered":"

In my post about sample targeting EDR<\/a> I mentioned that the sample is a PUA\/PUP. Looking at the code of many PUA\/PUP\/adware samples created in last few years it’s easy to see how far they go nowadays in fingerprinting the environments.<\/p>\n

This is why many of them should be treated as malware & should not be ignored in ‘business as usual’ IR activities.<\/p>\n

In the aforementioned post I listed a couple of routine names that that particular sample used. All these routines are called one by one, and a final string is generated containing reference numbers associated with each ‘discovered’ piece in the environment.<\/p>\n

\"fingerprinting\"<\/a>This is no longer just a sandbox detection.<\/p>\n

EDR, VPN, AV, security tools, often list of updates, hotfixes, full software list from registry, etc. is added too. Someone, somewhere populates some large databases with a lot of this ‘goodness’.<\/p>\n

One can imagine that this data may be a very valuable piece of information – it could be sold not only to advertisers, software writers, even companies whose products are being profiled (competition\/market research), but also – of course – on a darker side – to random malware authors, and guys specializing in targeted attacks. If you think of it, a good PUP\/PUA campaign could be even orchestrated by the actual BAD guys.<\/p>\n

If 0days allow a way in, a database with an information about used software may simplify and speed up a lateral movement. And why bother doing all the time-consuming illegal hacking\/malware infestation\/recon if you can simply deploy borderline software first. Let it populate a huge matrix including lots of information about as many hosts as possible in as many organizations as possible. And then, with such precise information about installed software & deployed countermeasures it can be leveraged to simplify many hacking operations (and targeting).<\/p>\n

This is of course scaremongering on my side and a conspiracy theory in the making, but the only reason I am writing this is that if you are ever looking for arguments to treat PUA\/PUP as malware… or someone argues that PUA\/PUP can be ignored in your AV alerts then the massive fingerprinting they do nowadays is the big one…<\/p>\n","protected":false},"excerpt":{"rendered":"

In my post about sample targeting EDR I mentioned that the sample is a PUA\/PUP. Looking at the code of many PUA\/PUP\/adware samples created in last few years it’s easy to see how far they go nowadays in fingerprinting the … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[15,46,8],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3388"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=3388"}],"version-history":[{"count":4,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3388\/revisions"}],"predecessor-version":[{"id":3393,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3388\/revisions\/3393"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=3388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=3388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=3388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}