#dc comics#dc#batman#tim drake#dc fanart#bruce wayne#dick grayson#batfam#batfamily
seen from United Kingdom
seen from United States
seen from United States
seen from United States
seen from Australia
seen from United States
seen from United Kingdom
seen from Kazakhstan
seen from Spain
seen from United States
seen from United States
seen from United States
seen from China
seen from United Kingdom
seen from Russia
seen from United States
seen from India
seen from Australia
seen from United Kingdom
seen from United Kingdom
Network Traffic Analyzer Explained: Features, Benefits & Examples
A network traffic analyzer plays a critical role in modern IT and cybersecurity by helping organizations understand what is happening across their networks in real time and over time. As networks grow more complex—with cloud services, remote work, IoT devices, and advanced cyber threats—simply relying on firewalls and logs is no longer enough. This is where Network Traffic Analysis (NTA) comes…
Civilsphere AI VPN: v0.1.0-beta release
Civil society organizations, activists, journalists and human rights defenders rely on digital devices to do their jobs, and are often in the field without the protection of firewalls, IDS, or any other advanced threat protection more commonly available to corporate users. How can these individuals identify if their devices are at risk while working in the field?
Since 2018, our Emergency VPN service has been leveraging VPN technologies to provide users with a security assessment of their devices’ network traffic tailored to identify digital threats. Our new AI VPN aims to take this work even further.
The AI VPN is a free software tool that provides users with an automatic network security assessment of their network traffic. Users can request a new OpenVPN or WireGuard VPN profile via email or Telegram, connect to it for a predefined amount of time (hours to days), and receive a full report after their VPN profile expires.
The AI VPN aims to enable organizations to deploy their own instance without the need to rely on third-parties with their data.
AI VPN v0.1.0-beta release
This beta release features the following functionality:
Automatic management of VPN accounts
Support for multiple VPN technologies, including Wireguard, OpenVPN and a NoVPN, a special configuration of OpenVPN without encryption to be used in countries where the use of encryption or VPNs may be illegal or endanger users.
Automatic network traffic captures and analysis per session.
Support for multiple methods to request a new VPN profile, including Email and Telegram.
Integration with Slips, the Stratosphere Linux IPS, a free software intrusion detection system that uses machine learning to automatically detect threats.
Slips leverages dozens of threat intelligence feeds of known threats, plus has special modules tailored for the AI VPN such as the new Leak Detection module.
Integration with Pi-Hole to provide protection against trackers while using the AI VPN service.
Support for launching the service using Nix Arion for NixOS users.
The beta version release notes are available on GitHub. This version was tested using Docker v20.10.6 and docker-compose v1.28.5.
The AI VPN is the New Emergency VPN Service Engine
Since late November, users of our Emergency VPN service can already experience the new AI VPN technology. Our Emergency VPN was enhanced and is now powered by the AI VPN, giving it more stability, speed, and reliability. We hope our users will enjoy the changes and help us improve even more this new tool. Get started using the Emergency VPN.
Acknowledgements
This project was funded through the NGI0 PET Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 825310.
This project was developed by the Stratosphere Laboratory, Artificial Intelligence Centre, Faculty of Electrical Engineering, Czech Technical University in Prague (2020-2021).
The AI VPN threat detection is provided by the Stratosphere Linux IPS developed at the Stratosphere Laboratory.
We would like to give a special thank you to the individuals who helped us get to this release, specially Sebastian Garcia, Maria Rigaki, Joaquin Bogado and Alya Gomaa.
Resources
Documentation: https://aivpn.readthedocs.io/
Repository: https://github.com/stratosphereips/AIVPN
Capturing and Detecting AndroidTester Remote Access Trojan with the Emergency VPN
Mobile remote access trojans, or RATs, are malicious programs that allow attackers to fully control a mobile device. What does this mean in reality? The person controlling the malware will be able to access information on the phone, including SMS, pictures and messaging applications, and also be able to steal or implant files on the phone. RATs are precision tools used to track and gather information about a person.
In this blog post, we show how the Emergency VPN can help identify RAT infections on Android phones. The images and network traffic included in this blog post are part of the original research by Civilsphere researcher Kamila Babayeva on the Android Mischief Dataset [1].
Android Tester Remote Access Trojan
AndroidTester is a RAT for Android that has been around since approximately 2020, and it is believed to be a variation of another RAT known as SpyNote. Among its functionalities, the RAT can access files, SMS messages, calls, contacts, locations, accounts, applications, and allows access to the shell, microphone, camera, keylogs, settings, and other functionalities. This functionality is shown in Figure 1 and 2.
Once the phone is infected with the RAT, the attacker has complete access to the phone. As we can see in the screenshots below, the RAT can list all the files and all the installed applications, among other things.
Capturing the Android Tester RAT with the Emergency VPN
The Emergency VPN is a service that provides a free security assessment of a phone’s network traffic to determine if the device is infected, under attack, or compromised. The Emergency VPN works like any other VPN, with the addition that once you connect to the Emergency VPN, our team will capture the network traffic generated by the device in order to analyse it and find potential security threats. The high level workflow of the Emergency VPN is shown in Figure 3.
To capture the behavior of the AndroidTester RAT, we connected a Nokia Phone with Android 10 to our Emergency VPN and then infected the device with AndroidTester v.6.4.6. The Nokia Phone was remotely controlled like a real attacker would do, stealing information, adding and deleting contacts, and locating the device.
During all this time, the Emergency VPN was active and the network connections through the VPN were captured and then analysed by our analysts to identify if there were malicious connections identified or not.
Detecting the AndroidTester RAT with the Emergency VPN
The Emergency VPN captures and stores the network traffic in a PCAP file. This file contains all the network connections the device did using the VPN and it is the primary source for analysis that our researchers use to find malware infections.
In this session, the Emergency VPN was used for 1.2 hours resulting in 80MB of network traffic captured. With this data, we proceed to perform our analysis.
In this investigation, we focused on three things to detect the malware infection:
Unusual data upload: is the device uploading (a lot of) data to unusual services?
Periodic connections: are there network connections that appear not to be human?
Data leaks: is there any personal information being leaked on the network?
The first thing we usually look at are usual data uploads. Most users are data consumers, generally downloading more data than they send. This quick analysis highlighted one suspicious connection to a server not associated with any well-known service, where the device uploaded 43MB as it can be seen below:
This connection is suspicious because the service is not known, the device uploads 43MB of data, but also, because compared to the other activities in the device this is an outlier. However suspicious, this alone is not enough to classify this connection as malicious and we investigate further.
Now that we have a connection that we consider suspicious, we analyse it to determine if this connection may have been generated by a human or a program. When humans browse the internet or use applications, we rarely do it in a periodic and automated fashion. Computers on the other hand, they do.
The Stratosphere Linux IPS is a network analysis tool that allows to quickly analyse if a connection is periodic. As shown below, the connection to this server is periodic, does not have an associated DNS name, and the data transfer occurs over a non-standard port (1337).
All of these individual findings show us that this connection appears more and more suspicious. We can examine the content of the connection and, if the traffic is not encrypted, we can see if there is anything else pointing out if this connection is malicious.
Upon examination, we find the attacker command and the device response sending the mobile phone number and name over the network:
With all the information gathered, our researchers will use existing Threat intelligence and their advanced knowledge on traffic analysis to try to associate the traffic with a specific malware family whenever possible to facilitate the risk assessment and remediation steps taken by users.
The Emergency VPN report for this device is available here. A technical in-depth analysis of AndroidTester network traffic is available in the Stratosphere Blog [6].
How to Avoid Getting Infected by RATs
These are our recommendations to stay safe:
Install new apps only from the Google Play Store and trusted developers.
The Google Play Protect is enabled by default, keep it enabled at all times.
Click only on links sent by people you know and trust. When in doubt, do not click.
Download and open attachments sent only by known and trusted contacts. When in doubt, do not download and do not open.
Keep only the essential applications installed on the phone for maximum safety.
Never leave your phone unattended or unlocked, even in trusted spaces.
Never share your phone PIN or Pattern, even with loved ones.
Remember that you can use the service ShouldIClick to check links before clicking, and see its content without visiting the site directly on your phone. Get started using the Emergency VPN.
References
[1] Execution, Analysis and Detection of Android RATs traffic, Civilsphere, https://www.civilsphereproject.org/research/execution-analysis-and-detection-of-android-rats-traffic. Accessed on 07/15/2021.
[2] A Study of Remote Access Trojans: This repository contains a curated list of papers, articles and other sources related to remote access trojans, GitHub, https://github.com/stratosphereips/a-study-of-remote-access-trojans. Accessed on 07/15/2021.
[3] ANDROID TESTER V6.4.6 (RAT) Cracked + Source, BlackHatRussia Web Archive, https://web.archive.org/web/20210705135241/https://www.blackhatrussia.com/1424-android-tester-v646-rat-cracked-source.html. Accessed on 07/15/2021.
[4] Screenshot from 2020-08-07 11-04-04.png, RAT01_AndroidTester, AndroidMischiefDataset_v2, https://mcfp.felk.cvut.cz/publicDatasets/Android-Mischief-Dataset/AndroidMischiefDataset_v2/RAT01_AndroidTester/RAT01_AndroidTester_screenshots/Screenshot%20from%202020-08-07%2011-04-04.png. Accessed on 07/15/2021.
[5] Screenshot from 2020-08-07 11-10-13.png, RAT01_AndroidTester, AndroidMischiefDataset_v2, https://mcfp.felk.cvut.cz/publicDatasets/Android-Mischief-Dataset/AndroidMischiefDataset_v2/RAT01_AndroidTester/RAT01_AndroidTester_screenshots/Screenshot%20from%202020-08-07%2011-10-13.png. Accessed on 07/15/2021.
[6] Dissecting a RAT. Android Tester Trojan Analysis and Decoding, Stratosphere IPS, https://www.stratosphereips.org/blog/2020/12/14/ngwqj0h060yv40w1afp51fg7wo9ijy-pzlhk. Accessed on 07/15/2021.
Civilsphere AI VPN: v0.1-alpha pre-release
Civil society organizations, activists, journalists and human rights defenders rely on digital devices to do their jobs, and are often in the field without the protection of firewalls, IDS, or any other advanced threat protection more commonly available to corporate users. How can these individuals identify if their devices are at risk while working in the field?
Since 2018, our Emergency VPN service has been leveraging VPN technologies to provide users with a security assessment of their devices’ network traffic tailored to identify digital threats. Our new AI VPN aims to take this work even further.
The AI VPN is a free software tool that provides users with an automatic network security assessment of their network traffic. Users can request a new VPN profile via email, connect to it for a predefined amount of time (hours to days), and receive a full report after their VPN profile expires.
The AI VPN aims to enable organizations to deploy their own instance without the need to rely on third-parties with their data.
AI VPN v0.1-alpha pre-release
This project is still in its early development, however we are happy to have an alpha pre-release already available for testing. This first release includes some of the AI VPN core functionality:
Automatic generation of VPN accounts
Automatic network traffic captures per account
Automatic revocation of VPN accounts
Automatic report generation of the captured traffic per account
Email is currently the supported method for sending VPN requests and obtaining the network traffic analysis reports.
VPN supported technologies currently include OpenVPN
AI VPN currently handles up to 253 simultaneous users.
This version was tested using Docker v20.10.6 and docker-compose v1.28.5.
The AI VPN documentation can be accessed at https://aivpn.readthedocs.io. The application can be downloaded in our GitHub repository https://github.com/stratosphereips/AIVPN.
Acknowledgements
This project was funded through the NGI0 PET Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet programme, under the aegis of DG Communications Networks, Content and Technology under grant agreement No 825310.
This project was developed by the Stratosphere Laboratory, Artificial Intelligence Centre, Faculty of Electrical Engineering, Czech Technical University in Prague (2020-2021).
Network Traffic Analytics Market: Global Opportunity Analysis and Industry Forecast, 2019-2026
CLICK HERE TO GET SAMPLE COPY OF THIS REPORT!
Network traffic analysis provides in depth insight into what type of traffic or network packets or data are flowing through a network. It performs through a network monitoring or network bandwidth monitoring software or application. Network traffic analytics is a process of studying, recording, and analyzing network traffic to enhance performance of network operations and to improve security. It is mainly used to understand and evaluate network utilization to track download or upload speed and identify suspicious and malicious packets within the network. The main focus of network traffic analytics is threat identification in real time. Network traffic analysis used with threat management services can provide an even richer perspective on activity and help expedite a response.
36c3 Chaos West: Emergency VPN, Analyzing Mobile Network Traffic to Detect Digital Threats
Our team had the opportunity to present a talk at the Chaos West stage on the 36th Chaos Communication Congress (36c3) in Leipzig. The 36c3 is the biggest hacker conference in Europe and it gathers every year more than 16,000 attendees from all over the world.
Sebastian Garcia, director of Civilsphere and Veronica Valeros, project leader of Civilsphere, presented the Emergency VPN in the Chaos West stay on December 27th. In their talk they emphasized the increased use of surveillance technology such as spyware by governments to surveil and abuse journalists, activists and human rights defenders. However, as Veronica Valeros mentioned in the talk, governments have crossed the line and have used this spyware also to target civilians, including, children.
The Emergency VPN is a service that allows users to obtain a free security analysis of the network traffic of the mobile device. This works based on the assumption that spyware or other digital threats will attempt to steal information and send it back to the attackers. Through the use of a VPN “researchers can analyze the data and send back a report with any suspicious or malicious activity that is putting you at risk”, says Sebastian Garcia director of the project.
“Right now we need your help”, indicates Veronica, “we need your help to be able to reach the right people at the right time. Are you at risk? Is people you know at risk? Please reach out to us, we can help. ”
The slides are available for download HERE.
Use of Facebook UDP Priming Revealed in Unencrypted UDP Connection to port 33000
Early this year we observed suspicious UDP connections to port 33000 in a mobile device. This traffic contained a Facebook URL that included a Facebook Graph token, and it was sent unencrypted over the network. In this blog post we show details of this traffic, what information was disclosed, and our discovery of UDP Priming. We have reported this potential data leak to Facebook, who confirmed this traffic is part of the Facebook normal behavior and that the tokens transmitted in plain text are not security related.
1. Discovery of UDP TRAFFIC to port 33000
We observed this behavior for the first time in the traffic of an iOS mobile device, specifically an Apple iPhone 6, OS Version 12.1.4. In Figure 1 it is possible to observe how this traffic looked like in Wireshark. The internal IP 10.8.0.105 was communicating with different Facebook IPs (31.13.89.19,157.240.30.18). The connections to UDP port 33000 are similar in length, and not periodic. Another thing to consider is that the host is sending traffic but never receiving a response from the server.
2. defining which questions need answering
The goal of our analysis is to understand the traffic and what is happening. The first step was to make a list of questions that we wanted to answer. In our case, were were interested in the following ones:
Who else is generating this traffic? Is this an isolated case?
Is this traffic generated by an official Facebook application, or by a third-party app? If it is, it should be documented.
What is the “primingtoken” of the Facebook Graph API doing?
What is this token used for?
We started our research trying to answer all of these questions.
3. FIRST ATTEMPT TO EXPLAIN WHAT IS HAPPENING
3.1 Is this an isolated case or are other users generating the same traffic?
To answer this questions we did two things:
First, we searched for occurrences in the traffic of some organizations we are monitoring. To our surprise, we observed multiple users generating the same type of connections. Some of these connections can be observed in Figure 2. The observed connections were all from desktop users, increasing the possible users affected by this leak.
Second, we installed Facebook on an Android mobile phone, capture its traffic for three days, and during this time we used the application normally as any normal user would. We then searched in the captured traffic for any connection on port 33000. We didn’t observe any occurrence or connection to high ports on Facebook services.
Conclusion: the observed traffic is not generated by a single user, but for multiple ones. This traffic was generated by both mobile (iOS) and desktop users (Unknown number of OS).
3.2 Is this traffic generated by an official Facebook application, or by a third-party app? If it is, it should be documented.
To answer this question we looked up the documentation associated to Facebook Graph API. The Graph API is at the core of the Facebook ecosystem. According to the facebook documentation [1]:
The Graph API is the primary way for apps to read and write to the Facebook social graph. All of our SDKs and products interact with the Graph API in some way, and our other APIs are extensions of the Graph API, so understanding how the Graph API works is crucial.
User tokens are needed in order to use the API. The documentation [2] states clearly the two main functions of the token:
They typically perform two functions:
1) they allow your app to access a User's information without requiring the User's password, and
2) they allow us to identify your app, the User who is using your app, and the type of data the User has permitted your app to access.
The Graph API documentation is quite good, however, after extensive search we didn’t find any mentions of the primingtoken or anything related to port 33000/UDP. Our tests from 3.1 didn’t help confirming if this behavior was generated by the Facebook App, or the Facebook Messenger. There are hundreds of other apps that may connect to facebook, and at this point this was unfeasible to test.
Problem: we were unable to answer this question at this point as the functionality was not documented. With this we were unable to answer the remaining questions of what does the token do and what is it used for? Solution: let’s report this issue to Facebook, if this is an issue they will fix it, if not, they will explain what this does.
4. REPORT ISSUE TO FACEBOOK
On March 15th we reported the issue to Facebook as “Access Token Disclosure” problems via their bug bounty program. On March 19th, Facebook support contacted us mentioning that these requests/tokens were used for pre-processing and were not security related. In a nutshell, everything was working just as intended. Facebook answer in full can be read below:
Thank you for submitting this. We have looked into this internally and can confirm that this is working as intended. These requests/tokens are used for pre-processing and are not security related. There is no harm for these to be exposed. Thank you for sharing this information with us. Although this issue does not qualify as a part of our bounty program we appreciate your report. We will follow up with you on any security bugs or with any further questions we may have.
This answer gave us enough information to focus our investigation and find the answer. The key elements that helped us move forward where:
This is an official part of Facebook apps.
The tokens are used for pre-processing of requests.
The token is not used (?) for accessing user information.
5. Finding the root cause. Meet UDP priming.
Our research finally led us to a blog post from 2015 [3] on “Optimizing Facebook for iOS start time”. In this blog post they introduce UDP Priming. UDP priming is a technique used to reduce the start time of the application. Every time a user clicks on the Facebook app, the application has to load. There are two cases: if the application is launched for the first time (not running on the background) so a considerable amount of content has to be loaded, this is known as cold start. If the application was already running in the background, a lower amount of content needs to be loaded for the application to run, this is known as warm start. UDP Priming is meant to speed up the cold start on Facebook for iOS applications.
In Facebook own words [3], UDP Priming is about speeding the cold start process: “before we send out the feed request over TCP, we send an encrypted UDP packet to the server, containing the feed request. The purpose of doing this is to give a hint to the server to kick off fetching and caching of data much earlier. When the actual feed request arrives over TCP, the server can then simply construct the response from cached content and send it back. Enabling this technique allowed us to gain several hundred milliseconds more.”
In this case, they mention that the UDP packet is encrypted, but they don’t specify if the token is encrypted, or if all the packet content should be encrypted. In any case, every time the application starts it will generate a request like the one above.
Conclusion
Performing network analysis on mobile phones turned our attention to suspicious connections to Facebook servers. These connections leak Facebook UDP Priming tokens which are used to speed up the loading of Facebook applications. While there is no documentation on this behavior on the Graph API, Facebook confirmed that this is indeed part of the normal behavior of the app. We confirmed that the same optimization technique (code) is present in Android Facebook apps, but we couldn’t confirm that this behavior is actually used in Android apps.
Security impact. Sending the full URL and token in clear text has implications for the security of the users.
First, the transmission of this information discloses to anyone surveilling the user the presence of Facebook applications installed, and can help confirm the operating system behind (if they only use this in iOS devices).
Second, while not confirmed to this date, this user token may disclose personal information about the user. However more research needs to be done to confirm this.
We believe that this negatively affects the privacy of users and the URL should be encrypted. Additionally, this behavior should be documented so users can understand what type of traffic is being sent out from their mobile phones.
References
Graph API, Facebook, https://developers.facebook.com/docs/graph-api
Using the Graph API, Facebook, https://developers.facebook.com/docs/graph-api/using-graph-api/
Optimizing Facebook for iOS start time, Facebook, https://code.fb.com/ios/optimizing-facebook-for-ios-start-time/
Network security ensures the integrity, availability and performance of an organization’s network, by protecting IT assets from threats.
