Endpoint Attacks, Evasion and Obfuscation

What it is

Endpoint attacks compromise a laptop, server or phone, and evasion techniques help the attacker avoid being noticed while doing it.

An attack on an endpoint usually has a delivery step, an exploit or execution step, and a control step in which the attacker keeps contact. Defenders try to catch each step.

Attackers respond with evasion and obfuscation. These hide what the traffic or file really is.

How it works

The attacks differ in how they gain a foothold, and the evasion methods hide the later stages.

Buffer overflow

A buffer overflow happens when a program writes more data into a memory area than it can hold. The extra data spills into neighbouring memory and can overwrite important values, such as the place the program returns to.

An attacker who controls the overflow can make the program run the attacker's code. It usually needs a coding flaw in software written in languages without automatic bounds checking. Defences include patching, safer languages, and operating system protections such as address space layout randomisation and non executable memory.

Malware

Malware is malicious software. Common types include:

Command and control (C2)

Command and control is the channel between compromised hosts and the attacker. The malware contacts a C2 server for instructions and sends back stolen data.

Malware often beacons, which means it connects at regular intervals. C2 traffic is frequently hidden in normal looking web or DNS traffic. Signs include regular connections to a rare external address, odd domain names, and traffic at times when the user is away.

Ransomware

Ransomware encrypts the victim's files and demands payment for the key. Some groups also steal data first and threaten to publish it, which is called double extortion.

Defences include offline backups, patching, limiting administrator rights and user training. Backups only help if they cannot be reached and encrypted by the same attacker.

Evasion and obfuscation

Evasion avoids detection, and obfuscation makes content hard to read or understand.

• Tunnelling hides one protocol inside another. DNS tunnelling, for example, carries data in DNS queries and answers, which many networks allow through.
• Encryption hides the content from inspection. Malware can encrypt its C2 traffic, or its own code, to stop signatures matching.
• Proxies relay traffic so the real source or destination is hidden. Attackers route C2 or scanning through proxies, and anonymising services add more layers.
• Packing and encoding compress or scramble a program so that its code looks different each time.
• Fragmentation and unusual protocols split or alter traffic so that simple inspection misses the pattern.

An example of obfuscation is a script that holds its commands as an encoded string and decodes them only when it runs. A scanner that looks for the plain command does not find it.

Detection ideas

• Look for regular beaconing intervals.
• Look for unusually long DNS names or very many DNS queries from one host.
• Look for connections to newly registered or rare domains.
• Use behaviour based endpoint tools, since signatures miss packed or encrypted code.