ExtraBlu: Checking Flash Content to see if it is from a malicious source using ExtraHop and OctoBlu

The Ransomware epidemic has spread on the internet like a plague in the last 18 months. In fact, Ransomware netted $200 million in Q1 of this year. One might think with numbers like that they would get acquired or start an IPO in the next year!! I predict “Ransomware” makes it into Webster’s dictionary by 2017! (You read it here first)As many (well…to the extent that I could call my readers “many”) of you have read in my earlier posts, I believe that the lack of surveillance, due to budget, staffing or just good ole fashion apathy, is the primary reason for most security breaches. However, in the case of Ransomware, I believe that wire data offers the only way to truly combat this. Ransomware plays out in the blind spot behind the perimeter, in a day and age when your credit report can keep you from renewing your clearance or even getting a job. This coupled with the COMPLETE AND UTTER LACK of advocacy for the consumer or accountability when the information is wrong , an email stating that you are delinquent on a bill is always taken VERY seriously and to think that people will just not open it isn’t necessarily practical. That said, the phishing attempts will continue to evolve and as we block one, they will program another. This is okay! When you use ExtraHop’s wire data analytics, you can pivot too. I know that threat intelligence is still developing but with the availability of restful API’s and an open platform, you have a great shot at keeping your malware/Ransomware exposure to a minimum.

In this post, I want to demonstrate one of those methods. Today I am going to walk through how I set up ExtraHop to integrate with one of our partners (Citrix) OctoBlu platform to just give you an example of how who open platforms can integrate with one another and provide unparalleled visibility as well as access to automatic workflows that can be used to corral infected systems and decrease exposure. I have been studying attack vectors for Cryptowall and in many cases, a user is redirected to a .SWF URI that contains the malicious software or directs them to download/install it. I want to demonstrate how you can leverage ExtraHop and OctoBlu to be able to audit access to these files and ensure that they are, in fact, not from malicious sources.

Materials: (and VERY special thanks to both VirusTotal and Malware-traffic-analysis.net who perform an utterly invaluable service to the community with their sites!!!)

  • 3 PCAP’s from Malware Analysis showing Angler Exploit Kit delivering Ransomware
  • A VirusTotal API key
  • An ExtraHop VM
  • An Ubuntu box running TCPReplay

There is some overlapping nomenclature with OctoBlu and ExtraHop so I want to take the time to define it.

  • ExtraHop Triggers: ExtraHop’s triggers are programmable (javascript) objects that allow you to interact directly with your Network and use your Network as a data source. They allow you to set conditions and initiate outcomes. In this case, we are initiating an OctoBlu trigger as well as a precision PCAP to perform a packet capture.
  • OctoBlu Trigger: (I am still learning about OctoBlu but…) An OctoBlu trigger is the item within an OctoBlu flow that initiates the actual workflow that is being performed.


On the ExtraHop System:
We set up a trigger that looks for externally accessed SWF files.

  • Online 14 we are looking for any uri that has .swf in it.
  • On line 15 we indicate that we are looking for non RFC1918 addresses (no 10,192 or 172 networks, just external) serving up the .swf file.
  • Then on lines 23 – 26 we access the OctoBlu trigger URI location to kick off the OctoBlu Flow.
  • Line 24 calls out my specific OctoBlu URI. (to avoid pranksters who will send me 10,000 emails)
  • And Finally, on lines 29 – 41 we are initiating what we call a “Precision Packet Capture” that will also create a PCAP file that I can download and evaluate as digital evidence.


On the OctoBlu system:
The OctoBlu flow has been set up to leverage four tools and one thing. You will see them defined below as follows:

  • Trigger (Tool): The Trigger is what initiates the flow, it has a specific URI assigned to it (called out in Line 24 above) and begins the workflow.
    • It receives the JSON payload from ExtraHop (Line 26) and sends the Server IP delivering the SWF File to the HTTP GET tool which then queries VirusTotal.com’s API passing my API Key and the Server IP.
    • It also passes the Client and Server IP’s as well as a URL to the “Compose Tool”
  • HTTP Get (Tool): This is the actual query of the VirusTotal API that checks to see if the IP is malicious or not.
  • Compose (Tool): Labeled “Consolidate JSON messages” below, this takes the JSON objects from both the initial trigger and the HTTP Get tools and creates a single set of metrics to be passed to the Template Tool.
  • Template (Tool): Labeled “Prepare Message” below, this takes all of the JSON metrics created in the previous tool and sends them to the “Send Email” thing
  • Send Email (Thing): This is the actual act of sending me an email warning me that I have had a user access a .SWF file from a malicious source.

(Please Click the Image)




The Warning from OctoBlu:
Below is a copy of the email I received when I replayed the pcap file from malware-traffic-analysis.net. As you can see, it includes the Server, the Client and a link to the Server IP’s VirusTotal dossier.


The Digital Evidence:
As noted on lines 29 – 41 in the ExtraHop trigger, we have also kicked off a Precision Packet Capture. This makes the actual transaction readily available to download and look at in WireShark and use to determine if there is an actual issue as well as leverage the PCAP itself as digital evidence. As you see below, you have a PCAP named “External SWF File Accessed”.

So, the question was asked by @Brianmadden on twitter as he remarked that OctoBlu was now “True Blue Citrix”, “What can you do with it?”. With the right integration platform I believe that there is quite a bit that can be done with OctoBlu both with ExtraHop but also with their own portfolio of tools. What I love about the two platforms is their open-ness and their ability to increase the aperture of both Security, Dev and Network Operations teams allowing them to have the kind of agility needed to fight in today’s “hand-to-hand combat” world where breaches and vectors pivot, stick and move on a monthly, weekly and daily basis.

Using ExtraHop I have been able to deliver the following integration solutions: (with more to come from an ExtraHop “Blu Bundle”).

  • Get warning about users who are experiencing high latency
  • Get warnings about long logon times that fall outside an SLA
  • Now the post above, where I am warned when an end user accesses an known malicious external flash content.

Other scenarios could include using the Netscaler HTTP Callout feature to warn you when a user launches an ICAPROXY session from outside the US (a breach that actually happened), or when a known malicious actor accesses the company website hosted on a Netscaler VIP. You could also, potentially, use OctoBlu and MeshBlu to shut off Netbios on a system that we see encrypting file shares with Cryptowall.

My comment back to Brian, “the real question is, what CAN’T you do with it” was not meant to be snarky or pithy, it was borne from enthusiasm for open architectures. Sadly, it has been removed from the site but I spoke about this a few years ago at Geek Speak during a session called “Return of the Generalist”. API’s are your friend, those who do not embrace them run the risk of being irrelevant in the new world and may fall prey to “Digital Darwinism”. Embrace Python, Javascript, Go, etc and watch your value to this industry increase as well as your effectiveness. Be it INFOSEC, Citrix, SOA, SDN or Database, API’s will have a major role in tomorrow’s IT.

Thanks for reading!!!

Please watch the Video!!




Leave a Reply