May 20, 2020 01:33 AM
(This post was last modified: May 20, 2020 01:34 AM by IPIKIN.)
Inspecting MacOS's KnocKnock for VirusTotal API Key
After seeing the following thread https://hackforums.net/showthread.php?tid=6077630
We saw it was not difficult to get hard coded credentials or API keys, we know that other tools than ProcExp also have Knocknock which is developed by Objective-See and checks files which have some method of persistence on MacOs and checking them against VirusTotal. Yes we will be looking at an OSX application with no OSX machine. We will be using Ubuntu and Cutter.
After searching the strings we quickly find the API key, of course different than Microsoft's SysInternals key.
![[Image: knocknock-vt.png]](https://i.ibb.co/bXvYp3B/knocknock-vt.png)
knocknock VT key: 233f22e200ca5822bd91103043ccac138b910db79f29af5616a9afe8b6f215ad
Now we have two VT api keys it made me wonder can this be of use to subvert the processes in place? What is VirusTotal's function? Well to upload files/URI's and check if they are infected with malware, but there is other functions for example uploading a sample IP's are logged, which can make it easier for tracking an APT group. We can get APT payloads that is not an issue as there are plenty of samples on multiple platforms such as GitHub. Of course hash values would be similar to previous known samples. Functionality is easily detected be it through seeing system calls and imports or actually executing the payload. So what does this mean? If we upload a stock payload it's pointless we need a unique payload, it's not our payload so we could care less.
Theory: Subverting Analysis platforms
So it made me think, could a couple of these API keys be used to advantage to the attacker? Perhaps to hinder or overwhelm?
the question right now is how to we generate a bunch of "samples" which on their face appear as something highly valuable? One simple word "Fuzzing". zzuf is such a program which we can use to create a sample of files, of course there are several fuzzers out there. As to a question on what could be considered as valuable, consider APT malware. Often used by organized criminal groups and nation state actors it would quickly lead to a focused effort on these particular samples. Slightly fuzzed it would lead to resources, time and money being thrown at analyzing and reversing critical parts not to mention it also would lead to false data which would further hamper accruate tracking.
After seeing the following thread https://hackforums.net/showthread.php?tid=6077630
We saw it was not difficult to get hard coded credentials or API keys, we know that other tools than ProcExp also have Knocknock which is developed by Objective-See and checks files which have some method of persistence on MacOs and checking them against VirusTotal. Yes we will be looking at an OSX application with no OSX machine. We will be using Ubuntu and Cutter.
After searching the strings we quickly find the API key, of course different than Microsoft's SysInternals key.
knocknock VT key: 233f22e200ca5822bd91103043ccac138b910db79f29af5616a9afe8b6f215ad
Now we have two VT api keys it made me wonder can this be of use to subvert the processes in place? What is VirusTotal's function? Well to upload files/URI's and check if they are infected with malware, but there is other functions for example uploading a sample IP's are logged, which can make it easier for tracking an APT group. We can get APT payloads that is not an issue as there are plenty of samples on multiple platforms such as GitHub. Of course hash values would be similar to previous known samples. Functionality is easily detected be it through seeing system calls and imports or actually executing the payload. So what does this mean? If we upload a stock payload it's pointless we need a unique payload, it's not our payload so we could care less.
Theory: Subverting Analysis platforms
So it made me think, could a couple of these API keys be used to advantage to the attacker? Perhaps to hinder or overwhelm?
the question right now is how to we generate a bunch of "samples" which on their face appear as something highly valuable? One simple word "Fuzzing". zzuf is such a program which we can use to create a sample of files, of course there are several fuzzers out there. As to a question on what could be considered as valuable, consider APT malware. Often used by organized criminal groups and nation state actors it would quickly lead to a focused effort on these particular samples. Slightly fuzzed it would lead to resources, time and money being thrown at analyzing and reversing critical parts not to mention it also would lead to false data which would further hamper accruate tracking.