Repurposing OnionDuke: A Single Case Study Around Reusing Nation State Malware

Presented at Black Hat USA 2015, Aug. 6, 2015, 9:45 a.m. (50 minutes).

The news media is awash with nation-states and criminals reusing malware. Why should they have all the fun? This is a case study about reversing the suspected Russian government made OnionDuke MitM patching system, discovered by the speaker in October 2014. During this talk we will seek to understand its inner workings, selecting desirable features, and repurposing it for use in other tools. This is pure malware plagiarism.

Presenters:

• Joshua Pitts - Leviathan Security Group
  Joshua Pitts works as pentester and reverse engineer. He began his IT career while serving the Marines working in Signals Intelligence and IT security in the mid to late 90's. He has audited and penetration tested numerous clients in both the commercial and government sectors. Josh the author of 'The Backdoor Factory' (BDF) and BDFProxy open source projects.

Links:

• https://www.blackhat.com/us-15/briefings.html#repurposing-onionduke-a-single-case-study-around-reusing-nation-state-malware
• https://infocon.org/cons/Black Hat/Black Hat USA/Black Hat USA 2015/video/Black Hat USA 2015 - Repurposing OnionDuke A Single Case Study Around Reusing Nation State Malware.srt (subtitles)
• https://infocon.org/cons/Black Hat/Black Hat USA/Black Hat USA 2015/video/Black Hat USA 2015 - Repurposing OnionDuke A Single Case Study Around Reusing Nation State Malware.mp4
• https://www.youtube.com/watch?v=OuyLzkG16Uk
• https://www.blackhat.com/docs/us-15/materials/us-15-Pitts-Repurposing-OnionDuke-A-Single-Case-Study-Around-Reusing-Nation-State-Malware.pdf
• https://www.blackhat.com/docs/us-15/materials/us-15-Pitts-Repurposing-OnionDuke-A-Single-Case-Study-Around-Reusing-Nation-State-Malware-wp.pdf