Back in college, in my capstone course, we had to give a presentation on a topic of our choosing.

I chose botnets. Even then, I always thought that showing something was more impactful than

just explaining. Towards the end of my presentation, I had my computer hooked

up to the projector so that the entire class could see my screen.

I had the management council open for the Remote Access Trojan, RAT for short, called Dark Comet that I had downloaded and set up.

I then had my friend, who was also in the room for the same class, open a Word document that I sent him.

The Word doc was actually an EXE, surprise surprise, that I used a cryptor on to obfuscate the code so that his computer's antivirus wouldn't catch it.

When he opened it, a few seconds later, his computer showed up on the management council.

I then demoed to the class how I could see his keystrokes, view a live version of his desktop, go through his files.

It was as if I was sitting in front of his keyboard.

After showing how easy it was, my professor wanted to explain to the class the ramifications of doing something like this outside of an academic setting.

The entire presentation was recorded, so here's the clip.

It is cheaper for you to commit first-degree murder than to do this in this country.

Now, for those of you who are a little confused with what murder means, Josh pisses me off.

I decided that, guess what, it's Josh's time.

I take my particular M14A.

I sit down and mention...

Josh walks by...

Clank!

Cheaper than this!

Are you...

I mean...

Stare.

Okay, this is not...

This is white-collar crime, guys.

The fines for white-collar crimes are ridiculous.

Yes, gun analogies in schools in America, a tale as old as time.

But really, I think he got his point across.

And as far as I know, no one from my class was arrested.

For computer-related crimes, that is.

The rat I used in my presentation was Dark Comet, but the one we'll be talking about today was popular in the mid-2000s and was still in use over a decade after its launch.

Poison Ivy was used to attack governments, human rights groups, and multi-billion dollar organizations on this episode of In the Shell.

Does this close a national security program?

Are being used without the operator's knowledge?

And if it sounds malicious, it's because it is.

40 attacks just this year on educational organizations.

And now to the massive cyber attack targeting hotels and casinos in Las Vegas.

To a possible cyber attack at one of the nation's busiest airports.

A cyber security firm, CrowdStrike, has caused this outage.

That it takes you longer to do something by putting it into a computer and calling it up again than if you just kept simple records yourself in the house.

Poison Ivy, which is also referred to as Poison, came to this scene around 2005.

You could find it at PoisonIvy-Rat.com, which is no longer up.

But the Wayback Machine has quite a few snapshots if you want to check it out.

Now what's different about Poison is that it was a rat.

A lot of people in this scene say that rats are for script kitties, or the equivalent of training wheels for hackers, because it doesn't take much skill to use them.

They are ridiculously simple to use, and a malicious actor can basically point and click their way through the setup.

Once the attacker downloads the software, or buys it from the dark web, the next step is to build the executable that will be sent out to their targets.

When building the executable, you tell it where to phone home to.

In this case, what is the IP or URL of the C2.

C2 stands for Command and Control, and this is where the malicious actor, or botmaster, will control their botnet from.

From the C2, they can access all the machines, and browse the user's files, record audio, or take a screenshot.

Now getting back to the specifics of Poison, Poison was more so targeted for the use of stealing data and spying on users.

Unlike other rats, which were meant for DDoSing organizations...

or mass exploitation, here were some of the features that it offered.

Capture and record a user's screen, audio, and webcam.

List active ports.

Log keystrokes.

Manage open windows.

Manage passwords.

Manage registry, processes, services, devices, and installed applications.

Perform multiple simultaneous transfers.

Open a remote shell.

It could function as a relay server.

Search user files.

Update, restart, and terminate itself.

It really just let you own the user's computer, which is why it was so dangerous.

So while rats were considered toys to some, they were often paired with sophisticated attacks,

using a zero-day exploit, along with clever social engineering.

The goal was to get their malicious executable onto the target's computer.

have them execute it. The Poison Ivy binary the target executed could function in a number of

ways, all depending on how the malicious actor configured it. In the default config, it was

divided into two parts, the initialization and maintenance code and the networking code.

When executed, the initialization and maintenance code is injected into the already running

explorer.exe process. Explorer.exe is like the control center for everything you see and click

on in Windows. It's the process that runs your desktop, your taskbar, and the file explorer.

If you are using Windows, it's what makes the whole system feel familiar and easy to navigate.

Without it, you would just see a blank screen with no icons, no start menu, and no way to find your

files, which means that this process is always running on all.

Windows computers. So after the initialization and maintenance code is injected, the networking

portion of the code then launches a hidden web browser process using the system's default web

browser and injects itself into that process. And just to keep things stealthy, Poison Ivy's

network traffic often used ports that are commonly used, ports 80 and 443. These are the standard

ones used for HTTP and HTTPS, which we all use every day, and you are currently using to listen

to this episode. So while your IT team might see the traffic on these ports as normal, Poison Ivy

is just slipping through using the same avenues as secure web browsing. It's important to note that

the initial binary that the user executed didn't contain all the code for the rat. It was just

enough to compromise the system and get things started.

Now that the networking portion of the code was running, it then downloads the rest of the code

and data it needs for all the features and functionality configured by the malicious actor.

Poison Ivy also has a complex, custom networking protocol which operates over TCP.

Most of the communication was encrypted using the Camellia cipher, which is similar to the

more widely known AES and uses a 256-bit key. The key for the encrypted communication is

derived from a password provided by the attacker when building the Poison Ivy server.

The password was set to admin by default, and like a majority of people and system

administrators at the time, most malicious actors didn't change it. The key is validated at the

beginning of the TCP session using a challenge response algorithm. The Poison server sends 250

bytes of randomly generated data to the client. The client then encrypts this data using the key

and 50

and 50

and sends it back to the server for validation. The victim is now fully infected and their machine

is calling back to the poison C2 where the malicious actor now has full control over the

target's computer. Now a little more about that encryption key. FireEye, which is a cyber security

company now known as Trellix, created a tool called Calamine, very fitting name, that could

be used to help decipher the encrypted traffic on an infected machine. You could specify a list of

passwords that tries the key but out of the box it would try the default of admin which worked a

number of times. They also released a pi command script for immunity debugger which digs right into

the memory of a running poison ivy process.

out config details like passwords or IPs used by attackers. Essentially, it was a way for

investigators to rewind and watch what Poison Ivy was doing under the hood, even when it's trying

to hide its tracks. Poison was so widely used that security professionals had a hard time

tracing attacks that used it to any specific group or attacker. Its most notorious use was in 2011

and the compromise of RSA Secure ID, which led to the compromise of the military contractor

Lockheed Martin. But I plan on covering that story in its own episode in the future.

Poison's ability to be controlled in a familiar Windows interface combined with a ton of useful

features is what made it so widely used and adopted by attackers. A state-sponsored threat

actor could easily spin up a team that could learn how to do it.

to use the point-and-click interface. Some other notable attack campaigns using Poison included

AdminAt338, which was active since 2008. And this campaign mostly targeted the financial

services industry, but was also seen targeting companies in the telecom, government, and defense

sectors. The bug, spelled with a three, which was first detected in 2009. And this campaign

primarily targeted higher education and healthcare. Menupass, which also launched in 2009. This

campaign appeared to originate from China, targeting U.S. and overseas defense contractors.

And last but not least, the Nitro attacks, which occurred between 2011 and 2012, aimed at stealing

sensitive information primarily from companies in the chemical, defense, and energy industries.

It's also believed that these attacks originated from China, like the previous one I mentioned.

The power and invasiveness of rats is unmatched.

They give full access into a user's computer, and with the ability to record audio and video,

they open up a multitude of ways for them to abuse a victim.

Poison Ivy has led to countless cybersecurity incidents that caused many sleepless nights

for systems administrators and security professionals around the world.

In the Shell is written, researched, and recorded by me, the Rat Keeper.

If you've made it this far, your computer was either compromised by Poison Ivy and you couldn't stop the episode,

or you enjoyed it.

If it's the latter, then I have a small request.

Please click the share button wherever you are listening, and send the...

This episode is someone you think would like to hear about rats.

I would truly appreciate it.

That's it. Take care, and I'll see you next time.