Appendix: Attack Tools
Matthew Monte · 2015
BackdoorA backdoor or implant is a piece of software, hardware, or modifi cation to an existing piece of software or hardware that enables the Attacker to circumvent security.Gaining initial access can be a diffi cult process that may require using ephemeral or temperamental vulnerabilities or relying on a gullible target.A backdoor ensures future access without the hassle.Backdoors are an essential form of precaution.Their specifi c features are fundamental to operational security.They come in two main forms: interactive and noninteractive. Interactive BackdoorAn interactive backdoor, enables the Attacker to execute commands, push or pull fi les, capture screen shots, or perform other actions in near real time.This requires one or more active network connections between the target box and the Attacker's infrastructure.It also requires a human Attacker on the other end of the connection to send instructions.An interactive backdoor is usually required to expand access, survey, or make any real-time operational decision.The Poison Ivy RAT (Remote Access Tool) is an example of an interactive backdoor. Noninteractive BackdoorA noninteractive backdoor is also known as beaconing malware.The undesirable program calls out and establishes a connection to a website, mailbox, fi le drop, chat channel, or other virtual location.It then retrieves and executes any tasking placed there by the Attacker.A beaconing backdoor may also be used for exfi ltrating data.Collected data is leaked out over time to one or more locations.This form of command and control is required to establish a connection with a target behind a fi rewall, NAT, or other form of network security.It is necessary for persistence within a network.Noninteractive command and control provides the Attacker with the ability to scale, as a person is not required to drive each implant.It is the most prevalent form of malware.10.