Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/citizen_lab/201712_Cyberbit/README.md

@@ -0,0 +1,3 @@
+# Indicators: Champing at the Cyberbit
+
+This folder contains the indicators of the report [Champing at the Cyberbit Ethiopian Dissidents Targeted with New Commercial Spyware ](https://citizenlab.ca/2017/12/champing-cyberbit-ethiopian-dissidents-targeted-commercial-spyware/) published in December 2017 by [Citizen Lab](https://citizenlab.ca/).

data/ioc/spyware/citizen_lab/201712_Cyberbit/iocs.csv

@@ -0,0 +1,14 @@
+uuid,event_id,category,type,value,comment,to_ids,date
+5a27f9f0-0654-4388-adcc-11098e96ca05,125,Network activity,url,"https://time-local.net/ts.php","",1,20171206
+5a27f9f0-8b98-4c33-bfce-11098e96ca05,125,Network activity,url,"https://time-local.com/","",1,20171206
+5a27f9f0-b9fc-4809-bbdb-11098e96ca05,125,Network activity,url,"https://pssts1.nozonenet.com/ts8/ts8.php","",1,20171206
+5a27f9f0-de2c-4a55-91a9-11098e96ca05,125,Network activity,url,"https://time-local.net/","",1,20171206
+5a27f9f0-ff88-4631-90ae-11098e96ca05,125,Network activity,url,"https://time-local.com/ts.php","",1,20171206
+5a27fa29-2f2c-428e-971b-11098e96ca05,125,Network activity,domain,"pssts1.nozonenet.com","",1,20171206
+5a27fa29-36d8-4b5e-bef3-11098e96ca05,125,Network activity,domain,"time-local.net","",1,20171206
+5a27fa29-c180-4131-8e5d-11098e96ca05,125,Network activity,domain,"time-local.com","",1,20171206
+5a27fac9-1f90-405a-8145-11098e96ca05,125,Network activity,domain,"pupki.co","",1,20171206
+5a281504-1720-4c8f-90c1-11098e96ca05,125,Network activity,domain,"eastafro.net","",1,20171206
+5a281504-6d78-458c-834f-11098e96ca05,125,Network activity,domain,"meskereme.net","",1,20171206
+5a281504-7ee0-446f-bd09-11098e96ca05,125,Network activity,domain,"getadobeplayer.com","",1,20171206
+5a281504-f94c-4e52-8866-11098e96ca05,125,Network activity,domain,"diretube.co.uk","",1,20171206

data/ioc/spyware/citizen_lab/201712_Cyberbit/rules.yar

@@ -0,0 +1,162 @@
+rule PSS_Agent {
+    meta:
+        description = "PSS Agent versions 4.x and 5.x"
+        author = "Geoffrey Alexander <geoff@citizenlab.ca>"
+        date = "2017-07-20"
+
+    strings:
+        $cmdproc = "CmdProc_" wide
+
+        $u1 = "SS_Agent" ascii
+        $u2 = "pss-agent" ascii
+        $u3 = "DC615DA9-94B5-4477-9C33-3A393BC9E63F" ascii
+        $u4 = { 06 1f 41 49 4d 48 50 4f 31 }
+
+        $s1 = "util::Process::" ascii
+        $s2 = "util::Resource::" ascii
+        $s3 = "util::System::" ascii
+        $s4 = "/M:{0FA12518-0120-0910-A43C-0DAA276D2EA4}" wide
+        $s5 = "Command is not allowed due to potential detection threat: %1%." wide
+        $s6 = "(%d) %.64s\\%.64s\\%.64s|%.64s|%.64s|%.64s|%.64s|%.64s|%.64s" wide
+        $s7 = "Name: %s Due: %02d/%02d/%04d %02d:%02d:%02d, Length: %d seconds" wide
+        $s8 = "Image will be taken on the next Skype call session." wide
+        $s9 = "\\\\.\\pipe\\BrowseIPC" wide
+        $s10 = "RES_BINARY" wide
+        $s11 = "/{433a-bbaf439-12982d4a-9c27}" wide
+
+    condition:
+        uint16(0) == 0x5a4d and $cmdproc and 1 of ($u*) and 4 of ($s*)
+}
+
+rule PSS_Pipeserver {
+    meta:
+        description = "PSS Pipeserver versions 4.x and 5.x"
+        author = "Geoffrey Alexander <geoff@citizenlab.ca>"
+        data = "2017-07-20"
+
+    strings:
+        $u1 = "pss-agent" ascii
+        $u2 = "PSS_Agent" ascii
+        $u3 = "Agent path too long (>= MAX_PATH)" ascii
+        $u4 = "Agent is not running, executing it now\\n" ascii
+        $u5 = "Failed to create PssClock!" ascii
+
+        $s1 = "LnkProxy" ascii
+        $s2 = "CUSTOMER\\Agent" ascii
+        $s3 = "BrowseIPC" ascii
+        $s4 = "CustomerConfig is not initialized yet" ascii
+        $s5 = "RES_BINARY" ascii
+        $s6 = "ipc::security_access::" ascii
+        $s7 = "util::Resource::" ascii
+        $s8 = "util::System::" ascii
+        $s9 = "AgentAdminGlobalEventName" wide
+        $s10 = "AgentDummyKillGlobalEventName" wide
+        $s11 = "AgentGlobalEventName" wide
+        $s12 = "AgentKillGlobalEventName" wide
+        $s13 = "AgentPipeServerInitGlobalEventName" wide
+        $s14 = "AgentUninstallGlobalEventName" wide
+        $s15 = "/M:{0FA12518-0120-0910-A43C-0DAA276D2EA4}" wide
+        $s16 = "\\\\.\\pipe\\BrowseIPC" wide
+        $s17 = "RES_BINARY" wide
+        $s18 = "/{433a-bbaf439-12982d4a-9c27}" wide
+
+    condition:
+        uint16(0) == 0x5a4d and 1 of ($u*) and 8 of ($s*)
+}
+
+rule PSS_lnkproxy {
+    meta:
+        description = "PSS lnkproxy versions 4.x and 5.x"
+        author = "Geoffrey Alexander <geoff@citizenlab.ca>"
+        date = "2017-07-20"
+
+    strings:
+        $s1 = "COMMAND_LINE_BEGIN:" ascii
+        $s2 = ":COMMAND_LINE_END:" ascii
+        $s3 = "Could not execute process when no command is specified" ascii
+        $s4 = "lnkproxy.db" ascii
+        $s5 = "SPAWN_COMMAND_BEGIN:" ascii
+        $s6 = ":SPAWN_COMMAND_END" ascii
+        $s7 = "util::Deserializer::" ascii
+        $s8 = "util::FileDeserializer::" ascii
+        $s9 = "util::File::" ascii
+        $s10 = "util::Process::" ascii
+        $s11 = "util::System::" ascii
+
+    condition:
+        uint16(0) == 0x5a4d and 4 of ($s*)
+}
+
+rule PSS_Agent_v6 {
+    meta:
+        description = "PSS Agent version 6.0.0 and 6.1.0"
+        author = "Geoffrey Alexander <geoff@citizenlab.ca>"
+        date = "2017-07-20"
+
+    strings:
+        $cmdproc = "CmdProc_" wide
+
+        $u1 = "C:\\Windows\\temp\\KB2979214.pdb" ascii
+        $u2 = { 06 1f 41 49 4d 48 50 4f 31 }
+
+        $s1 = "Did not complete transaction with pipe server" wide
+        $s2 = "SkypeControlAPIAttach" wide
+        $s3 = "SkypeControlAPIDiscover" wide
+        $s4 = "URL###Execute" wide
+        $s5 = "Failed to AddClipboardFormatListener, error [" ascii
+        $s6 = "transactionrequest.<xmlattr>" wide
+        $s7 = "DC615DA9-94B5-4477-9C33-3A393BC9E63F" ascii
+        $s8 = "getip.<xmlattr>.agentid" wide
+        $s9 = "AVAgentInstallException@agent@@" ascii
+        $s10 = "AVAgentCommandsException@agent@@" ascii
+        $s11 = "AVAgentCustomerConfigException@agent@@" ascii
+        $s12 = "AVTransactionParsingException@communication@@agent" ascii
+        $s13 = "AVStorageException@config@agent@@" ascii
+        $s14 = "AVDBStorageException@db@agent@@" ascii
+
+        $str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 }
+
+    condition:
+        uint16(0) == 0x5a4d and $cmdproc and $str_decrypt_loop and 1 of ($u*) and 8 of ($s*)
+}
+
+rule PSS_lnkproxy_v6 {
+    meta:
+        description = "PSS lnkproxy version 6.0.0 and 6.1.0"
+        author = "Geoffrey Alexander <geoff@citizenlab.ca>"
+        date = "2017-07-20"
+
+    strings:
+        $s1 = "C:\\Windows\\temp\\KB2971112.pdb"
+        $s2 = "AVResourceException@exception@util@@" ascii
+        $s3 = "AVLnkControllerException@LnkProxy@@" ascii
+        $s4 = "AVLnkPayloadException@@" ascii
+        $s5 = "AVShellLinkException@LnkProxy@@" ascii
+        $s6 = "AVFileUtilitiesException@LnkProxy@@" ascii
+        $s7 = "AVLnkEntryException@LnkProxy@@" ascii
+        $s8 = "AVFileRollbackException@LnkProxy@@" ascii
+
+        $str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 }
+
+    condition:
+        uint16(0) == 0x5a4d and 3 of ($s*) and $str_decrypt_loop
+}
+
+rule PSS_Pipeserver_v6 {
+    meta:
+        description = "PSS Pipeserver version 6.0.0 and 6.1.0"
+        author = "Geoffrey Alexander <geoff@citizenlab.ca>"
+        date = "2017-07-20"
+
+    strings:
+        $p1 = "PSS_Agent" ascii
+        $p2 = "pss-agent" ascii
+
+        $s1 = "%2s%u.%u.%u.%u\\\\n" wide
+        $s2 = "CustomerConfigException@agent" ascii
+
+        $str_decrypt_loop = { 8b 47 04 8b ce 83 e1 03 c1 e1 03 ba ?? ?? ?? ?? d3 ea 32 54 35 ?? 88 14 06 46 3b f3 }
+
+    condition:
+        uint16(0) == 0x5a4d and $str_decrypt_loop and 1 of ($p*) and 1 of ($s*)
+}