Research · GoSec 2016 · RSA FirstWatch
Schoolbell and the Kingslayer
A presentation about roughly two thousand internet-facing servers that were running software nobody had updated — and the campaign that used them. I am credited in it. The work is the reason this practice exists in the shape it does.
What was shown
Schoolbell was a campaign — some would call it a small botnet — that infected a little over two thousand servers. It used six command-and-control domains and at least seven kinds of malware, several of which had been described earlier by other researchers. The most likely route in was exploitation of vulnerable, and often years-old, JBoss installations, plus Java deserialization flaws affecting other Java application servers.
Between April and May 2016, RSA Research lawfully seized and sinkholed the C2 domains — google-dash.com, office365e.com, microsoft-cache.com, jbossass.org, xjjboss.com, and ukoffering.com — and watched the infections call home to the sinkholes.
The actors behind it sit in a cluster that different vendors have named ShellCrew, C0d0so0, APT19, and Axiom. Kingslayer, the strategic half of the story, was a long-running targeting effort — eighteen months or more — using tooling that antivirus largely did not see.
The credit
Quoted from the acknowledgements slide, verbatim.
Special thanks: Chuck Helstein, DigitalOcean; Darien Huss, Proofpoint; Luis Garcia of luisangelgarcia.com; MS-ISAC for notification assistance; CCIRC for notification assistance; unnamed researchers with whom we work daily. Acknowledgements, Schoolbell and the Kingslayer, GoSec 2016
What that does and does not mean. I was a credited contributor to the research effort, not the presenter and not the author of the deck. Kent Backman of RSA FirstWatch wrote and delivered it; the full team and the organizations involved are listed on the slides. I include it here because it is the clearest public evidence of the work I have done, and because it is directly connected to what I sell: finding servers that are running something they should not be.
Why it is on this site
The campaign did not spread because its victims were careless. It spread because updating internet-facing software is nobody's favourite job, and in a great many organizations it is nobody's job at all. That is still true. The difference between 2016 and now is only which version number is the dangerous one.
Three things from that work shape how I run engagements:
- Unpatched is the default state, not an exception. Assume it until a version number says otherwise.
- An exposed service is a fact you can verify from outside, without logging in and without scanning. Start there, because it is cheap and it is honest.
- Someone has to own it. Every organization that handled this well had a named person and a schedule. Every organization that did not, had a vendor and a hope.
Attribution
Schoolbell and the Kingslayer — Can you hear it? was created by Kent Backman and the RSA FirstWatch team, and presented at GoSec in 2016. The research, the analysis, and the slides belong to their authors. The copy linked here is reproduced unmodified for reference, with the original acknowledgements intact. RSA, FirstWatch, GoSec, MS-ISAC, and CCIRC are the property of their respective owners; nothing on this site implies their endorsement of my work.
The same failure mode, smaller scale.
Your site does not need to be part of a botnet to be worth fixing. It needs to be running a version that has a known fix available.