数据渗漏(Data Exfiltration)

=Start=

缘由：

最近在写一个文档，和数据安全审计相关的，需要有全局视角，思来想去好像还是用数据安全能力成熟度模型（DSMM, Data Security Maturity Model）中的数据生命周期来描述比较合适，一是因为这是一个数据安全领域通用的模型/框架，用起来不会错也不容易引发不必要的论战，二是因为确实比较好理解，更容易给没有相关背景知识的人讲。

这里简单记录一下“数据交换”阶段的数据渗漏风险，后面视具体情况看是否继续更新。

正文：

参考解答：

DSMM中数据生存周期分为以下6个阶段：

a) 数据采集: 组织内部系统中新产生数据，以及从外部系统收集数据的阶段；（一般是SDL从代码层面去控制，再加上一些功能/流量异常检测的监控）
b) 数据传输: 数据从一个实体传输到另一个实体的阶段；（主要通过加密和HTTPS来解决，但也需要有一些流量异常检测的监控）
c) 数据存储: 数据以任何数字格式进行存储的阶段；（一般通过网络隔离可以解决掉这一块大部分的风险，但生产网内部的安全，比如默认不出网和HIDS/RASP等能力要能覆盖，还有SDL来覆盖代码/接口层面的一些异常）
d) 数据处理: 组织在内部对数据进行计算、分析、可视化等操作的阶段；（知其所需，最小特权，全量审计日志记录，冷权限回收，批量操作审计，敏感操作审计，……）
e) 数据交换: 组织与组织或个人进行数据交换的阶段；（一般是用DLP兜底，但最好的办法还是敏感数据不落地，敏感数据仅在安全可控的空间内可用不可见，且操作全程有记录，否则一旦落了地，就会遇到下面ATT&CK中的Exfiltration这一部分，而且大部分企业真实环境对于攻击者来说会比下面描述的条件要更友好，不论是package方法还是media媒介抑或是network或者agent等维度的检测逃避，真实环境中真的是很难兜住前面步骤中埋下的坑）
f) 数据销毁: 对数据及数据存储媒体通过相应的操作手段，使数据彻底删除且无法通过任何手段恢复的过程。（一般公司遇不到，但也是一种很大的容易忽略的风险，简单的操作就是多进行几次强加密，然后把密钥给删掉）

特定的数据所经历的生存周期由实际的业务所决定，可为完整的6个阶段或是其中的几个阶段。

Exfiltration

The adversary is trying to steal data. 对手正试图窃取数据。

Exfiltration consists of techniques that adversaries may use to steal data from your network. Once they’ve collected data, adversaries often package it to avoid detection while removing it. This can include compression and encryption. Techniques for getting data out of a target network typically include transferring it over their command and control channel or an alternate channel and may also include putting size limits on the transmission. 泄露包括攻击者可能用来从你的网络中窃取数据的技术。一旦他们收集到了数据，攻击者通常会将其打包，以避免在转移数据时被发现。打包方式包括压缩和加密。将获取数据的从目标网络带走的技术通常包括通过其命令和控制通道或备用通道传输数据，还可能包括对传输设置大小限制。

Techniques

Techniques: 9

ID	Name	Description
T1020	Automated Exfiltration 自动化渗漏	Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection. 攻击者可能会在收集过程中收集到数据（比如敏感文档）后，通过使用自动处理来泄露数据。
	.001	Traffic Duplication 流量复制	Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device. 攻击者可能利用流量镜像在被攻陷的网络基础设施上自动进行数据泄露。流量镜像是一些网络设备的固有特性，用于网络分析，可以配置成复制流量并将其转发到一个或多个目的地，以供网络分析器或其他监控设备进行使用。
T1030	Data Transfer Size Limits 数据传输大小限制	An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts. 攻击者可能会通过传输固定大小的数据块，而不是整个文件或者将数据包大小限制在某些阈值以下来泄漏数据。这种方法可用于避免触发网络数据传输阈值警报。
T1048	Exfiltration Over Alternative Protocol 通过替代协议进行泄漏	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. 攻击者可以通过与现有命令和控制通道不同的协议来窃取数据。数据也可以从主命令和控制服务器发送到备用网络位置。
	.001	Exfiltration Over Symmetric Encrypted Non-C2 Protocol 通过对称加密非C2协议进行泄漏	Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. 攻击者可以通过非现有命令和控制通道的对称加密网络协议来窃取数据。数据也可以从主命令和控制服务器发送到备用网络位置。
	.002	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol 通过非对称加密非C2协议进行泄漏	Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. 攻击者可以通过非对称加密的网络协议而不是现有的命令和控制通道来窃取数据。数据也可以从主命令和控制服务器发送到备用网络位置。
	.003	Exfiltration Over Unencrypted Non-C2 Protocol 通过未加密的非C2协议进行泄漏	Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. 攻击者可以通过现有命令和控制通道以外的未加密网络协议来窃取数据。数据也可以从主命令和控制服务器发送到备用网络位置。
T1041	Exfiltration Over C2 Channel 通过C2通道泄漏	Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications. 攻击者可以通过现有的命令和控制通道窃取数据。被盗数据被编码到使用与命令和控制通信相同的协议的正常通信通道中。
T1011	Exfiltration Over Other Network Medium 通过其他网络介质进行泄漏	Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. 攻击者可能试图通过不同于命令和控制通道的网络媒介窃取数据。如果命令和控制网络是有线Internet连接，则可能通过WiFi连接、调制解调器、蜂窝数据连接、蓝牙或其他射频通道进行泄露。
	.001	Exfiltration Over Bluetooth 通过蓝牙进行泄漏	Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. 攻击者可能试图通过蓝牙而不是命令和控制通道窃取数据。如果命令和控制网络是有线Internet连接，攻击者可能会选择使用蓝牙通信通道窃取数据。
T1052	Exfiltration Over Physical Medium 通过物理介质进行泄漏	Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems. 攻击者可能试图通过物理介质(如可移动驱动器)窃取数据。在某些情况下，例如an air-gapped network compromise，可能会通过用户引入的物理介质或设备进行泄漏。这种媒体可以是外部硬盘驱动器、USB驱动器、移动电话、MP3播放器或其他可移动存储和处理设备。物理介质或设备可以用作最终的泄漏点或在其他断开的系统之间跳转。
	.001	Exfiltration over USB 通过USB进行泄漏	Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
T1567	Exfiltration Over Web Service 通过Web服务进行泄漏	Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel. Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise. Firewall rules may also already exist to permit traffic to these services. 攻击者可能使用已有的、合法的外部Web服务来窃取数据，而不是使用其主要的命令和控制通道。流行的Web服务作为一种泄露机制可能会提供大量的掩护，因为网络中的主机可能在泄露之前就已经与它们进行了通信。也可能已经存在防火墙规则来允许与这些服务的通信。
	.001	Exfiltration to Code Repository 借助代码仓库进行泄漏	Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel. Code repositories are often accessible via an API (ex: https://api.github.com). Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection. 攻击者可能会将数据泄露到代码仓库，而不是通过他们的主要命令和控制通道。代码库通常可以通过API访问(例如 https://api.github.com)。通常通过HTTPS访问这些API，这为攻击者提供了额外的保护级别。
	.002	Exfiltration to Cloud Storage 借助云存储进行泄漏	Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet. 云存储服务允许通过Internet存储、编辑和检索来自远程云存储服务器的数据。
T1029	Scheduled Transfer 计划转移	Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals. This could be done to blend traffic patterns with normal activity or availability. 攻击者可以仅在一天中的特定时间或特定间隔执行数据泄露计划。这可以将流量模式与正常活动或可用性混合在一起。
T1537	Transfer Data to Cloud Account 将数据传输到云帐户	Adversaries may exfiltrate data by transferring the data, including backups of cloud environments, to another cloud account they control on the same service to avoid typical file transfers/downloads and network-based exfiltration detection. 攻击者可能通过将数据（包括云环境的备份）传输到他们在同一服务上控制的另一个云帐户来泄漏数据，以避免典型的文件传输/下载和基于网络的泄漏检测。

另外，说句实话，ATT&CK框架中的这一部分感觉没什么逻辑，有点乱，不符合金字塔原理中提到的MECE（相互独立，完全穷尽）的原则，直接用这个来讲可能会被喷，最多只能拿过来做个参考，看看ATT&CK框架中技战术的覆盖情况。

参考链接：

信息安全技术数据安全能力成熟度模型
https://dsmm.cesidsat.com/assets/file/standard.pdf

数据安全复合治理与实践白皮书-学习思考
https://ixyzero.com/blog/archives/5204.html

DATA PROTECTION 101 – What is Data Exfiltration?
https://www.digitalguardian.com/blog/what-data-exfiltration

Advanced data exfiltration – the way Q would have done it
http://www.iamit.org/blog/wp-content/uploads/2012/01/Advanced-data-exfiltration-%E2%80%93-the-way-Q-would-have-done-it.pdf

数据渗漏（Data Exfiltration），比数据泄漏更隐蔽！
https://blog.51cto.com/yepeng/649540

MITRE ATT&CK
https://attack.mitre.org/

Exfiltration
https://attack.mitre.org/versions/v12/tactics/TA0010/

=END=

19 4 月, 2023

Docker

KnowledgeBase, Security

ATT&CK, DataSecurity, DSMM, Exfiltration, Security, 数据安全