For success on a night attack, send shinobi in advance to know the details of the enemy’s position before you give your orders.
—Yoshimori Hyakushu #12
Because shinobi were first and foremost experts in espionage, they had to safely relay secret messages containing scouting reports, attack plans, and other critical information to help their lords and allies make informed tactical and strategic decisions. Similarly, lords, generals, and other shinobi needed to covertly tell an infiltrated shinobi when to set a fire or execute other tactics. These messages had to be easily deciphered by the recipient shinobi but indiscernible to everyone else.
The Bansenshūkai, Ninpiden, and Gunpo Jiyoshu scrolls all describe secret methods shinobi used to communicate with other shinobi, friendly armies, or their employers after infiltrating enemy territory. Some are brutally simple. The Bansenshūkai describes hiding a message in the belly of a fish or even inside a person (use your imagination) who can easily travel across borders without suspicion. Common choices were monks and beggars. Obfuscation techniques discussed in the same scroll include cutting a message into several pieces and sending each piece by a different courier, to be reassembled by the recipient, as well as making inks from tangerine juice, rusty water, sake, or castor oil that dry invisibly on paper but are revealed with fire. Shinobi even developed the shinobi iroha—a custom alphabet indecipherable to non-shinobi—and used fragmented words or characters to create contextual ambiguity that only the shinobi meant to receive the message would understand.1
A popular—and direct—method of sending secret messages was yabumi, wherein what appears to be a normal arrow actually has a secret scroll rolled around the bamboo shaft, along with marks on the fletching to identify the recipient. Given the logistical realities of feudal Japan, shinobi could not always guarantee that they could fire a yabumi arrow at a prearranged time and place, so they developed an arrow “handshake” that, to an outsider, might have looked like a skirmish. If one side saw a specific number of arrows shot rapidly at the same spot, they returned fire with a specific number of arrows aimed to land in front of the shooter. This signal and countersignal established a friendly connection. The shinobi could then shoot the yabumi arrow, which would be picked up and delivered to the intended target.2 This method of communication became so common that the Gunpo Jiyoshu manual warns that the enemy may send deceptive letters by arrow; thus, the recipient should closely examine yabumi messages using some of the linguistic techniques described earlier in this book.3
For long-distance signaling or when sending a scroll wasn’t feasible, shinobi devised flag, fire, smoke, and lamp signals (hikyakubi). When even these were not possible, they employed secret drums, gongs, and conches. A loud, unique blast of the signaling device told the shinobi inside enemy lines to prepare to receive a secret communication. The exact signal pattern was agreed upon one to six days before infiltration to avoid confusion. After the initial hikyakubi signal, the message was delivered through drum, gong, or conch signals.4
In this chapter, we will look at how the covert communication methods of the shinobi closely resemble modern malware command and control communication. We will discuss why command and control communications are needed and their role in threat activity. We’ll touch on various techniques that modern adversaries have used to covertly conduct this communication. We will also explore various defenses against this technique and the challenges of using it. Lastly, we’ll list a large collection of security best practices to defend against command and control communications. The fact that the shinobi scrolls offer no guidance around how to stop covert communication suggests there may not be a good solution for it.
It is typically not feasible for malware to be wholly independent and autonomous. If it were, the malware would be exceedingly large, complex, suspicious, and visible to defenders. Rather, most malware needs tactical guidance from its controllers during a threat campaign, so threat actors use a technique called command and control (abbreviated as C2, CnC, or C&C) to communicate with malware, backdoors, implants, and compromised systems under their control in target networks. Operators use C2 communication to send commands to a compromised system, prompting it to execute actions such as downloading data, updating its configuration, or even deleting itself. The C2 implant can also initiate communication by sending statistics or valuable files, asking for new commands, or beaconing back to report that the system is online, along with its location and current status. Cyber threat actors often establish C2 infrastructure such as domain names, IPs, and websites one to six weeks prior to infiltration.
C2 functionality is widely known, and many firewalls, IDS/IPS, and other security devices and controls can prevent adversaries from communicating directly to target systems or vice versa. To bypass these controls, threat actors continually develop more advanced C2 techniques, tactics, and procedures (TTPs). For example, C2 data can be embedded in the payload of a ping or in commands hidden in pictures hosted on public websites. Adversaries have used C2 in Twitter feeds and comments on trusted sites. They have also used C2 to establish proxies and email relays on compromised systems; they then communicate over known protocols and safe sites that are not blocked by security controls and devices. Phones plugged into compromised systems can be infected with malware that, upon USB connection, “calls” the C2 via cell phone towers, bypassing firewalls and other network defenses and facilitating communication between the infected host and the C2 while the phone’s battery charges. Some C2 communication methods use blinking LEDs (like a signal fire), vary CPU temperature (like a smoke signal), use the sounds of hard drives or PC speakers (like signal drums), and leverage electromagnetic spectrum waves to bypass the air gap to a nearby machine.
Threat actors layer C2 communications with obfuscation, encryption, and other confidentiality techniques to maintain contact with a compromised system without disclosing evidence of the commands to the victims. Adversaries may avoid detection by:
Advanced C2 TTPs can be particularly sinister, virtually undetectable, and hard to block. Consider the example of a Windows IT admin who has implemented such strict firewall controls that the only site they can visit is technet.microsoft.com, the official Microsoft web portal for IT professionals. Only the HTTPS protocol is allowed, antivirus is current and running, and the operating system is fully patched. No external programs such as email, Skype, or iTunes are running, with the exception of the Microsoft TechNet website, which the admin needs to do their job. That may sound secure, but consider that Chinese APT17 (also called Deputy Dog or Aurora Panda) encoded hidden IP addresses in comments posted on Microsoft TechNet pages—comments that communicated with a BLACKCOFFEE remote access trojan on a compromised system.5 If anyone had inspected proxy traffic, behavior analysis, anomaly heuristics, IDS signatures, antivirus, or firewall alerts, nothing notable would have indicated that malicious communications were happening.
Advanced defense efforts to counter sophisticated C2s typically involve air gapping the systems, but new C2 communication techniques have been developed in recent years. One example is using a USB loaded with rootkits or compromised firmware and malware that, once plugged into a system, initiate communications with the implant on the compromised system, collect the packaged data, and discreetly upload it for exfiltration to an external C2.
It is common for organizations to subscribe to multiple threat indicator feeds. These feeds continually supply the organization with malicious URLs, IPs, and domains that have been observed working as C2s. The organization will then alert and/or block those threats in their firewalls and security devices. This is a good starting point for defending against C2s, but there is an endless supply of new URLs, IPs, and domains, allowing threat actors to take up new identities and evade the threat indicator feeds. Both old and new approaches are needed to address C2s, some of which are suggested below.
Where relevant, recommendations are presented with applicable security controls from the NIST 800-53 standard. Each should be evaluated with the concept of C2s in mind.
In this chapter, we reviewed the various communication methods shinobi used to receive and send commands to allies. We described various modern C2 methods, along with their comparative shinobi methods. However, we only scratched the surface, as it’s very likely that the most sophisticated C2 techniques have yet to be discovered. Just like the best of the shinobi’s covert communication methods were never written down, we may never learn of the genius and creativity behind the most advanced C2 techniques. We discussed several best practices, including whitelisting and encryption inspection, as ways to mitigate an adversary’s C2s, but an ideal solution to the problem remains to be found.
In the next chapter, we will discuss shinobi call signs. These were methods of communicating with allies inside enemy territory by leaving unique marks or messages. Similar to a dead drop, call signs never leave the boundaries of an environment, so traditional methods of blocking or detecting C2 communication generally do not work against them.