Ikaros - An attack surface management framework for in-house teams

A presentation on Ikaros, an in-house attack surface management framework we built targeting product security teams.

Transcript

1. Ikaros
   An attack surface management framework for in-house teams
   

   View Slide

2. The Team
   and the PhonePe Appsec Team
   Prateek - Dev Bharath - ASM Techniques Praveen - Architect Pragya - Frontend Hitesh - Secret Scanning
   

   View Slide

3. Problem statement
   

   View Slide

4. An organisation has ever evolving digital foot print and
   attack surface. Security teams need to discover new
   assets, identify exploitable threats, monitor them and
   alert on them continuously.
   

   View Slide

5. A light weight, opinionated but
   fl
   exible framework using open source tools to -
   
   
   • Discover new assets
   
   
   • Identify exploitable threats
   
   
   • Monitor for new threats
   
   
   • Alert us on new threats
   What did we build?
   Ikaros
   

   View Slide

6. What does it look like?
   Ikaros
   

   View Slide

7. What does it look like?
   Ikaros
   

   View Slide

8. A security framework feedback loop
   

   View Slide

9. A security framework feedback loop
   

   View Slide

10. A security framework feedback loop
    

    View Slide

11. A security framework feedback loop
    

    View Slide

12. A security framework feedback loop
    

    View Slide

13. Ikaros - 10K Feet View
    Ikaros
    

    View Slide

14. Ikaros - 10K Feet View
    Seed Information:
    
    
    • Root domain names
    
    
    • IP addresses
    
    
    • Network ranges (CIDR)
    
    
    Ikaros
    

    View Slide

15. Ikaros - 10K Feet View
    Subdomain Sources: CT Logs, Search Engines, DNS Zone
    fi
    les, permutation scans, Scraping, Threat Intel
    APIs etc
    
    
    Related domains: Passive DNS datasets, TLS/SSL Certs etc.
    

    

    We use tools like OWASP Amass, Project Discovery Sub
    fi
    nder, Chaos DNS datasets, AltDNS to perform
    discovery.
    
    
    

    In future, we will be able to identify related assets such as Code Repos & SaaS services etc.
    

    

    Ikaros
    

    View Slide

16. Ikaros - 10K Feet View
    

    View Slide

17. Ikaros - 10K Feet View
    Assets:
    
    
    • Subdomains
    
    
    • Code Repos
    
    
    • SaaS subscriptions
    
    
    • Network ranges
    
    
    Ikaros
    

    View Slide

18. Ikaros - 10K Feet View
    

    View Slide

19. Ikaros - 10K Feet View
    Identify WAF/CDN/Load balancer: By analysing headers, IP ranges, DNS records etc.
    
    
    Identify Tech Stack: By analysing response headers, source code, Behaviour patterns
    etc.
    

    

    Identify services: Using Shodan Internet DB, Censys etc.
    

    

    In future, we will perform light weight active scans to improve accuracy and coverage.
    

    Ikaros
    

    View Slide

20. Ikaros - 10K Feet View
    Ikaros
    

    View Slide

21. Ikaros - 10K Feet View
    • Find all domains with valid DNS records (Active domains
    
    
    • For all active domains,
    fi
    nd if they have services exposed
    to the Internet (Passive scanning)
    
    
    • For all the services, identify the tech stack they are built on
    

    

    View Slide

22. Ikaros - 10K Feet View
    Ikaros
    

    View Slide

23. Ikaros - 10K Feet View
    • Find application vulnerabilities using patterns/templates We
    use Nuclei - an industry-grade open source scanner.
    
    
    • Find CVEs affecting the tech stack of a service. In future, we will
    integrate this with Sirius service
    
    
    • Find leaked sensitive information across the Internet (In
    Progress)
    Ikaros
    

    View Slide

24. Ikaros - 10K Feet View
    Ikaros
    

    View Slide

25. As a:
    
    
    I want to:
    
    
    So that:
    
    
    Security Engineer
    be able to scan the attack surface of my org
    
    really quickly
    I’m on top of the security issues without a delay
    

    View Slide

26. Distributed scanning using Ray
    

    View Slide

27. Ray is an open-source unified compute
    framework that makes it easy to scale AI
    and Python workloads.
    

    View Slide

28. View Slide

29. As a:
    
    
    I want to:
    
    
    So that:
    
    
    Ikaros user/dev
    have deep visibility into Ikaros framework at run time
    So that I can be sure of the scan completeness and
    
    debug issues
    

    View Slide

30. Observability in Ikaros
    

    View Slide

31. View Slide

32. As a:
    
    
    I want to:
    
    
    So that:
    
    
    Product Security Engineer
    be able to feed the internal information
    
    available in the org to the tool
    It improves the coverage of the tool
    

    View Slide

33. • Ikaros supports feeding information
    that is available in the org such as
    
    • Subdomains from the Nameserver
    Zone
    fi
    les (Route53 etc)
    
    • Ability to have team based alerting
    if the org structure is provided
    

    View Slide

34. As a:
    
    
    I want to:
    
    
    So that:
    
    
    Vulnerability Manager
    have insights into Ikaros
    fi
    ndings in a
    
    non tech/friendly way
    So that I communicate the information across the org
    

    View Slide

35. Visualisation in Ikaros
    

    View Slide

36. View Slide

37. • Take the input from IKAROS assets. Subdomain either keywords+Org(ORG+AWS_KEY).
    
    • In Secret Scanning tool depth(File,Repo,Owner) can be de
    fi
    ned.
    
    • Based on the above params it crawls through Github APIs to
    fi
    nd the results wrt input provided by the user.
    
    • If results is identi
    fi
    ed, based on the depth it perform the cloning and secret detection operation. 

    

    So good thing about this tool is if you search for the keyword --> if that key is present on that
    fi
    le it identi
    fi
    es and also other keys also are can be easily identi
    fi
    ed.
    The current tool which are present are identi
    fi
    es the results and manually observation is required and it
    fi
    nds speci
    fi
    c to the input provided by the user.
    Secret Scanning :
    

    View Slide

38. View Slide

39. Future road map
    

    View Slide

40. • Open Source the project with
    documentation
    
    • More tools to be integrated == more
    coverage
    
    • Fine tune the secret scanning engine
    
    • Report generation capabilities
    
    • Fine grain control over modules to run and
    scheduling
    
    • Real time scanning capabilities
    
    •
    

    View Slide

41. Thank you!
    

    View Slide