Dissembling Ferret

Transcript

1. Clay, Justin Dissembling Ferret May 5, 2017 1 / 33

2. Dissembling Ferret: A Free/Open Source Firewall Testing Suite Clay Wells,

   Justin Klein Keane @ clayball, @madirish2600 https://github.com/clayball/Dissembling Ferret May 5, 2017 Clay, Justin Dissembling Ferret May 5, 2017 2 / 33

3. Overview Introduction Problem TCP/IP Primer Covert TCP/IP Channels - Methods

   Used Dissembling Ferret Demos Future Work References / Resources Links Thank You / Questions Clay, Justin Dissembling Ferret May 5, 2017 1 / 33

4. Introduction Inspiration for this project • Research data exfiltration techniques

   • Research covert TCP/IP channels • Develop a firewall penetration testing tool suite Clay, Justin Dissembling Ferret May 5, 2017 2 / 33

5. Introduction - View From The C-Suite • Security controls enter

   the environment with a baseline configuration 1. How and if this configuration is ever validated is debatable RFP, while legally binding, won’t help in an incident • After deployment security control, like any system will drift Clay, Justin Dissembling Ferret May 5, 2017 3 / 33

6. Introduction - View From The C-Suite (cont) • How you

   track drift and spot a failure in a security control is critical 1. Main paths Security audit or penetration test Lucky catch by staff Security incident RCA 2. None of these paths are optimal • Configuration control is essential to validate assumptions of effectiveness of security controls Clay, Justin Dissembling Ferret May 5, 2017 4 / 33

7. Introduction - Dissembling Ferret • DF will demonstrate failure in

   controls in many circumstances • While it may not be necessary to contact vendors to address the problem 1. It is imperative that teams know their gaps and blind spots to plan effectively Clay, Justin Dissembling Ferret May 5, 2017 5 / 33

8. Introduction - Continuous Review • DF and other hacker tools

   need to be operationalized in your environment • Only through regular technical testing can you retain confidence in your security posture • Many of these tools are free 1. If it’s on Kali you should be running it! 2. If you can’t staff for this operation consider outsourcing • Responding to drift may make the difference between an emergency config change and a security incident. Clay, Justin Dissembling Ferret May 5, 2017 6 / 33

9. Introduction - Be Proactive • Keeping up to date with

   the latest tools may be hard 1. Consider making a ”purple team” part of your pen test engagement 2. When the pen testers leave you should be running their tools as part of your remediation plan 3. None of the tools are overly hard and are fun so staffing will likely be easy (junior staff) Clay, Justin Dissembling Ferret May 5, 2017 7 / 33

10. Overview Introduction Problem TCP/IP Primer Covert TCP/IP Channels - Methods

    Used Dissembling Ferret Demos Future Work References / Resources Links Thank You / Questions Clay, Justin Dissembling Ferret May 5, 2017 8 / 33

11. The Initial Problem Data exfiltration methods • DNS - dnn506yrbagrg.cloudfront.net

    • HTTPS - encrypted • HTTP, FTP? - can this be prevented? • Reverse shell, bind shell to TCP port - good luck! Clay, Justin Dissembling Ferret May 5, 2017 9 / 33

12. Firewalls, Trust Code handling data from untrusted sources is worth

    review. • Firewall Software • Proxy • Host-based Clay, Justin Dissembling Ferret May 5, 2017 10 / 33

13. Types of Firewalls • Packet-Filtering, Stateless - layer 3, 4

    • Packet-Filtering, Stateful - layer 3, 4 • Next-Generation, Stateful Inspection - layer 3, 4, 7 Clay, Justin Dissembling Ferret May 5, 2017 11 / 33

14. Attack Landscape Stateless • FIN Scanning, SYN Ambiguity, UDP, Fragmentation

    Stateful • SYN-FIN & SYN-RST, UDP, Directionality, Fragmentation • IP TTL, IP Options, Zero-Length Fragments • Layering Issues, Spoofing External, Spoofing Internal Clay, Justin Dissembling Ferret May 5, 2017 12 / 33

15. Overview Introduction Problem TCP/IP Primer Covert TCP/IP Channels - Methods

    Used Dissembling Ferret Demos Future Work References / Resources Links Thank You / Questions Clay, Justin Dissembling Ferret May 5, 2017 13 / 33

16. TCP/IP Primer - IP Header Clay, Justin Dissembling Ferret May

    5, 2017 14 / 33

17. TCP/IP Primer - IP Header IP fields we’ll be setting,

    like an envelope • IPID • SRC • DST Clay, Justin Dissembling Ferret May 5, 2017 15 / 33

18. TCP/IP Primer - TCP Header Clay, Justin Dissembling Ferret May

    5, 2017 16 / 33

19. TCP/IP Primer - TCP Header TCP fields we’ll be setting

    • Sequence Number • Source Port • Destination Port • TCP FLAGS (C E [U A P R S F]) • Window Clay, Justin Dissembling Ferret May 5, 2017 17 / 33

20. Overview Introduction Problem TCP/IP Primer Covert TCP/IP Channels - Methods

    Used Dissembling Ferret Demos Future Work References / Resources Links Thank You / Questions Clay, Justin Dissembling Ferret May 5, 2017 18 / 33

21. Covert TCP/IP Channels - Methods Used Methods used for data

    exfiltration • Initial Sequence Number • IP ID • ACK Bounce Clay, Justin Dissembling Ferret May 5, 2017 19 / 33

22. Overview Introduction Problem TCP/IP Primer Covert TCP/IP Channels - Methods

    Used Dissembling Ferret Demos Future Work References / Resources Links Thank You / Questions Clay, Justin Dissembling Ferret May 5, 2017 20 / 33

23. Dissembling Ferret Inspired by: Covert Channels in the TCP/IP Protocol

    Suite, 1996 by Craig Rowland. Clay, Justin Dissembling Ferret May 5, 2017 21 / 33

24. Smuggling Data - Sequence Numbers m u l t i

    p l i e r = 16777216 message=’ Hi ’ for char in message : e x f i l C h a r = ord ( char ) ∗ m u l t i p l i e r print e x f i l C h a r #decode=chr ( e x f i l C h a r / m u l t i p l i e r ) 1207959552 1761607680 Clay, Justin Dissembling Ferret May 5, 2017 22 / 33

25. Smuggling Data - IP ID m u l t i

    p l i e r = 256 message = ’ Hi ’ for char in message : e x f i l C h a r = ord ( char ) ∗ m u l t i p l i e r print e x f i l C h a r #decode=chr ( e x f i l C h a r / m u l t i p l i e r ) 18432 26880 Clay, Justin Dissembling Ferret May 5, 2017 23 / 33

26. Smuggling Data - ACK Bounce pkt = IP ( s

    r c=d e s t i n a t i o n , dst=’ 65.199.32.22 ’ ) / TCP( sport=dstport , dport =80, f l a g s=’S ’ ) Clay, Justin Dissembling Ferret May 5, 2017 24 / 33

27. Overview Introduction Problem TCP/IP Primer Covert TCP/IP Channels - Methods

    Used Dissembling Ferret Demos Future Work References / Resources Links Thank You / Questions Clay, Justin Dissembling Ferret May 5, 2017 25 / 33

28. Demo - Dissembling Ferret - Layer 0x3 Youtube link Dissembling

    Ferret- https://youtu.be/smhYFqf3ARU Clay, Justin Dissembling Ferret May 5, 2017 26 / 33

29. Demo - Fireaway - Layer 0x7 Youtube link Fireaway -

    https://youtu.be/oiDcKMuSOk0 Clay, Justin Dissembling Ferret May 5, 2017 27 / 33

30. Overview Introduction Problem TCP/IP Primer Covert TCP/IP Channels - Methods

    Used Dissembling Ferret Demos Future Work References / Resources Links Thank You / Questions Clay, Justin Dissembling Ferret May 5, 2017 28 / 33

31. Future Work • Building upon Dissembling Ferret • Wily Possum

    - A Firewall Penetration Tool Suite 1. Scan and Analyze 2. Reports 3. Network Mapping (maybe) Clay, Justin Dissembling Ferret May 5, 2017 29 / 33

32. Overview Introduction Problem TCP/IP Primer Covert TCP/IP Channels - Methods

    Used Dissembling Ferret Demos Future Work References / Resources Links Thank You / Questions Clay, Justin Dissembling Ferret May 5, 2017 30 / 33

33. References / Resources Reference • Craig Rowland’s Paper Resources •

    Dissembling Ferret • Fireaway • Wily Possum • Firewalking • Port Scanning without the SYN flag Clay, Justin Dissembling Ferret May 5, 2017 31 / 33

34. Overview Introduction Problem TCP/IP Primer Covert TCP/IP Channels - Methods

    Used Dissembling Ferret Demos Future Work References / Resources Links Thank You / Questions Clay, Justin Dissembling Ferret May 5, 2017 32 / 33

35. Thank you Special thanks to.. Charles Rumford, John O’Brien, and

    the ISC Networking Team Christine Brisson and Warren Petrofsky Questions? @ clayball, @madirish2600 Clay, Justin Dissembling Ferret May 5, 2017 33 / 33