Thinking Evil Thoughts

Talk from Software Circus 2016 on Threat Modeling

Transcript

1. (without introducing more risk) Thinking Evil Thoughts Puppet Gareth Rushgrove A taste of threat modeling
2. (without introducing more risk) @garethr
3. (without introducing more risk) Gareth Rushgrove
4. (without introducing more risk) This Talk What to expect
5. - What is threat modeling? - Getting the scope right - Identifying risks - Using conferences to hack people Gareth Rushgrove
6. Introduce some security language to help you navigate the domain Gareth Rushgrove
7. Dive straight into examples Gareth Rushgrove
8. Empower you to ask questions more than provide easy answers Gareth Rushgrove
9. (without introducing more risk) Threat modeling A brief introduction
10. Gareth Rushgrove a procedure for optimizing network security by identifying objectives and vulnerabilities THREAT MODELING
11. - Determine scope - Identify threat agents and attacks - Understand existing countermeasures - Identify vulnerabilities - Prioritise risks - Identify countermeasures Gareth Rushgrove https://www.owasp.org/index.php/Category:Threat_Modeling
12. Inside each of us, there is the seed of both good and evil. It's a constant struggle as to which one will win. Gareth Rushgrove “ ” Eric Burdon
13. (without introducing more risk) Think evil.
14. (without introducing more risk) Getting the scope rights Avoiding gaps in your threat model
15. Ignoring part of your system when considering security is a common mistake Gareth Rushgrove
16. Gareth Rushgrove the attack surface of a software environment is the sum of the different points (the "attack vectors") where an unauthorized user (the "attacker") can try to enter data to or extract data from an environment. ATTACK SURFACE
17. (without introducing more risk) Example What is Production? Gareth Rushgrove
18. LOAD BALANCER FRONT END BACK END DATABASE PRODUCTION?
19. LOAD BALANCER FRONT END BACK END DATABASE PRODUCTION? PEOPLE DESKTOPS CI SERVER
20. LOAD BALANCER FRONT END BACK END DATABASE PRODUCTION? PEOPLE DESKTOPS CI SERVER HYPERVISOR MANAGEMENT MONITORING
21. Do you protect your CI stack as well as your production database? Gareth Rushgrove
22. Could I execute a query on your production database if I compromised your CI server? Gareth Rushgrove
23. Example Third party services Gareth Rushgrove
24. Gareth Rushgrove an entity which facilitates interactions between two parties who both trust the third party TRUSTED THIRD PARTY
25. Gareth Rushgrove a term in computer science and security used to describe a boundary where program data or execution changes its level of "trust". The term refers to any distinct boundary within which a system trusts all sub-systems (including data). TRUST BOUNDARY
26. Gareth Rushgrove
27. Why Serverless is a bad name Gareth Rushgrove
28. (without introducing more risk) There are still servers somewhere Gareth Rushgrove
29. How you think about the servers changes, and the respective risks and mitigations change. But servers still exist. Gareth Rushgrove
30. Why NoOps is a bad name Gareth Rushgrove
33. How you think about operations changes, and the respective risks and mitigations change. But operations still exist. Gareth Rushgrove
34. Your attack surface is bigger than you think Gareth Rushgrove
35. (without introducing more risk) Identifying risks The need to understand your system
36. Differences in how you perceive a system and how it actually works can be used to exploit it Gareth Rushgrove
37. Example Immutable infrastructure Gareth Rushgrove
38. Out systems are immutable, we don’t need runtime file integrity checking Gareth Rushgrove “ ” A possibly naive developer
39. Gareth Rushgrove unchanging over time or unable to be changed. synonyms: unchangeable, fixed IMMUTABLE
40. (without introducing more risk) Containers are not immutable by default Gareth Rushgrove
41. (without introducing more risk) Containers are not immutable by default Gareth Rushgrove
42. (without introducing more risk) Gareth Rushgrove $ docker run -d alpine /bin/sh \ -c "while true; do echo hello world; sleep 1; done"
43. (without introducing more risk) Gareth Rushgrove $ docker exec a7a01beb14de touch /tmp/surprise
44. (without introducing more risk) Gareth Rushgrove $ docker diff a7a01beb14de C /tmp A /tmp/surprise
45. (without introducing more risk) Gareth Rushgrove $ docker run --read-only -d alpine /bin/sh \ -c "while true; do echo hello world; sleep 1; done"
46. (without introducing more risk) Gareth Rushgrove $ docker exec 379150b2cf05 touch /tmp/surprise touch: cannot touch '/tmp/surprise': Read-only file syste
47. (without introducing more risk) Do your immutable EC2 instances have read-only filesystems? Gareth Rushgrove
48. (without introducing more risk) Most Immutable Infrastructure isn’t Gareth Rushgrove
49. (without introducing more risk) Without technical controls you only have social guarantees of immutability Gareth Rushgrove
50. (without introducing more risk) Hacking conferences Looking for vulnerabilities
51. Let’s assume your applications and infrastructure are super secure* Gareth Rushgrove * This probably isn’t true. You should worry about that as well.
52. - Penetration testing - Intrusion detection system - Web application firewall - Network firewalls - Malware scanning - Configuration management Gareth Rushgrove
53. Gareth Rushgrove How secure is your laptop?
54. - Hand maintained configuration - Updated whenever - No central monitoring - Administrative access - Single factor authentication Gareth Rushgrove
55. Can you push new Docker images from your laptop? Gareth Rushgrove
56. Can you create jobs on your Jenkins instance from your laptop? Gareth Rushgrove
57. Can you launch new replication controllers from your laptop? Gareth Rushgrove
58. Can you release new functions to Lambda from your laptop? Gareth Rushgrove
59. Real world threat
60. (without introducing more risk) As a hacker how do I own your laptop? The fun stuff
61. Where can I find hundreds of developer laptops… Gareth Rushgrove
62. Developer Conferences are a Target Rich Environment Gareth Rushgrove
63. Gareth Rushgrove More Internet Some Internet Marks iPhone FREE CONFERENCE WIFI Hacked Android CONFERENCE VENUE Private Software Circus Company next door Coffee shop downstairs Software Circus II Docker Corp Avengers Tower FON My Blackberry Nokia4ever ABANK
64. Gareth Rushgrove More Internet Some Internet Marks iPhone FREE CONFERENCE WIFI Hacked Android CONFERENCE VENUE Private Software Circus Company next door Coffee shop downstairs Software Circus II Docker Corp Avengers Tower FON My Blackberry Nokia4ever ABANK This is the official conference wifi right?
65. Gareth Rushgrove More Internet Some Internet Marks iPhone FREE CONFERENCE WIFI Hacked Android CONFERENCE VENUE Private Software Circus Company next door Coffee shop downstairs Software Circus II Docker Corp Avengers Tower FON My Blackberry Nokia4ever ABANK Or is it this one? Whatever, both work
66. Devices exist to man-in-the-middle wireless networks Gareth Rushgrove
67. Who has ever picked up a USB memory stick at a conference? Gareth Rushgrove
68. Gareth Rushgrove
69. USB devices exist which will run a script on connect (normally by impersonating a keyboard) Gareth Rushgrove
70. (without introducing more risk) DELAY 1000 COMMAND SPACE DELAY 500 STRING Terminal DELAY 500 ENTER DELAY 800 STRING echo 'RSA_PUB_ID' >> ~/.ssh/authorized_keys ENTER DELAY 1000 STRING killall Terminal ENTER Add my public key https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payload---OSX-Passwordless-SSH-access-%28ssh-keys%29
71. Local databases
72. Lots of people here are on Twitter and using the conference hashtag Gareth Rushgrove
73. Lots of people here are on GitHub with the same username Gareth Rushgrove
74. (without introducing more risk) $ curl -s https://api.github.com/users/<username>/events/public \ | jq '.[].payload.commits[0].author.email' \ | sort \ | uniq \ | grep -v "null" Email from GitHub user
75. an e-mail spoofing fraud attempt that targets a specific organization or individual, seeking unauthorized access to confidential data. Gareth Rushgrove SPEAR PHISHING
76. Hi <your name> Great to see you at <conference name here> last week. I thought you’d be interested in the container testing tool I mentioned. http://nothingevilhere.com. Would love to know what you think. Hopefully see you at DockerCon next year too.
77. (without introducing more risk) So you’re saying we’re all doomed? This is quite depressing now I think about it
78. Part of threat modeling is coming up with suitable mitigations to the risks identified Gareth Rushgrove
79. - 2 factor authentication - Time-limited credentials - Separation of duties - Two person rule - Configuration management Gareth Rushgrove
80. having more than one person required to complete a task. In business the separation by sharing of more than one individual in one single task is an internal control intended to prevent fraud and error. Gareth Rushgrove SEPARATION OF DUTIES
81. a control mechanism designed to achieve a high level of security for especially critical material or operations. Under this rule all access and actions requires the presence of two authorized people at all times. Gareth Rushgrove TWO-PERSON RULE
82. Gareth Rushgrove a process that identifies critical information to determine if friendly actions can be observed by enemy intelligence and determines if information obtained by adversaries could be interpreted to be useful to them. OPERATIONAL SECURITY (OPSEC)
83. Once you understand the threat you can seek out specific guidance Gareth Rushgrove
85. - Protect data in transit - Protect data at rest - Authentication - Secure boot - Platform integrity and sandboxing - Application whitelisting Gareth Rushgrove - Malicious code detection - Security policy enforcement - External interface protection - Device update policy - Event collection and analysis - Incident response https://www.cesg.gov.uk/guidance/end-user-devices-security-principles
86. Education. Education. Education. Gareth Rushgrove
87. Gareth Rushgrove
88. (without introducing more risk) Conclusions If all you remember is…
89. With Cloud Native approaches developers are nearer to production than ever before Gareth Rushgrove
90. The efficiency of modern tooling introduces new threats, and magnifies existing ones Gareth Rushgrove
91. Existing mitigations and security controls won’t be enough. You need to collaborate with security colleagues on new approaches Gareth Rushgrove
92. Threat modeling should be part of your development process Gareth Rushgrove
93. Gareth Rushgrove
94. Elevation of privilege
95. Gareth Rushgrove
96. (without introducing more risk) Thanks And any questions?