Post Exploitation in Developer Environments

This talk will zoom in to the cache of goodies which developers leave lying around that an attacker could leverage access valuable information and/or to pivot through a target environment. It will also highlight some of the tools available to developers and InfoSec professionals to find and prevent these sorts of information leakages.

Every day, developers interact with a variety of source-code repositories and environments, often both inside their corporate firewalls and outside on public hosting platforms such as GitHub.com and Amazon AWS. These source-code repositories can provide a wealth of information about a target environment, in addition to being a potential value all on its own. Best of all, a large amount of information about an environment can be gleamed quietly without having to actively scan the network.

If you are a penetration tester, are you able to find this information in your customer’s environment? Do you know how to help their developers prevent these leakages in the first place? Remember “prevention is ideal, but detection is a must!”

Transcript

1. LLNL-PRES-761319 This work was performed under the auspices of the U.S. Department of Energy by Lawrence Livermore National Laboratory under contract DE-AC52-07NA27344. Lawrence Livermore National Security, LLC Post Exploitation in Developer Environments SANS Pen Test HackFest Summit 2018 Ian Lee @IanLee1521 2018-11-13
2. LLNL-PRES-761319 2 § Computer Engineer in Livermore Computing @ LLNL § High Performance Computing — Red Team — ISSO § Gov. Open Source Evangelist — software.llnl.gov — github.com/llnl § Many other hats... whoami
3. LLNL-PRES-761319 3
4. LLNL-PRES-761319 4
5. LLNL-PRES-761319 5 https://3.bp.blogspot.com/-w2URcR6u9uQ/VENiIYIDDsI/AAAAAAAAH_c/GC_4nywJh2M/w800-h800/female-hacker.jpg
6. LLNL-PRES-761319 6 Got a shell!
7. LLNL-PRES-761319 7
8. LLNL-PRES-761319 8
9. LLNL-PRES-761319 9 VICTORY !! https://pixabay.com/en/children-win-success-video-game-593313/
10. LLNL-PRES-761319 10 IN THE CLOUD https://commons.wikimedia.org/wiki/File:%22Don%27t_Discuss_Secrets_on_the_Telephone%22_-_NARA_-_514138.jpg
11. LLNL-PRES-761319 11
12. LLNL-PRES-761319 12
13. LLNL-PRES-761319 13
14. LLNL-PRES-761319 14
15. LLNL-PRES-761319 15
16. LLNL-PRES-761319 16 https://pixabay.com/en/history-blackboard-chalk-chalkboard-998337/
17. LLNL-PRES-761319 17
18. LLNL-PRES-761319 18
19. LLNL-PRES-761319 19 https://www.unixmen.com/prevent-ssh-disconnecting-sessions/
20. LLNL-PRES-761319 20
21. LLNL-PRES-761319 21
22. LLNL-PRES-761319 22
23. LLNL-PRES-761319 23
24. LLNL-PRES-761319 24 https://www.flickr.com/photos/christiaancolen/33904011850
25. LLNL-PRES-761319 25
26. LLNL-PRES-761319 26
27. LLNL-PRES-761319 27
28. LLNL-PRES-761319 28
29. LLNL-PRES-761319 29 Not just for attackers penetration testers http://trulyhappylife.com/wp-content/uploads/2015/02/Persistence-1024x637.jpg
30. LLNL-PRES-761319 30
31. LLNL-PRES-761319 31 CTRL + A, CTRL + D
32. LLNL-PRES-761319 32
33. LLNL-PRES-761319 33
34. LLNL-PRES-761319 34
35. LLNL-PRES-761319 35
36. LLNL-PRES-761319 36 Recap § Loot — App tokens — SSH keypairs — Developer source code (important IP) — Passive recon (other servers / services) — Built in persistence § Mitigations — Training / monitoring — Static Source Code Analysis — Version Control-aware Analysis • https://github.com/18F/git-seekret • https://github.com/awslabs/git-secrets https://cdn.pixabay.com/photo/2017/11/07/23/55/pirate-2928821_960_720.jpg
37. LLNL-PRES-761319 37
38. LLNL-PRES-761319 38
39. LLNL-PRES-761319 39
40. LLNL-PRES-761319 40
41. LLNL-PRES-761319 41 https://software.llnl.gov
42. Thank you! @IanLee1521 ian@llnl.gov This document was prepared as an account of work sponsored by an agency of the United States government. Neither the United States government nor Lawrence Livermore National Security, LLC, nor any of their employees makes any warranty, expressed or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States government or Lawrence Livermore National Security, LLC. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States government or Lawrence Livermore National Security, LLC, and shall not be used for advertising or product endorsement purposes.