Automated Human Vulnerability Scanning with AVA

Presented at BlackHat USA 2015 by Laura Bell (SafeStack)

Transcript

1. Laura Bell
   Founder  and  Lead  Consultant  -­‐  SafeStack
   @lady_nerd    laura@safestack.io  
   h6p:/
   /safestack.io
    
   Automated human
   vulnerabillity
   scanning with AVA
   

   View Slide

2. #BHUSA
   #protectyourpeople
   
   To  join  the  discussion  (but  play  nicely  please)
   

   View Slide

3. This  talk  might  make  you  feel  
   uncomfortable.
   
   Sorry.
   

   View Slide

4. …I  want  you  to  feel  uncomfortable
   

   View Slide

5. I  like  people
   

   View Slide

6. Border  Security
   
   ApplicaEon  Security
   
   Threat  Intelligence
    
    
   

   View Slide

7. people  are  the  path  of  
   least  resistance
    
    
   

   View Slide

8. In  this  talk
   The  Problem  
   The  need  for  and  lack  of  human  defense  
   The  Tool  
   We  built  AVA…  and  we  think  you  might  like  it  
   The  Challenges  
   Building  human  security  systems  is  hard…    
    
   

   View Slide

9. we  are  comfortable  when  we  talk  
   about  technical  vulnerability
   

   View Slide

10. we  do  not  empathise  or  sympathise  with  
    machines
    They  are  inanimate  objects.
    

    View Slide

11. technology  is  only  part  of  the  security  picture
    technology people process
    

    View Slide

12. technical  systems  are:    
    reviewed  
    scanned  
    penetraEon  tested
    

    View Slide

13. processes  are  audited
    

    View Slide

14. what  about  people?
    

    View Slide

15. The problem  with  people
    

    View Slide

16. human vulnerability is natural
    

    View Slide

17. fear  of  rejecEon
    fear  of  exposure
    fear  of  physical  harm
    fear  of  loss
    

    View Slide

18. love
    

    View Slide

19. humans  are  sufficiently  predictable  
    to  make  it  suitably  annoying    
    when  we  fail  to    
    predict  their  behaviour.
    

    View Slide

20. The  modern  approaches
    

    View Slide

21. compliance  has  us  racing  to  the  boKom
    

    View Slide

22. we  watch  video  training  or  e-­‐learning
    we  make  posters
    we  Eck  boxes
    

    View Slide

23. Security  
    Awareness  
    EducaEon  
    really  sucks
    

    View Slide

24.  
     
     
    Posters  don’t  work  
     
    Stop  it  already.
    

    View Slide

25. this  is  not  how  people  learn
    go  ask  the  educaEon  and  psychology  communiEes
    

    View Slide

26. View Slide

27. we  shame  the  human  vicEms  of  
    human  security  aKacks*
    *while  secretly  doing  the  exact  same  things
    
    

    View Slide

28. we  forget  that  we  are  a  connected  species
    

    View Slide

29. why  don't  we  acEvely  assess  
    and  test  our  human  security  
    risk?
    

    View Slide

30. we  don't  test  because  it’s  too  easy
    

    View Slide

31. people  can’t  be  taught
    people  are  lazy
    people  are  stupid
    

    View Slide

32. s/people/we/g
    

    View Slide

33. we  don't  test    
     
    because  it  makes  us  feel  uncomfortable
    because we don't want people to get hurt
    because it’s hard
    because  we  don’t  know  how  to  fix  it
    because we don't want people to get fired
    

    View Slide

34. border  devices  are  not  enough
    

    View Slide

35. AVA
    

    View Slide

36. A
    first generation
    proof of concept
    3- phase
    automated
    human vulnerability
    scanner
    

    View Slide

37. Know
    PHASE 1
    

    View Slide

38. We don’t know what our organisations look like
    

    View Slide

39. Human
    security
    risk is
    magnified
    by
    connection
    

    View Slide

40. Active Directory
    Twitter
    LinkedIn
    Facebook
    Email providers
    People
    Identifiers
    Groups
    Relationships
    Data
    

    View Slide

41. Location
    Time stamps
    Sender
    Receiver
    User agent
    friends
    contacts
    frequency
    aliases
    profiles
    Last login
    Pw Expires?
    Disabled?
    Influence
    Admin?
    

    View Slide

42. test
    PHASE 2
    

    View Slide

43. Threat
    injection
    and
    behaviour
    monitoring
    

    View Slide

44. Attack vectors that mean something
    Email
    Social Networks
    Removable Media
    Files and honeypots
    SMS
    

    View Slide

45. Email attacks that go beyond phishing
    Email
    phishing Internal request
    social
    panic
    Direct request External request
    favour
    authoritative
    

    View Slide

46.  
    The  URL  may  be  different  on  different  messages.  
    Subject:  Security  Alert:  Update  Java  (*See  Kronos  Note)  
    Date:  February  22,  2013  
    ***********************************************************
    *************  
    This  is  an  automaNcally  generated  message.  Please  DO  NOT  REPLY.    
    If  you  require  assistance,  please  contact  the  Help  Center.  
    ***********************************************************
    *************  
    Oracle  has  released  an  update  for  Java  that  fixes  50  security  holes,  
    including  a    
    criNcal  hole  currently  being  exploited  in  the  wild.  
    The  IT  Security  Office  strongly  recommends  that  you  update  Java  as  
    User generated and publicly sourced attacks
    

    View Slide

47. Removing the boundaries between business and personal
    

    View Slide

48. Instant, scheduled and recurring
    Security fails when it is treated like a special event
    

    View Slide

49. Give the option of succeeding
    and reinforce good behaviours
    

    View Slide

50. analyse
    PHASE 3
    

    View Slide

51. Behaviour Vs. time
    

    View Slide

52. Measuring
    impact
    of
    training
    

    View Slide

53. And now for something a
    little bit different
    

    View Slide

54. Bridges, weak links and targeting
    

    View Slide

55. Pivoting
    and
    propagation
    

    View Slide

56. You know what would be fun?
    Predictive risk behaviour analysis
    

    View Slide

57. Technologies
    • Django
    • Postgresql
    • Celery
    • Redis
    • Bootstrap
    • Open source
    • GPL
    • docker
    • Integrates with exchange,
    ad and google apps for
    business
    

    View Slide

58. The  inevitable  demo
    

    View Slide

59. View Slide

60. Case  studies
    

    View Slide

61. The  process
    • Candidate  and  volunteer  requests  submiKed  to  social  
    media  and  contacts
    • Volunteers  briefed
    • Removed  volunteers  including  children,  students  or  
    health  data
    • AcEve  directory  users  and  groups  collected  from  acEve  
    directory  server  and  stored  in  json  files
    • Json  files  processed  to  remove  personal  informaEon
    • Ava  know  used  to  parse  and  idenEfy  paKerns
    

    View Slide

62. You  want  to  show  this  at  BlackHat?  
    LOL  
    Wait,  you’re  serious?  
    Nope.  Nope.  Nope.  Nope.  Nope.  Nope.  Nope.  Nope.  
    Yes!  
    …  please?  
    …  yes?  
    

    View Slide

63. 540  people  and  idenEEes  
    3  organisaEons  
    public  and  private  sector  
    educaEon  and  commerce  
    
    

    View Slide

64. 19  adminstrator  accounts  
    400  non-­‐expiring  
    4  groups  per  account  
    35  never  logged  in  
    oldest  password  =  11  years  
    newest  password  =  3  months
    

    View Slide

65. In  2015,  why  is  this    
    sEll  an  issue?
    

    View Slide

66. The  challenges
    

    View Slide

67. a  public  interest  security  tool
    

    View Slide

68. ….from  everyone
    success  requires  engagement
    

    View Slide

69. is  this  even  legal?
    

    View Slide

70. The  law  in  this  space  is  immature
    

    View Slide

71. publically  available
    previously  known
    already  published
    

    View Slide

72. can  we  assess  human  
    vulnerability  on  this  scale  
    compromising  the  privacy  the  
    people  we  assess?
    

    View Slide

73. Privacy  is  about  protecEng  people
    Know
    Update
    
    Delete
    Ask  
     
    

    View Slide

74. AVA  Ethics  and  Privacy  Board
    ObjecEve,  RepresentaEve,  Independent,  CollaboraEve
    new  members  welcome  to  apply
    

    View Slide

75. Open.  Honest.  Plain  English
    

    View Slide

76. Providing  people  with  the  
    informaEon  they  need  to  protect  
    themselves  and  their  privacy
    

    View Slide

77. Is  this  technically  possible?
    

    View Slide

78. Building  new  things  is  hard
    

    View Slide

79. Scale  that  has  to  be  visible
    

    View Slide

80. There  is  a  
    reason  why  
    compromised  
    email  accounts  
    have  value
    Can  we  simulate  
    aKack  aliases  in  a  
    manageable  way?
    

    View Slide

81. Nobody  has  Eme  for  more  appliances
    

    View Slide

82. Where  next?
    

    View Slide

83. From  research  project  to  real  life  
    TesEng
    ConEnuous  IntegraEon
    Roadmap  development
    Feature  development
    

    View Slide

84. Security  culture  change  as  a  service?
    

    View Slide

85. IntegraEon
    Google
    Facebook
    TwiKer
    Linkedin
    Microsom
    Slack
    GitHub
    
    If  you  are  reading  this  and  
    work  for  these  places,  we  
    should  probably  talk.
    
    

    View Slide

86. Ethics  board
    Developers
    Testers
    ContribuEon
    DocumentaEon
    Sociologists
    UX  and  design
    
    

    View Slide

87. volunteers  wanted
    Safe  
    consensual  
    human  security  
    science
    

    View Slide

88. TL;DR
    We  have  a  people  problem  
    AAVA  is  an  early  alpha  prototype  
    We  want  a  future  of  con>nuous  human  vulnerability  assessment  
    The  road  ahead  is  hard  
    Privacy,  ethics,  momentum,  security,  scaling  and  much  more  
     
    

    View Slide

89. Learn more or get involved
    hKps:/
    /github.com/SafeStack/ava  
    now  with  docker  build    
     
    @avasecure  
    hKp:/
    /avasecure.com  
    hKp:/
    /ava.rqd.org/  
    hello@avasecure.com  
    
    

    View Slide

90. Laura Bell
    Founder  and  Lead  Consultant  -­‐  SafeStack
    @lady_nerd    laura@safestack.io  
    h6p:/
    /safestack.io
     
    Questions?
    #protectyourpeople
    

    View Slide