Pro Yearly is on sale from $80 to $50! »

Agile Pentesting - Cisco RTP Cyber Security Summit

Agile Pentesting - Cisco RTP Cyber Security Summit

Agile and Pentesting, Goalsetting, and ... are we doing it wrong?

E723a33d80fb7795bb9b514c2a558ff1?s=128

mosesrenegade

April 04, 2014
Tweet

Transcript

  1. 2014 RTP Cybersecurity Summit Session ID 18PT Called To Duty:

    AttackOps moses@cisco.com / @mosesrenegade
  2. © 2014 Cisco and/or its affiliates. All rights reserved. 64282

    Cisco Public Moses Hernandez | @mosesrenegade WARNING This talk may contain comments or opinions that at times may differ with those of cisco systems. The views expressed here do not necessarily reflect those of cisco systems. Audience discretion is advised.
  3. © 2014 Cisco and/or its affiliates. All rights reserved. 64282

    Cisco Public Moses Hernandez | @mosesrenegade [d3adlist$]./whoami About Me: Moses Hernandez Consulting Systems Engineer [at] cisco moses[at]cisco.com @mosesrenegade about.me/moseshernandez I break apps… …and networks…
  4. © 2014 Cisco and/or its affiliates. All rights reserved. 64282

    Cisco Public Moses Hernandez | @mosesrenegade © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  5. © 2014 Cisco and/or its affiliates. All rights reserved. 64282

    Cisco Public Moses Hernandez | @mosesrenegade - Hattori Hanzo “The truth lies at the heart of the art of combat” © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  6. AttacksOps: What? DevOps constructs in Security Space. Industry Says: • 

    Penetration Testing (Must) •  Red Teaming (Why Not?) •  “Attacker Emulation” (Who does this?) © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  7. AttacksOps: What? DevOps constructs in Security Space. Reality Is: • 

    Economics and Tools •  Strategies and Goals •  Machines vs Humans © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  8. © 2014 Cisco and/or its affiliates. All rights reserved. 64282

    Cisco Public Moses Hernandez | @mosesrenegade Rules of the road… Buy the ticket, take the ride §  Some goals for the session today: –  Hopefully: A changing of ‘how’ we conduct internal/external testing paradigms –  Potentially: Leave with some neat new tricks. –  Collectively: Connect the dots for everyone, where will be going. © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  9. §  Your going to see tools in here, some tools

    are considered to be somewhat ‘safe’. §  There will also be code in here that, well. Not so safe. © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade Your in for a ride. …Hold on.
  10. Tibet Case Study © 2014 Cisco and/or its affiliates. All

    rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  11. gh0stnet §  Example of Highly ‘Effective’ Campaign –  Consider that

    only 300-400 compromised hosts spread across the globe. –  “Highly effective” targeting. §  What does this show us? ü Goal Setting. ü Detection and Avoidance ü Data Collection and Gathering © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  12. Tooling §  It would seem that they employed a few

    strategies. –  Gh0strat – A remote access tool, which was Poison Ivy. –  Used Real Documents (PDFs) of interest from W.H.O. and other Organizations like the U.N., in order to deliver the gh0strat payloads. –  Spear phishing + well designed (Remote Access Trojan) RAT. © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  13. Emulate the Attacker? © 2014 Cisco and/or its affiliates. All

    rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  14. Demo Discretion. © 2014 Cisco and/or its affiliates. All rights

    reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  15. AttackOps: Architecture 2009 Style © 2014 Cisco and/or its affiliates.

    All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  16. AttackOps Example Architectures §  More than likely multiple levels of

    obfuscation. §  Looking for the Loot? Maybe its ‘big data-style’. (Fast Data?) –  Because you know, once you know what your after you can do more targeted mining. §  Purpose Built –  For example, purpose built ‘RATS’ with purposed built ‘Plugin Architecture’. –  Servers (Linux) to serve as software routers. §  Obfuscation, for example a "Darknet within THE Darknet. –  Why use White Tools when the Black Hat tools are ‘better’? © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  17. AttackOps Example Architectures Victims / Targets Victims / Targets Victims

    / Targets © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  18. AttackOps Example Architectures Compromised Server Watering Hole Attack? Software Router

    Raw Sockets or HTTP(S) Victims / Targets Victims / Targets Victims / Targets © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  19. AttackOps Example Architectures Compromised Server Watering Hole Attack? Software Router

    Raw Sockets or HTTP(S) C&C C&C Victims / Targets Victims / Targets Victims / Targets © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  20. AttackOps Example Architectures Attacker Compromised Server Watering Hole Attack? Software

    Router Raw Sockets or HTTP(S) C&C C&C Victims / Targets Victims / Targets Victims / Targets Data Collection © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  21. CLANDESTINE INFOTECH © 2014 Cisco and/or its affiliates. All rights

    reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  22. Defining the problem © 2014 Cisco and/or its affiliates. All

    rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  23. US § We are the problem. § …A big big problem… – 

    Tools – Which Tools do Attackers use? –  Techniques – What techniques do they use? What do we know they do? –  Procedures – What procedures do they employ? Why do they do that? © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  24. Attackers and Goal Setting §  Attacker Goals: ü Military Advantage ü Power

    ü Corporate Espionage ü Intellectual Property Theft ü Monies. $$$ §  Pen Tester Goals: ü Find all the “Vulnerabilities” ü “On time and On Budget” ü “Prove it” ü Fix all at once. ü “Bragging Rights” ü (More on this Later) © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  25. Tools? §  Attackers Don’t Use Our Tools! –  Obfuscation Through

    DDoS –  They use RATs §  Connection Optional §  Highly Stealth §  ‘User’ friendly §  “Customer First” §  Mobile Ready –  Motivations and Goals §  “Pen Testers” –  Use “Developers Tools” –  Lots of Command Line –  “Scripts” –  Connection Oriented §  Lose the Connection loose it all §  Not designed to be user friendly §  Mobile (YMMV) © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  26. Let’s fix it © 2014 Cisco and/or its affiliates. All

    rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  27. Three suggestions Better Tactics, Tools, Goaling

  28. Tactics: Agile and Waterfall… §  Many organizations are looking at

    Agile methods of software construction or assembly. –  (Notice I didn’t say development or creation… ) §  …most software today is ‘assembled…isn’t it? §  …most exploit frameworks are assembled though aren't they? §  We called the original method waterfall…. We call the new ‘better’ way ‘agile’. –  Its mostly about quick small feedback loops though isn’t it? © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  29. “Penetration Tests today are waterfall…” •  Me © 2014 Cisco

    and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  30. “Penetration Tests today are waterfall…” •  Me © 2014 Cisco

    and/or its affiliates. All rights reserved. Cisco Public Moses Hernandez | @mosesrenegade
  31. Waterfall vs Agile §  Tendency to be Lengthier Cycles § 

    Project Managed §  Features on Features §  Ready for the Big “Release” –  Think Windows NT, 2000, 2003 §  Agile tends to not have much of a Project Plan –  More Roadmap focused –  Smaller feedback loops –  Smaller features into production at a time. §  Think Version 1, 1.1, 1.2, 1.3 §  Maybe more ‘weekly’, bi-weekly, or ‘monthly’ outcomes.
  32. Tactics: Scrumy Goal Setting © 2014 Cisco and/or its affiliates.

    All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  33. Tactics: Scrumy Scrum Starts Goal Setting Operations Support © 2014

    Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  34. Tactics: Scrumy Scrum Starts Goal Setting Recon/ Vuln/ Mapping Operations

    Support Data Storage © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  35. Tactics: Scrumy Scrum Starts Goal Setting Recon/ Vuln/ Mapping Exploit

    Operations Support Data Storage © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  36. Tactics: Scrumy Scrum Starts Goal Setting Recon/ Vuln/ Mapping Exploit

    Operations Support Data Storage Post Exploit © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  37. Tactics: Scrumy Scrum Starts Goal Setting Recon/ Vuln/ Mapping Exploit

    Operations Support Data Storage Post Exploit Goals Met © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  38. Goaling: Jeopardy Style § Lets take a page out of our

    War Games! § Jeopardy Style Goaling –  Change from “Find All” to “Goals” –  Use Jeopardy style Game Boards. –  Make sure you have Finite Goals! §  No ambiguity. © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  39. Better Tools? § I think we need better tools. –  But

    for now, lets do the best with what we have. §  Demo: –  Waterhole attack, exploit of a Wordpress 3.5 Vulnerability released last year. –  Drop a BeefHook –  Roll to a Metasploit Listener delivering a Metasploit Backdoor. –  Potentially can be Browser Autopwn. –  Emulation of Exploit Kit Delivery + Waterhole Attack –  Not as workable as Poison Ivy, best effort. © 2014 Cisco and/or its affiliates. All rights reserved. 64282 Cisco Public Moses Hernandez | @mosesrenegade
  40. Demo Watch this…

  41. © 2014 Cisco and/or its affiliates. All rights reserved. 64282

    Cisco Public Moses Hernandez | @mosesrenegade WARNING The demo you are about to see is conducted in a controlled environment. It is the authors suggestion that the audience do not attempt to use all of the tools described without proper validation.
  42. © 2014 Cisco and/or its affiliates. All rights reserved. 64282

    Cisco Public Moses Hernandez | @mosesrenegade Thanks! Moses Hernandez moses@cisco.com @mosesrenegade