Beginners Guide to OSINT

Slide 1

Slide 1 text

about me

Slide 2

Slide 2 text

really sucked at school

Slide 3

Slide 3 text

Age 12 18 14 16 work experience 20 *

Slide 4

Slide 4 text

No content

Slide 5

Slide 5 text

time to regroup

Slide 6

Slide 6 text

- Enrol in IT Program at NSCC - Get job with NSCC - Design and Build their first Security Monitoring Infrastructure - Deploy to 21 locations (13 campuses) throughout the province The Plan*: * OK, not really at all but incredibly that’s how it played out

Slide 7

Slide 7 text

No content

Slide 8

Slide 8 text

No content

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

open source developer

Slide 11

Slide 11 text

open source contributor

Slide 12

Slide 12 text

working for a really cool company

Slide 13

Slide 13 text

Next-generation, Deployable Defensive Cyberspace Operations (DCO) Infrastructure (DDI) prototype kits for Cyber Protection Teams (CPTs) *

Slide 14

Slide 14 text

moon shot ~1 year No VC $

Slide 15

Slide 15 text

No content

Slide 16

Slide 16 text

Beginners Guide to OSINT paul halliday | AtlSecCon Halifax | April 2016

Slide 17

Slide 17 text

So what is threat intelligence?

Slide 18

Slide 18 text

in the beginning, there was a whole lotta nothing

Slide 19

Slide 19 text

good guys

Slide 20

Slide 20 text

bad guys

Slide 21

Slide 21 text

threat intel provider

Slide 22

Slide 22 text

Take 1 Data

Slide 23

Slide 23 text

No content

Slide 24

Slide 24 text

No content

Slide 25

Slide 25 text

Source: iSIGHT Partners - What is Cyber Threat Intelligence and why do I need it? what we really care about

Slide 26

Slide 26 text

“Evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard.” Source: Gartner - Deﬁni[on: Threat Intelligence Threat Intelligence:

Slide 27

Slide 27 text

= = Take 2 More Data

Slide 28

Slide 28 text

No content

Slide 29

Slide 29 text

Take 3 Narrative 5 KM = = ETA 5min

Slide 30

Slide 30 text

No content

Slide 31

Slide 31 text

= = data intel but, add a narrative and URL IP FILEHASH DOMAIN USER EMAIL CERTHASH IOCs (by themselves) are just data

Slide 32

Slide 32 text

Source: David Bianco Indicators of Compromise (IOCs) The Pyramid of Pain “..knowledge about adversaries and their motivations, intentions, and methods..” refactoring effort =

Slide 33

Slide 33 text

types of OSINT

Slide 34

Slide 34 text

specific threats numerous trackers

Slide 35

Slide 35 text

No content

Slide 36

Slide 36 text

No content

Slide 37

Slide 37 text

No content

Slide 38

Slide 38 text

No content

Slide 39

Slide 39 text

No content

Slide 40

Slide 40 text

No content

Slide 41

Slide 41 text

No content

Slide 42

Slide 42 text

generic bad

Slide 43

Slide 43 text

Community Votes

Slide 44

Slide 44 text

non-specific threat (or perhaps no threat at all) Exit Nodes

Slide 45

Slide 45 text

some carry more weight than others many types, but keep in mind meaningful metadata little or no metadata

Slide 46

Slide 46 text

stay calm. more importantly though: threat indicators are not signatures

Slide 47

Slide 47 text

a simple use case

Slide 48

Slide 48 text

DNS Blackhole google.ca facebook.com cbc.ca badplace.ru reallybadplace.nl twitter.com cnn.com …. ? domains limitations 1. http:/ /dropbox.com/evilpayload.exe.txt 2. http:/ /95.28.37.16/evilpayload.exe.txt 3. http:/ /reallybadplace.nl/evilpayload.exe.txt (indicators)

Slide 49

Slide 49 text

a more advanced use case

Slide 50

Slide 50 text

DNS Log HTTP Log Connection Log SSL Log SMTP Log Files Log …..? The Bro Network Security Monitor Logging Framework

Slide 51

Slide 51 text

01100001 00100000 01110111 01101000 01101111 01101100 01100101 00100000 01100010 01110101 01101110 01100011 01101000 00100000 01101111 01100110 00100000 01100100 01100001 01110100 01100001 00100000 01101000 01100101 01110010 01100101 00100001 00100001 Intel::ADDR Intel::URL Intel::SOFTWARE Intel::EMAIL Intel::DOMAIN Intel::USER_NAME Intel::FILE_HASH Intel::FILE_NAME Intel::CERT_HASH Intel Types Intel.log #fields indicator indicator_type meta.source meta.url meta.do_notice meta.if_in 000007.ru Intel::DOMAIN MalwareDomains http:/ /malwaredomains.com/files/domains F - intel metadata args type Wow. More logs.. Now what?

Slide 52

Slide 52 text

Timestamp UID* Origin Response Indicator Type Where Sources super important

Slide 53

Slide 53 text

multiple log matches 1. connection log shows the protocol 2. intel log shows a bad IP address 3. ssh log shows an authentication failure 1 2 3 Timestamp UID* If we follow the UID from the intel hit, what do we see?

Slide 54

Slide 54 text

https:/ /intel.criticalstack.com Free!