Tweet
Tweet

Slide 1

Slide 1 text

mike arpaia / facebook osquery: approaching security the hacker way @mikearpaia

Slide 2

Slide 2 text

why is openness in security important?

Slide 3

Slide 3 text

what's osquery? why is openness in security important?

Slide 4

Slide 4 text

what's osquery? why is openness in security important? open source security design decisions

Slide 5

Slide 5 text

how can we work together? what's osquery? why is openness in security important? open source security design decisions

Slide 6

Slide 6 text

being open

Slide 7

Slide 7 text

open source makes life easier

Slide 8

Slide 8 text

no secrets are required we can be open in security •secrecy has stifled innovation •little software to help defend against modern attacks •reimplementing the same solutions, poorly •let's do the math

Slide 9

Slide 9 text

visualizing attacks and the defenses against them attacker math 101 popularized by Dino Dai Zovi and Dan Guido •attacker will take the least cost path through an attack graph •the juice has to be worth the squeeze https://www.trailofbits.com/resources/attacker_math_101_slides.pdf

Slide 10

Slide 10 text

visualizing attacks and the defenses against them attack graphs start overcome obstacle overcome obstacle overcome obstacle accomplish objective

Slide 11

Slide 11 text

visualizing attacks and the defenses against them attack graphs start overcome obstacle overcome obstacle overcome obstacle accomplish objective

Slide 12

Slide 12 text

visualizing attacks and the defenses against them attack graphs start overcome obstacle overcome obstacle overcome obstacle accomplish objective

Slide 13

Slide 13 text

visualizing attacks and the defenses against them attack graphs start overcome obstacle overcome obstacle accomplish objective overcome obstacle overcome obstacle overcome obstacle

Slide 14

Slide 14 text

we can alter the path of attackers by altering our defenses

Slide 15

Slide 15 text

the future of security will be written in vim it's an engineering problem

Slide 16

Slide 16 text

osquery

Slide 17

Slide 17 text

an open platform for host instrumentation osquery if you need to collect low-level information from an operating system then you should use osquery •small footprint •rich capabilities •solves real world problems

Slide 18

Slide 18 text

SQL for your infrastructure osquery use SQL queries to explore OS state •running processes •loaded kernel modules •active network connections •route table •firewall settings •installed software •much more

Slide 19

Slide 19 text

osqueryi

Slide 20

Slide 20 text

LaunchDaemons which run a binary at boot

Slide 21

Slide 21 text

running processes

Slide 22

Slide 22 text

processes listening on ports

Slide 23

Slide 23 text

more tables are being written every day many tables are available •acpi_tables •arp_cache •crontab •file_events •kernel_info •listening_ports •logged_in_users •mounts •pci_devices •processes •routes •shell_history •smbios_tables •suid_bin •system_controls •usb_devices •users •groups •rpm_packages •apt_sources •deb_packages •homebrew_packages •kernel_modules •memory_map •shared_memory •browser_plugins •startup_items

Slide 24

Slide 24 text

osqueryd

Slide 25

Slide 25 text

daemon for low-level host monitoring osqueryd know how the results of a query change over time •schedule a query on your hosts via a config
 •the daemon takes care of periodically executing your queries •buffers results to disk and generates a log of state changes •logs results for aggregation and analytics •run your query in differential or snapshot mode

Slide 26

Slide 26 text

event-based operating system introspection host event pub/sub stream subscribe to key OS events to create dynamically growing tables •subscribe to “publishers” •filesystem changes (inotify, FSEvents) •network setting changes (SCNetwork) •query the history of your host, as it evolves

Slide 27

Slide 27 text

event-based file integrity logging file integrity monitoring use wildcards to monitor important files on your hosts •/bin/* •/Users/*/Downloads/**

Slide 28

Slide 28 text

for config distribution and data infrastructure plugin system •simple plugin API •specify your plugins at runtime with a command-line flag filesystem http zookeeper configuration filesystem flume scribe logging

Slide 29

Slide 29 text

design decisions

Slide 30

Slide 30 text

lessons learned from MIDAS we knew that we could do better at •exposing capabilities safely •reducing engineering overhead •improving development culture

Slide 31

Slide 31 text

the problem exposing capabilities •sharing a capability required sharing the whole module •few example modules were released •dramatically limited the utility of MIDAS

Slide 32

Slide 32 text

the solution exposing capabilities SQL allows for simple, flexible analysis •tables allow us to give away the answers without giving away the questions •capabilities can be configured instead of developed

Slide 33

Slide 33 text

the problem engineering overhead in MIDAS, capabilities were written in Python •"complex" code to solve simple problems •security people are not programmers

Slide 34

Slide 34 text

the solution engineering overhead with SQL, asking a question doesn't require writing complex code •low-level operating system analytics with attention to UEX SELECT address, mac, count(mac) AS mac_count FROM arp_cache GROUP BY mac HAVING count(mac) > 1;

Slide 35

Slide 35 text

the problem development culture open source code was not actively used internally •codebase began to drift •contributions weren't getting pulled in

Slide 36

Slide 36 text

the solution development culture we do 100% of our engineering in the open, on GitHub

Slide 37

Slide 37 text

fighting together

Slide 38

Slide 38 text

and now our watch begins working together to stay safe many different industries are working together •offensive security researchers •defensive security professionals •entrepreneurs in infrastructure/security

Slide 39

Slide 39 text

questions https://osquery.io