Using Robots to Fight Bad Guys

Turning hubot into a DFIR sidekick...

Presented at BSidesDFW and updated for BayThreat 2013.

Transcript

1. using robots to fight bad
   guys
   turning hubot into a dfir sidekick…
   

   View Slide

2. scott j roberts
   dfir-er…?
   whiskey drinker
   star wars nerd
   !
   i do other things too…
   

   View Slide

3. making it easier to work together
   than to work alone….
   

   View Slide

4. View Slide

5. incident response is what
   happens after you get hacked
   

   View Slide

6. core elements
   - open source intelligence
   - network forensics
   - system forensics
   - reverse engineering
   - penetration testing & vulnerability management
   

   View Slide

7. tools & techniques
   -
   teams & organizations
   

   View Slide

8. how works
   

   View Slide

9. a little about GitHub
   - optimized for happiness
   - work when
   - where you want
   - reduce unnecessary processes
   - results
   - asynchronous
   - multidevice
   1%
   20%
   49%
   30%
   sf US
   world wanderers
   

   View Slide

10. bro do you even chat?
    - GitHub lives in chat
    - async (searchable, read back, push notifications)
    - multi device (laptop, tablet, phone)
    - collaborative
    - so we built tools around it
    

    View Slide

11. View Slide

12. a customizable, kegerator-
    powered life embetterment robot
    

    View Slide

13. what is hubot?
    - node.js based chat bot
    - coffeescript based actions+
    - redis based "brain"+
    - chat via shell & campfire+
    - deployable on unix, windows, & heroku+
    

    View Slide

14. View Slide

15. connectors
    

    View Slide

16. scripts
    built in scripts,
    community scripts,
    &
    your own scripts
    

    View Slide

17. how GitHub uses hubot
    - deploy & monitor servers via puppet
    - deploy & monitor code via capistrano & jenkins ci
    - monitor systems via nagios
    - update GitHub's status site
    - manage ops pager alerts from pager duty
    - remember things about people
    - look up funny pictures
    

    View Slide

18. View Slide

19. “ChatOps”
    - chatops is about a shared operations experience
    - hides the ugly
    - gives you mobile support everywhere
    

    View Slide

20. –Jesse Newland
    “By placing tools in the conversation everyone
    is pairing all the time.”
    

    View Slide

21. –Ryan Tomayko
    “This was always my main motivation with
    Hubot - teaching by doing by making things
    visible. It's an extremely powerful teaching
    technique.”
    

    View Slide

22. View Slide

23. View Slide

24. View Slide

25. hubot vtr
    

    View Slide

26. goal: adapt chatops for ir
    - automate common ir tasks
    - make it easier to collaborate with other incident
    responders for improved response and teaching
    - untie ir from a desk
    - learn some new technologies
    

    View Slide

27. making it easier to respond to incidents
    together than alone…
    

    View Slide

28. we already were
    - /firewall - manipulate host firewalls
    - /host-fw-port - manipulate the firewall on host
    - /nagios - interact with nagios
    - /pstree - show process tree on host
    - /puppet - manipulate a puppet agent
    - /whois - show info about an addr
    - /logs - get application logs from a given service
    - /twitter - posting to & monitoring twitter
    - secret stuff i can’t share but i promise is awesome…
    

    View Slide

29. throwback
    - open source intelligence
    - network forensics
    - system forensics
    - reverse engineering
    - penetration testing
    

    View Slide

30. hubot vtr
    - code name generator
    - pipl
    - yara
    - virustotal lookup (ip,
    url, hash)
    - geolocate ip address
    - my web of trust lookup
    - generate reputation
    links
    - reverse dns
    - shodan
    - short url expander
    

    View Slide

31. community modules
    announce
    availability
    deadline
    http-info
    isup
    news
    pypi
    sms
    

    View Slide

32. writing hubot scripts
    - coffeescript = javascript + python
    - tons of examples
    - documentation matters
    - pull requests welcomed
    

    View Slide

33. View Slide

34. View Slide

35. View Slide

36. View Slide

37. View Slide

38. View Slide

39. View Slide

40. msg.random
    

    View Slide

41. msg.random
    

    View Slide

42. reverse dns
    

    View Slide

43. geolocate ip
    

    View Slide

44. rhodey
    - not everyone writes coffeescript &
    security types love python
    - creates a local REST api for building
    new VTR services
    - built using flask
    - mostly an example framework at the
    moment, but PRs are welcome
    

    View Slide

45. why rhodey
    - some things are easier to write in python
    - take advantage of already available python libraries
    for incident response
    - allows local actions
    - gives control of networking & protects from third
    party snooping
    

    View Slide

46. rhodey first cut
    

    View Slide

47. View Slide

48. View Slide

49. View Slide

50. View Slide

51. View Slide

52. View Slide

53. View Slide

54. View Slide

55. View Slide

56. things to build
    - vtr helper library
    - “the list”
    - merging more pull requests (i hope!)
    

    View Slide

57. –Doug McIlroy
    “This is the Unix philosophy: Write programs
    that do one thing and do it well. Write programs
    to work together. Write programs to handle text
    streams, because that is a universal interface.”
    

    View Slide

58. development
    - terminal based chat
    - built locally
    - run from the command line + in memory redis
    

    View Slide

59. View Slide

60. dfir whiskey lounge
    - campfire based chat
    - built off a digital ocean vps
    - heroku (1 dyno) + redis to go brain
    - flint for osx & ios
    - we call him “Woodhouse”
    

    View Slide

61. live demo…
    always a terrible idea
    

    View Slide

62. takeaway
    - it’s better to respond together
    than alone
    - Hubot can help you automate,
    collaborate, mobilize, &
    beautify
    - coffeescript has a couple core
    patterns that make it easy to
    build new scripts
    

    View Slide

63. bonus takeaway
    learn
    to
    Ship code
    

    View Slide

64. links & errata
    - hubot
    - hubot vtr scripts & hubot vtr rhodey
    - chatops at github - jesse newland
    - programming butler: hubot scripts explained
    - code school: learn coffeescript
    

    View Slide

65. shoutouts
    - @rtomayko & @jnewland ~ hubot & chatops
    creators
    - @technicalpickles ~ for dealing with my constant
    questions
    - @technoskald, @jcran, @mattjay, & other
    contributors
    - everyone who exposes json endpoints
    

    View Slide

66. sroberts@github.com
    GitHub
    twitter
    {
    @sroberts
    

    View Slide