presentation uh today it's on screen
it's a Mirza burhan bag who's here same
time yesterday the great Hospital hack
great I cannot join you today personally
on this stage but I'll try to be there
next year hopefully so let's start with
the presentation
so today my talk will be on the great
Hospital hack uh we did for a hospital
industry we do retiming assessment for
multiple financial institutions and the
health industry as well so we came
across a test and uh that was an
assessment uh I cannot forget because we
did a lot a lot in that so I'll be
covering a lot of point in that today
and I'll be explaining what where they
were lacking and what we did so let's
start with the presentation
so few words about myself as you're
already aware that my name is marz
abrahambik and I'm working as a senior
security consultant and a UK based firm
and I'm always CP certified with some of
the known credentials and I was heavily
involved in the bug bounty hunting
program in back 2012 2013 and was
awarded and honored by Google Microsoft
Facebook Amazon uh there are a lot of
companies uh which I cannot put the name
over here so I've spoken on the big
stages like chriscon
um black at MIA last year and last
chapters I've spoken for a lot of Lost
Chapters in Islam about b-sides and uh
yeah a lot of things going on uh the Lee
hack this year which happened in the
Paris so I've worked for the financial
institutions I've worked for the health
industry government industry so I have
quite a large experience that of my and
nowadays I'm more interested in the red
teaming and the stock will be covering a
lot of things about my red team
experience for an organization that we
did earlier as you already will aware
there's a saying there are only two type
of companies those who have been hacked
and those that will be so no matter what
how many you're putting the boxes
security boxes in your company or you
are thinking that you're uh safe but uh
I must say that nothing has been patched
successfully or completely so there is a
loophole there is someone waiting for
you for you to make mistakes so what
happens uh just take care of your boxes
security boxes and let's see what
happens next now if I talk about the
hospital attack surface because I'm
talking about the hospital redeeming
right now so I'll be covering a lot of
things that considered to be uh what we
can say a tax service for a hospital in
hospital industry or the health industry
if you want to say so there are a large
quantity of diverse endpoints because a
lot of vendors are there and you're
putting all the boxes uh compliance
requirements tools applications mobile
applications a lot of endpoints are
there and you need to cover those as
well Insider taxes there are a lot of
people who have gained the excess and
who have the access it is pretty much
hard for anyone in the I.T team to
conclude all the access at one time so
you have to look for the groups then you
make the subgroups and then we give the
permission access and we check the logs
simultaneously if you have the little
sock system installed in your
organization and there are spear
phishing attacks as well going on for
the hospital hospitality industry as
well and the health industry as well if
I'm not wrong because we we are very
much afraid of the uh health issues so
what happens uh some people are very
well aware about the social engineering
but those who are not they're the
what can I say they're the victim for
the social engineering attack for the
spearfishing yeah uh then High exposure
of the third party components because as
I mentioned earlier large quantities and
points uh every vendor comes with their
own tools set of tools applications data
the apis are exposed there are a lot of
things going on in the markets so let's
catch up with some facts uh behind the
breaches we will be discussing a few of
them that what happened how this has
happened so it is estimated but it's not
the actual value 42 percent uh was
penetrated by The Outsiders 59 person
were involved inside it because uh most
of the time most of the time we have
seen that the attack has been initiated
from the inside so it's kind of inside a
job because they have the access to the
uh management area as well they have the
access to the uh what we can say the
RFID cars the access control list and
all the other things so that considered
to be an Insider threat attacks as well
top patterns that has been observed were
the malicious uh errors in the
application or the web application apis
that kind of thing privilege misuse
basically uh if I'm if I'm privileged to
use the data center or uh to access the
DB so uh I can give the access to
someone because uh of the social
engineering or something else so yeah
web applications web applications are
heavily involved in the health industry
nowadays as well uh why because most of
us check the reports online rather than
going to the lab or the hospital so we
prefer the mobile application API or the
web application so they are the very
very vulnerable point and points if you
you can see that so the data compromise
was the uh that that's just uh stats and
we are updating that as well uh for the
next one 72 percent Medical Data 34
person personal data and 25 percent
credentials were exposed and hacked
during the the multiple attacks what can
you say there are thread actors working
continuously for every industry so few
of them were Club is astral And Hive
there are a lot of more predictors who
are working against the uh Health
industry and they are considered as apt
growth because they are working day and
night to just get your health data out
of the system some of the notable data
breaches if I just have to mention over
here Alabama Health System forced to
limit hospitals are after our ransomware
attack yes we have observed that the
health industry uh faces the ransomware
attack because the medical data and the
health uh record of the patient is more
critical than anything in the hospital
and if you lose that you might face some
problem in the market and the code as
well so yeah that's uh pretty much real
world example that was hit by a hospital
hospital was hit by a ransomware and
yeah that happened actually not exactly
related to the hospital or the health
industry but I just want to say and
explain that how apt works there are a
lot of apts working for the different
Industries there is a group Lazarus and
they're working for the financial and
the banking industry they are working
day and night to get the data out of the
bank and they're making new new
techniques to procedures and the
processes and there is a Bangladesh
banking attack there uh they took around
uh 81 million US Dollars and uh that was
stopped but there was an attack so there
is a group and they were working on
something so for the financial industry
there are separate apt actors but for
the health and the hospital industry
there are a lot of different actors
working right now so let's start with
the attack pattern that what we have
done and what we are going to follow uh
one by one is stream by stream that what
we did how we did that what we have
found that in the attack so I'm going to
just demonstrate you and a tag that we
did for a hospital masking all the data
because of the confidentiality and I'll
try to explain you the process that how
you can start the red teaming assessment
for Hospital health industry or any
industry in that case so let's start
with the first thing we did the wi-fi
hacking simple pretty simple uh entry
point in an organization so Wi-Fi attack
we use a Karma attack using evil twin
attack where we launched the uh another
Wi-Fi with the same name and force the
people to disconnect from the original
one and to connect back to ours that
will bring us two things that can bring
us the hashes as well in the
communication if you are trying to
capture that and
most of the time we can get the clear
part uh clear text password as well so
let's see what happens next so initially
we launched the uh Wi-Fi attack because
that's pretty much loophole for everyone
in that hospital and there's University
operated in that as well so there are
students teachers staff admin
Finance people and all the other people
as well they are connecting to the wi-fi
system of that
organization and most of them are
vulnerable to our attack and we force
down them to disconnect from the
original one and connecting back it's a
pretty simple attack WiFi attack we used
to do for the organizations and most of
the people have connected that and we
got the ntlm hashes in that we got the
plain text passwords in that and we got
a lot of thing if I just want to uh tell
you about the data how much data we have
got through that so we successfully
collected 600 plus credentials either in
clean tracks on the ntlm no worries we
will try to uh bypass it by tracking the
password and tlm they're most common
things we can use right so
what we did we use the GPU rigs to break
the password internally and because we
cannot offer that ntlm has to some cloud
service or uh someone else because that
is uh uh that what we don't want to do
right so we built the rakes inside the
uh organization office and we try to
crack the password and yeah we
successfully got the password cracked
after the succession of the password
tracking uh we got multiple uh plain
text passwords or through which we start
the investigation by in gathering the
information what kind of user do we have
what students are having what exactly uh
the high privilege users are using
because we have a complete intranet
accounts and all the other things so we
scratched that one by one and here I
want to bring the point that red aiming
assessment is an assessment that doesn't
count the days because there's an
assessment if you are locking that
assessment for the 5-10 days that won't
be helping the redeemers to do their job
it's a ongoing process and we scratch
the back at any time of the day at any
time of the night and we try to get the
data out of the organization so next
step we start the intelligence threat
program and what we did we tried to
collect everything from those users that
we have just uh cracked so first I would
like to tell you that what we have found
and what's the impact of those things
some of the things that we have found
are the user which privilege accesses so
now uh there's a bell ringing in my mind
that what we were doing that we were
capturing all the credentials and we are
trying one by one hard and hard that
that is there any backup is there any
config file is there any password that
is stored in the plain text is there any
Powershell strip there are a lot of
things going on in my mind desktop host
name and the local administrators uh
because if I can run the command and the
software and the local admin and I can
privilege back to the 80 so I can run
anything inside the organization and
connect back to the outside world let's
see what happens so uh we have found
these soccer ports as well we we have
gained the access to the sock system as
well to see all the reports emails um
Outlook access inside the organization
so we can read every email that is going
through the sock to the users and and
there are a lot of things going on in
our mind network configuration files to
read the data uh to see what kind of
data they are using creating our own ACL
these are things going on in our mind
that uh if we can get the access on
these one by one we can capture the
whole organization in just a day because
network configuration we can set up the
ACL sock report so we can delete our our
traces back and local admins we can
install anything we want to do yeah
bitlogger Keys there's more instructions
bit logger key is that most interesting
thing that there are a lot of uh drives
that are locked with the BitLocker
because they contain the sunset
information right we put the bit logger
to save all the information but now I
have the key so I can retrieve the
password don't retrieve but I can uh
open up the drive impact was very high
because we can access the emails we can
access the stock reports uh daily
operations what's going on in the
organization how they are tracking us
basically the main point was in our mind
that uh if we can access these sock
reports or sock system so we can see
that how they are planning something
against us in the uh period to attack so
one day before I can see what they're
planning what they're putting the
filters and all the other things so the
next day we can plan a attack
accordingly so there are a lot of things
going on but right now we don't have
anything in hand so let's move forward
so next thing uh ad enumeration we name
it uh domain dominance because we are
going for the 80 right now so uh I just
want to own the domain and all the other
things so by scratching some emails and
some reports we found there is an email
uh which was titled administrative right
access form and it contains a list of
users and the email says as you can see
as discussed with Mr blah blah kind of
find the list of the users for
administrative rights now you can see
that we have the list of the users they
have given the access as an
administrator and then the previous
captured attack we have the list of the
users so now we can compare to them and
we can run the we can run as a local
admin on the system now let's see what
happened next so we created a local user
Mr X as a part of the local admin crop
now what happens if I can execute the
command from there if I can run the
software on the script run the mimikets
and all the other things so now it won't
be stopping me because I am the part of
the local admin group right Microsoft
Defender antivirus exclusion we just
copier files we copy the mimic it the
most important thing in the attack right
now uh we copy that in a folder and we
create some exclusions in the antivirus
that please do not scan them do not
delete them or just exclude them while
you're scanning anything so in that was
nitty and the organization part the
antivirus is not scanning our mimikets
the most dangerous thing that could
happen to an organization after that we
run the power sploit that enumerated
domain admin groups Enterprise admin
groups a lot of thing going on in that
organization that we have captured we
are we we were a short of uh data saving
devices hard drives external hard drives
because there are lot of data coming in
with the documents not just the tags
with the documents and all the other
collections of the PDF Blueprints and
what's on what not because we are just
collecting the data after that we can
filter that out and we will see what we
have to do but right now the main goal
is to capture everything that we are
getting from that organization
so after the hard work of ours we were
able to find an active directory backup
so I was not sure how old it is what
does it contains but backup is a backup
you you can find anything and maybe
maybe I can use it for some purpose so
let's see what happens we found the uh
basically it shows the location of the
backup we navigated to that location and
we found a lot of thing going on in that
system so what we try to do we try to
just copy and uh see what the files
contains so now we tried the ntds.dit
file we try to extract the content of
that file to see what happens in this so
uh ntds.dit file that contains a
database for the active directory it
contains the password hashes uh maybe it
can contain thousands of caches right
now so let's see there is a system file
as well the boot key and all the other
things for that purpose so what we did
we just extracted that and we try to
open and extract the content of that
file and boom what we found we are just
decrypting the file and there were 28
000 Plus hashes in that file that was a
boom movement for us because we can and
track the hashes we can see what's going
on in the organization that can contain
the sog management Finance admin
directors there are a lot of things
going on in our mind so we move forward
with that and we try to crack the
passwords as much as we can do so we
have tracked the password there were
these service credentials there were
privileged accounts weak password hashes
user mailbox jump servers there are a
lot of thing going on so what we try to
do we try to crack the passwords and
write uh reuse that to see what's going
on and after a few moments of the hard
work we were able to capture the most
important thing in the network that is a
Golden Ticket those who know what is a
gold indicate that's perfectly fine but
those who don't know about the golden
ticket the golden ticket file is
something uh that makes you unrestricted
and there's access to every system every
domain every user in the network so you
can annexes everything in the network
but there's a backup of the ad but we
are not sure if it's gonna work or not
so we tried that and hopefully yes we
did that and that work in the network
and what we did next We Run The mimikets
yeah because we were the local admin as
well we have the credential for that and
we made the anti-virus exclusion as well
in the directory so now we can run the
mimikits purely plainly as we are
planned so we try to Traverse the
directories it denies We Run The mimikes
and then what happens we try to access
that directory by escalating the
Privileges yes so we were able to
Traverse the directories we were able to
see the reports and all the other things
now the main thing that is more
interested for me to capture all the
health record data record because that's
the critical thing and the sock reports
that's a critical thing for an
organization to display that you are
vulnerable and your data can be leaked
out so now moving to the third phase of
the attack which is a network compromise
we have captured the credentials we have
dominated the 80 and we have got the
golden ticket now we are moving towards
the network compromise we will see the
firewalls we will see the vpns we will
see the scan reports let's see what we
can find okay some of the artifacts that
we have discovered during this phase
were the vulnerability assessment scan
report so we were very well aware what
kind of vulnerabilities are going on in
this network or the machines and where
this is specifically particularly
vulnerable right now device
configuration files the firewall
configuration files we can access that
very easily we can see the ACLS and all
the other things SSL VPN user with their
access level this is the most critical
thing because I can if I want to uh
transfer data inside or outside I'm just
looking for the VPN and the SSL access
level user so I can connect from the
external to the internal and drivers
back back to the data that I want to
send Network inventory almost everything
was captured and we were just hitting it
one by one in the face so we can capture
all the data so accessing the firewall
was the first thing we connect to that
and we try to capture the firewall and
now let's see what happens we log into
the 40 gate account and we are trying to
firewall back during the firewall how we
created a user that is a super admin
with a some particular pretty same name
as the previous one so no one will
suspect that this is newly created if
the lock says that says but and then
with the Naked Eyes no one can consider
that this is a malicious backdoor right
so we created that and we try to log in
with that specific user firewall was
back door now what we create try to
create we we we log into the system we
try to the uh login of the ad admin
rights and we see how we can manipulate
the ACLS and there were a lot of things
that we have tried which is not
mentioned over here uh but I'll try to
just give you a brief overview that what
we did simply we just back door the
firewall by creating a user these all
techniques and the procedures are pretty
simple if you find a loophole right the
main purpose of this assessment was to
get into that organization and if you
are inside the organization for once and
you can play your tactics your
procedures and all the other things
they're pretty simple thing right
trading a admin account on the firewall
that's a pretty simple but to get access
to that point is the main thing so yeah
we we created the user with the read and
write access everything was organized
everything was planned and we uh allowed
the access to the telnet as well if you
want to take the telnet of that machine
or the firewall to change the rules ACL
so yeah we did that and in the meantime
we were creating that we were scratching
the emails as well uh another team was
doing that they were scratching the
emails and they noticed that there were
some emails that the support IDs were
created there are support agents support
people and they were creating the IDS
for them so there was an email which
says that few users are removed and some
of them have given the privilege right
what we can do we have the users we have
the passwords we tried one of them and
yeah we can login into the uh firewall
once again and now we are accessing it
with the support IDs previously captured
now we don't have to use our own
credential that we have created uh back
door but we have used use the similar
one that we found over the email now the
main thing that I was looking for
previously is a sock report and the sock
monitoring how they're working and what
they are chatting about so we found a
ticket that states that there were some
users were created and we were not aware
of they were accessing something we are
not aware of and a user was created on
our device and were not informed about
there are a lot of complaints from them
that there a lot of user has been
created given the X's but the sock team
was not aware of anything that has
happened so there are a lot of things in
our hand now we have the sock reports we
have the VA reports Network identities
now what we are going to do we are
creating the malicious support IDs on
the active directory now we have created
the back door on the firewall we are
just keeping our hand tied over the
network for that we create the people
support IDs on the ad so it looks legit
for anyone that looks inside the 80 or
the network or if someone is accessing
something on the network with the
support ID so they will consider yeah
that's a support ID that's not a
malicious thing to do so we just created
the support IDs and after the creation
of the support IDs we try to log in
again to test that if that works or not
and yes it worked like a charm we were
logging into the firewall with the
support ID that is created just recently
so you are following the trail how we
entered and how we are Marching towards
our goal so that's the perspective of
the red teaming assistant that start
from somewhere do whatever you want to
do and just get the access to the main
core system so now we are confirmed that
uh we are sure that the access control
or the support IDs are working perfectly
same goes with the email boxes we
created the user ID we try to access the
emails and we have seen a lot of emails
going on in the organization alert stock
reports because every time we do
something they send the alert uh user
account was deleted user account was
created we removed those emails by the
way while we are doing the test we
remove those emails so no one get the
suspicious of that what's going on we
check the email there's alert new user
created we delete that so no one has
seen that email that someone has created
something on the network so that's a
planned activity that we were doing for
that organization
so ladies and gentlemen we are moving
towards the final phase of the attack
now we are trying to access the data
center and the backups uh of the
complete Organization for that we try to
back door the HP Superdome as well uh
the credentials were not cracked they
were found in the plain tags in a file
we scratched uh previously so we log in
and just the way we backdoor the network
device we backdoor the HP Super Dome and
to add up the spices we take the
connection from the VPN from the
external to the internal and we allow
the access on the firewall ACL that we
can access that anytime any day uh we
want and we can take the data from that
as well because we have everything we
have a backups and we have the admin
users with the ACL controls and
perfectly fine now what we did we tried
to take the access to a host that is
responsible for the health database and
it contains the Oracle uh backup service
and we saw that thing and we tried to
take the next step and we try to check
the backups if we can get those backup
out of the system
this is the moment that I was waiting
because I was just waiting for the
records I was not interested in the
firewall I was not interested in the VPN
but I'm interested in the records
because this is the most critical thing
for an organization they're trying to
save that they're trying to put the
boxes in front of that thousand of boxes
people working day and night to secure
that but achieving going there getting
the files is the most satisfying thing
in the whole attack so now we have the
files we have the host we have the
backup and yeah
that was a white uh red teaming but
white ball so we have to inform
everything and we inform everything
securely according to the NDA and we try
to make it happen as soon as possible
rather than someone getting hands on
that we try to report it back and fix
that next morning and after that we
create the report and all the other
things to the management but the main
goal is to make sure it is secured on
the same day because it's very very
extremely critical thing that we have
just found so ladies and gentlemen look
for everything uh there's a code that I
always use you can patch every system in
this world but you cannot patch humanist
stupidity because why I say that the
social engineering is the main part of
the red teaming attack either we do with
the Wi-Fi either we do with the
cafeteria either I try to clone your
card by the way we try to clone the card
as well in this attack which I have not
mentioned over here because something
are confidential so we try to clone the
card of the user from the data center
and we try to access that as well
getting our close change and making
ourselves someone else from industry and
yeah we did that as well in this
assessment so ladies and gentlemen just
look out for everything anything in your
organization and red teaming is an
assessment uh that everyone every
organization should consider should do
so no one takes their data out of the
organization without their permission so
with this note thank you very much
everyone if you have any questions I'll
be answering them uh we're here
and if you want to contact uh me there
are certain details and you can scan the
barcode as well so thank you very much
everyone for your time have a nice day
ahead and happy Hunting yeah bye
okay ladies and gentlemen that brings
you close to the presentations in the
security Dome 4 30 the Tyson crook makes
their Awards following the competition
at their stand and five minutes later 4
35 the CEO of the event organizer will
deliver the closing ceremony thank you
very much for your attendance