[Music]
okay
oh
hi everybody uh thanks for skipping
dinner or having dinner early i'm not
sure what you did but you stuck it
through so um i i did offer you know if
everybody's kind of sleepy and uh in
sort of a food coma we could like do a
guided meditation instead if you want or
maybe do a little power nap it's up to
you but um if not i'll go ahead and get
started
got my pointer so i'm robert wagner hi
um
mr minion on the twitters uh and you can
find me on linkedin as well
uh i um uh just did a quick introduction
to about
uh 50 i'm closer to 20 years of the
infosec experience now my first job uh
in a mosaic was as a third shift stock
analyst uh where we were running a 24x7
sock with only four people in one player
um so uh things were probably not as
difficult back then right we were
dealing with like slammer and sasser and
beagle and netsky but um i'm a
co-founder of hack for kids where you
may have seen our table over in one of
the villages uh we're a charity that
teaches kids about internet safety
security and ethics we use the lure of
hacking because hacking's cool to trick
them into stem sort of stuff right
amanda
and they love it um i'm on the board of
uh i say chicago
i love all things dogs motorcycles and
scuba and you can see i've even
points married two of my lups together
so
that's my 50 pound dog he's no longer
with this but he rode motorcycle for 14
years with me and was awesome um the
honorary wolf pup dad too those are some
wolf pups at wolf park that i honorarily
adopted which means i got to visit him
once and as you can tell i had bacon in
my pockets because they weren't all for
me um so
but getting on to the actual talk so
this talk is based on a a living deck
that was formed out of notes that i
started taking back when i was that
third shift sock analyst right and i
started to run into a problem that i
think everybody starts to run in which
was there was never enough budget to buy
the things we needed right it was like
boss there's a new problem and we need a
new person or a new tool or something
like that to cover it and boss would say
yeah
it's you know first month into the
fiscal year and we've already spent all
the budget so you're gonna have to wait
until next year comes around
make do with what you can
and that happens everywhere right we
need free easy ways to fill our gaps
unless you're lucky enough to have like
a really great breach right i mean
who what's a company here in milwaukee
that uh had a
huge breach and they got a blank check
after that to get all the security they
want yeah it's nobody nobody gets a
white check to do everything they want
um so
so as i was going hacker cons and uh and
i would be listening to talking someone
saying and if they had just done this
well i was like well i'm writing that
down um so this is a collection of all
those things that you know some of them
are common sense some of them if you're
new to infosec or if you weren't at that
talk
maybe uh maybe it's a little jump for
you to take home um but uh but first
thing that i noticed as i was talking
with my various peers in their
organizations was that the most
successful teams always started by
focusing on the most important tool
security tool in the in their
organization first um it's the best
place to start it's the tool everybody
has in their organization what's that
tool
yeah it's you not to call you guys tools
that's not my intent um but
uh i noticed that teams that worked
together to teach each other stuff um
that had bosses that let them go to
hacker conferences and stuff like that
did way more than the than the the tool
heavy shops right i saw a team of five
out security a team of 25 because the 25
had you know just like push button tools
and that's all they know how to do where
the other guys were teaching uh men and
women were teaching each other how to
script and how to write um like their
own root kit for point of sales devices
and all sorts of stuff like that and
that team was fantastic so um
and when we talked about uh yeah who
here hates this venn diagram i hate this
venn diagram because like every sales
person in the world uses it but i also
hate it because it never looks like this
we never have this beautiful balance of
people process and technology and we
give
equal amounts of tension attention and
dollars to all of them now
instead we tend to do what we focus on
technology and what does that do to your
infosec program makes it look like this
and nobody wants this is a description
for the rhythmosac program right so how
can we avoid that
so how do we avoid that and again how do
we avoid that when when our boss has
been telling us yeah there's no more
budget left for this year so let's start
with the people
um some group so
i know everybody here probably knows
about us people that may be watching
this later especially managers pay
attention because there is so many free
and cheap resources to level up your
people right um a quick thanks to many
of the people that uh that i got this
information from their every major
conference has their talks out on
typically youtube these days um hacker
cons like b-sides are cheap i when we
were trying to get trained up um i mean
i love sans sans classes are freaking
great right but back then they were like
four or five thousand dollars and
they're more expensive now so the boss
would be like well three of you get to
go this year and three of you right and
we all had to take turns um so but at
the same time i learned so much from
events like this so if you're a manager
and you're not letting your whole team
seriously go to an event like this where
it's like
a hundred bucks or so
for some of them but for the b-sides
even cheaper like 20 or free you are
pissing your nobody minds swear words
here right it's okay yeah okay if you
hate sword words say no don't say
anything no i'm sorry
but really you're you're you need to be
encouraging your teams to go to events
like this and giving them the time to do
it i i knew one company it was big
financial um they their cso would let
180 people take the day off to do an
internal ctf once every year freaking
amazing i mean other people
new to the industry they're just trying
to get really good at their job and
they're like hey why didn't you come to
the meet up or whatever and they're like
oh yeah my boss wouldn't give me like
the three hours in the afternoon off to
go to issa or one of the other meetups
that's ridiculous and that's how you
burn people out so don't do that um lots
of great people here to learn from a
quick list of just some of the people
that that have been really
uh great resources of information for me
hacks for pancakes and i know you all
know but she just puts out so much
information out there for free to help
people out as does everybody else i
started getting into some api security
and i found a couple of api resources
recently as well so check those people
out and jesus mig douglas puts out these
like amazing twitter threads of like
just awesome common sense security stuff
so uh so read his threads if you get a
chance
um but how do we know so that's us like
our you know our teams how do we level
up our users right we fight for the
users um
one of the best ways i've ever seen was
a presentation by ben 10 ben 0xa
and he did this at derbycon like 2012
2014 somewhere around there but the idea
was genius instead of forcing people to
watch those freaking security videos
that you'd rather rub glass in your eyes
than actually pay attention to he
decided to gamify security awareness so
he just it was simple he just made a
quick announcement to his uh his
organization he was a ciso there and he
said hey you know we're gonna have a
security contest you're gonna start
seeing some of those things that maybe
you would have learned about if you
would actually watch the video uh and
every person that reports any particular
thing the first person report this
particular incident or whatever
gets maybe i don't know five dollar gift
certificate to dunkin donuts he's going
to keep score at the end of the week 200
bucks to the person who did the best
right
by midweek people were trashed up you're
going down i'm totally gonna get more
points than you they start reporting
like the cfo for not wearing their
badges they're walking through the uh
the organization um somebody called
really quickly to report this strange
black box that was just outside one of
the side doors yeah it was a rodent
control box but still
people were paying attention in the best
one 15 minutes after he starts he gets a
call from a woman who's very excited
she's like ben ben i found one of those
things and he's like
what things she's like the things that
you said with the security and the stuff
and he's like
we haven't started yet
what are you seeing she's like oh this
thing pops up on my computer every once
in a while and says you know click here
to authorize i don't know what it is but
it's something like that just click here
to say okay yeah 15 minutes in he had a
real security incident he had turned his
people into carbon-based intrusion
detection sensors and it was beautiful
word of warning i did talk to a company
that actually tried this as well they
had a few users that were a little over
ambitious they started downloading
nessus and scanning for vulnerabilities
to really like yeah
and if your
users can do that you also have a bigger
problem right they shouldn't be
downloading necessary caps onto the
computers but i love the ambition right
so leverage it um
so uh okay uh so that's some people how
about process let's talk about process
um i
stumbled across this um there's a
presentation
about so we
using chaos engineering and security so
chaos security engineering and it's
brilliant so most of you heard of gas
engineering right netflix has been doing
a ton of stuff with it they've got chaos
monkey and the idea in chaos engineering
is
randomly break and make sure the
company still stays operational and the
fact that netflix is like yeah you can
do that you can totally do that you can
bring anything you want on purpose and
we better stay up and running brilliant
so how do we apply this to security so
uh so the ieee and uh uh kennedy takura
um published an entire uh white paper
about this um called cloud strike um he
presented on it besides berlin i was not
there for that one but that would have
been cool but in any event um he
presented a whole idea and how do we
apply that same kind of chaos to infosec
um so the the concept simple instead of
breaking stuff we're gonna inject flaws
into our process and into our
infrastructure and stuff so you create
user bob and then maybe you um
accidentally apply a policy to him that
he shouldn't have giving him more access
right and then you see how far you can
get into the organization if that
mistake happens because of course that
mistake would never really happen right
we wouldn't really apply a bad policy to
someone um and it's a great idea and the
framework that they created has a whole
scoring system um they've created uh
much like minor has categories for all
the different kind of things that you
can inject as flaws into your security
and then see how bad it can get and if
you've got a red team
leverage them tell you know tell them
we're going to start making bad things
happen in whatever environment and then
you know see if you can see if you can
find them and get in it's great
so passwords why why our passwords still
really the bane of our existence
hopefully you saw some of the wolf's
stuff over uh in in the tracks just
before this but not only does one simply
not use the same um
password for banking and twitter but how
many of you think you've got like domain
admins that are like oh i i have to
make a really strong password for my
banking account or home depot or
whatever um and i've already memorized
this
random character 18 character random
password for domain admin because i want
it to be really strong and then they
need another one so they go and use it
out on the internet yeah um and then i
was uh i'm not a domain admin i was a
server admin and i certainly did that
right it took me a long time to
memorize 18 random characters so um so
uh obviously the real answer for this
right now is is mfa right now and maybe
like what was saying maybe some
passwordless authentication but
why in god's name did it take over 20
years for a cartoon to teach us that
this is wrong right this whole leap
speak kind of thing um this cartoon at
this point who's seen the sex actually
yeah right we love it but it choke out
cartoon to teach our bosses it and we're
still
they still won't change in many
organizations their their typical
password policy from 20 years ago so 20
20 years ago
eight years ago when this was when this
came out um what it took about uh three
days to guess that troubadour elite
speak
these days especially if you've got the
hash we're talking like milliseconds on
some of this stuff right it's just
terrible so i i have suggested in scene
organizations go you know what
if you just do a pass phrase and if you
when i'm suggesting it to just like home
users i'm like go and find
uh your take your favorite song go three
lines down go maybe a couple of words in
and the next five words that's your
passphrase you'll never forget it right
um and organizations are saying if you
do that if you've got a passphrase it's
like 24 characters long you don't gotta
change it for the next year right
absolutely fantastic now
of course we don't want them to use them
on all sorts of different machines right
but that's so much better than you have
to change your password every 30 days
and yeah it's it's a mess now
keepass is free um
password vaults are a good stopgap
measure until we can get multi-factors
not free right unfortunately there's off
the out there i've seen people use it
for personal use i've never seen authy
deployed at scale so has anybody seen me
out i'm not right
it's a good tool but i've never seen it
used in an enterprise so
my red team friends and i will argue
about this because they're like yeah but
if i fish my way onto their laptop and
keep asses there i've got all their
passwords i'm like yeah and if i sneak
in with the smokers through the back
door and they have one password for
everything and it's on a sticky note i
still have all the passwords so i think
and most people i've talked to agree
getting a password vault at least is a
free stopgap measure for this
i wish there were easier ones like i
wish there was a password ball i could
give my grandma and it would just like
work everywhere right but
there's a bit of a learning curve
um so
people process great now let's talk a
little bit about technology so
who here
has java 6 running somewhere
in their organization yeah thank you for
being honest those of you that didn't
raise your hands if you're working at
any organization of size you're either
lying to me or even worse you don't know
because i guarantee you if you have
if you live work in a large company
there it's there somewhere and it's the
thing that makes the company all their
money it runs in the back
it's what i'll create what makes all the
money for the organization uh the
developer died 10 years ago no one knows
how to fix it
and that's a problem so
um until we can get someone to fix it
what can we do because we've got now
we've got this old java you have to have
these old java agents or versions of
java to connect to it where it doesn't
work and that's where a problem happens
right it's when that java connects to
the internet because then your own so a
lot of people don't know this but every
one of those java installs uh the
client side
has a user agent string and you can
block that user agent string at the
proxy so
it's not a perfect solution obviously my
laptop goes off the network you're gonna
have to put a gpo out there that says
when off the network java doesn't run at
all um
either that or backhaul everybody
through the vpn but you know
if you really want the network people to
hate you you could do that
so you really don't need java going
outside the organization um
either get a dev to fix that code
eventually or
yeah just you know
anyway um okay good uh so this is from
bluetumor.blogspot.com
this is
every uh executable extension that you
should be blocking at your email gateway
and i don't mean some of them
be like nike and just freaking do it now
i know what you're going to say you can
sing with robert roberts i've got some
people that might need a mas file what
would it do and to that i say if apple
can tell us we can do without a freaking
headset jacket we're just going to like
it
then we can
now the key here is a really nimble
exception policy right there will be a
few people that can get it and you'll
put them a little domain group and those
people get permissions for that file and
that's freaking it that's those are the
only people that get it i once uh once
had uh up appear that for his hr people
who had to open up pdfs all the time he
gave them all ipads he's like you can
read pdfs on an ipad and that's it
maybe a chromebook might work for that
as well these days but
but there are ways to limit the exposure
you don't have to give everybody the
access to this um and trust me the
moment you put that block list in place
you'll know who actually needs it right
it'll be whack-a-mole it'll start
popping up and you bang them down it'll
be great
so antivirus
um
yeah
um just about as helpful as uh yeah
right um so it it's not completely
useless slow uh enterprise doesn't do a
whole lot for us at this point but it's
not completely useless one nice thing is
every major av vendor out there will
allow you to put in your own iocs so if
you you know if you're back here and
you're dropping these in you
the best threat feed is your the one you
make yourself right so if you're
dropping these into like um cuckoo or
something like that you're extracting
your own ifcs even if you don't have
like a reverse engineer this is a good
start you know so you pull out your
ifc's you drop those into your antivirus
and then you start looking to see if
those ifcs are out there now you could
do this with your phone scanner too
provided that you're authenticating to
every device out there
that's traditionally been really hard
for a lot of companies i don't know any
any company that successfully has just
gotten in everywhere i see some gummies
that get most of it and that's great but
indeed just by policy has to be
everywhere right so leverage that
um
heuristics it was the first attempt to
do things without a signature right um
it's often a lot of places and i suspect
because it can be really freaking noisy
and the id people didn't want to have to
tweak that so they just turned it off um
but it can still find some low-hanging
fruit last but not least is anybody
actually checking
the av alerts so many of my red team
friends have like stumped through like a
trans arts rex just banging on left
and right nobody's checking the alerts
so
yeah nobody sees it um
um it can be really hard to deploy like
it'll break everything in your freaking
organization if you're not careful um
it's designed to protect the memory of
our apps there are bypasses for it like
rock chains and stuff and yes it was end
of life back in 20 freaking 18.
but tell me
what does every atm in north america
still run on right now
does anybody know
xp yeah um so um so there are
places that still might help you um
oh my god um actually that was probably
more secure because nobody was riding
the airplane going for reward for um so
um so and as well as you know how much a
windsor 2012 is still maybe freaking out
there um so you can leverage it test the
hell out of it and not in production uh
and it'll reduce the number of tools
that an attacker can use um so uh you
you're just making it harder for the
attacker to win
ah so i love this next section this is
all about land mines deception practices
canaries whatever you want to call them
but they're freaking barely and they're
so easy so very first one is so these
are like honey tokens choose what you've
got honey files is a brilliant way to
get started so you get together with the
it admins you put a hidden file into the
golden image you bury it deep down into
the os you drop it on everybody's box
push it out with ws or whatever
microsoft calls it today um and um and
then you make it juicy you start naming
that file something like password list
or pwd list or something like that maybe
even randomize that um but most
attackers will not be able to resist
that when they see it now there is some
chances for false positives right if
someone drops to the command line and
does a dirt slash s which i have not
seen a user do in a hell a long time but
um but that could trigger it you got to
make sure that you know your av doesn't
uh
trip it off or that your phone scanner
doesn't touch it either but just doing
this alone
you can be monitoring for at least some
evil throughout your entire user base
with one file right this one file you
alert on access to this file
you you you either have you know a minor
chance of a false positive or you've got
someone trying to lurk through your file
systems um
so honey accounts even better better
fidelity on this um put a put an account
in the domain call it domain admin x um
in the um in the description itself
put literally the text the password is
and some numbers password that you're
never actually going to use it doesn't
matter um but uh but when someone uses
their um domain enumerating tools to
pull back the entire freaking domain
they're going to see this and they're
going to think you are the dumbest mcse
that has ever walked on the earth but
they're the dumbest hacker that's ever
walked on the earth because you're gonna
put that in the admins group you're
gonna make sure no one can use it oh
sorry i went too far um and uh and if
someone tell you again you're just
monitoring for one tiny little thing
we're talking like less than a k worth
of vlogs here someone trips on that
account you know you've probably got
someone either looking around or someone
really needed domain admin so that they
can get out watch those cat videos uh so
um more on mines who here is actually a
dba
oh thank god because they are such prima
donnas right well you can't mess with my
freaking iops um and doing like database
monitoring stuff like that usually a big
project
so instead we make something like uh you
get together with
one or two of your ddas you make a
either a database or maybe even just a
table again call it something juicy
something that someone would want to
steal from you credit cards some sort of
intellectual property maybe blueprints
if you're in a manufacturing firm
something that they're going to want
and then you don't publish a scheme
anywhere nobody knows about this
table or database and then you just
alert again on access very simple very
fast if you get hints on it
on any of these things really now you
can come back around boston and go we
found evidence of some
it's probably it's like cockroaches
right if we found this there's probably
a lot more of it we need to start taking
a deeper look at things um and then this
last one
so beautiful in simplicity uh this is
invoke run as you can get from github it
actually loads a fake set of credentials
into memory on every system that it's
running on you put in the startup
routine on all uh all your all your
windows boxes really um and then if
anybody tries to use that account the
domain you'll you alert on use unless
you actually have users that are trying
to win that competition by using
mimikatz to scrape off creds um which is
the only way i can see this false
positivity you've got evil
unlock in the network for sure um
so oh and uh yeah so these eventually so
i just found out there's uh honey tokens
for the cloud now well not just not a
little while ago um so there's some
caveats with it um so project space crab
was released back in 2018 uh it was a
way to mass manufacture honey tokens for
cloud and it was brilliant until about
six months later when rhino security
labs found a way to detect booby trap
tokens now that means your attacker
still has to know that there's a
detection and actually try for it so you
still might be able to leverage it and
this is for mass produced tokens right
the issue was um there's some club trail
uh
parts of the college trail that don't
log certain niche services um and
apparently because amazon's own error
messages were tipping off um if you if
you if you're triggering them the right
way that the the token was booby-trapped
um but for uh for like a manually
created um token you know honey token to
booby trap i i believe that still works
it was just the mass-produced ones that
seem to have this issue
um so um yes uh other quick down and
dirty ways to stop attackers in their
tracks so just using a web form and
having people authenticate it just once
a day when they first log in um you know
maybe a little more difficult with
everybody working from home
if you're
really
you know top secret kind of place you
might even ask your users to just allow
a particular site once per day so like
the first person that goes to google
that day gets a pop-up and it says is it
okay to go to google and that user says
yes now i know that sounds crazy
but it doesn't matter well you know if
the user answers yes to everything the
intent is to stop scripted things from
finding their way out they're not going
to the script isn't going to understand
this this pop-up that asks for
validation um there's a
a person in the middle attack um in
w-pad those two no routes uh depending
on your ip v4 or v6 should take care of
that and as long as you gotta do that
anyway i want you to disable netbios
i know it's just like that freaking java
6 that's out there right somewhere in
the organization you got to have netbios
running because some important service
is going to go down that's fine but you
need to have a plan whether it's a one
year plan five year plan that has
got to go who here is either heard of or
used responder in an organization
yeah responders loves net bios because
responder amongst many things that it
does sits there and waits for netbios
broadcast and as soon as it hears one
goes yes yes i am the server you're
looking for just hand everything to me
it'll be fine um it is one of the first
tools many red teamers will deploy onto
a compromised system
and netbios makes it very easy to to to
leverage that tool
along with you know nd lan man and all
that kind of stuff but um give her a bio
see we really don't need it anymore um
making the internal name servers not do
recursive lookups to
external uh
sites
another good plan that's the proxy's job
right internal name servers should be
resolving names internally
and again the idea here is just to make
it difficult for scripted things to get
out because they don't know about the
freaking proxy especially if it's one
that you have to authenticate to once a
day um laughs so who here is still
running on some systems somewhere yeah
oh god now are you using laps too
yeah is it working right for you
see that's fantastic
um so it's something in security that
microsoft did that works
which is a weird sentence to say but it
works pretty damn well there are some
bypasses for it but the idea is simple
if you've got local admin on every
system it just randomizes the password
on every system running local admin so
we can't get instantaneous lateral
movement using local admin um so works
pretty well if you if you're forced to
use local admin deploy this
it should be free
if it's if your sales rep like tries to
charge you for it like kick him in the
ass or something like that because this
this should just come with your uh your
license um and then uh and then
this last one got this from dave kennedy
uh in a talk that he did um it's a
simple gpo that just says deny access to
this system all your
all your workstations and laptops from
the network and you just apply it to
everything out there and obviously not
your servers but there's no reason ever
that anybody should have to connect to
my workstation or my laptop right
if it needs to it's a gpo they can
change the damn gpa um so
deploying that out makes dave's life
miserable because then he has to start
spearfishing each and every target one
at a time in the organization unless
there's some bones out there that he can
uh that can leverage so i'm so friendly
with our groups that really is my dog by
the way i had this prop pipe sitting
around and when coving hit and i'm like
i got to teach my dog a new trick
that was it
she's a ham
but
um so three tools that will essentially
get you the same thing here so there's
something called r um you can also
leverage scipy and with maybe some
tableau or some other visualization tool
or you can apply for the splunk
developer's license and and do it with
splunk as well i actually learned this
one as it splunk but it's really clever
so um everybody wants to like sell you
their awesome freaking machine learning
stuff right
don't do it until you've had a chance to
actually play with just some raw machine
learning and see if it's going to be
helpful for you so here's a great
example
if you go to cms.gov and you go to that
button that says research statistics all
the way over on the right um you can
download
all sorts of healthcare data like
prescriptions now hipaa says that you're
not going to know who that prescription
was for
but you can get everything else
who wrote it what it was for when it was
written anything pretty much everything
else on that prescription other than the
person that got it is available in data
so so some of the guys doing some
research downloaded um a year's worth of
data prescription data specifically and
then they filtered it out for just the
opioid prescriptions figuring there
might be something interesting there
right now at this point they didn't know
what they were going to find but all
they did was run it through two simple
algorithms it's an algorithm available
in all those different tools that i told
you about so the first algorithm uh is
called pca and what pca does is it takes
all of the uh all the different um
columns basically that you have there
and reduce it down to x number of points
so that uh the first three that you see
there pc one pc two species that's the
algorithm figuring out okay i can reduce
this data down to x number of points and
we said 3 because you can plot it on a
3d graph so that gives you your
reduction
and then you pass that output through
just one more algorithm it's called
k-means it's a common clustering
algorithm and that's where we get this
um this uh 3d graph where you see most
of the things clusters so those are all
prescriptions they're all clustered
around several centroids and then you
see some trailing outliers now again
didn't know why there were outliers at
this moment but a little research and
you'll find that the second line down
here john couch
john's in jail for 240 months for
prescription fraud right and the reason
why he stood out was that he was writing
far more prescriptions than his peers if
i was able to scroll down we'd find
another doctor down there that um
actually the reason that doc is also in
jail by the way um for prescription
fraud but the reason he was an outlier
was that he was a pediatrician
and i don't know too many two-year-olds
that need oxycontin on a monthly basis
although every time i fly
there's always one um so
uh obviously he was not giving drugs to
kids he was writing it so that the
parents could abuse uh oxycontin but um
uh so think so think about how you could
just apply this to your own the best
machine learning that you can do is on
stuff that no data scientists would have
ever thought of because it's particular
to your organization so if you start
there and just kind of learn about what
you could find then you can maybe move
up to a commercial tool when you're
ready because you know exactly what it
is you want to be looking for um so what
about the long driver you used to work
at splunk uh so pass the hash detection
um and by the way these slides will be
available to everybody nobody yeah
not to comment anymore right but i would
uh if you haven't used this before i
would run it against your history right
just see if people were passing the hash
in the old logs and it still may turn up
um depending on your environment um
finding unauthorized dns dns in general
if you want to start looking for proof
of evil in your environment dns is a
great place to start so you can start by
um looking for unauthorized dns this is
just three ways to write the same query
um you can look for dns spoofing
activity uh the second one there finding
clients connecting to multiple dns
servers that was kind of brilliant one
of my peers wrote that one um and i was
like why oh yeah so how many dns servers
does any one host particularly know
about
usually two right yeah i mean you might
be round robin in your dns but by
default they know about too if it's
connecting to all sorts of dns servers
and it's not part of the round-robin
sequence
that's going to be weird check that out
um extremely long dns
right this is this is data exfiltration
um the numbers in here like two standard
deeds two characters long that's not a
magic number it's a place to start
you're gonna have to tweak it up and
down but you should be able to
especially if you're seeing lots of
super long dns queries coming from the
same host that's probably data
exfiltration
so i've been doing like i said uh some
some research into api this is really
great api dat joke um
some cool things that i found out here
that you can start doing for free so
first is um one of the big so it's
amazing you would have thought we would
have learned all of our faults when web
apps were the big problem 20 freaking
years ago right but instead we're making
the exact same mistakes in the api space
now that apis are blowing up so there's
a tool called kite runner it's free katy
packson fear has a youtube video on how
to use it it's amazing
you give it a place to start and start
scanning for api endpoints which confuse
me at first because i'm like endpoints
that's like a certain area you know
oaks right no endpoints are just a path
in an api and each thing that the
application does is one of those
endpoints so um but what they've done is
they scan the whole freaking internet
for apis to look for
uh word lists to create patterns because
the naming conventions and api paths
tend to follow kind of the same thing it
would be like this app v1
get and yeah so um
so you can run that against your
your existing to remember we also talked
about shadow i.t and it was like you
know the i.t guys that needed to stand
up some stuff really quick so they throw
a server under somebody's desk or
whatever i even did i i i snuck down in
the data center and put some taps in
when nobody was looking because they
wouldn't freaking do it for me and i
needed to monitor that line
but but now shadow i.t seems to be the
devs the devs are putting apis out in
the cloud faster than you can keep up
with them a lot of people concerned
about shadow api so kite run will get
for you if you're allowed to scan the
environment if you're not allowed to
scan the environment i've got a second
tip there but that'll at least tell you
what you're dealing with um and if
you're dealing with thousands more than
you expected that's a big problem um and
now and then the really sad thing is
there are free tools for the devs to
document their apis they don't even have
to lift a freaking finger so if they
don't know about it help them find those
free tools drop it into the cicd
pipeline everybody will be happy and
it's no extra work for them
web scanners traditional web scanners
not so great at testing the phones in
apis so there's a
here's three and there's a couple more
as well
free open source vulnerable apis to test
your testing tools with so to stand one
of those up um some of them are hosted
on the internet others you're gonna have
to pop a vm up or something like that
but if you run like your
white hat or your qualis or your ness's
against these apis and you get very
little back
you are missing a ton of out there
because these are very vulnerable apis
and you should come back with a lot of
results
so if you don't get vulnerabilities come
back and check
postman can be used to configure
security tests just as easily it is to
test for just the quality of the api or
functionality the happy path love happy
path i found out about happy path a
while ago i'm like yeah dads do a lot of
good stuff
um but
um
deception practices will actually work
here too so do things like create
endpoints not in your swagger or your
spec file
then put deceptive comments in the
messages that come back like oh yeah
your admin path is here or admin equal
true making them think that there might
be an admin that can be turned on
you can even replace like if you're
doing a little bit of proxy interception
you can release for replace 400 to 500
codes with a fake 200 code and say yeah
dude this is cool you also want to check
out this stuff over here
if anybody attempts to interact with
those honey endpoints you've probably
got someone at least trying to abuse
your api
um so how much time do i have left here
uh
oh we have a little extra time i was
gonna finish but i'm gonna jump ahead um
there's a couple other tips and tricks
that i can i can give you all that i
didn't know if i'd have time for
so let's see here
um
[Music]
yeah uh so uh when i was at splunk we
were working on a thing called um rba uh
very clever way to leverage any indexing
tool so whether it's splunk or gray log
or whatever
the concept is pretty simple when you're
writing those alerts to your index
um don't just write them to the index
also
the index where all the alerts are also
write them to a risk index and every
time you do a write into that index
either
both apply some points of risk and
there's whole write-ups on it on uh some
math that you can use it's all freely
available um apply some points of risk
and then also map it to whatever minor
tactic or technique that uh that it
would map to um and then
one you know every five minutes every
day whatever it makes sense for the
handful of rules that you're gonna have
to write um you're gonna write some
rules that say hey in the last 24 hours
did any host or person exceed so many
points of risk and you can make those
points different for different ou's
stuff like that if someone or something
goes over that threshold alert on that
because that's and this is like this is
so much more effective than a lot of the
uva stuff that's out there right
because when it accrues enough points of
risk and you'll have to tweak
that's too weird to be normal for that
environment nobody else is popping off
like that if
our second rule that you could write is
hey in the last three weeks has any host
exhibited
alerts that touch more than three or
whatever you have to tweak it to
minor tactics or techniques which is
much better than just trying i mean
typically when uh when a host starts
popping off a lot of alerts it's the
same one going over and over again right
um by doing it this way we filter out
all that duplication and instead we're
just looking for the oddities that come
out right um so very effective way in
just some simple testing we saw true
positive rates go way up um and false
positive rates drop considerably um
the
quick uh quick example of it here so
this is what you would see in a typical
alert dashboard in any sim oh what
did i just do um
oh
no there we go um so
when when we apply risk into this risk
index a separate index just for
accumulating risk
what we get is something like this where
you've got a typical phishing compromise
this uh this host gets compromised
starts connecting to other servers
there were
alerts that indicated on possibly things
like powershell um and uh scheduled
tasks other oddities that by themselves
maybe would not have caught your
attention but all together
you end up with these
basically super alerts
where uh
you can see like a 24-hour threshold or
a certain number of minor tactics and
techniques and what the analyst gets and
god i hope you can see that what the
analyst gets is a
set of alerts that even like your intern
should be able to look at this and
go whoa okay so we saw a net share we
saw some who am i some who am i um some
uh
a service uh
account was targeted this should send
anybody spiky sense tingling right and
you can do all sorts of things like that
like um who am i plus a couple other
commands scene that an attacker would
usually run that's a great super alert
right the
any one of those things like just seeing
who am i maybe not such a big deal but
if they're doing who am i and then a net
stat and then something else well either
someone's troubleshooting or someone's
on your system trying to figure out what
they've got um
so that's a good one
uh you can even then map things out
because you're basically creating
relationships between everything
and
wow okay and that's yeah that's it um so
with that um don't forget hopefully i've
given you a lot of great information
oh come on please
there we go
hopefully i've given you a lot of great
information
crap all right so
because only yo can prevent infosec
dumpster virus thank you very much
so any questions or even better anybody
else that's had to like you know
think of like a clever way to get around
the fact that we don't have budget to
secure up a particular environment or a
particular problem or anything like that
and or any questions
no no clever idea there we go okay thank
you
what would be your advice on
documenting some of the honeypots and
things that you make so that when
somebody comes in in the future trying
to fix a problem for like doing pen
testing
oh right yeah good point well so for one
unless you've got a really advanced team
i wouldn't even go with the honey pots
there's so much freaking work um oh but
what i would suggest even better honey
people so one of my friends came up with
this idea of creating people like you
know payroll people on linkedin and
stuff
and then when people try to do the oh
i'm the ceo and you've got to send me
some money then they'll be like
okay and it's one of the security guys
that's having the conversation with them
and then they'll actually try and log
into
the the site that they're going to use
to try and either do the um the money
transfer or try and get someone to log
in or whatever and then they'll say oh
it's not working
oh yeah it's our and then they'll give
them a different environment you know
like their backup one they're oh yeah
that's someone didn't you get the money
yet it's not working
and they're starting to now enumerate
the attackers as far as documenting like
some of the honey token stuff out there
um
if if you've got like some sort of sim
or something like that that would
probably be the easiest way to annotate
it because you could just attach the
notation to uh whatever's significant
the ip address or the database or
whatever it is that you've honey token
and then that should be something
prominent in the alerts itself so that
the
so if you start getting alerts on it
nobody knows what it is i think that'd
be probably the easiest place to
document that right because it will
always be there
um great question though anyone else
nope all right well i think i'm the only
thing between you and beer so i'm not
going to stand there very long
thanks everyone
and feel free to drop me a note i can
always get you i think they're going to
post the slides but i'll happy to send
it to you too if you want so thanks and
have a good night
okay
thank you
[Music]
you