[Music]
all right let's go ahead and get started
are we uh we ready with video
here
excellent Okay so
I have to ask how many of you consider
yourselves predominantly and I know a
lot of us wear a lot of hats how many of
you predominantly see yourself in a
defense
role okay and how many of you see mostly
in an offensive
role good we've got at least a few of of
mostly defense some some offense folks
which is good I was hoping for at least
a
mixture so here are the things we're
going to talk about today
um I'll tell you a little bit about
myself I'm going to talk about where
some of these ideas came from the
background behind them uh I'm going to
talk then about some Defender
assumptions because as Defenders we do
make a lot of assumptions and they're
usually based on some faulty thinking
that we don't necessarily realize and
then I'll give you a sense of where and
how you can fix that by learning more
about offensive security and that's why
I'm really glad we have both uh folks
here so a little bit about me um I have
been with the University of Buffalo for
a very long time um I love sloths I
don't know how many of you uh like
sloths but the Natural History Museum
the the Milwaukee Public Museum uh which
is like a f minute walk from here yeah
they have a sloth right now a live one
and you can go see her and I went to see
her this morning so I love sloths which
is why you'll always see sloths on my
slides this is one that I used to adopt
at the Buffalo Zoo um whose name was
Flash uh I am on staff with a bunch of
conferences um I'm a volunteer with a
bunch of conferences and I've done a
little bit of speaking here and there um
so that's a little bit about
me all right so how did I get here how
did I come up with with the idea that
I'm going to share with
you it's kind of a long story I'm going
to give you the short version which is
that in my very early days in security I
knew what most I think CIS admins
Network admins kind of know about
security you kind of know how to patch
things and you know that you know you
should kind of pay attention to notices
that come out from manufacturers and um
some some pretty basic you know here's
how you build a box and and this sort of
thing and I started to get involved with
uh our Network defense course at the
University of Buffalo which was a new
new thing that was started with the idea
of students going to a cyber defense
competition called
CCDC and one of our former students
decided it would be really cool if they
could get a bunch of kids together and
go do this competition so to do that
they had to teach students about how to
defend networks because the the purpose
of CCDC is that you're a team and you
sit down and you are in charge of
Defending a network and you get kind of
a scenario based situation and then
things happen and they happen sort of
like in the real world but at sort of
mock 100 by comparison so you're you're
asked to do things like um your you've
been told that there's a problem that
you have to fix uh somebody might come
walking in the room while you're doing
this competition and tell you that all
of a sudden uh the network router for
your organization has gone down um and
those are called in injects so the
students have to learn how to keep the
network up how to keep it secure and
part of that competition is offensive
security folks attacking that Network
toward the end so these these students
have to figure out not only how to do
kind of the day-to-day operational stuff
but in the mix deal with outages and
deal with active attacks it's a really
really unique
situation so I knew a little bit about
defense and I was starting to learn more
and and there were you know I had taken
I'd actually taken some Sans courses at
this point I was doing some forensic
work but that word offensive as an
offensive security I knew very very
little about it in fact I didn't really
even know it was a thing and thankfully
a friend of mine who works for trusted
SEC also happened to volunteer for this
particular course and I said I really
want to learn more about offensive
security what do I do and he said go to
a
bsides and I was like what the hell's a
bsides like I had no idea so he
explained it to me and I looked and sure
enough shortly thereafter was bides
Rochester bsides Rochester was my very
first bsides experience it was an eye
openening unusual and kind of amazing
thing um and what I will tell you is
fast forward
a few years later I now run besides
Rochester so uh I liked it a lot and I
started volunteering but that was sort
of the first
step as I got further and further into
the offensive security world and I
started to understand what these folks
do and how they do it I was intrigued
and I realized there was actually more
to defense than what we traditionally
think of as defense
there was this whole idea of
offense and it occurred to me it was
like it for me it was very much Matrix
is and that I discovered this whole
other world there's this like half of
security I didn't even know was a thing
so I thought to myself gee I wonder how
many other folks in
defense know anything about offense now
I'm willing to bet most of you here know
at least a little some about offense
because I found that most folks who
attend hacker cons tend to have a sense
of that right but until I attended my
first bsides I'd never been to a hacker
con I lived in the infos seex space so I
don't like to make the you know
traditional infos hacker like Universe
comparison directly but I will say that
in the corporate side of the universe
which even though I work in Academia is
still very much what we experience until
I found this other side until I found
the hacker community and these
conferences and all the things you learn
in them I was missing out on half the
story so when I'm talking about defense
this is the definition that I'm using
I'm specifically not talking about red
teaming or pentesting or purple teaming
or all of the words we tend to use when
we talk about these things and I'm doing
that because those words mean different
things to different people in different
companies in different ways so if we
just talk very generically about here's
what defense
is and these are what offensive Security
Professionals do so I'm trying to keep
this very high level hopefully nobody
horrifically disagrees with this um
again meant to be you know super high
level and not get into the
nitty-gritty so with those definitions
in
mind let's take a look at a traditional
server build doesn't matter if it's
Windows Linux makes no difference at
all so I'm a Defender I'm a CIS admin
maybe I'm I'm the security person
working with a CIS admin and I'm
building a server this is what I
do so here's a list of things we
typically do anyone disagree with
that anything you'd
add
H shout it out if you think there's
something that should be on here that
isn't training yep training is a good
one what governance and risk yep
sure okay so this is how defense
typically looks at
this this is what offense sees Am I
Wrong red teamer offense pentest folks
is this how you'd look at a web
server you've locked the thing down you
only have certain ports open and that's
great your offensive person goes woohoo
I have Port 40 443 or 80 open cool what
can I do with that and they start
looking potentially at the application
they look at what they can
change and they start thinking about the
relationship between that box and
anything else on your network do we
think about that as Defenders at
all
we do some of us yeah and and that's the
problem I think is that you know we
that's not to me that's not typical for
us all right so this is why I like this
quote and I've had people argue about
the fact that you know oh attackers
don't just think in graphs all right
forget it doesn't matter the point is
this as Defenders we do tend to think in
list we tend to think in first we build
the Box we patch the the Box we make
sure we've done all the things with the
Box we we do the governments we we do
our testing we do our training you know
and then we're good until Patch Tuesday
or whatever comes along and then we add
patches and that's great
okay your offensive team doesn't care
about any of that except where you might
leave stuff out they're looking at what
else they can do so they're looking at
relationships
and this comes back to where I started
about the whole business
of you only have half the story if what
you're looking at is purely
defense and this is not to say Defenders
need to stop defending and it's not to
say you need to go and you need to take
all kinds of you know detailed training
you have to get your oscp and become a
pent tester you know you don't have to
do any of those things you need to start
start by just being aware that this
exists and for many of you that starts
by being here which is
awesome so let's look at some
assumptions Defenders like to make
because they only seem to know half the
story who's heard of the Cyber kill
chain and how many of you have been told
what what are you told about the the Kil
chain what's the goal
here break it okay all right I break it
at any one of these points am I
good what the earlier the better right
what's the problem with that
concept if you're an offensive security
person and I as a Defender break that
kill chain earlier what are you going to
do what try again right regroup and
start over so it's great that you broke
them the kill chain at one point but
most attackers are going to go all right
so I come at it this way and you caught
me I'm G to come this way and I'm going
to try this and I'm going to go here it
doesn't stop with breaking the kill
chain if you assume that you get to any
one point in that kill chain and you're
good you're making a bad assumption
because attackers don't care about the
killchain most of them don't know about
the kill chain
it's it's irrelevant to them all they
know is well I couldn't get this way so
I'm going to try this other
thing they have they are goal oriented
they are not looking at your
steps here's another one we have AV we
have EDR we're good to go right now I
know some of you giggle because there
are people who recognize that these
things have
flaws but realistically not only do they
have flaws but folks who have been in
offensive security for a while will tell
you that there are always ways to get
around it turn it off or just make it
irrelevant lots and lots of ways to do
that I've left a few examples here if
you don't know what a lull bin is I
advise you strongly look it up the the
short answer to what a LOL bin is if
you're not familiar LOL bins are living
off the land binaries they are binaries
that are part of the operating system
and as an attacker you can use those
binaries against a
system doesn't matter if it's the you
know attackers don't need the latest
malware if they can use what's already
there that's why it's called living off
the land why would they bring something
else onto your box because you're never
going to see it if they're not putting
something new on that box the defender
if they don't know to look for it they
don't care they don't know it's there
right there are lots of ways to not
engage with or disable or get around any
sort of EDR and on top of that there's
research there are literally groups that
research how to do this both in
legitimate spaces and not legitimate
spaces right so if you don't think they
I mean if you've read nothing about kti
spend a little time and read about kti
because kti has done tons of research I
mean the biggest researchers research
teams in the world tend to be attackers
and they find out all kinds of stuff
about these products and how they can
get around and they share that
information so it's not to say we
shouldn't use EDR AV but you need to
recognize its limitations and you need
to understand that there are lots of
ways to get around it so put it in place
be aware of that but don't rely on it in
entirely all right now a little thing
about
detections um how many of you are
familiar with this TTP pyramid that's on
the bottom corner
here yeah so so this is I I'm seeing a
couple of nods so this thing down here
this TTP
pyramid this talks about tactics
techniques and
procedures this is something Defenders
really need to be familiar with so a
tactic is the goal so for example
stealing
credentials a
technique is the way you achieve that
goal such as dumping Elsas memory and
LSS is a process a Windows process but
you can do this there's ways to do this
in all operating
systems a procedure is specifically how
the attacker carries out doing this
particular technique and they're also
sub techniques by the
way but the idea is there's more than
one way to do this there is a a an
application called proc dump that can be
used for
this you can use task manager to do
this um there's a there are dll files
you can do use to do this so there's
lots of different
ways that a technique can be
done so if you think about this for a
minute
and you think about the fact that what
most AV EDR type products are looking
for are typically techniques and sub
techniques because looking I mean
ideally we want to be looking for
procedures but looking for procedures
can be very very difficult so if what we
want to look for is procedure but what
our tools are looking for is at this low
this lower level is that a
problem
you think maybe I see a few nods all
right so this thing I'm hoping some more
of you kind of know what this thing on
the left
is this is the attack
Matrix and uh so how many of you are
familiar with miter
attack yeah a lot more of you than the
ttps right okay so the miter attack
framework is a guide for classifying uh
different kinds of cyber attacks which
is great so then what happens is
organizations are told this is awesome
you can create a heat map which is what
this thing in the upper left corner is
and the heat map is supposed to show you
where you have protections and where you
don't have protections this seems really
logical as a Defender here's the problem
with that now I've just taught you about
the TTP
pyramid my lier attack focuses on these
techniques predominantly and sub
techniques if I say to you red means we
have no detections yellow means we're in
the process of getting some or we have
you know it it's it's in process and
green means we're good what does green
really
mean is this really the value that you
think you're getting from this framework
which is not to say you should never use
it but just because you have a rule in
some tool or something you've written in
place that detects a particular
technique do not assume you're now good
because an attacker will go they've
detected this I can do it this other way
using a procedure using different kind
of code and Bam it does it makes no
difference so if you assume if you have
been using something like this again
it's not that this is bad it's that you
need to recognize the limitations of
what that will buy you and not make the
assumption that you're
good all right so how many organizations
in here have Microsoft somewhere in
their
org yeah like pretty much most people
right it's rare not to have some
Microsoft this is a problem that a lot
of folks are not necessarily familiar
with and it's this business about signed
drivers okay so what is the problem with
signed drivers
well in theory the way this was supposed
to work if a driver that was signed I.E
it is now legitimate so Microsoft has
blessed it and said yes this is a
legitimate driver it's it's the thing
that's allowed to run on a system
because these drivers have so much
access to a system they can do a lot of
damage if it's not a legitimate
driver that you know this this this
seems to make sense we want sign
drivers the problem is there's supposed
to be a block list when they discover
that a legitimate driver is bad and
there's now a newer version or a
different driver that is should be
used however there's a great researcher
named will Dorman who is doing some
research he's an offensive security
person who does research and realized
huh check that out uh it doesn't
actually work and he went back and forth
and back and forth with Microsoft who
finally went oh yeah we have a problem
here and ultimately discovered two
things number one the list was not being
updated at all there was like two or
three drivers in it totally that was it
that list now has been updated
updated but the decision about in theory
the decision about it continuously being
updated like through Windows update we
haven't seen that come to fruition as
far as I know so it's important to make
sure that that list is
updated uh but how it's going to stay
updated right now seems to still be a
manual process that's not ideal but if
you assume your tools work the way
they're supposed to and you're not
spending time looking to see where they
might not be working this is a bad
assumption the second problem he ran
into so these hypervisor protected code
Integrity is supposed to protect if a
bad driver is
installed it didn't do anything he was
able to upload a malicious driver didn't
matter so this is not ideal so I just
come back to this whole idea that we
have these tools they're supposed to
work a certain way if you don't spend a
little time in this in the off sex space
and pay attention to what they're
learning about these things you can get
burned here's another one who uses
Defender for endpoint on their
systems at least a
few so you know Defender for endpoint is
as as antivirus type protection goes and
as EDR goes is actually a pretty solid
product comparatively I mean it it
compared to where Microsoft AV was like
a zillion years ago it's its heads and
tails beyond that and it is can be
challenging to get around that
said another researcher
discovered that despite the fact that
this Telemetry was supposed to be
collected for all of these things
because that's how Defender works it
looks at all this Telemetry it collects
and it makes decisions based on that
Telemetry I mean that makes sense right
it it looks to see what it knows and
then it makes that those decisions what
he discovered was by default there are
settings for certain things that aren't
enabled by default at all so it's not
getting all that Telemetry which means
it's not really fully functional I mean
it's not that it doesn't work at all but
it doesn't work in the way that you
would expect it to and so there are
things it's not catching and so that's
why I mentioned um like uh there are
these different events that uh it It
ultimately couldn't catch um schu there
was things about scheduled tasks USB
drivers firewall events there's a whole
bunch of stuff it just there's no
Telemetry
for I love this
one I don't know how many people in here
really feel this way but there are a lot
of people that think if we have MFA
we're
good anybody really believe
that you probably wouldn't admit even if
you did so the reality is MFA is a great
tool and we should all be using it and
there are better versions and worse
versions and you know I'm not going to
go down the the SMS rabbit hole that a
lot of people like to argue about um
because that's not the point the point
is having SMS or any kind of MFA uh
regardless of how much better it is is
not the Beall end all there are lots of
ways around MS fa and I've I've put some
up here so if you still have Legacy
protocols enabled your MFA doesn't mean
anything to an attacker because they're
like huh check that out I'll just come
in over here because I don't need MFA
for that configuration problems can
allow all kinds of interesting things
and especially if you're doing cloud
computing let me tell you there's lots
of ways around it if you aren't paying
attention there are all kinds of tax uh
so uh aitm attacker in the middle um a
little more friendly verbage here pass
the cookie social engineering these are
all things that can be done I mean I
certainly see all the time we uh we see
fatigue right from push attacks folks
who are like I don't want to deal with
this
click so um you know MFA again MFA is
great be aware of how attackers can get
around this um one of the the ways if
you have um a an MFA that has uh
passcodes where your users get a list of
passcodes in case like we we sometimes
um recommend like if you're going to be
out of the country and you're going to
run into a problem where you you where
the app's not going to work the way you
expect it you might carry passcodes with
you okay the problem is that those
passcodes never
expire and if an attacker gets gets hold
of them they can use them too and that's
not
ideal so how do we kind of fix this
problem where we're making these
assumptions and we kind of only know
half the story well ideally imersion in
offensive Security in one way or
another for folks who've never done or
been involved with or seen in offensive
security engagement this may be very new
although make a lot of sense um when I
first sort of learned about how this
worked it it completely made sense to me
but it was a totally new idea so these
are effectively the steps they go
through and they it depending on the
testing they're doing and what they're
trying um these are going to vary a
little but this is kind of the overall
idea so first they they're going to
figure out what they're going to try to
get into um how they're going to get
into it how do we stay in it once
were're there and then how do we move
further into the organization so all of
those relationships really come in in
play um you know how are we going to uh
pull data out right how are we going to
exfiltrate data to prove that we did
what we said we did and then what
happens when they find us and you know
that that is a consideration because
sometimes that's the end of an
engagement and sometimes it isn't it
just depends and there's a lots of it
depends here but I felt it was really
important to to see this versus
something like the killchain that I
think most of us are really familiar
with who has never seen something like
this before at
all okay good I'm
glad all right so where do you find
offensive Security Professionals well
look around there's some right in this
room uh I have a a number of good
friends who are who are in offsec um if
you've never been to a security bsides
and you can get to one I strongly
recommend they're they're great they're
usually small um you know you can you
can approach speakers um you know
they're they're great learning
opportunities uh there are Defcon groups
now 2600 meetings like all these
different things I mean now with you
know after covid the online communities
have gotten huge which is fabulous
because you know like Black Hill
security out here they have a fabulous
online community that has offs SEC
people and defense people and all kinds
of different uh you know ideas and um
you can engage with all of these
folks
training go to training and again I'm
not saying like you don't have to go to
Sands and spend a million dollars
although I list Sands because they are
an opport they are an option um but
there's lots of EX really inexpensive
training on offensive
security which does not mean you have to
go down the path of becoming somebody
who works in offensive security it just
means you need to kind of have a feel
for how that all works and there's lots
of different opportunities there so um
conferences have opportunities different
companies like I mentioned Black Hills
they've got training uh trusted SE who's
also here um offensive security is is
one of the probably most well-known
offensive security uh groups that do
training they have a certification you
know but they offer training you don't
have to do the
certification um there's lots of online
options so if you've never heard of like
hack the box or try hack me there's ctfs
you can go at your own pace they're not
super expensive so lots of options there
and there's also higher ed um we now so
I started out with this talk talking
about CCDC there is now a competition
called
cptc which is the Collegiate pen testing
competition ition it is the offensive
security where students are a group of
offensive security folks who are testing
in organization and they they don't get
attacked they are doing the attacking
and they have to write a report at the
end to to show what they learn so you
know there there are ways to learn some
of this through higher
ed so tradecraft Intel uh if you're not
familiar with that concept basically
it's um a skill that it skills and
experience you get through a trade in
some way um in this case the skills and
methodologies that offensive security
folks learn and what's cool is that
there's lots of places you can learn
about tradecraft that's not just a
classroom so I mentioned some of them um
Google's folks do some research rapid 7
folks there's lots of these websites I'm
just mentioning a couple um Discord and
slack again these online online
communities there's tons of information
you can get from those uh you know for
good or for ill what is wonderful about
Twitter is when this stuff blows up it
is on Twitter within seconds and I have
found that to be invaluable so I mean
how many heard about the the latest crap
with the PBX that there was a a hack
against oh if you oh at least one two
three okay so at least a couple of you
now I will say pbxs probably are not as
common anymore uh except in government
and small businesses I know for us like
we moved to VoIP and got rid of pbxs a
long time ago but um there there was a
recent issue with a supply chain attack
that uh is going to be very devastating
to the folks who are using a uh a PBX
and that broke on Twitter before any of
the formal announcements were made
because guess what the researchers found
it so so again it's a great place to
find the information and Matt masted it
on too I mean in this case now you're
it's kind of split there are some folks
who who will only live in one space not
the other you know I'm I'm on both
because I have friends that will only be
on one or the other and I want to follow
researchers in both
places so com so tradecraft Intel I want
to parallel that with organizational
Intel so organizational Intel is going
to be more information about the
organization for example um you know
what kind of tools are they using if you
look at something like LinkedIn and
somebody says I have you know 20 years
of Cisco experience what does that tell
you what do you think they company's
using guess what an attacker does they
go check it out that company uses Cisco
hm what do I know about attacks against
Cisco so know what your organization's
putting out there um um you can find
very interesting organization Intel on
your own organization that could be
really damning one of the places offc
will look also is GitHub GitHub is a
favorite of offensive security folks
because people who do coding don't
always like to put their code in a
private repository and sometimes they
accidentally don't put it in a private
repository and sometimes it includes
cool things like usernames and passwords
hardcoded right there for the whole
world to see woohoo so these are the
places that offensive security people
are going to start looking for that
information you should look for it too
another place a great place is message
boards again if you have an entity
that's looking for help with a
particular package of software package
or maybe Hardware um you know somebody
from their org might have posted
something about it uh and again it gives
you just some insight
so um um and if you can if you get
access to an internal Wiki there could
be some good stuff there and have I been
pone will you know potentially tell you
about uh breaches that the company has
suffered and sometimes you can get a
hold of those breaches and they can be
very
useful I'm not going to spend a ton of
time on these tools
specifically if you've never heard of
one of these
tools take a picture go home look it
up I mean this is a action of what
offsec folks use but there's some of the
most common ones that are used and yes
things like wire shark are are tools we
use as Defenders too um but in in many
cases they use these tools in a very
different way they look at this
information in a different way and
that's why it's valuable to sort of have
a feel
for this sort of
thing all right so to kind of sum this
up um
please understand that you know being a
Defender is an awesome thing but it's
only half the story I really want you to
realize that you're really missing out
if you're not spending time learning
about offensive security it is very
tempting to go to conferences and go oo
I should listen to this talk because it
talks about defending x and x is what we
have to a certain degree you're right
but is equally and sometimes more
important to start going to talks that
say how do I attack
X than it is to how do I defend X
because you cannot defend what you don't
understand if you don't understand how
offensive security people can do what
they do and likewise how an attacker
does what they do you cannot possibly
defend it fully and I know it seems like
a lot
but you're partway there you're here and
there's lots of offsec folks around
start conversations with them I'll tell
you what I have found in this community
is that they love teaching you the cool
stuff they've figured out how to do they
are all about sharing that information
take advantage of that because they want
you to know they want to teach you
because really at the end of the day
we're essentially all on the same team
we we really want organizations to be
more secure because there's no such
thing obviously as fully secure so jump
in you're partway there now meet some
offsec folks and learn what they know
and with that knowledge you will
ultimately become a much better
Defender if you like what you've just
heard a taste of I have to do some uh
Shameless self-promotion I have a book
coming out at the end of July called the
active Defender and it's this idea of
immersion in the offensive security
mindset and I purposely went this
direction as opposed to say the quote
attacker mindset because number one
there's already lots of books about that
and number two the idea here is that
it's it's a different way of thinking
that doesn't necessarily have to be
associated with any sort of
criminalistics right it's just a about
okay how do I get in how do I get from
here to there if what my goal is is
this what do I need to do to get there
and so instead of thinking about how do
I
defend these crown jewels and think only
of the crown jewels it's thinking about
that path to getting to that those crown
jewels and what different ways and how
you can get there and thinking that
through
so it's it's in pre-order now it's on
Amazon and and Barnes &
Noble and I always like to end with this
quote um from Douglas Adams because I'll
tell you right now my background my
first degree was in music industry I did
not do any like formal Computing
anything when I was younger I had no
intention of winding up in this industry
and certainly when I started down the
path of being a Defender I didn't
envision myself in the middle of a bunch
of you know offensive security folks
learning about their tradecraft but I'll
tell you it's absolutely where I need to
be and with that I'll open for
questions
yes yep and I'll repeat in a
minute
so the question is if you know that an
attacker is essentially always going to
try to find ways around it how do you
keep your mindset and not get like
overwhelmed with this idea that you know
they can always get around it what I can
tell you is two things number one the
harder you make it for
them the harder you make it for them but
more importantly the harder you make it
for them the longer they stay in your
system the longer you stay they stay in
your system the odds of you finding them
go up
exponentially so understanding the
routes they might take even if they try
to come in another
way the more things you can do like that
which is why we talk about defense in
depth right is because at the end of the
day once they're in your network if you
can see them them all bets are off if
you find all of them and that's the
trick is that because what we tend to do
as Defenders is make the Assumption well
we caught them at this point in the kill
chain and now they're done but if we
also go oh I should also look to see if
they've gone this way or done this or
maybe look for them coming in another
way so it's really about you know uh
take heart because attackers while they
will P they will continue to try to get
in if that's really what they're trying
to do you also are more likely to find
them if it you make it that much harder
hopefully that helps
yes okay so the question is do I have
experience with scripting tools like Red
Canary what in what in
particular
oh yeah do they provide utility
absolutely so um I I talk in the book
about the fact that um using these tools
like Red Canary tools Atomic red team
you know any of those things are
absolutely invaluable um what they can't
do is they can't tell you
concretely you are good for this kind of
attack because again there's different
ways that attack can happen but it tells
you at least what you do know right and
it allows you to test the detections you
do have in place cuz Let Me Tell You
Folks if you're not testing your own
detections you're probably not detecting
what you think you are because as we
already saw in some of my earlier slides
these tools don't necessarily the work
the way we assume that they will so yes
absolutely I think I think using those
kinds of tools is invaluable yeah other
questions all all right well I'm not
seeing anything else thank you all so
much for coming I'll be around the rest
of the conference if you want to hit me
up for anything else thanks
again