[Music]
um if you just came in the QR code is
download for the presentation if you're
interested in the presentation if uh you
get it and it sucked you can just delete
it so there you go um uh so I'm Joseph
I'm a senior security engineer and my
presentation is dragons can
fly a little bit about me I'm currently
a senior security engineer I've been
doing that for about five years so
relatively new and for a lot of you um
uh in the past I've been an instructor I
was an instructor for about 18 years
during that time I was a forensic
examiner a columnist prior to that I was
a network administrator I've been a
programmer technician I worked on the
help desk and then when I got out of
high school I joined the Marines any
other Marines in here
nobody oh all right I'm
alone uh if you're interested in my full
profile you can visit me on LinkedIn
that www.j joico.com will bring you to
my LinkedIn
page all right my goal for this
presentation is first to be entertaining
I want to tell stories stories about
what I'm seeing and what I found and
what's happened to me I find that that's
more entertaining and you probably get
you probably remember it better than you
remember somebody going through lots of
Ides with data um maybe you'll learn
something so if I set my expectation low
I'll probably meet
them all right a little bit about the C
about the title um so I started out as
an instructor and as an instructor you
you would want to associate the
learner's knowledge with the subject
matter being taught so one of the things
when I was discussing defense in depth I
would bring up you know medieval castles
and the protections you're probably
already aware of some like Moes you know
here's a moat everybody knows what what
a mod is uh or a drawbridge most people
can look at that and say yep I
understand what a drawbridge is and then
you know there are there are uh uh
Towers you know we know what a tower is
but there are also things like a
machicolation does anyone know what A
maculation is for this is this is like
your new it
product all right so a maculation was
built so that the guy who's on top of
the castle dropping rocks and hot
burning oil onto the attackers doesn't
get shot with an arrow and that's
important right because every time they
defended the castle they learned
something like yeah poor Bob was up on
top of the castle and he was defending
dropping the rocks in the oil he got
shot by an arrow so maybe we ought to do
something about that so they built that
thing called a
maculation this security approach
allowed for one or more layers to be
compromised without the castle being
breached but dragons can fly meaning
dragons don't care about all those
security measures that you have they're
just going to go fly right on by them
and they're going to breach the
castle so in this presentation I want to
look at the layers of it security how
malicious actors are compromising or
circumventing them and discuss what
Defenders can do to get ahead of the
attack all right to start I'm in
healthcare the number one cyber threat
in healthcare for the past two or three
years and according to this in 2023 is
going to be fishing so if fishing is the
number one attack Vector then we want to
look at all of the layers of security
that we have for a fishing attack or
we're missing out on a lot of things how
many of you are worried about
ransomware so Royal actors gaining
initial access to victim networks in a
new number of ways the number one way
that ransomware is deployed in an
organization is fishing so if you're in
I know Finance is uh the number one
attack Vector is fishing and I'm sure
most of you whatever organization you
work for the number one attack pror is
probably fishing so we want to look we I
definitely want to take time today
looking at the security layers of
fishing and how malicious actors are
getting past those I want to talk about
the definition of fishing now all you're
you're all groaning now oh my God the
definition of fishing you got to be
kidding me if you a ask the a normal
person what is fishing they're going to
tell you what's an email all right but I
go with the IBM definition here the IBM
definition is fish attacks are
fraudulent emails text messages you
might call them smishing phone calls you
might call that social engineering
websites designed to manipulate people
into downloading malware sharing
sensitive information or taking other
actions that expose themselves to their
organiz or their organization to cyber
crime so I'm not looping fishing into
just an email message I'm saying it's a
lot more than that and we have to have
security measures for all of those
things all right the layers of security
that I want to cover today I want to
talk about user education I've learned a
tough a bunch of lessons there um email
security filtering why some of that
stuff fails web security filtering why
some of that stuff fails our firewalls
and then I was going to do some stuff on
antimalware and EDR I think I have two
slides but there was already an EDR
presentation so I've removed a lot of
that from my presentation save you have
having to look at
that all right we're going to get
started you can compromise some of the
security layers all of the time and all
of the security layers some of the time
when you com compromise all of the
security laders at the same time you
have a breach and that's what we're
trying to avoid we don't want to have
that breach all right let's talk about
education story time so I was in
education 18 years like week one at my
new employer they said we want you to
develop some awareness training oh
that's awesome I know about developing
training materials I'll start with a
PowerPoint what I didn't realize is how
many people had to read that PowerPoint
before it would be authorized I like to
to tell my uh my co-workers this got to
be the most expensive PowerPoint I've
ever put together so I put it together
well now my boss has to review it now my
boss's boss has to review it now the
marketing team has to review it was like
amazing I couldn't believe it in
education I create a PowerPoint I use
it so then I want to talk about in
education right you might have hours to
learn something or years to learn
something they got I got the power point
back and they said it's too long you get
5 minutes so I got to train 5,000
employees with a five minut no more than
five minute presentation well we all
know that that from a user education
standpoint that's going to fail which
created uh an entire organiz an entire
uh um stream of companies that would do
fishing awareness training now more that
I learned about fishing awareness
training if you take a look at this uh
this this uh uh image here it's based on
9.5 million users that's a big set
that's a data set 9.5 million users and
basically it says on if you do no
fishing awareness training you're going
to have a
32% failure rate and if you do the first
month you do training you might get that
down to 27% and the second month get it
down to 25% and and if you buy this
without understanding what's really
going on you think oh my God if I use a
product to do fishing awareness training
I can get my 32% down to 5% but now
let's look at something I learned some
reality you're not if you're in an
organization of 5,000 employees probably
more if you have an organization of
15,000 employees you're not going to
have the same 5,000 employees at the end
of 12 months so if we look at 10% of
5,000 that's two 500 half of that is 250
we should have only 250 failures but if
you lose literally only 5% of your
employees that accounts for 50 leaving
that 250 is reduced down to 220 but
you're not going to lose lose 50
employees and not replace them and if
you're in a growth industry that you're
going to replace that 50 with 60 or 70
or 80 so it's going to be even worse but
let's go with best case scenario you
replace every you one for one body
taking in account 50 new employees per
month that number is actually 820 let me
explain on month 12 you just hired 50
new people that fail at
32% you have 50 people that just got
hired last month they fail at 20
27% so taking into account all of that
you actually end up with a fail rate of
820 or
16% I think the reality is probably
somewhere between 5 and 16% maybe 10%
but if you're hoping for that 5% and
you're an organization of any size if
you're getting there you're doing really
good again that's fishing awareness
training that happens every month so
based upon that previous screen we know
a decent percentage of our users will
fall victim to aish attack there's
nothing we can do about that they need
and so that means we have to look at our
technical controls and make sure that
our technical controls are the best that
they can be all right let's talk about
email technical
controls so here's a problem you're
probably getting emails from legitimate
senders now but those legitimate senders
may lose control of their email we call
that a business email compromise or a
vendor email compromise or an email
account compromise if it's not a
business it might be a personal email
compromise all th those legitimate
accounts that have been sending and
receiving your to your business emails
they look legit and they're going to
look legit to your users right I email
this person all the time so that's
problematic blocking known good senders
is going to be difficult if you have a
fix let me know I don't have a fix for
blocking known good senders there's some
things you can do like look at the IP
address that this email came from and
maybe it's coming from a foreign country
non-normal IP address but for the most
part it looks pretty normal to your
secure email
Gateway which brings in the threat in
the email you're going to have
legitimate emails let's look at the
threat that are so what are the threats
in an email probably links and
attachments our secure email Gateway
should be looking at those threats and
attachments so let's take a look at that
let's talk about links legitimate sites
as jump off points from the beginning of
2020 to June 2022 po Alto networks
analyzed URLs detected by their Advanced
URL filtering service and discovered
that the number of fishing URLs hosted
on legitimate SAS platforms continued to
increase at an alarming rate in fact
from June 2021 to June 2022 a rate of
newly detected fishing URLs hosted on
legitimate SAS platforms increased over
1,00% it's going to be hard to block
legitimate domain names now the first
time it comes through right you get
nailed and then hopefully you get that
fixed but you're going to have a hard
time blocking things that are legit for
instance might be something like this
here's a uh a Google translate this is a
Google translate link so fishing email
cont contained a Google translate link
translate. gooogle is not a illegitimate
site it was not categorized as fishing
by the security El Gateway but the
minute you saw that I don't know has
anybody in here ever gotten a legitimate
email that contained a link to Google
Translate like yeah so the minute you
see this you're like all right I won't
be hit by this again I want that blocked
all right so you can get that blocked
but there are others that are harder
like
srid I would love and I've heard of
Administrators blocking all of srid I'm
done with it I don't want to fight them
anymore but if you use srid it's kind of
hard to block everything from
srid let's look at some other fishing
statistics facts and figures from
2023 so fishing attacks at are at their
highest rate highest level since 2020
fishing attacks have risen to a level
that we haven't seen since 2016 the
anti-fishing working group fishing
activity Trends report for quarter 3
2022 reported that there were close to
1.3 million fishing
sites now if you're like me you look at
that and you say all right if they're
fishing sites then they're categorized
as fishing sites and I block fishing
sites so I ought to be good right
wrong there's this huge problem with
miscategorized websites so take a look
at this on the screen anybody categorize
that for me because this is what I fight
with with my web filtering and I I my
web filtering software your web
filtering software they they're all they
all suck so what is that site is that
advertising is that a park domain what
should that be categorized as let me
help you now there's a domain up there
and I'll zoom in for
that that's called commercial
bank.com is that a bank site is that
finance and
banking or is it fishing is that a spoof
lookalike domain that should be
categorized as fishing you tell me I
look at that and I say well that ought
to be fishing it's not advertising it's
not
like you know any of those other sites
shopping it ought to be categorized as
fishing now let's take a look at
reality you can't see this I'll zoom in
a little bit the top two are legitimate
commercial Banks Commerce Bank sorry
Commerce Bank the top two are
categorized as financial services and
they're lowrisk and they're authentic
all of the ones below it are spoof
lookalike domains that get this this is
going to be important a little bit in my
presentation are categorized as
Financial
Services they're also categorized as low
risk so if I want to fly by your web
filter now I just have because this site
which is clearly not Commerce Bank and
is miscategorized as a financial service
remember that because we're going to
talk about that in a little bit all
right Story Time half of you in the room
are going to have the same story as me a
relative calls
you
Joe I was just on the phone with HP tech
support and they remoted into my
computer and told me I had
malware and they wanted $100 to fix it
and I got nervous and I thought I should
talk to Joe there's a good thing so I
hung up the phone I turned on my
computer and I called you and I said
okay back up what
happened I just now this is what she
said I just bought a
printer and I took out the instructions
and the instructions said go to
123.hp.com which I did and
then I didn't follow the directions on
the piece of paper I just looked at the
screen and it I clicked a button and it
asked for my name and my phone number
and I put it in and they called me and
blah blah blah blah blah you know the
story
so doing what I do for a living I
thought one two three I bet you didn't
type 123.hp.com so I hung up the phone I
did a little research and I found yeah
there is a 123hp.com this is interesting
what does that remind you of a site we
discussed a little bit while
ago so here's something you have to
know when I did
this I saw what she
saw and when I went to get
screenshots the page showed up
differently
that's important for this talk the
second time I visited 123. 123hp.com I
saw an entirely different thing than I
saw the first time knowing the malicious
actor is probably keeping my IP address
or my browser agent or some type of data
and they know now I've come here two
times let me try to go to that site
using something else so the next
screenshots are from my phone because I
knew my phone is going to look different
and sure enough a site pops
up a normal user obviously my relative
is not going to see dubdub dub. geek. us
and this is an ad right they saw a big
blue button that said visit website so
she typed 123hp.com and clicked visit
website and when that happened this
popped up hi this is John Bell from
technical support how can I help you
today or if you'd like you can call me
tollfree at this number now when I was
on my phone I closed that out and
instantaneously it asked for my name and
my phone number I didn't go through it
because I knew the end of the story but
she typed in her name and her phone
number and they immediately called her
and we know how the story ends right she
allowed remote access who knows what
they did it's unlikely right they were
only trying to get some money but they
flew by all her security and right into
that machine by asking the user to log
in it all looked legit and it was a typo
domain so I looked up geek te. us
anybody have any idea looking at the
name servers blueh
host. yeah so we got a we got a tech
support scam site here and that's what
she fell for so now let's go back to
what happened to me in the first when
when I went to get uh the the
screenshots up pops up install HP
drivers so this would also look as
normal if it's the second time an IP is
going to this domain this might pop up
well let's do a little research all
right so we download that driver we
upload it to virus total and we get a
four out of 69 and that was on 34 so
this is also important about my talk I
want you to look at what's not there if
you use crowd strike ESET Dr web or
malware bites you're okay but all the
those other antivirus programs looked at
that and said you're good so if you're
using any of those other
products if you don't have defense in
depth something else looking at this you
don't allow users to install drivers
right we know the we know all those
things then that that malware gets
installed so I take that because it was
only four out of whatever four out of 69
four out of 89 and I upload it to hybrid
analysis a Sandbox a lot of us have
sandboxes configured and I say all right
what is this thing it looks at and says
threat score of 100 out of 100 oh I'm
guessing that's
malware I don't stop there because I
like to know what did the malware do
this is interesting to me because most
of my talk is about domain names it
didn't use a domain name it used an IP
address so now your DNS filtering is
probably not going to do anything for
you you're looking at your firewall or
filtering and hopefully it looks at that
uh7 or 152 address and blocks it it's
Port 80 so it's not secure
you ought to be able to look at that
traffic so if you're your firewall if if
this happened in a corporate environment
and you're doing monitoring well maybe
you would have caught it but I want you
to go back to that virus total page if
the product you're using to scan it
wasn't one of those four you didn't
catch
it so what is that IP address configured
maybe your firewall blocks that IP
address well using some web filtering
softw software right it was insufficient
content but I want you to look down
there at the bottom of of category low
risk so once again it's flying by all
your controls and getting to the users's
machine so how else are malicious actors
getting past your secure email Gateway
or your gateways well one thing is
they'll send a d they'll send a fishing
campaign that has a capture very hard
right now for your security email
gateway to do anything about a capture
they look at it and they say it's a
benign page I can't get by it um the
user can go ahead and visit it the user
understands captas can handle it what
does that look like well you you know
what a capture looks like now I'm
waiting for all the secure email Gateway
vendors to finally go and start using AI
to be able to get P the capture page so
this would be my call out to you you ask
your secure email Gateway uh software
vendor will you get past a capture what
happens with a caption and if they say
no say there's products out there that
will help you with that let's get that
employed here you know Capt AI 100%
accuracy with uh
recapt all right let's talk about
attachments so I don't have a zoom in
for this one wouldn't matter they're
awfully small here here is a particular
uh secure email Gateway filtering
software filters all of these
extensions well I want to point out two
one is
HTML and the other one isn't there it's
a JPEG image or a PNG it's an image file
and I'm seeing these both used now
regularly from an HTML standpoint how do
the malicious actors get past that well
the attachment is base 64 encoded the
thread actors have the JavaScript decode
it obvious skate it and then and they
can use free tools to do that and then
it winds up on your endpoint now I want
you to think about
this the attachment is on your endpoint
and when they double click it it's
running on the endpoint it'll probably
look on the like the left hand side of
your screen this isn't out on the web
yet there's no none of your other
filtering if the security email Gateway
has failed here it's sitting on your
machine and here's your credential
harvesting
page now the one thing that has to
happen with this credential harvesting
page is when they type their username
and password and click submit it's got
to go out to a website
but there's a couple of things we've
already seen websites are miscategorized
all the time and if that website happens
to be categorized as Finance Health Care
shopping those are all categories that
you're not supposed to be decrypting so
you won't see the credential leave
because laws preclude it oh I should go
back one the the one on the
right uh that's that's the images that
we're starting to see come in right
right these uh and boy boy do our users
jump on that right you just paid a bill
uh thank you for your payment right all
of these things as subjects and then
they ask for a phone call a question I
would ask you here's something you can
test with your EDR will your EDR block a
legitimate remote access tool because
that's what these bad guys are trying to
do they you get your user on the phone
hey yep I can take care of it I just
need to remote into your machine make
sure you're real or whatever lie they
come up with
so attachments that's how they're flying
by all right so let's talk about domain
your your web filtering and maybe your
secure email Gateway filtering a best
practice is to block newly observed
domains and newly registered domains if
it's newly observed so here this
particular product newly registered
domains block uh default is alert uh so
you would have to say I want this
blocked domains that have been
registered or had a change of ownership
in the past 32 days so now
the bad guy has to look at if I'm going
to go after your organization with this
domain I got to register it 32 days
before I want to use it or do
they who in here knew you could rent a
domain two three four four of you five
all right I didn't know that like up
until about three months ago I had no
idea that you could go out and rent a
domain let's talk about what kind of
domains you can rent so I went out to
look at I want to rent the domain and I
are there any Healthcare domains and
sure enough there's some healthcare
domains out there one of them is yummy
health.com it's a little pricey
$833 but you know if you're making a a
million the average health care payment
for ransomware is a million ah 833 you
might pay that another one my healthlab
domcom that one's a little pricey
I like this allmy health.com $101 a
month so there you go you can rent the
domain but now the important part right
we were just talking about newly
observed and newly registered domains
how long ago was this registered we go
out to our who who is data and wh let me
go back
one our who is Data this thing was
registered in 2004 it's 19 years old and
until I started doing this research I
would have given Credence to a domain
it's been around for a long time I would
have said well it's been around for 19
years but I won't
anymore so you can rent the domain it's
been around for a while but but Joel
it's probably got a category of like
domain parking right no
unfortunately you take this domain you
stick it into one of the web filter
categories you find out what it's
categorized and it's categorized as
health and wellness and it's low risk so
now for a hundred bucks I can rent a
domain it's categorized health and
wellness this is what the bad guys are
doing bad guys in those freaking red
teamers all right and here's a nice
important part your SSL decryption is
not going to help you here why because
the best practice dictates that you
decrypt all traffic except in sensitive
categories such as health Finance
government military and shopping so you
if you're doing your SSL decryption I
just beat that I just flew past
it all right there was an entire talk it
was a great talk evading EDR by dll Sid
loing uh with C when they when they if
you didn't get a chance to to view it
right the all of all of the talks are
recorded so you might be able to go and
look at that um there's other ways to
evade EDR right there was a Microsoft
signed driver this was just a while ago
U malicious drivers ush usher in EDR
killers and you end up with ransomware
so your EDR is not
like the end all be all there are ways
around it but if you're still using
Antiquated AV like I'd say you really
got to get an
EDR all right so we go back to earlier
in the presentation where I said fishing
is not just
fishing it's also you know just running
out onto the web and doing Google
searches so Story
Time here's a search that you can
perform right now WI nursing
practitioner it should be uh Wisconsin
practitioner collaborative practice
agreement Wisconsin this blew me away
because this targeted
Wisconsin now I'm in healthcare and if
if a employee of my organization did
this search it would be legit it's
work-related they're trying to get some
information about collaborative
agreements but the site that it's at is
n.com now as security practitioners we
might look at that and do a little bit
more research the average user what are
they going to look at nrha it's got a
cowboy on it like is that is that a
Health Organization in Wyoming what is
it the average user is not going to care
they're going to click on the link but
let's say we have a super user oh I
should know what that is they go out and
they look nrha is the North American
reigning Horse
Association why is there a nursing
collaborative agreement on the on the
raining Horse Association
website I don't know let's find
out so our super duper user is really
good they want to test that site before
they go at it so they run out and they
say hey let's throw this into the web
filter test what is what is this site
come up as it comes up as Sports and I
want you to look at the category low
risk all right well this is low risk I
should be able to go to this site it's
low risk and it's what I'm looking for
so again important the first time that
this link is clicked using your IP
address clicked using Google as a
refer and clicked this is going to be a
you know we're going to go through this
a bunch of times clicked with a an
appropriate browser agent this page
appears so your user says all right it
all looks good I'm going to click it and
what are they presented with hi I'm look
this is someone else hi I'm looking uh
uh to nurse practitioner collaborative
practice agreement in Wisconsin notice
does the grammar eror a friend of mine
told me he had seen it on your Forum I
will appreciate any help here and the
admin of the site says here's a direct
download link like how awesome I Google
searched and found
it now when you go to click on that we
got this super duper user they hover
over the link like they've been trained
in the five minute training they had at
the beginning of the year and they say
oh it's a website
alphabet. now I wouldn't expect them to
know that's Poland I that's kind of odd
a Wisconsin collaborative agreement in
Poland so let's take a look let's let's
do our due diligence what's that site
categorized as we take a look it's
categorized as personal sites and blogs
and once again low risk what are the
odds you're blocking that maybe you are
maybe you don't allow anybody to go to
personal websites and blogs wonderful
good for you but if you're not it's low
risk they're going to get
there there it is alphabets PL lowrisk
so our super duper user says okay before
I download this I'm going to take that
domain and I'm going to stick it into
virus total and they do that and they
see this site's been around for a while
three
years zero out of 71 it must be safe
virus total can't be wrong it's zero out
of
71 so our user is really really smart
right that was 0 out of 71 that was old
data I want the updated virus total so
they clicked the little refresh button
and and what do they see Zero out of 90
when I did this on the 4th of March this
year it's got to be okay to go to that
website so they go ahead and go to that
website and they download something and
amazingly this is incredible the file
they download has exactly the words in
it that they need nurse practitioner
collaborative agreement
Wisconsin do zip this is awesome but
we've got this super duper user that's
just not going to take that as what they
want they're going to upload that to
virus total so let's upload it to virus
total oh my God there's three
detections but again I want you to look
at what's not there there are three
detections if you're not using goog EET
no Google EET nod or icaris right your
product didn't catch this and if the
user really wants this bad they're going
to say well that's probably a false
positive there are 87 that say it's
okay so we downloaded and we extract it
and you and I look at that the first
thing we do is we review over to the
right and oh it's ajs file and we're
done like that's nothing that I want but
our user doesn't right our user doesn't
even know what a JS file is they're
going to doubleclick that JS file and
the minute that they double click well
no actually no they're really really
smart right we're dealing with the
incredible user they're going to say
let's take that JS file and let's upload
it and it's been downgraded from 3 out
of 59 to 2 out of 59 woohoo
the JS it must have been something in
the zip file that was bad now they're
going to say okay let's run it and at
that point in time you better hope your
EDR is working because this flew by all
of your security mechanisms down to the
end point and if your your your your EDR
doesn't look at this and what you're
going to see here in a little bit your
EDR should say this is bad but if it
misses it or if it gets disabled some
way shape or form you're a a luck so I
took that JS file and I uploaded it and
it didn't say it was malicious this is
interesting right the earlier one I said
100% out of 100 but this one is 35 out
of 100 it's
suspicious and as a thread Hunter I want
to say well why was it suspicious I
always go to what did it do well that JS
file was run by
wscript and that
wscript well I can go back but the W
script it was going to reach out to a to
a website download a a downloader and
infect the
machine so never ever ever and this is
why the EDR should have caught it never
ever ever should someone download
something from the web and then it gets
executed by wscript and then it reaches
back out to the web that ain't normal so
any EDR worth its salt should block that
but if you don't have an EDR or you EDR
failed in some way shape or form right
at this point you're going to get
infected so now I want to talk about
that happens and as the thread Hunter
investigator I want to look into
it I extract the domain name the URL to
go see what was what was this website
where was it and I just go directly to
it and when I do that I'm actually
provided a different website with the
nurse practitioner collaborative
agreement
so one of two things as
a thread Hunter that's never been
through this you're going to think is
it's been cleaned up and you're probably
not going to contact that website and
say you you got ma malware there
or you're going to submit that URL to
your secure email Gateway or your web
Filter company and they're going to look
at it and they're going to say it looks
normal to us we went to that URL and
it's fine now what the bad guys are
doing is they're saying if someone goes
to that URL a second time from the same
IP show them a different
page if someone goes to that
URL and the refer is not Googled meaning
they didn't get to it using a search
engine it's a thread Hunter show them a
different page so it makes our job
harder in finding these things because I
have to look at what the user did and
then I have to emulate it
perfectly
now if you're interested in finding some
more of this type of malware you can
search for Colorado nurse practitioner
agreement now I want you to notice where
this one is in Iran right I hope you
don't download unless you're a
investigator right you don't want to go
downloading that one but it's out there
now what attack have you just seen
that's a Goot loader attack and the
JavaScript based infection framework for
Goot loader rat increasingly delivers a
wide variety of malware including random
someware that's as easy as it
happens user doing everything legit your
software applications not being uh uh
not filtering properly right your SSL
decryption not seeing the SSL decryption
your antivirus not catching it your
inline antivirus not catching it and if
your EDR doesn't catch it then that's
how when you hear about organizations
that have been Ransom weared that's how
it can happen a simple Google search
all right so that you know uh I first
sent so the the the filtering software
that I said was missing this I said you
know it would be good for me to let them
know that they missed it so I shot them
off an email and said this website is
malicious it's got malware on it and I
got a response back we're not changing
it and then I was like all right so they
don't know how to analyze it so I sent
them a new email email if you go to this
IP address the first time using uh but
you have to find it through Google and
this is how you do that um and you
probably need a browser agent of this
then it will show you this page which
which has a malicious download now I
don't know if they were lazy or if they
just didn't want to do it the next email
was send us a copy of the
malware so I had it so I sent them a
copy of malware and here you go they uh
they went ahead and recategorized it as
malware so I did the right thing and I
said di their product's not working
right let's get it
fixed so how might you as a a security
practitioner help out your secure email
Gateway filtering and your your web
filtering well there's a product out
there on GitHub called uh uh DNS twister
it might is it Mark do you know is it
built into
Cali okay I it might be built into Cali
but what what DNS twister will do is it
you can can you can feed it a domain and
it will find all of the iterations like
I showed you all of the false uh um uh
banking sites it'll tell you all those
iterations it'll find out if that domain
name has been categorized here's an
important part it'll tell you whether
there's an MX record so if there's a
fishing site that uses email you can
tell your secure email Gateway block all
that crap uh and if you if you're like
me and you don't like downloading and
installing stuff there are a couple of
websites so here's here's DNS twister at
the command line and you know Linux Cali
box uh there's a couple of websites that
will do it for you here's dnst twist.
you can just put in the domain name and
here's DNS twister. report the one I
like and why do I like it because it's
got this export CSV value so you can go
stick in a domain and you can say find
me all the iterations and then you can
export that to
CSV the next thing you would do is feed
that into your your your secure email
Gateway or your uh uh your vendor
firewall and find out what are all these
categorized as and if they're not
categorized as fishing or malware or
whatever right then you would say okay
I'm going to have them all recategorized
and you're going to make you and
everybody that uses your product more
safe so uh you know uh do GE healthc
care sometime on uh on on uh well all
right here's here's is this the fake one
yeah here's GE Healthcare uh improperly
configured uh in this site telling you
how it's going to be uh uh tested and it
would just come back as you know a
health and wellness site that needs to
be
recategorized um you can automate the
process so you can take all those URLs
and you can write a script that you can
stick into like on AO elto you would do
a test URL and the domain name and it'll
spit back what all this stuff is
categorized so if any of you are using
po elos you can do
that what I would recommend so I would
script the domain so I am scri
scripting all of the domains that I find
are important to us so all of our my
organization's own domains all of the
organizations like me that we do
business with their domains I go into my
my firewall and I say dump everything
that was a was a financial organization
or health and wellness or or shopping or
uh um uh I don't really worry about
Mills and gobs because they can't be
faked that easy and and get me all those
domains and then I feed that into my
ioc's filter which tells me what they're
categorized as that provides me with an
Excel spreadsheet that I can say don't
show me anything that I'm already
blocking show me all the other stuff and
I literally block hundreds of domains a
week unfortunately this can take some
time it's easy when you have something
like GE healthare or Commerce Bank it's
much harder when you have these weird
domains like
BC how does that go um
bcbsil.com anybody happen to know what
bcbsil.com is that's Blue Cross Blue
Shield
Illinois well those love they love to
fake those sites because people make
typos all the time and so that BCBS i l
and there's probably other states that
are using them that's one of those that
you're going to get all kinds of
legitimate domains that begin with
BCB so you have to view them and say all
right that's legit and that's why I
recommend your script ignores legit
websites that look like they're uh um
spoofed but they're not they're spoofed
domains then you don't have to re-review
them every
week uh start with your domains I would
highly recommend you look at your vendor
domains and then add your special
domains and if you think this looks like
a lot of work it's a lot of work I like
do 10 ,000 domains like when I get my
spoof domain list it's in the 10,000
range uh luckily there's nothing you can
do like how do you eat the elephant
anybody thank you very much right so one
bite at a time you eat the ele elephant
one bite at a time so I wouldn't
recommend starting with all of your
domains because you're going to end up
like me you got 10,000 things to fix and
I can't turn off a lot of you are
probably like that just can't turn off
like uh yeah commercial maybe I can go
down and ref filter some
domains so add your special domains and
then look at businesses and others right
you may may have some ideas that I don't
have and uh the last thing I want to
talk about is when you have a compromise
in a layer of security but you didn't
have a breach you really need to start
looking at every single layer that it
got by and find out why it got by that
and fix that layer or your eventually
going to be nailed this is why we have
defense and depth and if you're just
saying oh my defense and depth worked
I'm good you're making a mistake so I
don't have a checklist for you here but
if you Google postmortem checklist I
highly recommend that you do that okay
it got through these five layers of
security it's at this layer of security
uh um why did it get by these five and
then look at what can we do to fix it I
think you're going to find like I did it
all starts with DNS or 90% of the time
it starts with DNS so if you can fix up
DNS you're probably better
off and that's what I have thank you are
there any
questions everybody waiting for final
announcements I did pretty good 45
minutes thank you cyphercon have a good
day I will do
that
there you
go if you're in education uh if you're
an instructor this would be a really
easy if I was still teaching this is
absolutely a project I would do I would
say I want now here's the problem you
can't do it with an edu site because you
can't really fake an edu site yeah
that's a special site like. goov and
like mill but you could go to
organizations in your area and say uh
just start with them and then if if
they're willing to tell you what
firewall they're using again this is for
Education if they're willing to tell you
what firewall they're using you could go
find out what website will tell you what
those things are filtered as and you
could provide them with a report and if
there's a free method lot of these
filtering software uh websites will
provide a location where you can you can
request request
recategorization um you could do it all
for the business and you could provide
incredible value to your students
because now they know how to do this and
incredible value to the local businesses
that you're helping out so if you're an
instructor think about that easy things
to do all right thank
you