[Music]
good evening everyone my name is Joe so
my goal today is to share a bit about
the team that I work for and how we
combine the red and blue security
perspectives but before I jump into that
I'm going to share a little bit about my
background as I feel it's relevant to
this
conversation so I spent the first 15
years of my career as a penetration
tester and security consultant and I was
very fortunate to be part of an amazing
team in Madison uh during the early days
of the security industry and during that
time we contributed a number of tools
and content to the community under the
the fufus name and this included the
password guesser Medusa the password
hash Liberator FG dump and a bunch of
other useful scripts and and
tricks I recently heard these referred
to as Boomer
tools but I still take great pride in my
contributions at that time to them and
then about 10 years ago I left
pentesting to join a large Healthcare
software
company specifically I work within its
hosting division where we provide our
software as a p solution to hospitals
clinics and other healthcare related
Orcs now I made a lot of recommendations
on paper as a consultant to various
clients um a key reason for my change
was to see firsthand what it took to
actually Implement those controls in in
a real world scenario and then as an
extra kind of benefit reward I now get
to create very challenging obstacles and
just make life very hard for our
pentesters so for me there are really
two separate worlds in security there's
a red one and a blue one and as a red
teamer one is hired to test existing
security controls right they attempt to
answer question questions of whether
they can evade some sort of protection
can they compromise credentials can they
elevate their access to gain further
inroads basically the red teamer will
they get hired to do what others might
go to jail for
doing and they also through that develop
this deep knowledge into what a real
Attack might look like and they
prioritize vulnerabilities then in ways
that give them clear paths to things
they care about for example domain admin
now that being said the deliverable here
isn't the hacking of something but the
report on how to fix it and why that
actually matters and that's usually
where the fund might end right cuz these
reports they're often used simply to
check a box and their recommendations
aren't actually
implemented for me it was a major point
of burnout and why It ultimately left
and I found myself just asking the
question of what what I was doing was it
really providing real
value now as a blue teamer we often
prioritize our security efforts based on
a bunch of different sources of
information usually discret lists for
example we have vulnerability scanner
output right we have configuration
Benchmark checklist checklists
compliance requirements or maybe
internal lists that prioritize some
asset based on business context
there's value in all of this information
however it's an often overwhelming
amount of data and it begs a question of
whether we can really use it
intelligently on the blue team we also
have the challenge of implementing our
controls and our prioritization while
it's based on our own time ensuring
availability meeting compliance
requirements and
finally dealing with the real security
impact now I don't have the answers
necessarily how to always bridge the gap
between blue and red but what I can do
is share a bit about how we look at
security where I work specifically how
we try to find that magical kind of
purple
mix I'm going to start out by laying out
several discreet attack components
before combining them hopefully
interesting ways the first step in my
hypothetical attack is password guessing
red teamers they're probably going to
mock password spraying they're going to
say that well you're likely to get
caught it's noisy and so forth and my
experience I'll admit is dated but this
was never a problem I ran
into so my
preference is that we do a shallow
attack right we send a very small number
of passwords against a very large list
of
users and this approach I found to be
incredibly effective and generally will
fly under any radar
it's why we wrote Medusa 20 years ago
because zero days they're great fun and
all but their life is generally
shortlived users picking stupid
passwords that my friends that's
Timeless and and to be sure MFA and all
that is improved but it's not everywhere
and it's not always foolproof as the
previous talk just
mentioned we're now as I show show here
in what I consider Prime spring 23
season that I am incredibly confident if
you look at any company out there they
have at least one maybe many more people
with a password of spring 2023 at this
point I'm going to pick on Citrix next
in my
example so I'm in healthcare it Citrix
it's everywhere and it's been that way
for 20 years and it's going to continue
for many more so so as a very quick
refresher in a Citrix environment the
end user does not have the application
installed locally the application and
all its configuration and data reside on
the remote server the user they simply
send keystrokes and mous clicks to that
server and they get back screen
updates our users nurses and doctors
well they're incredibly mobile moving
from exam room to exam room and they'll
log in to some Thin Client and they'll
get access to their tools via
Citrix in this approach then it provides
them easy session movement it gives us
centralized management and overall cost
of endpoint
reduction an individual hospital it can
have hundreds or thousands of concurrent
Citrix
sessions on the flip side Citrix is a
favorite Target of penetration testers
right it's sometimes exposed to the
internet and at least to a less trusted
Network and Citrix is nearly impossible
to fully secure I would argue that the
technology is just dated at this point
and it's from a gentler time in our
history and remember that that
application and the actions are
happening on the citric server not the
workstation so if that server is
compromised well the attacker is
potentially behind the firewall and able
to act within the
environment so let's assume that I
compromised a employee at a hospital
through my password guessing effort and
then I used their account to log on to
an internet facing Citrix portal this
can be bad in and of itself right I can
potentially abuse published tools such
as this EHR application that get to
sensitive
data in this case though I'm an attacker
with larger Ambitions I want to
compromise the entire
organization and I'm going to continue
down my path by breaking out of this app
so in it we see this import option and
what that does is it takes us to a
standard Windows File dialogue box and
here as an attacker I can now peruse the
local file system of that remote citric
server and then rather than importing a
file as intended by the application I
can use a simple drag and drop type
action to execute Powers shell it
provides me with an interactive prompt
on the the remote citric server and the
important thing to remember here is that
that command prompt it's on the server
it's not on my
workstation and there's going to be many
many ways to break out of any published
app and the more complicated that piece
of software is the more possibilities
will
exist so at this point I have an
interactive prompt within the target
organization however I'm still just a
non-privileged user in the domain so to
continue down our path I need to elevate
my rights and gain administrative
control of the
server in the past few years we've seen
zerod day privilege escalation exploits
Dro roughly once every 6 months the
first here exploited a bug in the native
task scheduling service it allowed a
normal user to run things as an admin
and it's a bit dated at this point
however I mention it because it's a good
example of the logic behind some of the
controls I'll discuss later
so let's assume that I've elevated my
rights and I'm now an admin on the
citric server what am I going to do well
for me I'm going to steal credentials of
other logged in domain users as well as
local
accounts back in the day we wrote FG
dump to do just this today tools like
MIM cats and others might be used and
this sort of action is especially
important on shared systems like citric
servers well many people will be logged
into at once and their
credentials those might be in clear text
and memory or maybe they're stored as
one-way hashes on the system from an
attacker perspective it doesn't actually
matter I can use either to connect as
that person to some
resource Microsoft Windows it has this
beautiful design flaw where you can use
a password hash in Li of the actual
password to authenticate to something we
call it passing the
hash what we saw here was Medusa
spraying a single hash against a very
long list of computers and identifying
which of them had that hash assigned to
its local administrator
account and if you look then beyond
those local accounts logged in users are
also especially handy tools like blood
hound will they make finding those
sessions and then identifying where they
can be abused incredibly
easy so in this scenario let's assume
that I stole some creds I sprayed them
and I was able to start moving across a
domain and I stole additional creds and
I could strategically hop at that
point and if we start to connect these
discreet paths well things just get more
interesting right because as an attacker
assets they're not a list they're a set
of relationships best described Des by a
graph and this concept it's it's not new
I mean as attackers we stole passwords
20 years ago and we hop through things
but the tools to visualize both
offensively and defensively and then
prioritize our remediation efforts those
have
improved this first graph here in the
upper left um is one a former coworker
of mine made probably more than a decade
ago in it each tiny Blue Dot represents
a system at the Target
Network each red box is a unique local
account
credential the giant Pac-Man thing that
you see that exists because there are a
thousand systems that have the same
local administrator
password a compromise of any single one
of them is effectively a compromise of
them
all the screenshot on the other side is
that of modern free and open open source
Blood Hound it's prettier than the first
and it shows more than just local
accounts but the idea is the same right
it's how do systems and accounts Link in
ways that we can abuse
them so when we start to combine these
kind of individual attack components we
get an attack path graph that we can
actually
visualize so in the earlier example I
discussed an attacker gaining access
citric from the
internet they broke out of some
published application they elevated
rights they then stole credentials from
that host and identified where they
might be useful and they hopped and
moved laterally across the environment
ultimately finding a domain admin
credential the steel and owning the
entirety of the
domain if we look at it a different way
in a second path maybe the attacker
fishes the end
user and in this scenario the end user
has local admin rights over their
respective workstation which is very
common still in organizations today and
it makes the attacker's life all that
much easier then let's assume that that
workstation was spun up from some gold
image some template right and because of
that the built-in administrator account
is shared with every other thing spun up
from that
template allowing the attacker then to
hop through
them and in this scenario let's assume
that they ultimately landed on the
workstation of a help desk member and in
most organizations the help desk is
looked to and delegated rights to
provision and reset other accounts so
here in our scenario we can take over
the admin account of somebody in charge
of the Enterprise password vault which
then contains the keys to the kingdom
right so we can extract other
credentials maybe demain adid and it's
game
over so what we have are two two
starting point or the same starting
point and destination point with two
distinct paths between them in any place
you go likely if you pick these two
points there's going to be a lot of
different paths through
them so at my work we invest a lot of
effort into penetration testing and
offensive
exercises our goal is to graph out
potential attack paths and then look for
ways to to proe those
graphs in our efforts while they can be
boiled down into a couple of different
options the first is how do we map and
prioritize choke points that large
numbers of attack pths might flow
through secondly how do we identify
singular controls that if implemented
would eliminate the largest number of
graph
edges admittedly when we were first
building our environment we had graphs
that looked like the problem one so
let's walk through now a couple of the
choke points and edges that we tackled
to fix our graph
problems we addressed this first choke
point by ensuring that privileged
accounts such as domain admins can only
be updated by similarly privileged
users in our environment it's members of
our operations center who are delegated
rights to reset and provision most staff
accounts however it's only a subset of
the windows admins that can update
similarly administrative level
accounts and then we take it further and
we Implement processes that manage the
active directory account ownership and
that's to fix the problem where an
account that creates another account
retains ownership of it under the hood
indefinitely so in our environment we
don't have your traditional workstation
for us it's Citrix that fills that role
and at any given time we might have a
quarter of a million conc concurrent
citric sessions it is by far our biggest
attack surface it is the most likely
point of Ingress and it's the start of
most paths in our
graph we invest a lot of effort into
hardening Citrix against the breakout
attacks that I showed earlier and this
includes application control where we
restrict which processes can be run to
only those signed by trusted
sources and then we take it a step
further and limit that to a subset of
those processes because we want to avoid
the problem called living off the land
right where an attacker might abuse a
normally trusted sign tool such as
poh we we also disable any unused native
functionality for example that whole
drag drop action that we saw earlier
that's ripped out services like the prin
spooler Tas scheduler they're also
it's by turning off that which
we do not need that we can avoid the
impact of a lot of these zero
days now de feating 100% of Citrix
breakout attacks it's not realistic
right and our goal then is just to make
that initial compromise as hard as
possible we want to make the attacker
really work for it because if they have
to they're going to trip a lot of alarms
along the way and just as important as
stopping that break out well it's our
ability to detect and contain the
malicious
user now there's always going to be some
way into a network the key then is to
break up paths sufficiently enough to
contain or slow the attacker and provide
us with an opportunity to detect
them and the first step we took to
reducing our edges was just to eliminate
the sharing of local account credentials
right we wanted to avoid that Pac-Man
problem seen earlier and we did it just
using Microsoft's Labs it's a free and
effective tool that sets a fully managed
random password on each local
administrator account
we then looked at how we could sever
edges between different groups of
systems and we implemented logical
credential tiers to help Define what
accounts can have administrative access
to what class of
server this year is Microsoft's uh
graphic of their classic 3tier Model and
it essentially mirrors our own
implementation in it tier zero that top
layer that is the most privileged highly
sensitive tier it contains things like
accounts like domain admin and servers
like domain controllers or password
bolts tier 2 is your most atrisk layer
it's systems that have interactive end
user log on such as workstations or
maybe our internet basing web servers
and then tier one is everything in
between application servers and the
like and the basic rule to the tiering
model is
that if you have an account with
administrative rights in a given tier
that account can only be used within
that tier for example a domain admin
account it's used to log into a domain
controller it can never be used to log
into something in tier one or tier two
because if it was it password would be
in memory or somewhere that could be
stolen if that machine was popped and
used to elevate rights in the
environment
the final step we' used to carve up our
Network in sever edges was through micro
segmentation so in security there's this
classic &m analogy used to describe the
traditional corporate Network right the
internet firewall provides this hard
outer shell but inside it's soft and
gooey now I might have the analogy
slightly wrong because most M&Ms aren't
soft and gooey but nonetheless it still
has always stuck with me right because
as an attacker if you get past that
internet firewall and you're inside the
environment you're generally free to
move about an
attack with micro though we can be way
more granular in our network controls
the firewall rules they're now applied
at the asset itself rather than out at
the network Edge and it allows us to
Define groups of assets and what they
can talk to and how they might be able
to talk
for example we can say our Citrix server
well I can talk to a specific file
server on a file sharing protocol or
maybe I can talk to an operational
database on a database
protocol but then we can layer on this
default deny rule where things that are
not explicitly allowed are implicitly
denied so that brings us to the end of
my talk so my goal here was to share a
little bit about my transition from red
to blue and then how we attempt to
combine the two perspectives to protect
our
systems and I work in a complicated
environment with a lot of controls right
and I'm biased but I strongly believe
that our most effective controls are the
ones that we developed in response to
offensive security
testing and quickly before I go I want
to make one quick plug so like most of
the world we are actively looking for
experienced Security Professionals so if
you're out there and you're a pentester
who wants a more purple role and you
live in Madison or willing to move there
and you work want to work in a complex
environment with meaningful data and
make a difference please talk to
me that's all I
[Applause]
got