MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with ATT&CK, David Middlehurst, Trustwave

MITRE - ATT&CKcon
MITRE - ATT&CKconMITRE - ATT&CKcon
••
Playing Devil’s Advocate to Security Initiatives with ATT&CK David Middlehurst Principal Security Consultant October 23, 2018
Agenda Introduction Playing Devil’s Advocate Command and Control Demo Mitigations 1 2 3 4 5
whoami /priv • IT security since 2009 • Pentester @ SpiderLabs • Researcher • Red Teamer • Many top-tier financial organizations • Some regulator driven red teaming @dtmsecurity
Thoughts Beyond the Rainbow • Can we apply to wider security initiatives? • Assess if existing controls are sufficient. • Take into consideration when rolling out new initiatives. • Are we introducing new attack vectors? • Can we pre-empt a new variant of an existing technique? • Could a security initiative actually things worse? • Are we focusing effort in the right areas?
Playing Devils Advocate
Playing Devils Advocate “[Adopting Smart Cards] provided a false sense of security in regards to credential theft from malware infected machines.” “To add insult to injury, Windows Smart Card logon has a truly ugly side to it, as it generates an “everlasting” hash, thus providing less security than the regular password-only logon process against Pass-the-Hash attacks.” Lateral Movement Pass the Hash & Pass the Tickethttp://www.infosecisland.com/blogview/23657-Smart-Card-Logon-The-Good-the-Bad-and-the- Ugly.html
Playing Devils Advocate • Implementing multi-factor authentication. • Assuming a token based implementation is adopted. • Is this enough? • Evilginx2 style attacks • Sim Swapping Attacks • SS7 Initial Access Spearphishing Link
Playing Devils Advocate • Secure Boundary • Validate Security Controls • Attack Simulation / Red Teaming • Purple Teaming Configuration review of an isolated system PRE-ATT&CK
Command and Control
Exfiltration / Command and Control Direct TCP connections.• HTTP based over any domain• HTTPS based over any domain• Valid SSL certificates• Categorized domains• • “Domain Fronting” Third• -party services / “C3” Exfiltration Exfiltration Over Command and Control Channel Command and Control Web Service
DNS over HTTPS (DoH) - DNS over HTTPS (DoH) is an experimental protocol for performing remote Domain Name System (DNS) resolution via the HTTPS protocol. The goal of the method is to increase user privacy and security by preventing eavesdropping and manipulation of DNS data by man-in-the-middle attacks. [Wikipedia] - “Even if you are visiting a site using HTTPS, your DNS query is sent over an unencrypted connection. That means that even if you are browsing https://cloudflare.com, anyone listening to packets on the network knows you are attempting to visit cloudflare.com.” [1] - “To combat this problem, Cloudflare offers DNS resolution over an HTTPS endpoint.” [1] [1] https://developers.cloudflare.com/1.1.1.1/dns-over-https/
DNS over HTTPS (DoH) How can we fix this with Trusted Recursive Resolver (TRR) and DNS over HTTPS (DoH)? “At Mozilla, we feel strongly that we have a responsibility to protect our users and their data. We’ve been working on fixing these vulnerabilities. We are introducing two new features to fix this— Trusted Recursive Resolver (TRR) and DNS over HTTPS (DoH). Because really, there are three threats here: You could end up using an untrustworthy resolver1. that tracks your requests, or tampers with responses from DNS servers. 2. On-path routers can track or tamper in the same way. DNS servers can track your DNS requests.3. ” https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/#trr-and-doh
You can enable DNS over HTTPS in Firefox today, and we encourage you to. [1] “DoH support has been added to Firefox 62 to improve the way Firefox interacts with DNS. DoH uses encrypted networking to obtain DNS information from a server that is configured within Firefox. This means that DNS requests sent to the DoH cloud server are encrypted while old style DNS requests are not protected. DoH standardization is currently a work in progress and we hope that soon many DNS servers will secure their communications with it. Firefox does not yet use DoH by default. See the end of this post for instructions on how you can configure Nightly to use (or not use) any DoH server.” [1] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/#trr-and-doh [2] https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/
DNS over HTTPS (DoH) https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/
MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with ATT&CK, David Middlehurst, Trustwave
DNS over HTTPS (DoH) https://blog.nightly.mozilla.org/2018/08/28/firefox-nightly-secure-dns-experimental-results/
DNS over HTTPS (DoH) https://github.com/curl/curl/wiki/DNS-over-HTTPS
DNS over HTTPS (DoH) • https://dns.google.com/resolve?name=example.org • https://cloudflare-dns.com/dns-query?name=example.org HTTPS GET JSON (application/dns-json) HTTPS POST DNS Wireformat (application/dns-message) echo -n 'q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | base64 -D | curl -H 'content- type: application/dns-message' --data-binary @- https://cloudflare-dns.com/dns-query -o - | hexdump curl -H 'accept: application/dns-message' -v 'https://cloudflare-dns.com/dns- query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | hexdump HTTPS GET DNS Wireformat (application/dns-message) DNS over TLS on standard port 853
Legacy DNS - A Record EIGFGMGMGPCAFHGPHCGMGE 0x48 0x65 0x6c 0x6c 0x6f 0x20 0x57 0x6f 0x72 0x6c 0x64 H e l l o W o r l d JBSWY3DPEBLW64TMMQ 0x480x650x6c0x6c0x6f0x200x570x6f0x720x6c0x64.example.org eigfgmgmgpcafhgphcgmge.example.org jbswy3dpeblw64tmmq.example.org Command and Control Standard Application Layer Protocol
Legacy DNS – A Record RFC 1035 • labels 63 • names 255 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa. aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa. aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa. aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa. a.example.org 63
Legacy DNS - TXT Record • Strings 255 octets or less • Multiple Strings • Base64 TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2N pbmcgZWxpdC4gTWF1cmlzIHNjZWxlcmlzcXVlIHNhcGllbiBhYyBudWxsYSBjdX JzdXMgdm9sdXRwYXQgZWdldCBpYWN1bGlzIGFyY3UuIFByb2luIHF1aXMgc2VtI HF1aXMgcmlzdXMgZmVybWVudHVtIHVsdHJpY2VzIHV0IHZpdGFlIGVuaW0uIElu ===
Legacy DNS Exfiltration • https://wiki.skullsecurity.org/Dnscat • https://github.com/iagox86/dnscat2 • https://github.com/yarrick/iodine • https://www.cobaltstrike.com/help-dns-beacon • https://github.com/Arno0x/DNSExfiltrator Exfiltration Exfiltration Over Alternative Protocol
Implementing C2 over DNS over HTTPS… https://www.cobaltstrike.com/help-externalc2 …for Cobalt Strike I think I should use the External C2 specification
Implementing C2 over DNS over HTTPS • But It’s HTTPS right? • Malleable C2 allows us to customize HTTPS requests and responses • Simple DNS server to relay Netbios query to teamserver then pass back base64 response via a TXT record
Implementing C2 over DNS over HTTPS • Not quite enough flexibility • Netbios encoding is there • Can’t limit length? • http-post which we can force to be a GET requires two parameters, we only have one
Implementing C2 over DNS over HTTPS But it• ’s DNS right? DNS beacon uses DNS• cloudflared• is a nice binary that can set up a legacy DNS to DoH proxy Only need admin to listen on a privileged• port (53) Package that with a beacon and we are• good to go?
Implementing C2 over DNS over HTTPS • Idea of a DNS beacon was to send queries recursively • Cannot hardcode a DNS server • Need to modify OS to change default resolver. • This would work but is not ideal
C2 over DNS over HTTPS
C2 over DNS over HTTPS • Implement a DoH channel in .NET External C2 Framework • Create a custom DNS server Ryan Hanson https://github.com/ryhanson/ExternalC2 https://github.com/outflanknl/external_c2 https://github.com/pawitp/acme-dns-server MWR Labs (@nmonkee & @william_knows) - ‘C3’ / ‘Overt C2 – The art of blending in’
C2 over DNS over HTTPS
Demo Show it-
Demo
That’s not all $ nslookup > server 8.8.8.8 Default server: 8.8.8.8 Address: 8.8.8.8#53 > google.com Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: google.com Address: 216.58.206.110 > dns.google.com Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: dns.google.com Address: 216.58.206.110
That’s not all $ curl 'https://google.com/resolve?name=google.co.uk' -H "Host: dns.google.com" -H 'authority: dns.google.com' -H 'upgrade-insecure-requests: 1' -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8' -H 'Accept-Encoding: identity' -H 'accept-language: en-US,en;q=0.9’ {"Status": 0,"TC": false,"RD": true,"RA": true,"AD": false,"CD": false,"Question":[ {"name": "google.co.uk.","type": 1}],"Answer":[ {"name": "google.co.uk.","type": 1,"TTL": 299,"data": "216.58.206.99"}],"Comment": "Response from 216.239.38.10."} Command and Control Domain Fronting & DoH
Mitigations • Strip TLS connections – Delta between the target host and the ‘Host:’ header (Domain Fronting) – Signature for DoH queries in the same manner you would for DNS tunneling i.e. question and response lengths, common encodings • Heuristic based detection – Anomaly based detections of packet sizes, frequency and volume, time based, pattern of life. • Block or monitor access to public DoH providers (If you can) – You can still use DoH from your root organizational DNS servers and host your own DoH servers. – How are the URLs categorised. Specific IP addresses of the providers. (Not in the case of Google). – ‘application/dns-json’ – ‘application/dns-message’ – Port 853 (DoT)
Social Mapper Questions @SpiderLabs @dtmsecurity https://github.com/SpiderLabs/ Check out Check out
1 of 36

MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with ATT&CK, David Middlehurst, Trustwave

••
Download to read offline
Technology

This talk presents a case study which demonstrates that we should consider the knowledge and wisdom contained within ATT&CK in all organizational security initiatives to make sure by fixing one thing we have not just created an opportunity. The presentation shows how to leverage the analysis and classification of APT tactics and procedures (TTP) to guide research into new and novel techniques, specifically focusing on exfiltration and command and control. DNS over HTTPS (DoH) aims to increase user privacy and security by preventing eavesdropping and manipulation of DNS data by man-in-the-middle attacks. Major web browsers such as Firefox are considering its implementation by default. But what could this possibly mean for exfiltration and command and control? This session provides an end-to-end demo that shows DoH being implemented to provide full command and control in a popular attack simulation framework and discusses associated mitigations.

MITRE - ATT&CKcon
MITRE - ATT&CKconMITRE - ATT&CKcon

Recommended

Threat-Based Adversary Emulation with MITRE ATT&CK by
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels
2.9K views•30 slides
MITRE ATTACKCon Power Hour - December by
MITRE ATTACKCon Power Hour - DecemberMITRE ATTACKCon Power Hour - December
MITRE ATTACKCon Power Hour - DecemberMITRE - ATT&CKcon
1.1K views•120 slides
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,... by
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...
MITRE ATT&CKcon 2018: Sofacy 2018 and the Adversary Playbook, Robert Falcone,...MITRE - ATT&CKcon
2K views•57 slides
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo by
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoBSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoKatie Nickels
6.2K views•40 slides
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate... by
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...
MITRE ATT&CKcon 2.0: Ready to ATT&CK? Bring Your Own Data (BYOD) and Validate...MITRE - ATT&CKcon
2.7K views•132 slides
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT... by
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...
MITRE ATT&CKcon 2.0: Flashback with ATT&CK: Exploring Malware History with AT...MITRE - ATT&CKcon
3.8K views•19 slides

More Related Content

What's hot

MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da... by
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE - ATT&CKcon
2.6K views•22 slides
ATT&CKING Containers in The Cloud by
ATT&CKING Containers in The CloudATT&CKING Containers in The Cloud
ATT&CKING Containers in The CloudMITRE ATT&CK
650 views•27 slides
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit... by
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...PROIDEA
2.4K views•28 slides
MITRE AttACK framework it is time you took notice_v1.0 by
MITRE AttACK framework it is time you took notice_v1.0MITRE AttACK framework it is time you took notice_v1.0
MITRE AttACK framework it is time you took notice_v1.0Michael Gough
3.5K views•41 slides
MITRE ATTACKcon Power Hour - October by
MITRE ATTACKcon Power Hour - OctoberMITRE ATTACKcon Power Hour - October
MITRE ATTACKcon Power Hour - OctoberMITRE - ATT&CKcon
3.2K views•102 slides
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe... by
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE - ATT&CKcon
5.2K views•123 slides

What's hot(20)

MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da... by MITRE - ATT&CKcon
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE - ATT&CKcon•2.6K views
ATT&CKING Containers in The Cloud by MITRE ATT&CK
ATT&CKING Containers in The CloudATT&CKING Containers in The Cloud
ATT&CKING Containers in The Cloud
MITRE ATT&CK•650 views
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit... by PROIDEA
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vit...
PROIDEA•2.4K views
MITRE AttACK framework it is time you took notice_v1.0 by Michael Gough
MITRE AttACK framework it is time you took notice_v1.0MITRE AttACK framework it is time you took notice_v1.0
MITRE AttACK framework it is time you took notice_v1.0
Michael Gough•3.5K views
MITRE ATTACKcon Power Hour - October by MITRE - ATT&CKcon
MITRE ATTACKcon Power Hour - OctoberMITRE ATTACKcon Power Hour - October
MITRE ATTACKcon Power Hour - October
MITRE - ATT&CKcon•3.2K views
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe... by MITRE - ATT&CKcon
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon•5.2K views
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz by Christopher Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - GerritzBSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
BSidesLV 2016 - Powershell - Hunting on the Endpoint - Gerritz
Christopher Gerritz•9K views
No Easy Breach DerbyCon 2016 by Matthew Dunwoody
No Easy Breach DerbyCon 2016No Easy Breach DerbyCon 2016
No Easy Breach DerbyCon 2016
Matthew Dunwoody•40K views
David Bianco - Enterprise Security Monitoring by bsidesaugusta
David Bianco - Enterprise Security MonitoringDavid Bianco - Enterprise Security Monitoring
David Bianco - Enterprise Security Monitoring
bsidesaugusta•2.8K views
Hunting: Defense Against The Dark Arts by Spyglass Security
Hunting: Defense Against The Dark ArtsHunting: Defense Against The Dark Arts
Hunting: Defense Against The Dark Arts
Spyglass Security•3.4K views
Confusion and deception new tools for data protection by Priyanka Aash
Confusion and deception new tools for data protectionConfusion and deception new tools for data protection
Confusion and deception new tools for data protection
Priyanka Aash•687 views
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx by Chi En (Ashley) Shen
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
Chi En (Ashley) Shen•5.9K views
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w... by Adam Pennington
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Adam Pennington•3K views
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows... by MITRE - ATT&CKcon
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
MITRE ATT&CKcon 2018: Detection Philosophy, Evolution & ATT&CK, Fred Stankows...
MITRE - ATT&CKcon•1.8K views
Helping Small Companies Leverage CTI with an Open Source Threat Mapping by MITRE - ATT&CKcon
Helping Small Companies Leverage CTI with an Open Source Threat MappingHelping Small Companies Leverage CTI with an Open Source Threat Mapping
Helping Small Companies Leverage CTI with an Open Source Threat Mapping
MITRE - ATT&CKcon•660 views
Leveraging MITRE ATT&CK - Speaking the Common Language by Erik Van Buggenhout
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common Language
Erik Van Buggenhout•4K views
MITRE ATT&CKcon 2.0: State of the ATT&CK; Blake Strom, MITRE by MITRE - ATT&CKcon
MITRE ATT&CKcon 2.0: State of the ATT&CK; Blake Strom, MITREMITRE ATT&CKcon 2.0: State of the ATT&CK; Blake Strom, MITRE
MITRE ATT&CKcon 2.0: State of the ATT&CK; Blake Strom, MITRE
MITRE - ATT&CKcon•1.4K views
Avoiding the Pitfalls of Hunting - BSides Charm 2016 by Tony Cook
Avoiding the Pitfalls of Hunting - BSides Charm 2016Avoiding the Pitfalls of Hunting - BSides Charm 2016
Avoiding the Pitfalls of Hunting - BSides Charm 2016
Tony Cook•1.3K views
Shamoon by Shakacon
ShamoonShamoon
Shamoon
Shakacon•659 views
Sharpening your Threat-Hunting Program with ATTACK Framework by MITRE - ATT&CKcon
Sharpening your Threat-Hunting Program with ATTACK FrameworkSharpening your Threat-Hunting Program with ATTACK Framework
Sharpening your Threat-Hunting Program with ATTACK Framework
MITRE - ATT&CKcon•789 views

Similar to MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with ATT&CK, David Middlehurst, Trustwave

DNS over HTTPS by
DNS over HTTPSDNS over HTTPS
DNS over HTTPSDaniel Stenberg
2K views•38 slides
DNS Security, is it enough? by
DNS Security, is it enough? DNS Security, is it enough?
DNS Security, is it enough? Zscaler
1.5K views•33 slides
Is DNS a Part of Your Cyber Security Strategy? by
Is DNS a Part of Your Cyber Security Strategy? Is DNS a Part of Your Cyber Security Strategy?
Is DNS a Part of Your Cyber Security Strategy? Digital Transformation EXPO Event Series
234 views•23 slides
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ... by
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...Felipe Prado
72 views•76 slides
Understanding DNS Security by
Understanding DNS SecurityUnderstanding DNS Security
Understanding DNS SecurityNihal Pasham, CISSP
138 views•21 slides
Phreebird Suite 1.0: Introducing the Domain Key Infrastructure by
Phreebird Suite 1.0: Introducing the Domain Key InfrastructurePhreebird Suite 1.0: Introducing the Domain Key Infrastructure
Phreebird Suite 1.0: Introducing the Domain Key InfrastructureDan Kaminsky
14.5K views•68 slides

Similar to MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with ATT&CK, David Middlehurst, Trustwave(20)

DNS over HTTPS by Daniel Stenberg
DNS over HTTPSDNS over HTTPS
DNS over HTTPS
Daniel Stenberg•2K views
DNS Security, is it enough? by Zscaler
DNS Security, is it enough? DNS Security, is it enough?
DNS Security, is it enough?
Zscaler•1.5K views
Is DNS a Part of Your Cyber Security Strategy? by Digital Transformation EXPO Event Series
Is DNS a Part of Your Cyber Security Strategy? Is DNS a Part of Your Cyber Security Strategy?
Is DNS a Part of Your Cyber Security Strategy?
Digital Transformation EXPO Event Series•234 views
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ... by Felipe Prado
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...
DEF CON 27 - GERALD DOUSSOT AND ROGER MEYER - state of dns rebinding attack ...
Felipe Prado•72 views
Understanding DNS Security by Nihal Pasham, CISSP
Understanding DNS SecurityUnderstanding DNS Security
Understanding DNS Security
Nihal Pasham, CISSP•138 views
Phreebird Suite 1.0: Introducing the Domain Key Infrastructure by Dan Kaminsky
Phreebird Suite 1.0: Introducing the Domain Key InfrastructurePhreebird Suite 1.0: Introducing the Domain Key Infrastructure
Phreebird Suite 1.0: Introducing the Domain Key Infrastructure
Dan Kaminsky•14.5K views
Dns protocol design attacks and security by Michael Earls
Dns protocol design attacks and securityDns protocol design attacks and security
Dns protocol design attacks and security
Michael Earls•3.7K views
abusing dns to spread malware：from router to end user(滥用dns传播恶意软件：从路由器到最终用户)-... by Yankmo
abusing dns to spread malware：from router to end user(滥用dns传播恶意软件：从路由器到最终用户)-...abusing dns to spread malware：from router to end user(滥用dns传播恶意软件：从路由器到最终用户)-...
abusing dns to spread malware：from router to end user(滥用dns传播恶意软件：从路由器到最终用户)-...
Yankmo•366 views
Using GreyNoise to Quantify Response Time of Cloud Provider Abuse Teams by Andrew Morris
Using GreyNoise to Quantify Response Time of Cloud Provider Abuse TeamsUsing GreyNoise to Quantify Response Time of Cloud Provider Abuse Teams
Using GreyNoise to Quantify Response Time of Cloud Provider Abuse Teams
Andrew Morris•2.7K views
DNS Over HTTPS by Michael Casadevall by Glenn McKnight
DNS Over HTTPS by Michael CasadevallDNS Over HTTPS by Michael Casadevall
DNS Over HTTPS by Michael Casadevall
Glenn McKnight•200 views
DDoS mitigation in the real world by Michael Renner
DDoS mitigation in the real worldDDoS mitigation in the real world
DDoS mitigation in the real world
Michael Renner•969 views
Google Cloud DNS by Zdenko Hrček
Google Cloud DNSGoogle Cloud DNS
Google Cloud DNS
Zdenko Hrček•903 views
Grey H@t - DNS Cache Poisoning by Christopher Grayson
Grey H@t - DNS Cache PoisoningGrey H@t - DNS Cache Poisoning
Grey H@t - DNS Cache Poisoning
Christopher Grayson•1.7K views
Wrath of Ransomware_Longinus Timochenco by Longinus Timochenco
Wrath of Ransomware_Longinus TimochencoWrath of Ransomware_Longinus Timochenco
Wrath of Ransomware_Longinus Timochenco
Longinus Timochenco•707 views
Q Con New York 2015 Presentation - Conjur by conjur_inc
Q Con New York 2015 Presentation - ConjurQ Con New York 2015 Presentation - Conjur
Q Con New York 2015 Presentation - Conjur
conjur_inc•835 views
Building Resilient Applications with Cloudflare DNS by DevOps.com
Building Resilient Applications with Cloudflare DNSBuilding Resilient Applications with Cloudflare DNS
Building Resilient Applications with Cloudflare DNS
DevOps.com•174 views
Infoblox - turning DNS from security target to security tool by Jisc
Infoblox - turning DNS from security target to security toolInfoblox - turning DNS from security target to security tool
Infoblox - turning DNS from security target to security tool
Jisc•2K views
DNS Security by johnmcclure00
DNS SecurityDNS Security
DNS Security
johnmcclure00•780 views
DNS – Strategies for Reducing Data Leakage & Protecting Online Privacy – Hack... by EC-Council
DNS – Strategies for Reducing Data Leakage & Protecting Online Privacy – Hack...DNS – Strategies for Reducing Data Leakage & Protecting Online Privacy – Hack...
DNS – Strategies for Reducing Data Leakage & Protecting Online Privacy – Hack...
EC-Council•217 views
AWS User Group - Perth - April 2021 - DNS by James Bromberger
AWS User Group - Perth - April 2021 - DNSAWS User Group - Perth - April 2021 - DNS
AWS User Group - Perth - April 2021 - DNS
James Bromberger•117 views

More from MITRE - ATT&CKcon

ATTACKers Think in Graphs: Building Graphs for Threat Intelligence by
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceMITRE - ATT&CKcon
2.6K views•21 slides
State of the ATTACK by
State of the ATTACKState of the ATTACK
State of the ATTACKMITRE - ATT&CKcon
1.2K views•40 slides
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries by
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by AdversariesATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by AdversariesMITRE - ATT&CKcon
536 views•11 slides
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R... by
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...MITRE - ATT&CKcon
763 views•25 slides
MITRE ATTACKcon Power Hour - January by
MITRE ATTACKcon Power Hour - JanuaryMITRE ATTACKcon Power Hour - January
MITRE ATTACKcon Power Hour - JanuaryMITRE - ATT&CKcon
637 views•99 slides
Using ATTACK to Create Cyber DBTS for Nuclear Power Plants by
Using ATTACK to Create Cyber DBTS for Nuclear Power PlantsUsing ATTACK to Create Cyber DBTS for Nuclear Power Plants
Using ATTACK to Create Cyber DBTS for Nuclear Power PlantsMITRE - ATT&CKcon
534 views•15 slides

More from MITRE - ATT&CKcon(20)

ATTACKers Think in Graphs: Building Graphs for Threat Intelligence by MITRE - ATT&CKcon
ATTACKers Think in Graphs: Building Graphs for Threat IntelligenceATTACKers Think in Graphs: Building Graphs for Threat Intelligence
ATTACKers Think in Graphs: Building Graphs for Threat Intelligence
MITRE - ATT&CKcon•2.6K views
State of the ATTACK by MITRE - ATT&CKcon
State of the ATTACKState of the ATTACK
State of the ATTACK
MITRE - ATT&CKcon•1.2K views
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries by MITRE - ATT&CKcon
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by AdversariesATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries
ATTACK-Onomics: Attacking the Economics Behind Techniques Used by Adversaries
MITRE - ATT&CKcon•536 views
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R... by MITRE - ATT&CKcon
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
Measure What Matters: How to Use MITRE ATTACK to do the Right Things in the R...
MITRE - ATT&CKcon•763 views
MITRE ATTACKcon Power Hour - January by MITRE - ATT&CKcon
MITRE ATTACKcon Power Hour - JanuaryMITRE ATTACKcon Power Hour - January
MITRE ATTACKcon Power Hour - January
MITRE - ATT&CKcon•637 views
Using ATTACK to Create Cyber DBTS for Nuclear Power Plants by MITRE - ATT&CKcon
Using ATTACK to Create Cyber DBTS for Nuclear Power PlantsUsing ATTACK to Create Cyber DBTS for Nuclear Power Plants
Using ATTACK to Create Cyber DBTS for Nuclear Power Plants
MITRE - ATT&CKcon•534 views
What's New with ATTACK for ICS? by MITRE - ATT&CKcon
What's New with ATTACK for ICS?What's New with ATTACK for ICS?
What's New with ATTACK for ICS?
MITRE - ATT&CKcon•440 views
From Theory to Practice: How My ATTACK Perspectives Have Changed by MITRE - ATT&CKcon
From Theory to Practice: How My ATTACK Perspectives Have ChangedFrom Theory to Practice: How My ATTACK Perspectives Have Changed
From Theory to Practice: How My ATTACK Perspectives Have Changed
MITRE - ATT&CKcon•582 views
Putting the PRE into ATTACK by MITRE - ATT&CKcon
Putting the PRE into ATTACKPutting the PRE into ATTACK
Putting the PRE into ATTACK
MITRE - ATT&CKcon•394 views
What's a MITRE with your Security? by MITRE - ATT&CKcon
What's a MITRE with your Security?What's a MITRE with your Security?
What's a MITRE with your Security?
MITRE - ATT&CKcon•401 views
ATTACKing the Cloud: Hopping Between the Matrices by MITRE - ATT&CKcon
ATTACKing the Cloud: Hopping Between the MatricesATTACKing the Cloud: Hopping Between the Matrices
ATTACKing the Cloud: Hopping Between the Matrices
MITRE - ATT&CKcon•434 views
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile by MITRE - ATT&CKcon
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for MobileMapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile
Mapping the EventBot Mobile Banking Trojan with MITRE ATTACK for Mobile
MITRE - ATT&CKcon•343 views
Transforming Adversary Emulation Into a Data Analysis Question by MITRE - ATT&CKcon
Transforming Adversary Emulation Into a Data Analysis QuestionTransforming Adversary Emulation Into a Data Analysis Question
Transforming Adversary Emulation Into a Data Analysis Question
MITRE - ATT&CKcon•410 views
TA505: A Study of High End Big Game Hunting in 2020 by MITRE - ATT&CKcon
TA505: A Study of High End Big Game Hunting in 2020TA505: A Study of High End Big Game Hunting in 2020
TA505: A Study of High End Big Game Hunting in 2020
MITRE - ATT&CKcon•382 views
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research by MITRE - ATT&CKcon
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and ResearchUsing MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
Using MITRE PRE-ATTACK and ATTACK in Cybercrime Education and Research
MITRE - ATT&CKcon•797 views
What's New with ATTACK for Cloud? by MITRE - ATT&CKcon
What's New with ATTACK for Cloud?What's New with ATTACK for Cloud?
What's New with ATTACK for Cloud?
MITRE - ATT&CKcon•449 views
Starting Over with Sub-Techniques by MITRE - ATT&CKcon
Starting Over with Sub-TechniquesStarting Over with Sub-Techniques
Starting Over with Sub-Techniques
MITRE - ATT&CKcon•896 views
MITRE ATT&CKcon Power Hour - November by MITRE - ATT&CKcon
MITRE ATT&CKcon Power Hour - NovemberMITRE ATT&CKcon Power Hour - November
MITRE ATT&CKcon Power Hour - November
MITRE - ATT&CKcon•925 views
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel... by MITRE - ATT&CKcon
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE - ATT&CKcon•2.1K views
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili... by MITRE - ATT&CKcon
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE ATT&CKcon 2.0: Prioritizing ATT&CK Informed Defenses the CIS Way; Phili...
MITRE - ATT&CKcon•3.3K views

Recently uploaded

Uni Systems for Power Platform.pptx by
Uni Systems for Power Platform.pptxUni Systems for Power Platform.pptx
Uni Systems for Power Platform.pptxUni Systems S.M.S.A.
56 views•21 slides
Empathic Computing: Delivering the Potential of the Metaverse by
Empathic Computing: Delivering the Potential of the MetaverseEmpathic Computing: Delivering the Potential of the Metaverse
Empathic Computing: Delivering the Potential of the MetaverseMark Billinghurst
478 views•80 slides
Melek BEN MAHMOUD.pdf by
Melek BEN MAHMOUD.pdfMelek BEN MAHMOUD.pdf
Melek BEN MAHMOUD.pdfMelekBenMahmoud
14 views•1 slide
Vertical User Stories by
Vertical User StoriesVertical User Stories
Vertical User StoriesMoisés Armani Ramírez
14 views•16 slides
PharoJS - Zürich Smalltalk Group Meetup November 2023 by
PharoJS - Zürich Smalltalk Group Meetup November 2023PharoJS - Zürich Smalltalk Group Meetup November 2023
PharoJS - Zürich Smalltalk Group Meetup November 2023Noury Bouraqadi
127 views•17 slides
Info Session November 2023.pdf by
Info Session November 2023.pdfInfo Session November 2023.pdf
Info Session November 2023.pdfAleksandraKoprivica4
12 views•15 slides

Recently uploaded(20)

Uni Systems for Power Platform.pptx by Uni Systems S.M.S.A.
Uni Systems for Power Platform.pptxUni Systems for Power Platform.pptx
Uni Systems for Power Platform.pptx
Uni Systems S.M.S.A.•56 views
Empathic Computing: Delivering the Potential of the Metaverse by Mark Billinghurst
Empathic Computing: Delivering the Potential of the MetaverseEmpathic Computing: Delivering the Potential of the Metaverse
Empathic Computing: Delivering the Potential of the Metaverse
Mark Billinghurst•478 views
Melek BEN MAHMOUD.pdf by MelekBenMahmoud
Melek BEN MAHMOUD.pdfMelek BEN MAHMOUD.pdf
Melek BEN MAHMOUD.pdf
MelekBenMahmoud•14 views
Vertical User Stories by Moisés Armani Ramírez
Vertical User StoriesVertical User Stories
Vertical User Stories
Moisés Armani Ramírez•14 views
PharoJS - Zürich Smalltalk Group Meetup November 2023 by Noury Bouraqadi
PharoJS - Zürich Smalltalk Group Meetup November 2023PharoJS - Zürich Smalltalk Group Meetup November 2023
PharoJS - Zürich Smalltalk Group Meetup November 2023
Noury Bouraqadi•127 views
Info Session November 2023.pdf by AleksandraKoprivica4
Info Session November 2023.pdfInfo Session November 2023.pdf
Info Session November 2023.pdf
AleksandraKoprivica4•12 views
STKI Israeli Market Study 2023 corrected forecast 2023_24 v3.pdf by Dr. Jimmy Schwarzkopf
STKI Israeli Market Study 2023 corrected forecast 2023_24 v3.pdfSTKI Israeli Market Study 2023 corrected forecast 2023_24 v3.pdf
STKI Israeli Market Study 2023 corrected forecast 2023_24 v3.pdf
Dr. Jimmy Schwarzkopf•19 views
Network Source of Truth and Infrastructure as Code revisited by Network Automation Forum
Network Source of Truth and Infrastructure as Code revisitedNetwork Source of Truth and Infrastructure as Code revisited
Network Source of Truth and Infrastructure as Code revisited
Network Automation Forum•26 views
Piloting & Scaling Successfully With Microsoft Viva by Richard Harbridge
Piloting & Scaling Successfully With Microsoft VivaPiloting & Scaling Successfully With Microsoft Viva
Piloting & Scaling Successfully With Microsoft Viva
Richard Harbridge•12 views
SUPPLIER SOURCING.pptx by angelicacueva6
SUPPLIER SOURCING.pptxSUPPLIER SOURCING.pptx
SUPPLIER SOURCING.pptx
angelicacueva6•15 views
Tunable Laser (1).pptx by Hajira Mahmood
Tunable Laser (1).pptxTunable Laser (1).pptx
Tunable Laser (1).pptx
Hajira Mahmood•24 views
Future of Indian ConsumerTech by Kapil Khandelwal (KK)
Future of Indian ConsumerTechFuture of Indian ConsumerTech
Future of Indian ConsumerTech
Kapil Khandelwal (KK)•21 views
METHOD AND SYSTEM FOR PREDICTING OPTIMAL LOAD FOR WHICH THE YIELD IS MAXIMUM ... by Prity Khastgir IPR Strategic India Patent Attorney Amplify Innovation
METHOD AND SYSTEM FOR PREDICTING OPTIMAL LOAD FOR WHICH THE YIELD IS MAXIMUM ...METHOD AND SYSTEM FOR PREDICTING OPTIMAL LOAD FOR WHICH THE YIELD IS MAXIMUM ...
METHOD AND SYSTEM FOR PREDICTING OPTIMAL LOAD FOR WHICH THE YIELD IS MAXIMUM ...
Prity Khastgir IPR Strategic India Patent Attorney Amplify Innovation•29 views
The Research Portal of Catalonia: Growing more (information) & more (services) by CSUC - Consorci de Serveis Universitaris de Catalunya
The Research Portal of Catalonia: Growing more (information) & more (services)The Research Portal of Catalonia: Growing more (information) & more (services)
The Research Portal of Catalonia: Growing more (information) & more (services)
CSUC - Consorci de Serveis Universitaris de Catalunya•80 views
PRODUCT LISTING.pptx by angelicacueva6
PRODUCT LISTING.pptxPRODUCT LISTING.pptx
PRODUCT LISTING.pptx
angelicacueva6•14 views
Five Things You SHOULD Know About Postman by Postman
Five Things You SHOULD Know About PostmanFive Things You SHOULD Know About Postman
Five Things You SHOULD Know About Postman
Postman•33 views
Attacking IoT Devices from a Web Perspective - Linux Day by Simone Onofri
Attacking IoT Devices from a Web Perspective - Linux Day Attacking IoT Devices from a Web Perspective - Linux Day
Attacking IoT Devices from a Web Perspective - Linux Day
Simone Onofri•16 views
Design Driven Network Assurance by Network Automation Forum
Design Driven Network AssuranceDesign Driven Network Assurance
Design Driven Network Assurance
Network Automation Forum•15 views
Serverless computing with Google Cloud (2023-24) by wesley chun
Serverless computing with Google Cloud (2023-24)Serverless computing with Google Cloud (2023-24)
Serverless computing with Google Cloud (2023-24)
wesley chun•11 views
Case Study Copenhagen Energy and Business Central.pdf by Aitana
Case Study Copenhagen Energy and Business Central.pdfCase Study Copenhagen Energy and Business Central.pdf
Case Study Copenhagen Energy and Business Central.pdf
Aitana•16 views

MITRE ATT&CKcon 2018: Playing Devil’s Advocate to Security Initiatives with ATT&CK, David Middlehurst, Trustwave

  • 1. Playing Devil’s Advocate to Security Initiatives with ATT&CK David Middlehurst Principal Security Consultant October 23, 2018
  • 2. Agenda Introduction Playing Devil’s Advocate Command and Control Demo Mitigations 1 2 3 4 5
  • 3. whoami /priv • IT security since 2009 • Pentester @ SpiderLabs • Researcher • Red Teamer • Many top-tier financial organizations • Some regulator driven red teaming @dtmsecurity
  • 4. Thoughts Beyond the Rainbow • Can we apply to wider security initiatives? • Assess if existing controls are sufficient. • Take into consideration when rolling out new initiatives. • Are we introducing new attack vectors? • Can we pre-empt a new variant of an existing technique? • Could a security initiative actually things worse? • Are we focusing effort in the right areas?
  • 6. Playing Devils Advocate “[Adopting Smart Cards] provided a false sense of security in regards to credential theft from malware infected machines.” “To add insult to injury, Windows Smart Card logon has a truly ugly side to it, as it generates an “everlasting” hash, thus providing less security than the regular password-only logon process against Pass-the-Hash attacks.” Lateral Movement Pass the Hash & Pass the Tickethttp://www.infosecisland.com/blogview/23657-Smart-Card-Logon-The-Good-the-Bad-and-the- Ugly.html
  • 7. Playing Devils Advocate • Implementing multi-factor authentication. • Assuming a token based implementation is adopted. • Is this enough? • Evilginx2 style attacks • Sim Swapping Attacks • SS7 Initial Access Spearphishing Link
  • 8. Playing Devils Advocate • Secure Boundary • Validate Security Controls • Attack Simulation / Red Teaming • Purple Teaming Configuration review of an isolated system PRE-ATT&CK
  • 10. Exfiltration / Command and Control Direct TCP connections.• HTTP based over any domain• HTTPS based over any domain• Valid SSL certificates• Categorized domains• • “Domain Fronting” Third• -party services / “C3” Exfiltration Exfiltration Over Command and Control Channel Command and Control Web Service
  • 11. DNS over HTTPS (DoH) - DNS over HTTPS (DoH) is an experimental protocol for performing remote Domain Name System (DNS) resolution via the HTTPS protocol. The goal of the method is to increase user privacy and security by preventing eavesdropping and manipulation of DNS data by man-in-the-middle attacks. [Wikipedia] - “Even if you are visiting a site using HTTPS, your DNS query is sent over an unencrypted connection. That means that even if you are browsing https://cloudflare.com, anyone listening to packets on the network knows you are attempting to visit cloudflare.com.” [1] - “To combat this problem, Cloudflare offers DNS resolution over an HTTPS endpoint.” [1] [1] https://developers.cloudflare.com/1.1.1.1/dns-over-https/
  • 12. DNS over HTTPS (DoH) How can we fix this with Trusted Recursive Resolver (TRR) and DNS over HTTPS (DoH)? “At Mozilla, we feel strongly that we have a responsibility to protect our users and their data. We’ve been working on fixing these vulnerabilities. We are introducing two new features to fix this— Trusted Recursive Resolver (TRR) and DNS over HTTPS (DoH). Because really, there are three threats here: You could end up using an untrustworthy resolver1. that tracks your requests, or tampers with responses from DNS servers. 2. On-path routers can track or tamper in the same way. DNS servers can track your DNS requests.3. ” https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/#trr-and-doh
  • 13. You can enable DNS over HTTPS in Firefox today, and we encourage you to. [1] “DoH support has been added to Firefox 62 to improve the way Firefox interacts with DNS. DoH uses encrypted networking to obtain DNS information from a server that is configured within Firefox. This means that DNS requests sent to the DoH cloud server are encrypted while old style DNS requests are not protected. DoH standardization is currently a work in progress and we hope that soon many DNS servers will secure their communications with it. Firefox does not yet use DoH by default. See the end of this post for instructions on how you can configure Nightly to use (or not use) any DoH server.” [1] https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/#trr-and-doh [2] https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/
  • 14. DNS over HTTPS (DoH) https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/
  • 16. DNS over HTTPS (DoH) https://blog.nightly.mozilla.org/2018/08/28/firefox-nightly-secure-dns-experimental-results/
  • 17. DNS over HTTPS (DoH) https://github.com/curl/curl/wiki/DNS-over-HTTPS
  • 18. DNS over HTTPS (DoH) • https://dns.google.com/resolve?name=example.org • https://cloudflare-dns.com/dns-query?name=example.org HTTPS GET JSON (application/dns-json) HTTPS POST DNS Wireformat (application/dns-message) echo -n 'q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | base64 -D | curl -H 'content- type: application/dns-message' --data-binary @- https://cloudflare-dns.com/dns-query -o - | hexdump curl -H 'accept: application/dns-message' -v 'https://cloudflare-dns.com/dns- query?dns=q80BAAABAAAAAAAAA3d3dwdleGFtcGxlA2NvbQAAAQAB' | hexdump HTTPS GET DNS Wireformat (application/dns-message) DNS over TLS on standard port 853
  • 19. Legacy DNS - A Record EIGFGMGMGPCAFHGPHCGMGE 0x48 0x65 0x6c 0x6c 0x6f 0x20 0x57 0x6f 0x72 0x6c 0x64 H e l l o W o r l d JBSWY3DPEBLW64TMMQ 0x480x650x6c0x6c0x6f0x200x570x6f0x720x6c0x64.example.org eigfgmgmgpcafhgphcgmge.example.org jbswy3dpeblw64tmmq.example.org Command and Control Standard Application Layer Protocol
  • 20. Legacy DNS – A Record RFC 1035 • labels 63 • names 255 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa. aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa. aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa. aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa. a.example.org 63
  • 21. Legacy DNS - TXT Record • Strings 255 octets or less • Multiple Strings • Base64 TG9yZW0gaXBzdW0gZG9sb3Igc2l0IGFtZXQsIGNvbnNlY3RldHVyIGFkaXBpc2N pbmcgZWxpdC4gTWF1cmlzIHNjZWxlcmlzcXVlIHNhcGllbiBhYyBudWxsYSBjdX JzdXMgdm9sdXRwYXQgZWdldCBpYWN1bGlzIGFyY3UuIFByb2luIHF1aXMgc2VtI HF1aXMgcmlzdXMgZmVybWVudHVtIHVsdHJpY2VzIHV0IHZpdGFlIGVuaW0uIElu ===
  • 22. Legacy DNS Exfiltration • https://wiki.skullsecurity.org/Dnscat • https://github.com/iagox86/dnscat2 • https://github.com/yarrick/iodine • https://www.cobaltstrike.com/help-dns-beacon • https://github.com/Arno0x/DNSExfiltrator Exfiltration Exfiltration Over Alternative Protocol
  • 23. Implementing C2 over DNS over HTTPS… https://www.cobaltstrike.com/help-externalc2 …for Cobalt Strike I think I should use the External C2 specification
  • 24. Implementing C2 over DNS over HTTPS • But It’s HTTPS right? • Malleable C2 allows us to customize HTTPS requests and responses • Simple DNS server to relay Netbios query to teamserver then pass back base64 response via a TXT record
  • 25. Implementing C2 over DNS over HTTPS • Not quite enough flexibility • Netbios encoding is there • Can’t limit length? • http-post which we can force to be a GET requires two parameters, we only have one
  • 26. Implementing C2 over DNS over HTTPS But it• ’s DNS right? DNS beacon uses DNS• cloudflared• is a nice binary that can set up a legacy DNS to DoH proxy Only need admin to listen on a privileged• port (53) Package that with a beacon and we are• good to go?
  • 27. Implementing C2 over DNS over HTTPS • Idea of a DNS beacon was to send queries recursively • Cannot hardcode a DNS server • Need to modify OS to change default resolver. • This would work but is not ideal
  • 29. C2 over DNS over HTTPS • Implement a DoH channel in .NET External C2 Framework • Create a custom DNS server Ryan Hanson https://github.com/ryhanson/ExternalC2 https://github.com/outflanknl/external_c2 https://github.com/pawitp/acme-dns-server MWR Labs (@nmonkee & @william_knows) - ‘C3’ / ‘Overt C2 – The art of blending in’
  • 30. C2 over DNS over HTTPS
  • 32. Demo
  • 33. That’s not all $ nslookup > server 8.8.8.8 Default server: 8.8.8.8 Address: 8.8.8.8#53 > google.com Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: google.com Address: 216.58.206.110 > dns.google.com Server: 8.8.8.8 Address: 8.8.8.8#53 Non-authoritative answer: Name: dns.google.com Address: 216.58.206.110
  • 34. That’s not all $ curl 'https://google.com/resolve?name=google.co.uk' -H "Host: dns.google.com" -H 'authority: dns.google.com' -H 'upgrade-insecure-requests: 1' -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36' -H 'accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8' -H 'Accept-Encoding: identity' -H 'accept-language: en-US,en;q=0.9’ {"Status": 0,"TC": false,"RD": true,"RA": true,"AD": false,"CD": false,"Question":[ {"name": "google.co.uk.","type": 1}],"Answer":[ {"name": "google.co.uk.","type": 1,"TTL": 299,"data": "216.58.206.99"}],"Comment": "Response from 216.239.38.10."} Command and Control Domain Fronting & DoH
  • 35. Mitigations • Strip TLS connections – Delta between the target host and the ‘Host:’ header (Domain Fronting) – Signature for DoH queries in the same manner you would for DNS tunneling i.e. question and response lengths, common encodings • Heuristic based detection – Anomaly based detections of packet sizes, frequency and volume, time based, pattern of life. • Block or monitor access to public DoH providers (If you can) – You can still use DoH from your root organizational DNS servers and host your own DoH servers. – How are the URLs categorised. Specific IP addresses of the providers. (Not in the case of Google). – ‘application/dns-json’ – ‘application/dns-message’ – Port 853 (DoT)