Recommended
More Related Content
What's hot
What's hot (9)
Similar to Raising the dead to save the living
Similar to Raising the dead to save the living (20)
Recently uploaded
Recently uploaded (20)
Raising the dead to save the living
- 1. Jared Peck BSides Chicago May 12th, 2018
- 2. Firefighter Paramedic Sysadmin SOC Analyst Threat Intelligence
- 3. Active Defense vs. “Hacking Back” Types of decoys and how to create them When and how to deploy decoys Detection / Alerting Methods Adversary Infrastructure Tracking ◦ Phishing / ATO
- 4. I’m not a lawyer…so always check the latest court opinions and laws before doing anything active...not to mention company policy! “Hacking Back” = Reach out and touch someone “Active Defense” = Booby trapping your own stuff
- 5. Carpenter vs. Sandia ◦ Chinese hack of Lockheed Martin ◦ Carpenter assisted FBI, given immunity ◦ Case is wrongful termination - $4.7 Million ◦ National Security Georgia SB 315 (Vetoed!) ◦ Legal “Hack Back” to get stolen stuff ◦ Trouble for vulnerability researchers
- 6. Active Cyber Defense Certainty Act (Pending) ◦ Tom Graves, (D) Georgia “Congress holds that active cyber defense techniques should only be used by qualified defenders with a high degree of confidence in attribution, and that extreme caution should be taken to avoid impacting intermediary computers or resulting in an escalatory cycle of cyber activity.”
- 7. Beacons Keyloggers DDoS Malware Rootkits Kinetic?
- 10. May act on or run on adversary computers, but doesn’t have a negative effect. Disruption is the goal! Web Bugs Decoys Honeypots / Tarpits Honey Tokens / Honeycreds
- 11. Crawl Walk Run
- 12. Fake Hosts Fake Network Ranges Fake AD Credentials Fake AWS Credentials Fake Database Credentials
- 13. Just an entry in a table or list Detection when anyone scans / tries to connect No interaction / responses Easy to detect for an adversary Many False Positives
- 14. Real AD Creds Can be normal user or admin Can be risky if not set up correctly User set up with no active login hours Tougher OPSEC Have to have right logs
- 15. Again, real creds This time no permissions Detection with Cloudwatch and CloudTrail Pretty easy to set up Rapid7 Blog: “Early Warning Detectors Using AWS Access Keys as Honeytokens”
- 16. Fake – just detect login attempt Decoy – can be part of honeypot or tarpit Real login with fake data to keep attacker busy Can salt database with other creds ◦ Account numbers ◦ AD Creds
- 17. Email Documents ◦ Workstation, server, cloud, etc Databases Logs Bash History Anywhere the bad guys look
- 18. Logs! Be sure to have what you need Make sure logs are together (SIEM) Think of any place creds would be tried Don’t forget DLP detections
- 19. SIEM tools Splunk / Hadoop Proxy alerts Windows Event Logs Unix event logs
- 20. Your own callback server! Domains and VPS are cheap ◦ $35 a year for both Custom scripts Out of band email alerting Make it believable ◦ Externally hosted pictures ◦ Links in trapped docs ◦ JavaScript calls
- 21. Honeypots Honeynets Tarpits Trapped Documents Personas
- 22. Low Interaction ◦ Few services ◦ No Data ◦ Easy to figure out High Interaction ◦ More like a real system ◦ Still little activity
- 23. Collection of Honeypots Segregated on VLAN More lively Still feel fake Higher risk
- 24. High Interaction High complexity Applications Data Transfers Logs Difficult to set up and maintain
- 25. Web bug JavaScript Remote Image Scatter on shares Place in email (CEO, SysAdmin, etc) Unique callback per document Need both Internal and External network detection
- 26. Canarytokens.org Automatically create: ◦ Web bug ◦ Trapped Documents ◦ AWS Keys ◦ Etc Affiliated with “Thinkst Canary” ◦ Canary.tools OPSEC issues….
- 27. Play pretend Build some connections ◦ Twitter ◦ Facebook ◦ Linkedin ◦ IRC What TOS??
- 28. Basic Info Unique info / picture No connections to your company (unless decoy) Don’t friend your fake personas Post occasionally Random friend requests are OK
- 29. Get permission Make it believable Positions in: ◦ HR ◦ Finance ◦ Etc. How about an executive?
- 31. Phish the Phishers ◦ Infrastructure Tracking ◦ “HoneyCreds” ◦ Live Credential Placement ◦ Mule Operations ◦ Physical Drops
- 32. Customer Reports WHOIS Registration Tracking Email Drop tracking TLS Certificate Transparency Logs Server Logs
- 33. Sites like Domain Tools (Paid) Track new sites as they are registered ◦ GDPR making this difficult* Predict Phishing Domains based on registrations
- 34. Collect Phishing kits ◦ Open directories Most common kits list address for drop Track campaigns based on email address
- 35. Track new TLS certificates issued Certstream (Python) Keyword search -> Slack Github: Jerry Gamblin “login.companyname.anysite.com”
- 36. Apache / IIS WAF Fraud detection tools
- 37. Detect Phishing Pages Takedown phishing pages Track Actors Track Campaigns Protect customers
- 38. Made up login credentials Made up Name, address, etc Made up email address Made up account numbers
- 39. Phishing site reported by customer… Entered creds… Checked a few hours later and…
- 42. 1923 Yankees Roster 1886 Census List Famous shipwrecks?
- 43. Fill out phishing pages Complete information Unique Information Use different proxies Use a variety of User Agents Set up detection! Pastebin?
- 44. Credential Testing IP addresses! Early detection of compromised creds Pass to fraud Block or not? Don’t delay takedowns!
- 45. 175 “Honeycreds” placed 43% Seen tested 80 Testing IPs to monitor Hundreds of real customer creds Shortest = <1 minute Longest = ~ 6 months Some creds re-tested much later
- 46. Most credentials were tested within 24 hours Average (mean)– ~ 9 days Median – 5 hours 3-4 other customer creds tested with fakes most times
- 47. Live Account Credentials! Testing IPs Fraud patterns Mules Drops
- 48. High risk Need coordination Known monetary loss ◦ $500? Cash back? Miles?
- 49. How is your site accessed? What User Agent Strings are used? Automated or Manual? Email Addresses
- 50. Willing or unwilling accomplice “Work from home” Move money for laundering Expendable Need law enforcement
- 51. Place to get the fraudulently purchased items Again, willing or unwilling More “Work at home” ◦ Reshipping overseas ◦ May be paid through other fraud Need local law enforcement
- 52. Get your basic “Cyber Hygiene” set Keep it simple OPSEC! Build your decoys Build your detection Profit!
Editor's Notes
- Dealt with heart attacks, gunshots, stabbings, car accidents, house fires, wildland fires, etc. I have delivered 3 babies in the ambulance Now…
- Carpenter vs. Sandia “legal” hack back does not mean authorized by employer Honepot – real but declassified documents Tracked back to storage Turned over to FBI Assisted with other FBI stuff Jury awarded him $4.7 million in damages – Acting in the interest of national security Georgia SB315 Can go after those who attacked you to retrieve stolen material ACDC Act – Tom Graves, D Georgia “Congress holds that active cyber defense techniques should only be used by qualified defenders with a high degree of confidence in attribution, and that extreme caution should be taken to avoid impacting intermediary computers or resulting in an escalatory cycle of cyber activity.” May 7, 2018 “New Yorker” magazine article
- All these techniques require you to run code on the attacker machine What about cookies? JavaScript? Flash? Where does escalation stop? Tomahawk missile strike? Stuxnet?
- Bad guys doing it to us, why not return the favor? Why are we the only ones whose systems are affected? Why cant we disrupt or destroy?
- Reality: Just like the cloud, it’s just someone else’s computer They are the victim too They don’t know it’s happening Mirai botnet Mikrotik routers Malware dropping proxies Attribution is hard.
- “Light touch” Disruption of their activities, but not their machines No persistence
- I’m going to say the words. “Cyber Hygiene”. Do this first. Get your shit together. Active defense is least of worries without patches / logs / detection Crawl, walk, run – takes time, takes effort, takes coordination OPSEC is important
- False positives – printers / routers / protocols
- Need workstation logs along with server logs. This is a LOT of data!!!! Need server logs – need right logs with logon codes and usernames
- This is all good, but what do we do with these credentials / decoys once we create them?
- If you can, put these in a Tarpit and have them transmitted on the wire for network sniffing to catch. The more realistic placement the better Logs – bad guys love logs BTW, Can you detect log deletion? Bash history – full commands so the bad guys can copy / paste
- A little better, still not convincing for the seasoned attacker May have a few systems communicate occasionally, like DNS queries or wget a web page in a cron script.
- “Full on” network. Segregated on VLAN Can be both physical and virtual Workstations, servers, switches, coffeepots, etc “From DNS to Databases” - live apps Scheduled tasks to run commands – data on the wire Takes a team to manage?
- Callbacks to show when document is opened. Place on admin machines, on shares / SharePoint , in the CEO’s email, etc.. Detection for callouts internal – maybe insider or haven’[t tried to remove data yet Detection for calls made outside the network – poor attribution, but a start May make attacker more cautious next time if they see the callback Do it yourself - About $35 a year for domain and VPS Canarytokens.org - Good = they provide the decoys and detection Bad = Known domain these call back to “canarytokens.com”
- Canarytokens.org will do the setup and much of the detection. They are affiliated with the vendor “Thinkst Canary” which run canary.tools Canarytokens are free to use but… They all call back to the same, known site…
- There a lot of social media platforms Maybe have a persona on all of them Watch for Terms of Service Oh yeah….
- Keep it simple Don’t use stock or celebrity photos – too fake (Reverse image search) Don’t have any mentions of your company unless it’s a decoy (later) Don’t friend from your personal account Average / generic posts every few days – week Who are these people? Who cares! Other researchers / bots / FBI?
- Get permission from your company before doing this Mid level job, enough to get attention but not so much they should be known on the company web page. Maybe get some help from a vendor if you want…especially higher level execs
- Unless you are a native Russian speaker with actual connections to the Russian underground…. DON’T try to join the groups Google translate won’t cut it with all the slang. The federal agencies with Three Letter Acronyms don’t even do this. They pay an informant.
- I know, not really active defense, but this sets it all up Find the pages pretending to be your company
- WHOIS – Going away (maybe) because of GDPR Track known malicious registrants – email, name, business
- Not super useful…
- Jerry Gamblin wrote original Python script – Sends keyword matching certstream entry to Slack channel I modified to use regex – better filtering on common words “Login.comanyname.anysite.com” Typically catch one site every day or 2 HIGH bandwidth used in these scripts Fun to watch bad guy try to figure out how they are being caught so fast…
- Who hasn’t put an “F U” in a phishing login? Some names and info to enter into phishing pages Unique No collisions with actual customers (Check, and recheck!)
- Made a list of 5 user names Set up logging detection Found customer reported phishing page Entered some creds Got antsy and checked 2 hours later…… Where was the IP located? ENHANCE!
- Can you be any more cliché? Proved the theory was sound. Consumed a lot of my time…
- There are a myriad of sources Older the better – less chance of collisions with actual customers Anyone know where to get over 3000 names? (Titanic sites)
- Use unique proxies! Change user agents Look for URI patterns (Same kit or same campaign?) Maybe only put on one site Pastebin took at least 2weeks to be tried Gift that keeps giving…seen on at least 4-5 separate occasions Spaced out by months Maybe ended up in a list sold or passed around?
- If they are testing your fake creds, maybe they have some real ones? Pass these to your fraud department and have the passwords reset Watch out, the bad guys can reset too! Do we block? Stop them from trying creds? No, too easy to change Ips. Why don’t we keep watching? Don’t delay takedowns to play with sites
- You are going to lose the money Need lots of coordination- SOC Fraud Business Local / Federal law enforcement?