all right so uh good afternoon welcome
to the serie weekly serious security
seminar today is my great pleasure to
welcome our honorable guests from Sandia
National Labs we have a excellent group
of colleagues coming to visit us and our
main speaker is gonna be mr. Vinson
yuria Vince is a computer engineer and
the principal member of technical staff
in Sandhya's cyber analysis research
development department he has made major
contributions to Sandhya's cyber defense
programs especially in the simulation of
complex networks in developing
innovative cybersecurity methods and the
in designing exercise scenarios that
test the limits of current network
security this work is helping Sandhya's
customers anticipate current and
emerging security threats and make
critical decisions about their
investments Vince and his team used
technologies to conduct cyber defense
exercise in partnership with the US
Department of Defense and to support
national security in collaboration with
colleagues and other US Department of
Energy National Labs DoD National Labs
as well as the US military without
further ado thanks so my name is William
Hart and before Vince gives his his
technical talk about the cybersecurity
work at Sandia we thought that we would
provide some background about Sandia and
show you a brief video that provides
some context about what's it like to
work at the labs so Sandia is the
largest of the Department of Energy's
National Laboratories historically it's
been responsible principally for
engineering and maintaining the safety
of nuclear weapons but in the last
couple decades Sandhya's mission has
evolved to support a very wide range of
national security programs for the US
government one of which is supporting
that cybersecurity through a variety of
different programs for DHS the
Department of Defense
and for the Department of Energy as well
so without with that I'll show you a
quick video and we can proceed to
Vince's talk
[Music]
so what drew me to Sandia was the idea
of really working for a mission I really
wanted a career where I felt like I
could be improving the world in some way
and with Sandhya's mission focus on
national security and I think that we
really had the opportunity to have an
impact broader than just within the
laboratory but actually have some global
impact as well personally I think with
regard to the mission work I think
there's a tremendous amount of pride and
value in knowing that you're
contributing to a large infrastructure
our mission is exceptional service in
the national interest it helps make my
community safer it makes my country
safer it makes me want to work harder
because I know it actually impacts
people's lives so we do work in terms of
chemical biological defense disaster
preparedness of course nuclear weapons
radiological detection cybersecurity and
just a whole host of different problems
you see the impact of your work on a
daily basis the work that we do is
tremendous and it is underpinning a lot
of the national security and our safety
so I'm proud to be a part of that
contributions that I make are directly
related to tangible things that relate
to the nation I've been able to have a
lot of freedom to pursue the type of
work that I find that you see at the
laboratory I'm always being given the
opportunity to address a new challenge
answer a new problem work for a new
sponsor and learn new things it's
important to be able to evolve because
you change your interests change your
strengths develop
sandhya provides the flexibility to
adjust to every twist and turn I'm
excited about working here because
personally I'm very motivated by
learning new things and also solving
problems particularly problems that have
significant impact and in this
environment I have a very rich set of
R&D problems that I can work on and try
to solve we get to play with the newest
greatest technologies we get to
integrate technologies from various
areas into the national security realm
I've seen some of my work be deployed
around the world and it's humbling and
it's amazing experience to do have the
opportunity to contribute to a solution
that that has such widespread effect the
sheer amount of talent that we have it's
India's stacker we get to work with
great colleagues who are experts in
their fields so really it's about
blending from different backgrounds
different skill sets and really finding
that right team being able to come here
to Sandia and feel part of a larger
community was it was a big deal to me
from the get-go I felt like people knew
who I was were interested to know my
background but more importantly wanted
to integrate me into the team very
quickly I really liked the focus of
professional development and how much
Sandhya invests in early career
professionals it's hard to replicate the
stability the benefits that you get from
working here I feel like I determine my
destiny I determine my success if you're
interested in a rewarding career working
with great folks cutting-edge technology
than Sandhya is a place that you should
strongly consider if you want to go
somewhere and be in an environment where
you can talk to world leaders and all
the experts in a variety of fields as
well as really be challenged yourself
technically I mean scientifically I
think Sandhya is a tremendous
ways to do it you know I feel like an
important member of the team I feel like
I'm contributing to my country and it's
a great feeling to come to work I want
the world's greatest and brightest minds
here so that we can work together and
come up with new better solutions the
reason I get up every morning to come to
Sandia National Laboratories is to have
high impact I know that when I go home
at the end of the day I have
accomplished something that's going to
be bigger than myself
okay well while Vince sets up his laptop
let me just say a few more words so my
job is a partnerships manager for
manager working with purdue university
so sandy has identified purdue is one of
a select select group of universities
that we want to develop deeper
partnerships with and as a consequence
of they've assigned me here to live in
west lafayette and develop research
relationships with Purdue faculty and
with students so if you want to learn
more about Sandhya's mission after the
the presentation feel free to reach out
to me I have an office in Discovery Park
and we and I regularly bring out a staff
from Sandia as well as managers to
interface with with new faculty and
students all right with that I'll pass
it off to well also introduce will stat
real quick
I was critical part of the team
he is keeps me honest keeps me on track
and he's a great asset talk a little
about your background sure my name is
Will stout I've been at Sandia for about
four-and-a-half years now everything in
there was true to a point to a point
true to a point before come Sandia as a
DoD guy so I ran DoD active duty type
things in the communication
cybersecurity domain at Sandia I
continued on but now I'm delving more
into the research and development aspect
so my background is primarily networking
Software Defined Networking delving into
some cloud space delving into some IOT
as well awesome
so hopefully this will be interesting
talk I like lots of feedback I tell lots
of jokes I'll pick on people but we're
going to talk a little about network
deception and some of the research we've
done in the last three three four four
years now on how we look at network
deception as an emerging field as
emerging technology to help understand
for intelligence jump in so we'll talk a
little bit about introduction motivation
the environment itself and then sort of
the differentiating factors of the
technology and then we'll walk through
some we'll walk through some awesome use
cases and then conclude right I think we
have time there's video there's video at
the end if we have time yep I also speak
very quickly so feel free to say
I don't make much sense I like I like
laughter it's okay it's okay to laugh
it's okay
I swear all right so so deception as a
whole right has existed for years and
years and years right there's been lots
of prior art in this field in philosophy
in the military you know in countless
areas and as a whole you know it's also
existed in computer network defense
right so things like honey pots have
existed
I think I'm not here to talk much about
theory or background or doctrine in this
area more application use cases so I'm
very operationally focused individual
and talk a little bit background so we
go through this but it's like how do you
build tools what are the tools that are
available to analysts and to network
defenders in order to aid them in doing
their job so so we contend you know
deception is a powerful concept that has
been underutilized by Network defenders
there's a lot of contemporary tools that
are not sophisticated enough to deal
with the threat actors that we see today
they're awesome in creating the fog of
war but at the end of the day this
hopefully you understand from this talk
the hope is to close the gap between
understanding the defenders goal which
is to defend the network and then
gathering threat intelligence and
merging those two right using deception
as a mechanism to say hey threat
intelligence is produced so understand
when it emissary compromises a network
or compromises a machine there's
information you can gather from them in
real time to aid and defend the network
and how do we close that gap in the
real-time fashion with that's not
intrusive and then so the defenders
needs right so I came from an
operational background I was very much
focused on net defense on our on our
systems and working with partner systems
and understanding hey so there are there
is a need right so if you look at modern
techniques and tools they're very
reactionary in the sense that a
compromise has existed somewhere else
and we're trying to mitigate it so we
have things like IPS SIDS is you know
network firewalls etc are there to
prevent an action that's already been
seen there very reactionary and it
doesn't really necessary necessarily
evolve a threat once threat happens when
start exists you know these signatures
are very static and not very mutable so
how did we get to the point of
understanding what the adversary is
doing and what we see is we lose lots of
threat intelligence from that space
right so when there's a compromise at a
site at a location what it was our
instinct as a network
defender what do you want to do unplug
the box right want to say hey stop the
bleeding the bleeding has happened our
job is to stop that bleeding
but the constants the consequence is we
don't really know how or what the
motivation of that emissary is how much
information did they know before coming
in what what are they looking for are
they have they been there before those
are the questions I'm interested in
right because that's gonna further help
develop the the my capabilities to
defend that network so really at the
time there's about three three and a
half years ago right we said hey the
network defender there there are a few
or limited capabilities that allowed us
to interact with with our adversaries or
adversaries
since we're they exist on network and we
want to enable a network defendant
interact with it in some level so we
said well we need a belt bid build
better tools to gather information about
our adversaries so what we try to do
even more so there's over the last few
years we've seen some interesting trends
also there's lots of intelligence needs
and that is you know you see a lot of
intelligence feeds so things like
eyesight partners and eye defenses
purchases in the last you know year year
and a half by fire I and others are
these threat feeds I have taken tens of
years to develop are now going behind
behind the curtain and other companies
are buying them and not freely
accessible they're not being
disseminated the information could
become not necessarily as ubiquitous as
it is right now so in three years you
know what else is gonna happen or other
feeds are all the feeds gonna get
purchased other things like that are
sort of emerging issues from a threat
perspective and on top of that we're
saying hey is there a way to sort of
create a custom profile custom set of
tools to proactively defend my
networking and ask questions about the
security posture of my organization in a
very tailored fashion so so about in
2015 there was a report released by
Gartner and this is to me is some set of
validation about techniques and
information that we've been producing
and they said you know deception and
this Gartner report deception is an
emerging field and they believe by 2025
that by 2025 they're gonna see that
deception as a technique is going to be
operationalized and used by about 20 to
25 percent of the community by in order
to help protect the network this is a
basis for
yes sir on your deception procedures are
you looking at the capability of being
able to pretend that nothing has
happened on a network and then shift all
your traffic to another one and conduct
business there that is one mechanism so
we'll be walking through like three or
four different operational modes and
that is one one way is that you have the
operational network here and then using
Sdn and a couple other strategies you
can move them to another network that
exists and coexist at the same time and
let them continue the OP within that
environment but yes yes sir
so again right there is significant
opportunities in advanced threat
detection and there's a need for
actionable intelligence and if you read
the report but there's lots of gaps
right now if you look at the commercial
field they're emerging as they're coming
there are emerging market leaders but
there's still a lot of deficiencies and
they even claim that you need to be able
to develop and synthesize actual
intelligence so there's lots of
different places so they map to again
the garden report they were mapped to
different parts of the cyber kill chain
and they say there's different ways that
you can live within that space and as we
go through the presentation we'll talk
about some of how we live and coexist
across most most of space in order to
sort of successfully mitigate threat so
some more motivation right so if you
think about it a common IT
infrastructure is built off of
predictability right we want common
configuration management common patch
management the infrastructure has in
order to have hygiene you have ubiquity
you have how much in eighty and that's
actually what's being used in leverage
by or adversary in order to maximize
their opportunity within our environment
so if they can compromise one box it's
likely think of or has compromised
multiple boxes on top of that our
contention is that we can exploit this
understanding and exploit this
expectation of homogeneity through cloud
and virtualization technologies and say
hey there may be things that change and
and you may not know about them so
through deception right there's lots of
things we can do and we'll talk about
how you know from a mindset perspective
we want to do a lot of things in order
to change the asymmetric nature of how
we see threat today very much so you
know they pop a box and there's the
right they can break any window within a
house and they can get in and steal our
information right that's that's one
approach right so the hope is that we
want we can do things like devalue the
information that they're gathering
increase the difficulty attack expose
their intent
limit the scope the attack introduced
doubt into their minds when an attack
happens and say hey so when when an
attack is going on if you use an exploit
if you try to exfil data and things
don't work what is the issue is the
issue of my my device is the issue with
my capability is the issue with the
network connection there's a lot the
hope is to changing introduce work
somewhere in their lifecycle in order to
help them help us change asymmetric
nature of the attack who sorry
I also drank a monster so I'm speaking
very quickly but so there's a three
three focus areas that we focus on and
part of it is you know again we take a
very systems approach to things right so
you try to introspect and understand
what's going on the endpoint understand
and change the mutability of the network
and then the environment itself so how
do you create an environment such that
you can have things like highly
virtualized highly complex environments
with traffic generation and then tailor
that the operational vironment the
existent so the environment itself so
for me the approach is that we have
virtualization and the print assessing
factor right so if you think about three
years ago what ends up happening is what
we saw is that you know cloud was
becoming more more ubiquitous on top of
that about three three and a half years
ago Sdn was becoming a little bit more
more prevalent and was emerging as a as
an interesting area right so you have
mutability in the network and the
amiability on the endpoint through
virtualization so we're saying hey can
we leverage that sort of change in the
operational environment so these things
are coming in and being adopted by you
know fortune 500 companies common
enterprises so the hope is that through
these changes the network we can then
help inject ourselves in the life cycle
somewhere so the other half is I have
this belief right if you go back and how
we're it so I have this belief and
that's you know they're adversaries are
very sophisticated they keep on pulling
on information and there's very much you
need to be able to extract information
about what's going on if you look at a
lot of tools that exist there this
understanding of what a TTP is what tool
taxes procedure is being able extract
and real-time is
not it doesn't exist right we do very
much forensics right so if you think
about the box when the box is proper is
how we extract information from that is
we pulled the pull the plug and we do
forensics the question for me was could
we do that in a more real-time fashion
could we start understanding hey as the
compromise is happening as adversaries
working on our networks could we
understand how they're navigating the
directory structure can we understand
when information they're looking for
will plot passwords and tools may exist
that they have and then how they pivot
through the network right to me that's
all actual information it's like hey
when you have a compromise why are you
here what are you looking for and what's
valuable to you all that should be fed
back to network defender so that's where
our transparent reaching capabilities
sort of work and the agent lists for me
right so if you look at all of other
approaches and technology space right
now they're very agent focused right so
to me they're you're putting something
in there either custom or commercial
that may exist the problem is that to me
is a signature that's a something that
you or an adversary can see so how can I
do this in a transparent fashion without
them knowing what I'm doing to them or
interact or how I'm interacting with
them on top of that we have this belief
that is you need to merge lots of pieces
of information so host based information
so package logs is where the world comes
front comes down to for me right so get
log information system call information
guess the information and merge that
dynamically with the network state so
getting things like dpi and merging that
dynamically so I can sort of see the
entire kill chain all at the same time
talk for a bit
sure yeah absolutely you guys having a
situational awareness goal yeah because
that's a pretty pretty pretty complex
task are you guys gonna get into that a
moment or yeah I think it is the
approach and where and how we have
everything and then we threw everything
into to jump to the the punch line is we
throw everything into a seam so we've
everything Splunk right now and then use
time Tim core assign time sequencing to
to get information out so you're still
at the raw data part yeah I'm really
quite figured out the human interface to
it because that's correct so the hope is
that you provide the information to the
analyst right so enabling where will
allude to some of this is sort of the
work that the collaboration hopefully is
in some areas like causality right we're
trying to get to the point where you
have all this information and you can
create causal graphs but that was the
starting point was how much information
can you pull dynamically in real
and then how do you store that
information and sort of worry where
where we're at today and now it's how do
you enable analysis primitives to help
the analyst navigate that data have you
looked into business intelligence cubes
so things like tableau and is that we're
talking about like you know when you're
capturing snapshot to the three
dimensional data in time and then doing
analysis so yeah we're looking at things
not necessarily business cubes but
looking at two poor crops and looking at
temp or graph evolution as one approach
but I've not looked at business cubes
yet okay may not be necessary it was
curious Thanks all right so as Vince
mentioned there are basically three
tenets I go into this deception
environment steps and framework
deception concept if you will and that's
the brutalization environment itself
that's a platform upon which we deploy
all of the the endpoints the network
system itself virtual machine
introspection so how can we reach into a
virtual machine to determine what's
going on and pull information out that's
reflective of what's happening on that
particular end point and of course
offered to find networking how can we
change the state of the network how can
we change the perspective of the network
either given from the the endpoint that
is the the user of the network or if
someone is going into the network to
attack how can we change all that
perspective in real time while still
maintaining things like TCP connections
so that these these breaks are these
changes in the network from an
operational network to Deception network
aren't necessarily noticed by those
people in the network or attack in the
network so the virtualization
environment itself so Sandia has a long
history of test test and evaluation
tests and test ranges and things like
that so we come from you want to talk a
little about that that's our background
right yeah so very much keep it this so
very much if you think about it
we come from ot backgrounds so how do
you do operational test in some
meaningful way how do you emulate system
States so you can understand
vulnerabilities things like that and
from that came a series of technologies
that we've evolved our last decade and
you know starting with live virtual
consistent modeling and external
high-density virtualization how do you
represent and create both services
networks and all the underpinning that
you could say oh let's let's build a so
for instance something tangible let's
say let's build Purdue right let's build
put news network ground up so give it a
sensor information let's say
hosts operating system information
service information account
mission how could you build all of that
in real time without having Alice in the
loop and we built a whole platform
around that we called sort of the
platform and the technology amulet
acquit of emulation and analytics
together so we can start reasoning and
the reason for this the outcome the
reason we built this is you know there's
really no science around cyber right now
and the lack of science around cyber
really understands causes a lot of non
determinism and lack of knowledge so
through experimentation much like a lot
of other basic sciences how they evolved
we believe that that's one way we can
start reasoning about the system so we
did a lot of stuff around this right so
we did a lot of Rijo sting and how do
you do hardware in the loop extremely
high density so we have a series of
technologies focusing on hey let me boot
700 Windows boxes on a single common
commodity blade so change the scheduler
and term memory to context switching
things right it's awesome awesome stuff
on top of that we want to extremely high
fastboot times so I don't want to wait
15 20 30 hours would be 10,000 virtual
machines I want to be able to put that
in five seven ten minutes so leveraging
all of that we also said hey can we also
automate the ability for us to represent
and discuss and code how a network is
specified so build the whole language
around that so saying hey this is what a
network how we represent services in
that network how we were present
operating systems how I represent sort
of links and nodes routing
infrastructure and then create and boot
all of that in an autonomous fashion so
that was the underpinning of this so we
started this about three years ago and
there was a there that was the
foundation right we had a great ability
to say hey we can build these cool
networks that are highly representative
that people like red teams and blue
teams interact with can we use the same
technology and say can we just even
adversary with it so that's where we
started any questions so far numb
speaking quickly you guys seem super
enthused I see lots of ingress lots of
eyes that's okay all right so thank you
for laughing I appreciate that
so the virtualization environment so
this is basically a view graph that that
displays everything that Vince just said
how we go about creating these high
fidelity virtual environments we don't
have to get into the depth of this in
the interest of time so let's move away
from the environment let's start to look
at virtual machine introspection kind of
went over that glossed over a little bit
machine introspection is let's get down
into the nitty-gritty here okay so with
a hypervisor can we go in through this
hypervisor and you know there are some
solutions here that I already exist for
virtual machine introspection we would
like to take a different approach and a
lot of the reasons are here I mean the
API is exist in some of these
hypervisors to do to some we're not
remedial but um basic basic some more
basic type of virtual machine
introspection but you can see right here
on the right side these rings right so
you have to pass through a couple
different rings the context switches
which involves some overhead in trying
to gather information out of these
virtual machines so we said well let's
take a different approaches just build a
rootkit essentially a hypervisor a
rootkit that goes directly into the
hypervisor so we don't have to worry
about that we can live in kernel space
pull the information out directly to
minimize the impact on that virtual
machine and the reason for that raise if
you think so tools exist right Livy my
is that access a variety of other tools
right but when we're talking about rings
right the challenge is computationally
right in order for me to get the VM get
vmi in and out of the virtual machines
it's computation expensive right so if
you think about how much data we want to
pull it magic if you want to pull
everything every system call every
binary every every executable that was
ever loaded into that box in real time
there's there's great tools out there
however they're not built for that
they're built for very targeted
questions they're saying hey I want to
build I want to gather you know this
specific system call or I want to access
I'll get all you know a file IO
primitives off of this system and we
said hey let's take a different approach
and say could if I could could I pull
everything from the virtual machine and
then store it somewhere so that's that's
what bull is alluding to yeah exactly so
the idea is like let's get all the
information and data first and then we
have it let's reason about it but we
have to have everything first because
you can't go back in time at that point
right you have to have everything right
there and then
so the initial idea you kind of went
over this I've kind of went over this is
that VMs run until a reversible stream
quire's of VM exit that is that's the
the act of the virtual machine
requesting access from the hypervisor
some type of resource that the
hypervisor provides from the operating
system annoying operating system so that
is what we hope yes sir thank you guys
done a Pareto analysis to figure out the
20
me together it might make 80% of the
difference because this is a wide open
world yeah so no we have not I think
we've worked in lots of different spaces
and using sort of commercial tools and
said let's fuse that so you think of
things lots of tools provide data right
so IPS is ideas and firewalls host based
information like host base agents we
said you know it goes back to my comment
about the science of cyber right so we
don't know and we don't know how to
reason about a lot of things and so we I
agree we need to get there and to sort
of do the analysis to say what is the
most valuable information to cost to
reduce the cost of both storage and i/o
to sources information but we've took
the approach which was let's gather
everything we can and figure out what's
important right because the challenge
for us is you know especially as a
network defender there may not be a
sensor necessarily that indicates that
this is a compromise right so how do I
investigate that and how do I create
causality and relationships off that
data in some meaningful way when I may
not know that exists so as we run
experiments right we learned a lot as we
worked with red teams right it's like
where teams are very creative episodes
very creative and when I say let me just
look at file i/o let me just look at
this specific thing it's interesting you
can evolve and find absolutely the
system system call there may be a
trigger that gets you to another point
that creates a causal relationship
between you know file access network
access and an exploit so that's that's
the reason why we we decided to say
let's let's take the kitchen sink and
see if it's possible first right and
we've been subtracting features over
time so we've noticed I'd like certain
things are just congesting and being
super noisy when we pull out all the
data and we take them out because may
not be adding any purpose but the option
the option still exists okay so I'm
gonna pick it up a little bit sure so at
a low level what what can we get out of
hugging the VM exit handle so we can
pull out things like system calls that
are directly relevant to the virtual
machine itself but we can also pull out
more targeted things like windows
functions and things like that as well
as injecting things back into the
virtual machine so it's a - it's a
two-way two-way Road in that respect
sure and that's that's one of the
research questions that we have as well
right I think yeah one of our papers we
look at that the the cloud paper we look
at that so yeah
we want to be able to protect that if
somebody you know there are all types of
different attacks so someone does like a
breakout attack and they want to get
into that you know that could be that
could definitely be a problem but that's
that's an open research question for
ourselves as well yeah how would you
protect the hook yeah okay so why do we
why do we go the path we wanted to so
our BMI is based completely on a KVM the
kernel virtual machine a hypervisor for
the Linux systems we didn't want to be
able to we wanted to just be able to
drop the hook into any type of system so
we wanted to minimize any other
dependencies that you that would
normally go to implementing a virtual
machine introspection tool so we didn't
want to have to patch KMI we had
previous projects that actually did this
where we're dependent on a particular
version of KVM well you know with the
updates and things like that and
software software that dies out very
very quickly so we wanted to be able to
to have a a kernel module that we could
insert and remove at whim and the only
dependencies was basically a compiler a
C compiler copilot on the end system
bang you had a kernel module drop it and
pull it out as maybe I also lent itself
to portability on different systems as
well we did not want to be able we did
not want to have to utilize any type of
dependency particularly with things like
symbol tables so you'll see a lot of
virtual machine introspection tools I
require the symbols for their particular
operating system well we didn't want to
have to do that we want to be able to do
things dynamically so you insert the
kernel module onto the endpoint or onto
the host bank and just walks memory and
then determines heuristic aliy what are
the symbols and correlate corresponding
to that virtual machines print imprints
in memory another thing as we saw is
patching as a lot of Windows patching
has evolved we've seen that as patches
change they remove they remove things
like symbols for specific functions as
you see that you lose context right so
you may rely on a specific piece of
specific or specific symbol we didn't
really necessarily want to be bound to
that right so we want to be able to say
hey if I'm collecting this information
now and exist in the future we want to
continue be able to collect that without
having to depend on third-party symbol
libraries
and of course everything is done at
runtime so we inject it determines what
kind of operating system it is and then
fills out the symbol table which we then
use to pull out certain windows
functions and the parameters high-level
abilities so at very high level what can
we do with that we can get the process
information that is corresponding to the
user command line entries the PD images
that are in store executed on the the
endpoint itself we can look at the DLLs
or executables that are loaded on that
particular virtual machine additionally
we can actually pull those out of memory
as they're loaded so if something never
gets written to disk we can still pull
it out of memory as it's executed we
have specific API hooks and these are
the things that we can tailor so if we
notice that we try to pull a particular
API hook that is providing excessive
amounts of noise well we can take that
out on the fly and not have to worry
about that any longer or we can pull it
put it inject it back onto the the
kernel module itself so we can gather
that type of information we can run
arbitrary functions within the virtual
machine primarily to do things like
redirection and if we have time we can
we can look at a couple demos there and
of course we can input so we can put
commands into the virtual machine to
change some things about the state again
this is all agentless right so this is
coming from the hypervisor so these
aren't necessarily originating within
the virtual machine itself so if
somebody's on the virtual machine I'll
send their system temp it's time time
starts changing they're not going to
notice that that it's coming from a
particular agent it's actually
transparent to them all right so for the
Sdn aspect as Vincent mentioned the the
this was started with at the the genesis
of Sdn really coming into the research
space and so we said well let's take
advantage of this so we can do away with
all the the little constraining
protocols that normally go with
communication systems let's build it up
from the ground up closely integrates
with cloud type or virtual type
environments and let's Mel it's make
let's create a malleable fabric Network
fabric that we can control or we can
extract information from an SD and
controlled fabric that we could then
pull information out that we could also
change the the particular attributes of
a network so if we're looking at VLANs
we're looking at IP addresses MAC
address so we can change those types of
things additionally we can also redirect
the connectivity from a bertram
- any other endpoint within that virtual
environment so that we can do things
like man-in-the-middle on-the-fly with
some other the different technologies
that we have at Sandia additionally
since we owned the fabric we also have
layer seven dpi
tool sets that we've written to not only
extract class or to classify certain
types of data but also to pull out
metadata that we we believe it's
important to do it basically what
determine what's happening on host
correlated back to network or vice versa
that's one of the interesting things are
I just you think about it as you start
pulling the thread and trying to
understand what's happening why is it
happening where is it happening right
some from a forensics perspective we
want to try to piece all those things
together and be able right so if you
take a peak a period after that we
didn't want to offline analysis right so
could we do online analysis of
everything then that's why we're trying
to do a real-time dpi right is to enable
us to say let's extract this metadata
and be able to fuse that without having
to do it afterwards exactly so the high
level methodology here with with regard
to an operational Network and
interception network is that you would
have somebody attacking an operational
asset within the environment itself
that's a you can see little attacker guy
up there attacking some virtual machine
within our network that virtual machine
over time is communicate with s1 s2 and
s3 and we're not talking about the
detection mechanisms here right because
that's not really the business that
we're into so nor Chile naturally
something else with an alarm a an
analyst that something is happening
within the network given some period of
time that's are an arbitrary period of
time that can be specified we say ok
this particular virtual machine is
communicated with s1 s2 and s3 over this
period of time that we are interested in
so at that point we can initiate a what
we call a live migration so this virtual
machine is migrated from the operational
Network into the deception Network and
those 3 s 3 s 1 s 2 and s 3 are
essentially cloned these are cloned
virtual machines that go into the
deception network so that as this
adversary begins to look at things in
the network in this deception network
there's familiarity he realized he
recognizes these particular virtual
machines are still there so that he's
not tipped off I'm using Sdn we install
static flows from that adversary into
the deception network so that they
cannot get back into the operational
network
and that also allows the cloning uh the
cloning process allows us to go back
into this operational network do types
of remediation things like that so you
can patch or mediate right without
having to impact the rest of operations
and the hope is right if there's active
connections right if you I wanted to
plug up pull on this just a little bit
if you think about it right there's
active connections going on right so if
you don't think about what we tradition
do is you pull the plug right so if an
adversary is coming in and saying hey
I'm on this box I am I have an active
TCP connection with the Sdn controller
we're able to say okay let's take this
this machine clone it and actually take
their network state all their active
network state all the active connections
to see to that they may have the
interactions they have with that system
and then move them to a new environment
usually people say no okay course there
are a lot of gotchas there and we're not
able to go through everything here but
so some of the operating modes that we
alluded to earlier and this is in order
of increasing costs and increasing
fidelity right so you're gonna have a
trade-off between the the greatest
fidelity high fidelity deception
environment and the cost that comes with
that so the first ones of course is a vm
replacement so can we take this flow yes
we can take this flow and then migrate
it to a what we call warm vm that's if
um that matches some of the similar
attributes of that previous vm that it
was migrated from not the highest
fidelity but it serves some purpose for
people with low cost who can't tolerate
things like cloning in like that so it
works well with physical machines so if
you have a physical machine migrate the
flow over to something else vm isolation
and Quarantine this is actually masking
off certain parts of this operational
network and interesting there are a
couple vendors that do this type of
thing of course this will in turn cut
off that connection to an external
entity which does what it dis allows us
from getting anymore intelligence about
what they're doing this is essentially
equivalent to the cut off net quite off
proach of pulling the plug the next next
level up is service a forking and
service migration so this is the idea of
cloning virtual machines right cloning
virtual machines into a network or
subset of the network is cloned to
provide this high fidelity Deception
environment and the last of course is
running parallel deception networks high
high high cost so this is lockstep
having virtual machines are completely
in lockstep with an operational network
high cost but again this does provide
the greatest amount of fidelity
for a deception Network all right so
guests and network data fusion so we
take from the the cave EMI which was the
hypervisor the hypervisor via my virtual
machine introspection tool we take that
all the data that comes out of that in
conjunction with the network data which
is all the flow rules that are
established at any given time within the
network as well as the DPI information
and the dpi metadata and we merge that
with all of the virtual machine
information that we've pulled so we have
virtual machine beep it's the the
modules and drivers loaded system calls
machine processes machine files sockets
system FS type files would get over that
we'll get into that in a little bit and
we have fields I essentially correlate
between all of these different source
types so that we can start to stitch
together what's happening in real time
or after the fact in a network use case
analyses alright so again going back to
the original theme you can already see
the malleability of the platform itself
you can basically use this for any type
of an analysis deception Network cyber
security platform but for the theme here
is we're talking about threat
intelligence right so how can we get
some information out of this network
that is tangible that we can then feed
back to the network defender that says
ok here's what we've gotten we have
certain signature certain attributes of
this particular actor we can take that
data and say ok now we have a signature
that we can we can bring back to the
network defender that they can use for
further protection of the network and so
these these are just a few of the
different use cases that we have here
the first one is VM as a platform for
bad actors so for this particular use
case you might have someone who jumps on
their hosts and tries to steal certain
information from that particular host or
uploads and downloads files onto that
host what can we get out of that
signature such as hashes it's our
particular file types are dropped onto
it he's gonna walk through all of these
in a minute and just do a deep dive and
just walk through things like the UI and
the data we're collecting do you want to
just jump - yeah let's yeah this job
took maybe one or two of these so we
could have time to go through
lots of words lots of words you just
want to go to use key to start there
okay so VMs an exploited end point okay
so this is a little long one so
essentially a virtual machine user or a
user on a particular clean end point
visits a malicious website this is the
drive-by download if everyone's familiar
with the drive-by download okay this is
the drive-by download the attacker gains
access and controls the particular
endpoint that is downloaded the the
malware and then starts to pivot through
the network and so what have we done
here so KVM i introspects all the
information from the VMS we have network
forensic logs that correlate that guest
data to the network data and so we can
essentially step through these logs to
show what has happened not all the loud
dad is here but enough is here to show
what we're looking at so the first one
is an administrator logs into a
vulnerable workstation and visits a
phishing website and so this is all this
is all canned but the the website is a
attacker comm and so we can see that
within the DPI log we've extracted the
metadata particular to a dns request
this attacker comm and we've also got
the IP address that goes along with it
the next thing is the attacker
compromises that endpoint through a
vulnerability a several I terrible nura
bility within the web browser itself and
we can see that vulnerability come
through another dpi log and then it
opens a matter of Terp report on our
meta trip report on part 2 2 to 2 and we
also see that maybe not here but we'll
see it a little bit later the attacker
then starts a new process then
notepad.exe and migrates to that process
so that it's the user should close the
the browser they'll still be resident on
the endpoint machine and so we see that
here with the opening of notepad.exe and
then the attacker uploads a binary and
executes sit on the endpoint and you can
see this here notepad.exe is actually
executing or creating a file it's
executing a file called binary XE which
is kind of strange why would notepad be
executing a binary here and so at this
point the attacker then downloads a file
located on the the endpoints machine and
so from the the logs we can see that
he's starting to he opens up
explorer.exe and starts to walk the
directory so you can see
here looking at the desktop all right
and then he runs hashed up and loads
mini cats to collect some passwords and
at this point it uses those passwords to
pivot to another machine within the
network and you can see some of the
eyepieces have changed here and then
actually opens up a communication
channel back to the back to his endpoint
over port 3 3 3 3 and we see that here
ok and then as information is
transferred back we can see some high
entropy URLs that are going back to that
attacker machine very indicative of some
attacks that we've seen ok and so in
this is one part of the the former UI we
were actually developing as Vincent
Vince mentioned using some poor graph
representations of the data previous UI
though we can see the flows is there
established on the endpoints and as they
connect back from endpoint 1 to the
active directory machine and then all
the way back to this Green Dot which
we've had to blur out the the IP address
- okay so we got like five minutes left
the other okay so this is a using cloud
as a relay so this is another use case
where if we had some own some portion of
some cloud network could we be able to
see tie-back maybe the use cases here's
botnets right so if you have a virtual
machine that's being leveraged as a
botnet could we tie back the activity on
that particular virtual machine to an
application and so this is a quick one
and so from our the data we extract from
the virtual machine itself we can tie
back to the connected connections from
the the windows API to particular
endpoints I P addresses and we can tie
them back to the applications and cell
so this is tied back to explorer.exe so
from here we can start jumping off and
correlating that dad to other things
that are going on the virtual machine
using the pit of the virtual machine as
well as any further communications with
IP addresses using the DPI log or the
flow logs the hope from there is that we
start correlating you know so we the
system call information exists right so
when you create a socket Sokka has to
have an ephemeral port you walk through
all of that and you can start really
correlating process to sock it to
network flow to associate a process
information
so you can have a full take of
information so you can really start
looking at what is the causal
relationship between a process a
specific system call a specific registry
key change and what is making that
change and what information is
transferring over the wire at the same
time there you go okay
so we have a couple more use cases again
since we're limited on time we would
just attend it to focus on how we
extract some threat intelligence type
data so so right
hopefully rate the hope right from a
mindset perspective I think we've really
got to think rethink about how we're
gathering information about people and
how we're interacting with our system
right at the end of the day right being
able to understand the motivation and
the techniques that they're using to get
on our boxes is sort of the for me the
the basis for us starting to develop
better defenses and at least for us this
was a starting point to start being able
to say okay let me try to run an
experiment with a potential adversary in
some low risk environment and the low
risk fashion such that I can interact
with them and and start changing both
the state and gathering information
about them and then providing them
breadcrumbs be it virtual machines be
services be it data and then have them
sort of navigate throughout my network
and it's learn something about them
right like there's a lot of interesting
information you can start pulling like
how they start commands how they what
where in the file system they start
looking those are I think are all
transient information that's often lost
by a lot of other systems and that's
what you need to start looking at is
saying okay so really when you start
attributing hey someone's doing
something to me the question is what are
they doing how are they doing it when
did they get there and then how they
navigating sort of your network I think
these are the things that we want to do
so other part of it right is being able
to change the network state and we
didn't really get through the
demonstration but it's also changing
things on the network and things on the
import and such that you can introduce
doubt be it doubt in what the data
they're pulling the doubt on the
environment itself without an execution
of of a binary just so that they have to
do more work in order to understand
what's going on in the network and
that's it's part of what we're trying to
do and then finally it's a it's really
the correlate
right so all this information should be
able to autonomously be pulled and you
can navigate and understand this
information such that you can create
action intelligence and to inform your
operational defense infrastructure so
you can develop things like your our
signatures or sort signatures in such a
way that you can inform future decision
and defense techniques questions
excitement Wyatt I understand yes sir so
it sounds like at this point you're not
really at a spot where you can say you
could execute an interception with claws
the attacker to gather information that
will totally not just technically but
from an operational perspective confuse
you know confuse them in terms of what
reality is that's a whole different
that's a little different whole
different research area right I think a
lot of it is just frost it was using
creating a platform right so right we're
engineers we like to build stuff and
that's really where we started was
building a platform such that we can
start asking a reasoning and interacting
with someone and in some pseudo fit safe
fashion obviously a very experienced
people on a network where there's open
collaboration that works verbally say
I'm going I think the bad guys heard
that and they would never do that on a
radio network exactly if to another
radio network continued traffic on the
first one is if nothing ever happened
and then conduct business securely
elsewhere so it's good to see it's been
fun any questions guys are quiet quite
bunch huh what's your name sir make sure
all right cool
[Applause]
you