it's a no goodnight not done my job as a prisoner but things are internal network
and the targets do not work we're not going to be talking about external just
gonna say that up front so a little bit about me or my name mcconnell
adults and one of their red team members networking mobile security so I'm
generally not the guy that's going to be honest I'm going to set aside neither
britain remotely working on boxes on your network reporter mobile
applications by me my mom three node is laying out the Dec one channel GMAC also
much better if you have questions want to know anything after this my email in
McConnell
works for me gmail.com so I wanna do hoon here is responsible for your
organization's security and I T three organization that much everybody so
russia now everyone you are responsible for your organization's it doesn't
matter if you're not if you're an employee for an organization
you are responsible for security so what this isn't anything new advanced we're
not going to talk about the tax we're not gonna talk about many things we're
not covering anything super in the reason why I don't need it because I'm
attaching and that works as a red team member whether it be physically break in
and whether I get in touch whatever i dont not need to exploit I don't need to
use super advanced on your network
compromise your data what I used is very basic simple attacks but rules that are
already on your network to access their street years in my mind of what security
information system security you have your human aspect and this isn't just
presentation
information security reason being that I'm gonna try to explain this in such a
way that makes sense that you're human aspect you cannot assume you can't
change and the psychology about train on a human being is so real documented so
wrong now it doesn't matter I rolled their retailer we someone in your
organization
no questions asked and you can assume that if I get one person to click on a
link in your organization compromising on your network there's just no
questions about it
the second thing about it is this a security problem you're gonna face
there's two real dilemmas one there's no way to keep me out of your building
unless you work in a missile silo that's buried under you know hundreds of armed
guards and there's only one point otherwise I really wanna I've got enough
seats for a term I am coming to a wall
yeah the door I'm given your building brick through the window you know those
are very destructive violent attacks but now let's go to him or her side of human
and physics to carry such as tell you you know that's how many times have you
to someone carrying a box aesthetics UPS guy and you're building a couple boxes
what do you do
here let me help you as much as I love all do that all day every day walk on
your network settings boxes down somewhere good luck my devices networks
and walk away you won't see it you know what's there and now I've got a
compromise that is why for those two things it's imperative that we talked
some information security those two things are beaten every day
information security of your so there's no emotion there's how ramifications
there's no instinctive response by particular it does exactly what it says
goodbye and its guests now in May behaved inappropriately because the two
attackers altitude but it is doing exactly what I was told
examples of this job fairly early lockdown lobby they couldn't get past
the guards so they can buy the physical and human aspect to pave
started taking a piss everyone
been dropping to god statues everybody comes all the other patrons took a
worker walks up behind them
the elevators when it was game over at that point they walked out with access
about 36 hours everything they want that one
focus on that she doesn't matter if you don't build that you're protecting your
assets it does so there's this is not so organizations
down approach how many of you and hear how to deal with compliance ok how many
of you in here
directives from management that says you have to secure your environment you have
to be security to make it so we don't incidence you know that's not the
problem but it doesn't do anything to security team members PCI HIPAA the year
two socks that does not sound environment in such a way that it is it
is very much
100 companies over a billion dollar five hundred billion dollar company ninety
percent of their security was still based on scams Nexus how we know that's
not buildings we have this is what our friends this is how we do not follow yes
ninety percent of the time and where the stock started from was that will not
catch this thing works it will not just any day of the week and then here's the
other parts of you ensure an unlimited budget in here have a very small tight
budget you can buy a new product or maybe you can upgrade that machine you
need for most stuff from here built environments from the ground up with
security in mind how many of you in here at something happens we need to put them
on our VPN where we need to put it in this day on her email or we have to set
stricter passive policy because every user having the password really you know
it doesn't make sense we have to build a top we bought today it's not in our
environments and that's why I try to get slapped why don't you dance this is
right now it's actually dive into some of the actual things up I will exploit
on a daily basis
tax compromise network how many of you and hear how such a structure that you
will turn up you can secure and the new go back and disabled every pore except
the ones you need reports he don't need because if you don't have free access
how many of you also actually figure Europe for two specific match if you
don't do that I'm going to target device to a PC devices to be how many of you in
here will actually do to keep your car wash on DHCP for Microsoft
say a lot of this is very much focused for ceramics FreeBSD
environments however most corporations that are most networks I see windows on
the network that I can use these acts as if you you know it doesn't matter
also however I need to expand access to data and continue to evolve or do you
see Config configured to get for these distracted us in this range
will you be
that's a hundred million dollars
so I would say about a nine hundred and ninety billion dollar company they do
they manage tight on money so hundred-million to them but when a drop
in the bucket that a given in yet they still into thinking about that the next
trouble here are some of my absolute favorite doing here as ever and one
person couple people ran tom cat do you know where the users are configured
within the comp project director about it
capacity for all your clear text interactive logon ko system access but
there's a good likelihood its operations missions have been screwed up and I'm
able to just connect directly to it and pulled out box up five got it now I've
got the child abusers Tom channel but not successfully run system
be grabbed that user login tom cat employees do I gotta show I can be
hashes I can dump everything in like this since tom cat is also a fabrication
using to close its hot summer months large tracts a lot of time domain admin
are seen as key configs where the root password to the database they don't get
their asses they use room with the root password database
lot of times people don't change their passwords across multiple databases so
the root password for one database is the same for every database great
wonderful the last week he isn't sure how many of you in here have an internal
Richie SharePoint something that you used documents
shared
going through that
500
monitor every time my laptop fire up here to pick Cebu your network as I
start to image in your image to employees generally speaking what
happens when you deploy again
can get it wrapped ready and then what do you do it's actually the next thing
you want to do for that machine anybody
done prior to joining machine to the elevated
day one
reason you're not going to hear what I want to monitor your pics of your
deployment watch
yeah
I didn't think about this either and tell the sex I actually I don't have tax
imaging you build a golden image you deploy everything we need
k road works your workstations needs to be able to fix the computer quickly run
too long there they don't want to transform back and forth so they do they
put a minute hidden directory on the SEDAR after they put on some work very
detailed hey we need to be able to put around these tools so I used to know I'm
not gonna points a finger at the most users don't go but I will I gain access
to one machine and I started poking around just a little bit but here's the
same record as all these systems are you have system configuration scripts I
wanna times descriptive hardcoded credentials so that they can run up and
leave you know some of them will prompted it just really depends so that
being said though there's an attacker if I sign that contains a skirt initials
are sworn enemies so strapped by temperature was to do something else for
me
that's great that's not that's the least you're looking at that scene admins on
people's walls and security you need to be thinking about what you're actually
put it in your images are you leaving behind
configuration management SCCM from Microsoft
question for you do you go back and invalidate all your packages after
referring to deploy
machines
next question have you ever pulled apart the strategist who struck say you need
to install something or driver for what's required elevated privileges at
least machine and likely it's an account that gets used but is also linked to the
domain sometimes yes sometimes no but there's an admin account that allows it
to check in a rock and a sec
that allows it to do the place of these machines so what do you think might
happen if a crowd was able to compromise that
so we could sit at the admin prediction stress gradient we when it rolled up our
own she'll put it out there looks like we did however reduced cover department
I'll get to that but we've got a shelter every server on the network running his
administrative privileges sooner we want an hour we're on the train ourselves we
could stop are deployed and redeployed to machine so Monday morning when all
the users came back in wrong back in our culture over 5,000 more shells and we
couldn't handle the temporary census was the amount of shells we had coming back
just an absolute bad day bad times and code towards doing here transactions
4000 test
actually
everyday man and i right
administrative privileges on that box box almost guaranteed administrative
purposes and then I'm in the house somewhat elevated privileges based upon
who ran into our studio secured the boxes were it actually turned down but
it is a sure way to get a show and to some 200 limited to do you got a
structured in or go to Google
to search out there just encouraging consensus out there on the way
and what our intelligence building your network broadcast I'm looking for Ashes
on your network
sure I send the masai I've got a big 25 GPU cracking groups that I have access
to so many of you your masters in here
password minimum no
ok then what's troubling what's the likelihood that a password is gonna get
cracked just lost users are always this summer
2016 special exclamation capital letters capitalized the first I've got my
special characters and i got to understand their I don't forget to ya
but it's very predictable
things that are you know
and I'll wait 10 minutes I'll jump to another box run number to try to stay so
I can grab driving season box you name it at that point it's just a matter of
time before I find what I'm looking for
I'm actually backed out whether the 3G modems whether it be booked another
possible compromise or if I've got a big enough so hard on my cock sucked up on
your network about my guy on the ground go back in full up box back out
everything is all too soon after I miss considerations are looking for systems
have been to God going in there but even so hundreds of organizations I've got
what I have ever seen anywhere in 2002 at a remote desktop on their internal
networks because of an old my setup would secure the perimeter weheartit
down and everything kind of Russian side mister in there is a lot that is at this
point where I am and my attack all your data will call you this whatever I came
to find
now the question is what I was just talking about here thinks it would
actually depicting gonna hear things that actually noticed you nominees in
their traffic or in their service communications the gym was detected
after their networks and here's to rock and looks at the deal honestly feel that
they could stop their first dance attack using basically the TAC towards on their
network
so that's so what does any of what I just told you have to do is your
organization has any of what I just told you about any idea what kind of discuss
shared a minute how to fix some of those other problems kind of what you need to
do better as the day if I could just give you had a six days problems give
you the carrot 2006 discussing this right what happens when it comes out and
becomes a very basic anatomy so I need you here
jennifer Love paradigm shift lights fundamentals you know there's been some
discussion Stevenson discussions going on at this conference
you know what miss any of those matters if I can give you a great day for
underlying issues in it
it doesn't matter what I do write anybody does your environments not built
in such a way to be able to detect attacks and respond to it with a new
mobility in the way of things don't worry your perimeter how many of you and
your views of cloud-based solution but I don't ever tell me now this should
shouldn't I don't want to hear your job is to make that showed it looks good I
made mistakes but think about it is a time on your networks I am going to make
mistakes but the first couple of days I'm gonna try to access to research
I'm gonna try to do something I don't have some issues to jobs to find it and
see those anomalies not your job to be a hundred percent rock down third-round
robots they're not they're not they don't focus on their motion that is why
we need to take and send it to buy it area and not try to stop users because
it's always going to happen so we as an industry we have to be better at
teaching diploma with users yes they should be better yes they can be better
but no we got to stop blaming them for a compromise we need to start checking out
over some sort of yeltsin have any ideas what next step should be what
saying you know what we did first thing she takes a step back
go to your management building your business stakeholders find 12 gold
two-year environment is for sure couldn't tell me every piece of critical
data on their network where it's located the Commission chiron down it is in such
a way that walk down and say ok this is where my girls this is where I have to
be the most secure anybody know where all your completed because I may not get
a compromise was your big billion 220 billion dollar company also you've got
twenty thousand employees 30,000 employees can still and that includes
our healthcare formation which means I can turn increase healthcare information
if your software shop where is your code let me ask how many of you in here
basic public open source because you need to know where it's at then the next
thing you need to find out
good business stakeholders not just use I T shirt challenging your marketing
executives at night
wrote about your environment you know who to call the stock and bond markets
laptops where are all of our competitive market analysis its losses that you know
how to start struggle but like I don't understand where all that is critical
all of that document you need to go sit down at an accomplishment
shares always stated this is where it now works protected given the mall to
buy off you continue with the status quo nothing will change your environment
will be still wide open records obtained which is used
builders don't know how to lock down their own environment how to reach the
spektr state once you know where this is going to management said look there is
every bit of time I know exactly where to move data we've moved servers we know
it's all right here
gonna get you guys to say yes
rights to get them to buy awesome how would your company survives the next
Ashley Madison reach all yours users data was lead
how would you survive she works hard for Home Depot how would you survive if
you're she was completely delete your business your business you work will
continue to go what your customers still retain so come here you know your target
or Home Depot there's limited choices but it's here just a small mom-and-pop
shop and there's a couple other competitors out there and your credit
card in all your information sleep and success summer it's likely they're going
to go elsewhere
how's your business to handle that you need these kind of questions what she
have it in you know this is how it is and you put that fear of God in your
management that is used to screw this up we go out of business I lose my job
everybody else loses their job you know and if you're a healthcare company are
you personally liable under some of the HIPAA laws now healthcare executives can
be held liable
and serve actual jails a nuclear reactor standards coming out just what it is no
longer onus on the banks that there is gross negligence failure to do their
part correct we can be held liable so targets insurance the bank's kind of
took care of everything kind of all got our target handle having to pay for
credit monitoring lots of every game and then lots of other merchandise paid for
by those fraudulent cards today like they're big enough but still put a huge
dent in their evidence you need to ask those kind of questions once you have it
map out your security means a larger projects I would have you in here n roll
San upgraded or at old servers domains it needed upgraded why not when you're
upgrading take increased your budget a little bit and insecurity right sit down
and actually map your security needs to these projects and build it now you will
change your security and saw the ball to get on top
you're doing it at the time but it's already being rebuilt so it's not done
correctly and more securely just makes everybody shopper reviews Jeremy and and
it continued strength and I'm sorry say again even if your job title doesn't say
security and it it is your job as an employee for every new works for secure
whether that be being cognizant issue making sure that you're setting strong
passwords you see something just doesn't feel right
recorded automatically load up the manager said well this doesn't feel
right
this just continue to be that squeaky wheel types of issues get resolved that
is your job as a user and even more so this year and I T person
be going and complaining demanding but recipients of documentation to know
everything about you I wanna know what I want to know what's database
configuration once running gives me she helped so much detail on this you see
one minor variance you know you have a breach because it's out of the normal
for you have a user and the Machine you need about to say we need change this
mindset
operating in a responsive motive to operate in Minamoto we are 24 by 7
compromises are always compromise environment and we need to continuously
react in such a way that it varies from the norm
reach until we can prove otherwise not your luck and exceed monitoring
monitoring is she just that's affecting your ideas your firewall so big so they
protect you from some of these assistant at me ask you an honest question do you
know why you Joe at 3 a.m.
walking speed development server when he's an account or do you even know that
he is why is your sequel sure you do your domain controller on 36 airforce
all the time now why does that normally happen and Sarah any of you that don't
know how to standard default warrant that medicine that is slowly payloads
and mature proposal it's generally run from the shoot that's just had a basic
willy nilly
rising why do these things top why are they doing that any of you and hear that
would be checked the secret service to ensure on your environment
your web server on some say non-standard port could you tell me why there was
talking on those terms
you can't tell me that if you can answer that kind of a question you don't have
enough profile of your government to know what it is and what's not
and I'm gonna tell you that's why I say monitoring is to this because if you can
not see families in your network what's going on you can respond to a breach
until the FBI Secret Service comes naturally bill Doran says we notice yes
you're serving this or we trace your credit card week back here in Business
Bureau alrighty sids our firewall hasn't said anything worth 40 devices actually
see it now
away from that we just had a new device plugin for this device is now change MAC
Address see those kind of things how can you expect to harden your source not
protection
locked in your physical locations be better about your physical security be
better about yours
information security don't read things just don't read things just running make
sure users are actually machines are talking about even if you have to be a
stickler
five minutes of inactivity I'm going to scream General about and check under
your keyboard I had to do that in a very large grammar one of my tasks on a
Friday night after he'd be harsh your job's not to make sense to protect us
mean he makes an inside straight but if that compromises your retirement
security because of it
some work since last summer in time rome wasn't built in a day you're not gonna
hard and everything go back sharon today
garden everything down and be good
you gonna take start with the most critics start to build a primitive there
and then continue to build but you have to know where you start
I actually started