Guerrillas in the Wire

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 1/159

COMPLIACE

CHRIS NICKERSONGuerillas in

the Wires

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 2/159

the Wires

hi. =)

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 3/159

Thanks

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 4/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 5/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 6/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 7/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 8/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 9/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 10/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 11/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 12/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 13/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 14/159

Anyway...

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 15/159

I’m Chris 

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 16/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 17/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 18/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 19/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 20/159

-me

• Pain in the arse

•Loudmouth

• Hacker Punk

• Tells lies (professionally)

• Is called all sorts of bad

words.. That I will likelysay throughout this talk

• Cant code well

• Talks $hit

•

Drinks a LOT• Is an overall J3rk

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 21/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 22/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 23/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 24/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 25/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 26/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 27/159

LARES

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 28/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 29/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 30/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 31/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 32/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 33/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 34/159

Electronic• Network Pentesting

• Surveillance/ plants

Social• In Person Social Engineering

• Phone Conversation

• Social Profiling

Physical• Lockpicking

• Direct Attack

EP Convergance

• Attacks on

physical

systems that

are network

enabled

ES Convergance

• Blackmail

•

Phishing• Profiling

• Creating moles

PS Convergance

• Tailgaiting

• Impersonation

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 35/159

Figure Out Whatis Important tothe company

Steal It !

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 36/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 37/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 38/159

To get you awake

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 39/159

Get you to THINK about

what we are doing

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 40/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 41/159

So… 

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 42/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 43/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 44/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 45/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 46/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 47/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 48/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 49/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 50/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 51/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 52/159

We areclearly

doingsomething

wrong

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 53/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 54/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 55/159

2012 Infosec Year In review 

2,644 incidents were reported (Up117.3% from 2011)

267,000,000 records exposed

Over 150,000,000 in ONE incident

84.7% of the records exposed camefrom business

45% of incidents included publicreleases of passwords

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 56/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 57/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 58/159

Persians vs Scythians

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 59/159

ROME vs Britons

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 60/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 61/159

Mongolians vs Tanguts

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 62/159

Vs.

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 63/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 64/159

El Empecinado

Aka

Juan Martín Díez

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 65/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 66/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 67/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 68/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 69/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 70/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 71/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 72/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 73/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 74/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 75/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 76/159

Structureexists even

in Guerilla

warfare

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 77/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 78/159

h l

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 79/159

The only

patch for

Human

Stupidity isEXPERIENCE

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 80/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 81/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 82/159

So how does

all of this

apply to us?

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 83/159

Environment

AttackerDefender

Home Field

Advantage 

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 84/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 85/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 86/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 87/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 88/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 89/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 90/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 91/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 92/159

ENCRYPTION

Own the box/steal the keys

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 93/159

Keylog

GPU Cracking is fun TO the cloud!!

Attack 3rd party crypt

And if all else fails… 

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 94/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 95/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 96/159

 Nmap… --data-

length=0

Or –f

Or just go faster –T5

Lame… that this STILL

works in many cases

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 97/159

Roll your own crypto

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 98/159

Use “other” data streams

(mDNS, Airdrop,BITS,DNS, HTTP,SIP)

Go to the phones..

(Translate to 16 octave

audio and exfil over fax)

Hopefully you sawSteffen Wendzel’s talk

if not go find em

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 99/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 100/159

 AV/Anti-

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 101/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 102/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 103/159

Custom checksums are

not hard… theres

apps for that =)

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 104/159

Clearthelog.rb

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 105/159

… rm

Run scripty logcleaners in your

tools*MSF,CORE,CANVAS all

have **so do mostexploit kits (yeay

china)

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 106/159

Of the

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 107/159

6Top Firewalls

How many can

effectivelyblock TCP ports?

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 108/159

-Source NSS Labs Firewall Group test

:Section: TCP Split Handshake

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 109/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 110/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 111/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 112/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 113/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 114/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 115/159

WHAT DO

 WE DO?

STEP 0

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 116/159

STEP 0

EDUCATION

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 117/159

Implement

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 118/159

Implement

Awareness

and

KnowledgeFormula

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 119/159

Defense = capability (awareness + knowledge) +experience

Capability =(Knowledge + Awareness) Can we defend

against an attack?

Experience – over all ability to

understand/plan/execute/and remain on task during

the event

**ps… this is not math… just conceptual. Most companies out there couldn’t put

actual ACURATE values on controls or any of the areas above if they even tried.

Crawl,walk,run… 

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 120/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 121/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 122/159

Practice

BASIC

INFOSEC!

Patching

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 123/159

Patching

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 124/159

“The more

sophisticated

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 125/159

sophisticated

thetechnology, the

more vulnerable

it is toprimitive

attack. People

often overlook

the obvious” –

Dr WHO

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 126/159

Align With

the business

objectives

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 127/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 128/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 129/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 130/159

What does

your company

DO???

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 131/159

How does it

do it?

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 132/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 133/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 134/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 135/159

Now what?

Grow Revenew Buy firewall

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 136/159

Increase Productreliability

Increase brand

value

Launch xyz new

thing

Increase customerservice/satisfaction

Deploy DLP

Move to Cloud

Install moar AV

WAF

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 137/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 138/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 139/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 140/159

How much do

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 141/159

you spend onDisaster

Recovery.

(Average is

1 8% t t l

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 142/159

Average costof a

downtime

$287,600

Multiply that

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 143/159

by the # ofbugs found in

code that can

stop aservice

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 144/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 145/159

TEST TO SEE IF ITWORKS….. DUMMY 

VulnerabilityAssessments?

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 146/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 147/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 148/159

Process

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 149/159

Figure Out Whatthe Company

Thinks is Important

Steal It !

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 150/159

5

+ Customdesigned attack

kitsAt ANY time

Non Interactive,without update

+ CorporatePartner Attacks

4 + 0daydevelopment

At ANY time

Non Interactive,Without update

unlessurgent/issue

based

+ Physical Attacks

3Exploitation of ALL

KNOWNvulnerabilities w/non-interactive

sessions

Extendedengagement time

window

Non interactive w/update

+ Individualattacks

2

Exploitation of Known

vulnerabilities atALL layers w/

interactive sessions

Unlimited Timewindow during

engagement

Interactivew/scheduled update

+ Indirect attacks

1Exploitation of 

knownVulnerabilities atall layers underApplication with

interactivesessions

Constrained Timewindows

Interactive w/constant client

updateDirect Attacks

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 151/159

FOLLOW A REPEATABLE

METHODOLOGY

Allow a FULL TEST

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 152/159

Allow a FULL TEST

to get FULL VALUE• ACT as you would NORMALLY

 – Systems attack : tests IR plan

 – System Error: tracks mean time to

issue identification

 – Service Outage: tests/identifies

flaws in BCP – System down: tests/identifies

flaws in DR plan

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 153/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 154/159

SET REASONABLE

EXPECTAITONS

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 155/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 156/159

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 157/159

What do you

have to lose?

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 158/159

YOU HAVE

ALREADY BEENHACKED

7/30/2019 Guerrillas in the Wire

http://slidepdf.com/reader/full/guerrillas-in-the-wire 159/159