"2Fac: Facebook's internal multi-factor authentication". Tim Tickel, Chad Greene, Facebook
•
0 j'aime•2,939 vues
An in-depth look at Facebook's easy-to-use internal multi-factor authentication deployment. We will discuss our motivations, how our solution works, technical and security trade-offs, deployment problems, and outstanding issues. Bio Chad Greene: A security manager at Facebook, Chad Greene focuses on security engineering, intrusion detection and incident response at scale. Protecting user data for over 1 billion active users of the social network, his teams are responsible for building creative security solutions that balance rapid growth and innovation with a strong security posture. Prior to Facebook, for more than seven years Chad worked at eBay, where he worked on solving product security and security operations challenges. Chad holds a Bachelor's degree in Management Information Systems from The University of Notre Dame.
Recommandé
Recommandé
Contenu connexe
En vedette
En vedette (19)
Similaire à "2Fac: Facebook's internal multi-factor authentication". Tim Tickel, Chad Greene, Facebook
Similaire à "2Fac: Facebook's internal multi-factor authentication". Tim Tickel, Chad Greene, Facebook (20)
Plus de Yandex
Plus de Yandex (20)
Dernier
Dernier (20)
"2Fac: Facebook's internal multi-factor authentication". Tim Tickel, Chad Greene, Facebook
- 1. Tuesday, October 1, 13
- 2. 2FAC:Facebook’sinternalmulti- factorauthplatform C O N F I D E N T I A L FacebookSecurity Tuesday, October 1, 13
- 4. Facebook - Big Numbers 1.15B monthly active users 699M daily active users (80+% outside US) 5K+ employees Tuesday, October 1, 13
- 5. Identifying weakest points Red Teams Incident 1: Spear phishing OWA Incident 2: Breach identified in January Tuesday, October 1, 13
- 6. Red Team Drills - Identify weak points Tuesday, October 1, 13
- 7. Incident: Spear Phishing OWA Tuesday, October 1, 13
- 8. Incident: Spear Phishing OWA Tuesday, October 1, 13
- 9. Incident: Breach discovered in Jan 2013 digitalinsight-ltd Tuesday, October 1, 13
- 10. Incident: Breach discovered in Jan 2013 Tuesday, October 1, 13
- 11. Goal: Protect against remote attackers •DisruptLateralMovementphase •Ensurelocaluserisatkeyboard •LimitoriginofillegitimateSSHaccess Non-goal: Protect against local attackers Why 2Fac for SSH? Tuesday, October 1, 13
- 12. •Facebookculture:MoveFast •Intolerantofslowdown •Highlyskilledatfindingworkarounds •PrimarilyworkviaSSHondevservers Engineering @ FB Tuesday, October 1, 13
- 14. State of Multi-Factor Tuesday, October 1, 13
- 19. •Easytosetup •Easytouse •Push(onlyonsomedevices) •Requiresfast,reliableonlinechannel •Usabilityisgoodonlyforinfrequentuse OOB / Mobile Tuesday, October 1, 13
- 20. Tuesday, October 1, 13
- 23. Deployment: Planning Tuesday, October 1, 13
- 26. •HowisSSHbeingused? •Thousandsofengineers •Tensofthousandsofsessionsperday •Peakuserswith>3000sessions •Usingallauthenticationmechanisms •Whataretheydoing? sshd[87820]: Accepted keyboard-interactive/pam for twt from ::1 port 51317 ssh2 sshd[87820]: User child is on pid 87825 sshd[87825]: Received disconnect from ::1: 11: disconnected by user Deployment: Planning Tuesday, October 1, 13
- 27. •Adddetailsaboutwhattheuserisdoing sshd[27587]: Accepted publickey for ::1 port 61447 ssh2 sshd[27587]: User child is on pid 27589 sshd[27589]: Exec Request for user twt with command uname -a sshd[8540]: Accepted publickey for twt from ::1 port 50654 ssh2 sshd[8540]: User child is on pid 8548 sshd[8548]: Allocated pty /dev/pts/18 for user twt session 0 sshd[8548]: Shell Request for user twt sshd[8548]: Received disconnect from ::1: 11: disconnected by user Improving SSH Logs: First Attempt Tuesday, October 1, 13
- 28. •Adddetailsaboutwhattheuserisdoing sshd[27587]: Accepted publickey for ::1 port 61447 ssh2 sshd[27587]: User child is on pid 27589 sshd[27589]: Exec Request for user twt with command uname -a sshd[8540]: Accepted publickey for twt from ::1 port 50654 ssh2 sshd[8540]: User child is on pid 8548 sshd[8548]: Allocated pty /dev/pts/18 for user twt session 0 sshd[8548]: Shell Request for user twt sshd[8548]: Received disconnect from ::1: 11: disconnected by user •Problem:requiresmultipleloglineswithdifferentPIDsforanalysis Improving SSH Logs: First Attempt Tuesday, October 1, 13
- 29. •AddsessionizationdatatoSSHlogs sshd[27587]: Accepted publickey for ::1 port 61447 ssh2 session=dev123:52369e5a.c6786 sshd[27587]: User child is on pid 27589 session=dev123:52369e5a.c6786 sshd[27589]: Exec Request for user twt with command uname -a session=dev123:52369e5a.c6786 sshd[8540]: Accepted publickey for twt from ::1 port 50654 ssh2 session=dev123:5236a24d.3f32 sshd[8540]: User child is on pid 8548 session=dev123:5236a24d.3f32 sshd[8548]: Allocated pty /dev/pts/18 for user twt session 0 session=dev123:5236a24d.3f32 sshd[8548]: Shell Request for user twt session=dev123:5236a24d.3f32 sshd[8548]: Received disconnect from ::1: 11: disconnected by user session=dev123:5236a24d.3f32 Sesssionizing SSH Logs Tuesday, October 1, 13
- 30. •Whataretheydoing? •SFTP •Randomscripts •TRAMPmode •Lotsofshells •Usingeveryauthenticationmechanism SSH Usage Analysis Tuesday, October 1, 13
- 35. Handling SFTP Tuesday, October 1, 13
- 39. Handling scripts + TRAMP mode Tuesday, October 1, 13
- 40. •SwitchtouseSFTPsolution? Handling scripts + TRAMP mode Tuesday, October 1, 13
- 41. •SwitchtouseSFTPsolution? •Primarysecurityconcern: •Singlefactorcommandexecution Handling scripts + TRAMP mode Tuesday, October 1, 13
- 42. •SwitchtouseSFTPsolution? •Primarysecurityconcern: •Singlefactorcommandexecution •Solution: •SSHwhitelists Handling scripts + TRAMP mode Tuesday, October 1, 13
- 43. •SwitchtouseSFTPsolution? •Primarysecurityconcern: •Singlefactorcommandexecution •Solution: •SSHwhitelists •Newproblem: • REGEX:sh -‐c "cd (~/|w)(((?<!..)/)|((?<!/).)|[w_-‐])+ && grep -‐P '[^']+t' tags | head -‐n 10" Handling scripts + TRAMP mode Tuesday, October 1, 13