How to improve your security by interconnecting devices/applications to increase their knowledge, detection/protection capabilities.

1. Unity Makes Strength
BSidesAthens 2017 - Xavier Mertens

2. <profile>
<name>Xavier Mertens</name>
<aka>Xme</aka>
<jobs>
<day>Freelancer</day>
<night>Blogger, ISC Handler, Hacker</night>
</jobs>
<![CDATA[
www.truesec.be
blog.rootshell.be
isc.sans.edu
www.brucon.org
]]>
</profile>
Follow
me!

4. “Did you turn it off and on again?”

5. Agenda
• Some facts
• Current situation
• Toolbox
• Examples
5

6. Welcome to Belgium!
6

7. Belgique, België, Belgien
But with a very complicated political
landscape!
7

8. Belgian Motto
“L’union fait la force”
(“Unity Makes Strength”)
8

9. And Infosec?
Why not apply this to our security
infrastructures?
9

10. Agenda
• Some facts
• Classic Situation
• Toolbox
• Examples
10

11. Initial Situation
Firewall IDS Proxy
Malware
Analysis
Action Action Action Action
11

12. Then Came the god “SIEM”
Firewall IDS Proxy
Malware
Analysis
Logs Logs Logs Logs
Centralized Logging Solutions / SIEM
12

13. Weaknesses?
• Independent solutions
• Static configurations
• Only logs are centralized
• No global protection
• Useful data not shared
• Real-time protection not easy
13

14. Teams Must Share Too!
14

15. The Value of Data
• IP addresses
• User names (!)
• URLs
• Domains
• Digests (MD5, SHA1, etc)
15

16. Multiple Sources
• Online repositories
• Internal resources
• Automatic process
16

17. Nothing New!
Input OutputProcess
17

18. Back to the Roots
• REXX is a scripting language
invented by IBM.
• ARexx was implemented in
AmigaOS in 1987.
• Allow applications having an
ARexx interface to
communicate to exchange
data.
18

19. RTFM!
• Security is a big market ($$$)
• The “Microsoft Office” effect
(<10% of features really used)
• Invest time to learn how your
products work.
• Be a hacker: Learn how it work
and make it work like you want.
19

20. A True Story…(1)(2)
During a meeting with $VENDOR_A, the
presales guy proposed a new solution to
intercept SSL traffic. Later, the engineer
explained that the $VENDOR_B’s product
could perfectly handle the traffic just by
activating the feature “x” and redirecting
traffic to $VENDOR_A’s appliance. Still
remembering the face of the presales
guy… Priceless!
20
(1) Names have been changed to protect the innocents
(2) More info could be disclosed during the after party :-)

21. BackdoorsAPI’s
• CLI
• WebAPI (JSON, XML)
• Databases
• Scripting languages
• Serial console
21

22. Protocols / Formats
• HTTP(S)
• JSON, XML, …
• TFTP
• SSH
• SNMP
• IF-MAP
22

23. Lazy people or Optimization?
23
“A lazy sysadmin is the best admin”
- Anonymous

24. Automation is the Key
• Python|Perl|Bash|…
• Expect!
use Expect;
my $e = Expect->new();
my $c = “ssh $user@$host”;
$e = Expect->spawn($c) or die “No
SSH?”;
$e->Expect($timeout,
[
qr’password: $’,
sub {
my $fh = shift;
print $fh $passwordn”;
}
]
24

25. A New Architecture
Firewall IDS Proxy Malware Analysis
Logs Logs Logs Logs
Centralized Logging Solutions / SIEM
25
Action Action Action Action
Toolbox

26. Agenda
• Some facts
• Current situation
• Toolbox
• Examples
26

27. HTTPS
• Generate an API key
https://10.0.0.1/api/?type=keygen&user=foo&password=bar
• Submit XML requests
https://10.0.0.1/api/?
type=config&key=xxx&action=set&xpath=/config/device/
entry[@name=localhost]/vsys/entry[@name=vsys1]/address/
entry[@name=NewHost]&element=<ip-netmask>192.168.0.1</
ip-netmask><description>Test</description>
27

28. Snort-Rules Generator
• Lot of Security tools accept Snort rules
use Snort::Rule
my $rule = Snort::Rule->new(
-action => ‘alert’,
-proto => ‘tcp’,
-src => ‘10.0.0.1’,
-sport => ‘any’,
-dst => ‘any’,
-dport => ‘any’,
);
$rule->opts(‘msg’, ‘Detect traffic from 10.0.1’);
$rule->opts(‘sid’, ‘666666’);
28

29. IF-MAP
• Open standard to allow authorized
devices to publish/search relevant
information
• Information could be
• IP
• Login
• Location (devices)
29

30. IF-MAP
use Ifmap;
use Ifmap::Util;
my $r=Ifmap::Request::NewSession->new();
my $ip=Ifmap::Identifier::IpAddress->new(ip_address, ‘10.0.0.1’);
my $mac=Ifmap::Identifier::MacAddress->new(mac_address,
‘aa:bb:cc:dd:ee:ff’);
my $id = Ifmap::Identifier::Identity->new(name=> ‘john’,
type=>‘username’);
my $meta=Ifmap::Metadata::Element->new(name=>‘name’,
value=‘employee’);
30

31. SNMP
$ snmpset 10.0.1 Pr1v4t3 .1.3.6.1.4.1.9.2.1.53.10.0.2 acl.tmp
31
• SNMP can be used to push configuration
changes
• Example:
• Router 10.0.0.1 will pull the access-list
“acm.tmp” from TFTP server 10.0.0.2

32. TCL
event manager applet Interface_Event
event syslog pattern
“.*UPDOWN.*FastEthernet0/1.* changed
state to .*”
event 1.0 cli command “tclsh
flash:notify.tcl”
32
• Cisco devices have a framework called
EEM: “Embedded Event Manager”
• Example:
• The router may communicate information
based on its status

33. The Conductor
• OSSEC
• Log Management
• Active-Response
• Powerful alerts engine
33

34. Action? Reaction!
• Example of OSSEC rule
<rule id=”100101” level=”5” frequency=”5”
timeframe=”60”>
<match>access denied</match>
<group>invalid_login,</group>
</rule>
<active-response>
<command>ad-block-user</command>
<location>local</location>
<rules_id>100101</rules_id>
</active-response>
34

35. Agenda
• Some facts
• Current situation
• Toolbox
• Examples
35

36. <warning>
Some slides contain examples based
on open source as well as v€ndor$
solutions.
No affiliation ahead!
</warning>
36

37. Online Resources
• DNS-BH
$ wget -N http://dns-bh.sagadc.org/domains.txt
• Google SafeBrowsing
use Net::Google::SafeBrowsing2;
use Net::Google::SafeBrowsing2:::Sqlite;
my gsb = Net::Google::SafeBrowsing2->new(
key => “xxx”,
storage => Net::Google::SafeBrowsing2::Sqlite-
>new(file => “google.db”)
);
$gsb->update();
my $match = $gsb->lookup(url => “http://evil.com”);
if ($match eq MALWARE) { ... }
37

38. Dynamic Firewall Config
• FireEye malware analysis box
• Firewalls
• Checkpoint
• PaloAlto
• IPtables
• <insert your preferred fw $VENDOR
here>
38

39. 39
Dynamic Firewall Config
(*)
(*) Replace “Palo Alto” with your favourite $VENDOR

40. Dynamic User Blacklist
• Syslog Concentrator
• OSSEC
• SSL VPN
• LDAP directory
40

41. Dynamic User Blacklist
$ ldapmodify -D ‘cn=admin’ -w ‘pass’
dn:uid=jdoe,o=acme.org
changetype: modify
replace:userpassword
userpassword:newpass
41

42. Hunting for Samples
• Postfix
• Bro
• Viper
• Cuckoo
• MISP
42

43. 43
Hunting for Samples

44. Hunting for Malicious Files
• MISP
• OSSEC
• mof.py (“MISP OSSEC Feeder”)
44

45. Hunting for Malicious Files
45
#
# OSSEC RootCheck IOC generated by MOF (MISP OSSEC Feeder)
# https://github.com/xme/
#
# Generated on: Mon Jul 11 22:06:56 2016
# MISP url: https://misp.home.rootshell.be/
# Wayback time: 30d
#
[MISP_2073] [any] [Packrat: Seven Years of a South American Threat Actor]
r:HKLMSOFTWAREMicrosoftActive;
r:HKLMSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerRunPolicies;
r:HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunmsconfig;
[MISP_2200] [any] [Click-Fraud Ramdo Malware Family Continues to Plague Users]
r:HKCUSOFTWAREAdobeAcrobat Reader14.0GlobalsLastLoggedOnProvider;
r:HKCUSOFTWAREAdobeAcrobat Reader14.0GlobalsIconUnderline;
r:HKCUSOFTWAREAdobeAcrobat Reader14.0GlobalsHangDetect;
r:HKCUSOFTWAREAdobeAcrobat Reader14.0GlobalsLastProgress;
r:HKCUSOFTWAREAdobeAcrobat Reader14.0GlobalsShowTabletKeyboard;
r:HKCUSoftwareMicrosoftWindowsCurrentVersionRunBluetoothManage;
[MISP_2210] [any] [Jigsaw Ransomware Decrypted: Will delete your files until you pay the Ransom]
f:%USERPROFILE%AppDataRoamingFrfx;
f:%USERPROFILE%AppDataRoamingFrfxfirefox.exe;
f:%USERPROFILE%AppDataLocalDrpbx;
f:%USERPROFILE%AppDataLocalDrpbxdrpbx.exe;
f:%USERPROFILE%AppDataRoamingSystem32Work;
f:%USERPROFILE%AppDataRoamingSystem32WorkAddress.txt;
f:%USERPROFILE%AppDataRoamingSystem32Workdr;
f:%USERPROFILE%AppDataRoamingSystem32WorkEncryptedFileList.txt;

46. Hunting for Malicious Files
46

47. MySQL Self-Defense
• MySQL Server
• MySQL Proxy
• lib_mysqludf_log
47

48. MySQL Self-Defense
48
(https://blog.rootshell.be/2012/11/01/mysql-attacks-self-detection/)

49. Controls
• Security first!
• Strong controls must be implemented
• Authentication/Authorization
• Could break your compliance
• Use an OoB network
• Risk of DoS!
49

50. Controls
• RFC1918
• Alexa Ranking List
• Top local sites
• admin logins
• Your domains, IP addresses
50

51. Conclusions
• Don’t buy just “a box”
• RTFM
• Control
• Take time to optimise your time (be lazy!)
51

52. Thank You!
Questions? Shoot or…
Στην υγειά σας!
52