Upload
energysec
View
595
Download
3
Embed Size (px)
Citation preview
WHAT “YOU’VE GOT MAIL” TAUGHT ME ABOUT CYBER SECURITYHawaii Security Sessions
2
Reintroduce Ideas Break old ones.
What the Heck?!
TOM HANKS
NY152
MEG RYAN
Shopgirl
What is a researcher?
What do they do?
5
WHAT IS A “ZERO-DAY”
01 02 03 04 05 06 07
Su Mo Tu Th We Fr Sa
FEBRUARY
08 09 10 11 12 13 14
15 16 17 18 19 20 21
22 23 24 25 26 27 28
29 30 01 02 03 04 05
It’s easer then you might think but you might be looking in the wrong places, the
wrong way and if you blink you could miss it in some special instances.
Can you find one?
Not the 29th
Too busy, 5th
9th Monday ehh
21st seems good
”Who cares thats just a defcon term”
Above is the list of reasons why anyone might not be familiar with a cyber
security researcher, there are few of us and we don't get introduced until people
put on sad faces.
”Think the news was using it”
”Was part of stuxnet and we’ve scanned for it”
”Why did all of the PLC’s go offline then back?”
6
@DanielCLance
Twitter to Hacking
Step by Step
Miami to Phoenix PLANNone
PROCHEDUREEhh Not really
SCHEDULENone
7
@DanielCLance
Start to no2ce a trend in the technologies developers are using to
promote new products.
The Tech
I wasn’t Looking but found something ”“
8
@DanielCLance
Event-Horizon
The go-no-go point for any good guy or bad the moment you can’t pass
something up that you know or have a great feeling about
Funny feeling
I wasn’t Looking but found something ”“
9
@DanielCLance
Approach Tactic
Analogous Path CompleRon
Company Who Uses
Company Who Adds To
Company Who Works On
Customer (Enduser)
Service Provider
Company Who Dev
Weighing AnalysisThere isn't a right answer or a wrong one. But
picking the lesser evil path if possible is advised and more oXen easier.
9
10
@DanielCLance
Is there a way of telling all par2es involved what the issue is and what milestones will escalate this effort?
Planing
Is this going to be something loud? What is the current reputa2on of the
target and how will a vulnerability force change.
Promotion
Who are we really looking at and why? You can waste a ton of 2me contempla2ng who and what to peek into.
Research
Bounce ideas off other people in the industry. Use the kinda detail that protects the idea from harming the public.
Review
11
@DanielCLance
Knowing the target “size” can tell you a liZle about possible reac2ons to your findings. They might not be a
good target.
SizeIs there a win-win that can be found
in working with one target over another. Customers demanding
change works.
Relationships
Is this issue going to only effect one major player or will it effect all of
them, and in what way?
Industry Target
12
@DanielCLance
StrategicIs this really the best use of Rme, how mission criRcal is the issue? Ask this throughout research.
LoyalDo we have a way to see the issue through to the end. Is the body of work going to require any longterm funding?
HonestCan the data collected about the target be a risk to the researcher and when do you stop.
RespectfulAre there relaRonships at play that might effect the
company you work for and the target?
AccomplishmentWhat do we show to the
public when we show the capability of working on a
parRcular set of equipment.
EnergeticWhat is the speed of
approach based on any possible past experiences
with the target
13
@DanielCLance
Respectful
Accomplishment
Approach Speed
Industry
The End User
The Company
Weighing should be interlaced ”“
14
@DanielCLance
CERT Use
Repor2ng Method
Public Disclosure
Personal Risk
Mi2ga2on w/effected
Private Disclosure
Weighing AnalysisThere isn't a right answer or a wrong one. But
picking the lesser evil path if possible is advised and more oXen easier.
15
@DanielCLance
The two forks are op2onal but the center in the integrity of approach and must always be done
Approach TacticRequiredOptionalOptional
16
@DanielCLance
This can all be very useful later if you have to write a vulnerability report
INVESTIGATE
What all are they showing on there website. Are they talking about the
technology as a new innova2on.
Websites
What did they saw the public in the past. Can this be used against them.
Way-back Machine
See how people are using the technology and if it already shows up in the public space.
ShowDan
Many companies use video as a training tool. How can this be used against them.
YouTube
17
@DanielCLance
This is a very light assessment on the public percep2on of the company and isn't always needed at this point in the process. This informa2on can be used to help the vulnerability report.
FISHING IN THE DARK
Service ProcessWhat tools are used to service the
technology itself. What service do they do
RMA ProcessHow do they handle returned product. Can I get an exploit in to them that way
Carrer CenterHow do I stack up against what they are
looking for. Build an account apply.
Photos of ControlsEveryone wants to show off. Show me your (NOC) network operaRons center
You would be shocked how much you will find. Hardcoded passwords lee in, default passwords lee in with no way to change them in the manual.
18
@DanielCLance
\When an engineer writes the manual they tend to over inform you for the task at hand. Us this to your advantage.
READ THE MANUAL
a
19
@DanielCLance
Why wait so long?
DOWNLOADING LOOKING
There wasn't a password to download manuals and firmware, the manuals had direc2ons to all of the tools needed to service and break the device. Even had direc2ons on how to build the parser they use and that happen to be a stock parse. Then they showed you how to upload new calibra2on files, even gave me fake telemetry to test with.
WEBSITE
20
@DanielCLance
Collect all of your findings and package them up so it is easy to understand to anyone reading. Then encrypt the hell out of it, and at this point it should be clear you have something that could be cri2cal to humans on
the other end of the technology
CLARIFY
BASIC SECURITY PRACTICES
SUGGESTIONS
This aZack was done without having the
physical device. If they had protected some of the things we covered
this wouldn't have been possible to uncover.
FULL NETWORK SEGMENTATION
SUGGESTIONS
This is really more of a mi2ga2on and not a
long term fix.
RECALL ANY DEVICES THAT ARE USED FOR
MISSION CRITICAL
SUGGESTIONS
Rarely done in the real world but serves as a way of saying this is a
major issue.
UNAUTHENTICATED COMMAND AND
CONTROL
VULNERABILITY
The sweetest words. You could remotely blow
away the firmware on the device and even install applica2ons of
your own.
NETWORK LEVEL COMMAND AND
CONTROL
VULNERABILITY
Not a worst case scenario most of the
2me this is a quick fix. But in this case the
device could be spoofed on the network. So it
was a big issue.
21
@DanielCLance
This is the easiest part to mess up, you want your work to be taken seriously so write it up professionally say what you mean and mean what you say or the report wont be taken seriously by any developer
SEND TO THE CORRECT PARTIES
SubmitICS-CERT and US-CERT both lack a forma`ng rule for submi`ng new reports.
FormatStart with company background and the industries effected. Then a narraRve explaining the issue at a high level. Close with technical detail.
Proof-of-concept is always good to include. This is where that pre-research will come in.
www.inspirasign
I am contac2ng you both as this product is used in both consumer products and ICS the vendor claims.
Velodyne LiDAR, Inc.
Velodyne’s three flagship products the HDL-64E, HDL-32E, and the PUCK suggest they are used for:
Automo2ve
UAV
Mapping
Automa2on (ICS)
Robo2cs
Security (Ironic)
Urban Planning
Agriculture
Mining
R&D
Topography
Geology
HDL-64E, HDL-32E, and the PUCK (AKA VLP-16) All make use of packet captures to relay in plain text, telemetry from the sensor to server. The server will make a logical determina2on based on the telemetry this could be leveraged to, in the case of an automobile tell the
server (CPU) in the system that the sensor or vehicle has a wall in front of it. They’ve employed an embedded web server that doesn’t require authen2ca2on to access and update both firmware and calibra2on files for the lasers. If an aZacker can gain network level access at
any point they can modify the firmware and calibra2on files and remove any forensic evidence in the process. With very liZle effort an aZacker could access the GPS data also collected in some configura2ons of the sensor and launch a replay aZack replaying telemetry from
the sensor itself at plus or minus a given la2tude and longitude. Sample .pcap files can be found at hZp://midas3.kitware.com/midas/community/29 for tes2ng. Some of the documenta2on that is public also shows you how they parse the data.
Addi2onally if an aZacker is on the network, all they need to do is launch an aZack at a given telemetry and control what the vehicle (for our example) can see live thus allowing them to steer the vehicle if an aZacker has commend and control of a network enabled device.
The official vulnerability of this system:
Unauthen2cated command and control with network level command and control lacking basic security prac2ces.
Sugges2ons:
Full network segmenta2on. Recall any devices that are used for mission cri2cal, or could present a health and welfare risk to users, and/or bystanders. Un2l basic security prac2ces can be implemented.
hZp://velodynelidar.com
hZp://velodynelidar.com/downloads.html
Firmware, Manuals, and soeware are all free to download. Suggest user authen2ca2on here.
P.S. hZps://www.youtube.com/watch?v=wUfHadExvs8 (Proves a good deal of the claims above in the promo video)
You can give them my name, our goal at Archer is to strengthen cri2cal infrastructure through a collabora2ve effort with effected venders. Please keep me updated so I may be of service when needed.
Thank you,
Daniel Lance
22
@DanielCLance
As of 1 Sept 2011 the other elements of our disclosure policy, see below, are no longer in effect. We will decide what we want to do with any vulnerability. We may disclose it to the vendor; we may disclose some or part of it publicly; we may disclose only to our affected customers; we may keep to ourselves for future use; or we may do something else.
OTHERS Our goal at Archer is to strengthen cri2cal infrastructure through a collabora2ve effort with effected venders. Please keep us updated so we may be of service when needed.
ARCHER LABS
Iden2fying a vulnerability is easy; taking care of the vulnerability so your work beZers the overall health of an industry is the hard part oeen 2mes. And reading vulnerability disclosure policies around the industry proves
how most aren’t cut out for the job of security research.
VULNERABILITY DISCLOSURE POLICY
23
@DanielCLance
MALWARE IN A NUTSHELLMalicious SoXware
“ Generally, software is considered malware based on the intent of the creator rather than its actual features.“ -pctools.com-
Dynamic Attack Surface “ Code should be classified from its behavior alone.“ -Daniel Lance-
24
@DanielCLance
Where do these people come from?
Becoming a security researcher?
Former coder, a hacker, a programmer, a developer, and a computer scientist.
25
@DanielCLance
Venn Diagram
26
White, Black, Gray, and everything between? Hat Trick
BAD GUYSTypically use there skill for some type of personal gain or agenda.
GOOD GUYSUse there skill for penetra2on tes2ng and implement.
GRAY GUYS They are everywhere you want to be, and typically where you need them.
27
@DanielCLance
HACKING/RESEARCH BACKGROUND
COMPUTER SECURITY HACKER HISTORY
28
@DanielCLance
Nevil Maskelyne1903 Disrupts John Ambrose Fleming's
public demonstraRon of Guglielmo Marconi's purportedly secure wireless
telegraphy technology, sending insulRng Morse code messages through the
auditorium's projector.
A family of portable cipher machines with rotor scramblers. Broken by Polish cryptologists Marian Rejewski, Henryk Zygalski and Jerzy Różycki
The Enigma cipher machine Finds a frequency of 2600 Hz would interact with AT&T's implementa2on of fully automa2c switches.
Joe Engressia,
1932
1943
1957
French computer expert René Carmille, hacked the punched
card used by the Nazis to locate Jews.
IBM Punchcard
Used to interact with automated telephone systems
Phreaking boxes
1960s
Na2onal CSS employee revealed the existence of his
password cracker
1980
29
@DanielCLance
MORAL HAZARDYou have to wonder if we are major enough
for the technology we choose to use
Movies The Net and Hackers are released.
Pop Culture
1995
1981
The New York TimesDescribes hackers for the first 2me as we all have come to know them.
Hundreds of advisories and patches are released
Windows 98
1999
Stuxnet, The first Malware Conference, MALCON. Intellectual property thee from Google.
Malware
2010
Hospital pays ransom to get computers back.
$17,000 ransom
2016
WHAT DOES SUCCESS LOOK LIKE?
Great, now your in who cares. Is finding nothing good.
Is there an obvious difference?”From the Rme you get in your car for your morning
commute, to the Rme you walk through your door at the end of the day, you make decisions about your security”
-Daniel Lance (Ripely Stole This)-
\Forensic vs Clinical
32
@DanielCLance
The Best We've Got In ICS
Working with ICS-CERT
ReportComplete report gets sent-in via
encrypted email, some2mes other encrypted files get sent as well
Weighing analysis done, report is done. Everything in the report is now TLP RED to us
33
@DanielCLance
Report ReviewedThe good folks at ICS-CERT review and send any comments back with a 2cket number
This next part takes forever, you wait for a whole Siberian winter to pass before gexng
another email
VenderICS-CERT will let you know your report is in the hands of the vendor.
34
Learn To Play Darts Then you get another email saying
they are “s2ll working to verify claims” or maybe get a ques2on or
two [but s2ll learn darts]
35
@DanielCLance
DisclosureZero-days maZer because we are all effected in some way. Picking the appropriate 2ming can be key to a effec2ve disclosure
Patch or quit 2me. If aeer an appropriate 2me period you’ll
know the kinda ac2on the vendor will take
36
patch or quit
Timeline For Disclosure
NovDec
JanFeb
MarApr
MayJun
JulAug
SepOct
2015
Disclosure Requires VenderTo follow a proper disclosure path the vender must take the time to work with research and want to fix the issues. If they don't want to play kick ball we play dodge ball.
Report Sent
Assigned Ticket
Vendor Verification
Drop Dead Date 100%
Full DisclosurePUBLIC WITH CUSTOMER OUT REACH
Vender, Customer, Public and I
Disclosure role play
Right side of the room: How would you handle escala2ng the process or would you?
Lee side of the room: Would you want to know about the issue from the vender or from me the researcher.
Public Everyone whom has an opinion.
”Cybersecurity Researchers Are Hunted
from All Sides”-Motherboard-
Image: Shutterstock
39
Hacker MotivationsWhite Hat Hackers
State Sponsored Hackers
Spy Hackers
Security Researcher
Black Hat Hackers
Script Kiddies
Hacktivists
Cyber Terrorists
40
@DanielCLance
DEGREES OF HACKING
State Sponsored Malware
Militarized code
Think OS level attack code. This is the
stuff most real “Zero-Days” are made of.
Custom attack
They’ve installed something and left
default passcode in or a port open
Implementation
Tools are already made they are just
making use of whats around
Penetration
41
Free research given to critical infrastructure
ARCHERS CONTRIBUTION
All will publish before the end of the year
Could Represent
2015 the number of reported vulnerabili2es was 142*
21%
29+
3
6
13
Applications SensorsPLC’s Industries
Of all advisories for ICS-CERT in 2016
*Based on Advisories By Vendor coded as a “15”
@DanielCLance
CLOSING PATH
Build an ArkGo medieval on malicious code
You’ll be hackedAccept that and move on
Hire blue teamStart using firewalls how they were
meant to be used.
Hire a researcherFind problems not solutions
Use carrier pigeonsStop using email
Isn't everything ownedGo with the masses pay bounties
Hold BEER-ISACHave a beer and talk about those dam
hackers
Baseline everythingBlow away everything and always start
from scratch.
Where do we go from here?