00:00:00.000-->00:00:06.250 >>Hi guys. Uh before we begin my name is Steinthor Bjarnason and I'm from Iceland. Is anyone from 00:00:06.250-->00:00:11.250 Iceland here? >>Woo >>Okay [audience chuckles] somewhere over there. Ok so thank you for 00:00:13.542-->00:00:18.542 attending yes um it for some of you you haven't probably slept yet and you're sitting here 00:00:18.542-->00:00:23.875 enjoying the course in tears. So this presentation, it's interesting. Well first of all 00:00:23.875-->00:00:28.875 Jason Jones as you probably see he is not here. Unfortunately he got sick so he'll staying at 00:00:31.292-->00:00:36.292 home and I'll be doing his slides but he made them so he will get credit for it. 00:00:38.375-->00:00:43.375 [applause] Okay so this presentation it's an interesting one because it's about a 00:00:46.542-->00:00:51.542 security incident which didn't happen. But it's an interesting one. And see as we as security 00:00:54.750-->00:00:58.750 professionals we often sit down and think "What could be the worst thing which could possibly 00:00:58.750-->00:01:03.958 happen?" And all those doomsday scenarios where this happens and so on and so on and back in 00:01:03.958-->00:01:10.167 February when uh something called the Mirai Windows Trojan came out, and it's one of those 00:01:10.167-->00:01:15.167 "oh beep" kind of things because when we saw it was actually a critical component in one of the 00:01:18.667-->00:01:23.667 worst case scenarios which we could possibly think of. Luckily it didn't happen. So yeah, the 00:01:25.750-->00:01:30.292 purpose of this presentation is to explain what was going on, give you some details about the 00:01:30.292-->00:01:35.292 trojan itself, what it can possibly do if its gets activated, and how to defend 00:01:37.750-->00:01:42.583 against it. So I think this is rather im- important. Some people are saying "Hey you 00:01:42.583-->00:01:47.958 shouldn't be going public with this." But we are. Fy- people need information and if this 00:01:47.958-->00:01:54.625 happens and I think it actually will then you are prepared, you know what to do. So IoT we've 00:01:54.625-->00:02:01.542 all know what IoT is, yes all kinds of wonderful things doing all kinds of magic but it's it's 00:02:01.542-->00:02:06.583 just security issues back and forth. Because they're supposed to be easy to use. They're 00:02:06.583-->00:02:11.917 supposed to- supposed to be easy to deploy should be low cost and so on and so on and of course it 00:02:11.917-->00:02:16.833 leads to all kinds of nice security issues. And I'm really happy to see what's happening 00:02:16.833-->00:02:20.333 down- downstairs in the IoT workshop where you're hacking those things because this is 00:02:20.333-->00:02:25.333 what is needed. We need to get people to understand they need to secure those devices. 00:02:25.333-->00:02:30.458 Unfortunately there are still millions of those things out there unsecured. And what 00:02:30.458-->00:02:35.458 happened last year is basically this: large scale weaponization and a vulnerable IoT device. And 00:02:38.875-->00:02:45.583 those IoT devices uh with were weaponized using the Mirai trojan actually were used along 00:02:45.583-->00:02:51.708 with one of the biggest DDoS attacks we've ever seen. Up to 800 gigs, some say one terabit 00:02:51.708-->00:02:57.708 against uh them, against private security, OPS and so on and so on. And these devices are being 00:02:57.708-->00:03:02.708 used to launch attacks which are really devastating and hard to stop. Also when we were ll- 00:03:07.208-->00:03:11.917 trying to analyze all these things, we actually deployed a number of honey pots out there, 00:03:11.917-->00:03:17.375 in different areas around the world. And basically built up the end which simulates an IoT 00:03:17.375-->00:03:20.583 device with those vulnerabilities, placed it out there and then basically tried 00:03:20.583-->00:03:25.583 to see what was going on. And during 2 weeks time, we got about uh back in uh in November 00:03:28.708-->00:03:35.625 we got about 1 hundred thousand unique IP addresses trying to connect to out- our honeypot 00:03:35.625-->00:03:41.208 devices and trying to infect them. And you can actually s- the map shows you the source IP 00:03:41.208-->00:03:47.750 of host devices trying to infect our honey pots. So as you can see it's all over. What's most 00:03:47.750-->00:03:52.750 important is the number here on the bottom. It takes about one minute for an IoT device when 00:03:55.875-->00:04:01.792 you put it on the internet to get infected. One minute. After that someone else owns it do use 00:04:01.792-->00:04:06.792 it for whatever. Now that's scary. So what's the situation today? We have if you have an 00:04:13.458-->00:04:19.042 unprotected IoT device and put onto the internet it'll get infected within one minute and 00:04:19.042-->00:04:25.875 be used against you. Luckily most of the IoT devices today hide behind a NAT device, 00:04:25.875-->00:04:32.500 firewall or something protecting it against all the scams from the internet. The ratio well 00:04:32.500-->00:04:39.167 some say 5 percent visible, 95 percent are behind the firewalls. And it's ok this is 00:04:39.167-->00:04:45.083 sort of ok, they can't be scanned. Some might be breached in some ways but most of them 00:04:45.083-->00:04:51.917 are behind there and relatively secure. We thought. That's what we thought, basically. Until 00:04:51.917-->00:04:56.917 early 2017. So I'll come back to this iceberg a little bit later. So Windows-based IoT infection. 00:05:04.417-->00:05:08.750 This is about the trojan which came out in, which was discovered back in February. So 00:05:08.750-->00:05:15.042 before I go into details I'll let's give you a little bit of background. Malware infecting 00:05:15.042-->00:05:18.667 all of the types of devices, or basically hopping from one device to another is not 00:05:18.667-->00:05:24.083 something new. We've seen this with malware which has infects Windows computers and Mac and 00:05:24.083-->00:05:30.500 Macbooks Mac pros and then infects your telephone your Android phone or your Iphone, 00:05:30.500-->00:05:34.917 eeeerrr your Android phone or the Apple phone. Things would go on and try to break into your 00:05:34.917-->00:05:40.625 two factor authentication so on and so on. But this is I would say as far as we know, this is 00:05:40.625-->00:05:45.625 the first trojan which actually tries to infect IoT devices. So Windows Mirai. Detected early 00:05:50.292-->00:05:57.083 2017. Uh this is actually this is not a Windows version of Mirai, this is actually a 00:05:57.083-->00:06:02.083 refurbished trojan which was discovered back in 2016. Back in 2016 it was actually used to to 00:06:04.250-->00:06:09.958 probe for and attack Linux machines and try to mess with the SOCKS settings. So it would 00:06:09.958-->00:06:14.958 actually attack those machines. So someone took that trojan and bolted the Mirai code onto it to 00:06:18.458-->00:06:24.208 actually make it now I- infect IoT devices. So basically someone refurbished it and is 00:06:24.208-->00:06:29.208 reusing it to do new interesting things. It appears to be Chinese well the reason why we say that 00:06:33.125-->00:06:35.125 some of the text in the inside the binary, it uh some of the domain names it uses, the 00:06:35.125-->00:06:37.125 command and control service which are hard-coded point towards China and so on. It is 00:06:37.125-->00:06:39.125 not built in a way which would expect a professional organization to do there's some 00:06:39.125-->00:06:44.125 bugs in it, rather embarrassing bugs in the first versions which then got fixed. But so but again 00:06:57.625-->00:07:02.625 we don't really know and just guess. So the way we actually mapped this back to the older 00:07:05.042-->00:07:09.958 versions is that basically the older versions all contained th- uh inside the executable these 00:07:09.958-->00:07:16.792 properties. Which never changed except for the version numbers. The way it works it spreads to 00:07:16.792-->00:07:21.917 Windows that is when your computer gets infected it actually then st- starts up and 00:07:21.917-->00:07:28.500 tries to f- brute force MySQL and MSSQL databases scans for and it tries to uh find and then 00:07:28.500-->00:07:34.167 if it finds a vulnerable machine it injects stored procedure calls which basically then will 00:07:34.167-->00:07:39.167 download and install that trojan on the machine. Later versions also did RDP attacks and used a 00:07:43.083-->00:07:49.417 WIMS router. Simultaneously, that trojan would also scan for vulnerable Linux, and IoT 00:07:49.417-->00:07:54.417 devices. And this is basically exact same like Mirai used to be. It scans telenet scans SS8 00:07:56.958-->00:08:02.708 asks the database of commonly used usernames and passwords, tries to log on, and then tries 00:08:02.708-->00:08:08.167 to und- understand what kind of OS its actually eh was able to lock on, and then gets the 00:08:08.167-->00:08:13.167 proper binary for that specific OS. So it's basically the same way as normal Mirai and it's not 00:08:15.417-->00:08:20.250 using any of the other exploits which we've seen more recently; attacks against the web servers 00:08:20.250-->00:08:25.250 and just plain force, like username passwords attacks. A little bit more details um the 00:08:30.583-->00:08:35.375 different versions have used dif- uh multiple different command control servers. The 00:08:35.375-->00:08:41.042 interesting thing they were they they when we saw it initially, and then the command and control 00:08:41.042-->00:08:47.917 servers were only active for about a week and then they died. So the later versions actually 00:08:47.917-->00:08:53.000 uh were tra- were pointing towards command and control servers was inactive. Which made 00:08:53.000-->00:08:57.000 it little more difficult to understand how it actually behaves but as I said I'm not 00:08:57.000-->00:09:02.208 sure what was going on. Was someone doing an experiment? Was it a mistake, or whatever? But 00:09:02.208-->00:09:07.208 the C and C servers only active for about a week. Like I said earlier spreads and installs the 00:09:10.167-->00:09:15.500 uh load that we uh we get TFTP. Can uh also use Echo to just push the binary across the 00:09:15.500-->00:09:21.667 Telnet which is interesting. And the interesting thing is how they actually build up the 00:09:21.667-->00:09:26.917 binary, because it actually uses reasoning resourced from part of the executable to install 00:09:26.917-->00:09:32.208 different binaries. It basically has about 9 of them, just puts them in there and is actually a 00:09:32.208-->00:09:38.417 nice way to build to build the trojan itself. So it's I'd say the programing part is pretty 00:09:38.417-->00:09:44.708 ok. It's a little more likely structure of the trojan itself. Easy to extend, easy to modify, 00:09:44.708-->00:09:51.542 easy to create new versions. As to say, the Mirai command an- th- command and controls for the 00:09:51.542-->00:09:57.750 Mirai part they are hardcoded to this address. And they were all down, they have never come up. 00:09:57.750-->00:10:02.875 The command and control servers for the trojan itself, those are the ones which are up. For about 00:10:02.875-->00:10:07.875 one week. Ok. And this is just showing you how it's exactly stored inside the resource file. 00:10:10.125-->00:10:15.125 >>[unclear voice of mic] >>Heh. Ok. >>[unclear voice of mic] >>Ok someone is trying to inject 00:10:18.000-->00:10:24.167 something. Scream an injection at the board. [laughs] Um they also stored all the debugging 00:10:24.167-->00:10:28.083 strings inside the binary, which is pretty nice of them, makes it easier for us to understand 00:10:28.083-->00:10:33.167 what's going on. Also shows us where those debug strings are used in the code which makes it 00:10:33.167-->00:10:39.083 easier to detect what the, which part of the code is doing what and so on and so...thank you. 00:10:39.083-->00:10:44.083 Please continue to do this. Um little bit about how it actually works. So as soon as it has 00:10:46.542-->00:10:52.083 infected your machine it will then try to download a text file. That text file contains 00:10:52.083-->00:10:57.083 two things. One a uh link to a jpeg and then a link to a uh batch, batch file. So and 00:11:02.875-->00:11:07.667 actually they store the executable inside the jpeg. The jpeg it looks perfectly normal, 00:11:07.667-->00:11:10.917 I'll show it in the next slides. But if you execute it contains it actually contains the 00:11:10.917-->00:11:17.125 executable which can extract from it. It also downloads a version file. So it actually 00:11:17.125-->00:11:22.458 tries to see oh what's the latest version and so on just to keep itself up to sync. So this 00:11:22.458-->00:11:28.833 is the jpeg. Looks like a normal jpeg if you take a look at it or try to see what's going on. It's 00:11:28.833-->00:11:33.375 in this place. It's a nice picture. But inside it you have the actual binary for the 00:11:33.375-->00:11:38.375 executable. Moving on. The bat the batch file downloaded also nothing special except for this 00:11:40.583-->00:11:45.750 part, the one highlighted in green. Which is showing you it actually tries to download the 00:11:45.750-->00:11:50.750 DLL. You have no idea what the DLL is doing, it could be doing anything. But at least it has a 00:11:53.125-->00:12:00.042 hook downloading something extra to do extra things. The it also downloads what we believe to be 00:12:00.042-->00:12:06.083 the configuration file. So first it downloads a file containing the identification of the 00:12:06.083-->00:12:12.167 configuration file, then the configuration file itself, which is encrypted. And because as I 00:12:12.167-->00:12:17.167 said we uh never were not able to do detailed diagnosis of it then we were not able to crack 00:12:20.917-->00:12:27.917 its executable contents. But it probably contains which scanning modules to use, uhhh the subnets 00:12:27.917-->00:12:34.042 to look at, and so on and so on. And also the username and passwords used for brute forcing 00:12:34.042-->00:12:39.292 then those are probably in there. Because they're not part of the executables. So ok now 00:12:39.292-->00:12:44.292 I've spend about 10 minutes talking about the trojan which never got active. So what's new 00:12:49.500-->00:12:54.333 well what people are deploying these creating trojans all the all the time, and what's so 00:12:54.333-->00:12:59.333 special about this one? Why is our why am I actually up here and talking about this? And 00:13:02.167-->00:13:08.042 that's because of the iceberg. 5 percent of IoT devices are outside in the open internet and 00:13:08.042-->00:13:13.542 are already being used, 95 percent are behind the firewalls and everyone thought that was 00:13:13.542-->00:13:18.542 perfectly safe. So these things happen. Zombies. So basically a vulnerable computer, a computer 00:13:24.542-->00:13:29.625 containing a virus when it comes into your network it is now capable of actually seeing uh 00:13:29.625-->00:13:36.083 locating and then infecting all those vulnerable IoT things you have behind the firewall. Could 00:13:36.083-->00:13:41.500 be your webcams, could be your DVRs, could be the, well, anything. We have refrigerators 00:13:41.500-->00:13:48.292 and stoves stoves downstairs which could be used as used to uh as ports for some of these. 00:13:48.292-->00:13:52.917 So we'll actually supplement them and change them all from something innocent and nice into 00:13:52.917-->00:13:59.292 these kind of things. Now, when the attacker has gained control of all those things behind your 00:13:59.292-->00:14:05.125 firewalls he can begin to do interesting things. Like go scan for other devices, launch 00:14:05.125-->00:14:11.083 outgoing attacks, and then also try to attack internal resources. So let's go into more 00:14:11.083-->00:14:16.083 detail about this. What can happen? First of all this is a typical network design for a 00:14:18.167-->00:14:22.792 mid-enterprise network. I'm not going to tell you who created it, because we do need to 00:14:22.792-->00:14:29.708 protect the innocent. But this is a typical design for how to build a secure mid-enterprise 00:14:29.708-->00:14:34.708 network. Here's the thing: bad guys on the outside then you have some security boxes and 00:14:37.875-->00:14:44.250 then you have this guy. The one who is attacking DEFCON he got infected by something and then 00:14:44.250-->00:14:49.250 tomorrow he comes back to his network probably the depot his branch in Las Vegas, plugs in 00:14:52.125-->00:14:57.125 and then he plugs in his laptop. What can possibly go wrong? [chuckles] Ok, so. First of all, 00:15:01.125-->00:15:06.125 scanning. In this network you have tons of IoT devices but just to make your life easier 00:15:08.917-->00:15:14.667 then these are the ones which we found very quickly. The webcams, our webcams, probably a little 00:15:14.667-->00:15:19.667 bit more high end than the things you buy out on uh BestBuy or somewhere. But probably not 00:15:22.167-->00:15:28.417 been upgraded recently. Well why rec- why upgrade the software of those things? They're secure, 00:15:28.417-->00:15:34.083 they're behind the firewalls, right? But what happens is that this guy down here, as soon as 00:15:34.083-->00:15:40.208 he plugs in his computer, could be local could be remote via VPN or whatever, it begins to scan. 00:15:40.208-->00:15:45.917 Scans the local subnet in this case it actually find a webcam in the same branch office. 00:15:45.917-->00:15:51.500 Continues scanning goes to some other s-- to some other devices and then it will probably start 00:15:51.500-->00:15:57.417 to scan other subnets. The version which we got didn't do that, it only scanned the local 00:15:57.417-->00:16:03.167 subnet, but if the configuration file said "please scan all RFC1918 subnets" that's easy, to 00:16:03.167-->00:16:09.458 scan some other subnets. And then it continues and continues and continues. But look at this, 00:16:09.458-->00:16:15.625 now there's a black arrow coming. Because as soon as this webcam got infected, it will 00:16:15.625-->00:16:20.625 also start scanning. So and if it infects other Windows computers it will also those 00:16:22.750-->00:16:29.458 will also start scanning as well. Meaning as the traffic increases, as more devices get 00:16:29.458-->00:16:35.875 infected you will have more and more devices doing scans. The scans themselves are not that 00:16:35.875-->00:16:42.750 risky, but actually the act of performing those scans is what can pose problems. And bi- er 00:16:42.750-->00:16:47.750 the version we've seen just sending them out packes try to send send the packet to 10216801 00:16:49.833-->00:16:56.417 okay that's a that's a hit 02 someone is responding, someone is actually trying to use- use 00:16:56.417-->00:17:02.208 resources for all those arrows. And try to process them and so on. And what we've seen is that 00:17:02.208-->00:17:08.458 just the scanning activity itself is enough to c- to make most normal networks collapse. 00:17:08.458-->00:17:13.042 This happened back in the old days with NIMDA those things this happened actually last 00:17:13.042-->00:17:19.417 year, in Germany, when our last service provider got infected by a Mirai and when the CPU devices 00:17:19.417-->00:17:25.917 began to look for other devices, they actually caused the the access routers and switches to 00:17:25.917-->00:17:32.625 collapse. Meaning the entire user population in Germany, about more- one or two million 00:17:32.625-->00:17:37.625 users got off, cut offline. Just because of the scanning. Also this this scanning stuff sends a 00:17:40.792-->00:17:46.458 lot of small packets. And devices, most IoT devices are not comfortable with having tons 00:17:46.458-->00:17:51.458 of small packets going through. So this could cause a problem. The second thing. Now this guy 00:17:54.083-->00:17:59.208 he suddenly gains control of lots of webcams in different companies. So what will he do 00:17:59.208-->00:18:05.500 with them? Well he will launch DDoS attacks, of course. So first one sends the packet, 00:18:05.500-->00:18:10.500 second one, and third one, fourth one, so on and so on and so on and so on. So basically if 00:18:12.833-->00:18:17.417 he gained control of 100 webcams inside your network then he'll probably use all of them to 00:18:17.417-->00:18:23.833 launch outbound attacks against someone else. So ok that's bad for the guy on the internet. But 00:18:23.833-->00:18:28.958 in this case it is actually could cause serious problems inside the network itself 00:18:28.958-->00:18:33.958 because these attacks with Mirai the Mirai code is using could be packet flooding could be ICP UTP 00:18:38.375-->00:18:43.500 TCP, could be some attacks, could be reflexing attacks, could be application level 00:18:43.500-->00:18:48.500 attacks all casual things but most of those things are small packets and what's interesting 00:18:51.000-->00:18:56.000 is that inside the network you have all kinds of devices which have stayed full. And this is 00:18:58.167-->00:19:03.375 important a firewall will actually, when you send a packet to a firewall, any packet, it 00:19:03.375-->00:19:08.417 tries to remember if it remembers the packet. Because you might be setting up a 00:19:08.417-->00:19:12.667 connection which means it's storing information about that specific packet. And when the 00:19:12.667-->00:19:17.542 next packet comes along it stores also information about that packet. And the third one, 00:19:17.542-->00:19:24.250 and the fourth one, and so on. In our experience a firewall when defending against outside 00:19:24.250-->00:19:30.542 attacks will collapse about 50 percent of the time. A firewall which is trans which is actually 00:19:30.542-->00:19:36.958 allow- ascending outbound to be destructed will collapse all the time. It will simply go up in 00:19:36.958-->00:19:43.750 smokes and die. So just the act of launching and outbound DDoS attack will cause most of your 00:19:43.750-->00:19:48.292 firewalls load balancers, switches, routers, and anything else inside your network to go 00:19:48.292-->00:19:54.042 up in flames. The attacker didn't wasn't planning to do these things but this is what 00:19:54.042-->00:20:00.500 will happen. Also you have WAN links you're connecting the branch offices back to the 00:20:00.500-->00:20:05.292 headquarters. What will happen those links will fill up. That means the important traffic that 00:20:05.292-->00:20:10.125 is for your commerce systems your phone traffic whatever else, will not get through. 00:20:10.125-->00:20:16.583 Physically your network is full, check, your boxes are falling down left and right and you're 00:20:16.583-->00:20:21.583 in a bad state. The third one. If the attacker is clever, he will probably try to do some 00:20:25.833-->00:20:31.625 kind of reconnaissance. Because well if he has control of devices inside the network let's 00:20:31.625-->00:20:36.625 why not why not try to find out where he is. So he starts to do probes. Basically he tries the 00:20:39.250-->00:20:43.500 webcam in the data center sends out some packets, listens to some packets and so on and so on 00:20:43.500-->00:20:49.208 and very quickly he finds out he's inside Evil Corp. Which is an interesting thing because 00:20:49.208-->00:20:54.667 that's exactly the target he wanted to attack. And because he's doing reconnaissance he'll 00:20:54.667-->00:20:59.667 probably find out that uh well the network operation guys they are on the subnet 10 1 1 00:21:02.042-->00:21:08.708 something. The security operation guys they're on 10 1 1 2 something and how difficult 00:21:08.708-->00:21:15.250 would it be to inject some kind of a routing packet or a null packet or something to basically 00:21:15.250-->00:21:21.458 shut off the security guys and the operation guys leaving them totally offline and then launch 00:21:21.458-->00:21:27.208 these attacks. That's basically true. If you're inside the network attacking routing 00:21:27.208-->00:21:32.208 protocols is relatively easy. So he would then launch his ne- new route. Shut off the security 00:21:35.667-->00:21:40.958 guys and then he would start to detox the data center then we start to detox the region data 00:21:40.958-->00:21:45.958 centers and so on and so on basicallyyyy taking everything offline and totally shutting 00:21:48.000-->00:21:53.000 down what's going on. So this sounds bad and also this could actually lead to something new 00:21:55.750-->00:22:01.000 which is the uh ransom attack mode basically DDoS attack from the inside because this clever 00:22:01.000-->00:22:04.750 guy runs this for 10 minutes then he would send an email saying "Hey please pay me some 00:22:04.750-->00:22:09.750 bitcoins otherwise I'll continue." And defending against an insider attack if you're not 00:22:13.083-->00:22:19.167 prepared to do that is really difficult. You will not be able it's difficult to start to 00:22:19.167-->00:22:25.833 reconfigure networks into segmentation remove softer devices, put hardened devices on 00:22:25.833-->00:22:30.833 if during the attack. Basic- it's basically impossible. So and then the question is: "wait 00:22:34.708-->00:22:39.708 a second can a webcam or something thing which cost 100 dollars can it actually take 00:22:41.750-->00:22:46.750 down a half a million dollar Kor Switch Something huge, from Cisco or someone else with multi 00:22:49.958-->00:22:56.083 terabit this and that and so on and so on. And the answer is: if that device is not secured 00:22:56.083-->00:23:01.083 properly, yes. But to understand that, we need to understand bi- how the anatomy of the typical 00:23:05.167-->00:23:10.208 network device. Most network devices have something called "fast path". And then they have 00:23:10.208-->00:23:16.125 something called "slow path" and this is where the CPU lives this is where all the A6 and half of 00:23:16.125-->00:23:20.458 the x rated this and that lives and basically shoves packets through it through it on a full 00:23:20.458-->00:23:25.958 wire speed. And the packets going through these are the normal data packets. And this 00:23:25.958-->00:23:30.958 is- in most known situations a network device works. Packet comes in the- the it'll look up 00:23:34.292-->00:23:38.875 where the packet should go. That happen- this happens in hardware takes no time whatsoever. And 00:23:38.875-->00:23:44.542 the packets goes out a different port very quickly. That's good. Um th- the main CPU load is 00:23:44.542-->00:23:51.167 about 1 percent. And that's how things should be. But a network device needs to communicate with 00:23:51.167-->00:23:55.958 other devices. Which means it needs to receive information it needs to rec- receive the 00:23:55.958-->00:24:01.958 routing updates. It needs to be able to be managed it needs to send statistics and so on and so 00:24:01.958-->00:24:06.625 on. So there will be some packets going towards the device which it has to process. Then 00:24:06.625-->00:24:11.958 you have the interesting packets, which are called exception packets. Things which 00:24:11.958-->00:24:16.958 should have gone through the device but for some reason need special handling. This could be 00:24:19.000-->00:24:24.542 things like TTL expiry. You send the packet which expires on the device that means it will have 00:24:24.542-->00:24:30.292 to be sent to the main CPU, the main CPU will have to create an ICMP TTL expiry and then send it 00:24:30.292-->00:24:37.125 back to source. Which means one packet can actually cause the main CPU to analyze and create a 00:24:37.125-->00:24:42.125 new packet, use memory and resources to do that and then send it out. That's quite a hit. 00:24:44.292-->00:24:49.750 So let's send 10 billion packets towards that device. And if you managed to do things properly 00:24:49.750-->00:24:54.958 then w- you have problems. One other thing, because a lot of people don't know about Non-IP 00:24:54.958-->00:25:00.292 packets. If you send a packet which is not IP towards a switch re router, it will have to be 00:25:00.292-->00:25:05.583 sent to the main CPU for special handling. Could be as IoS it could be something else. Again 00:25:05.583-->00:25:10.583 requiring special handling CPU and resources. And if you managed to keep the CPU busy 00:25:13.167-->00:25:19.250 enough it will not be able to do what it's supposed to be doing. Like receiving routing updates, 00:25:19.250-->00:25:24.042 sending out routing updates, sending hello timers, or something like that. Which 00:25:24.042-->00:25:29.042 basically translates into, this. And this is actually a test I did, I did this about I think 7 00:25:31.542-->00:25:37.792 years ago for another conference where I was using just a normal tiny little IBM to attack a high 00:25:37.792-->00:25:42.792 end course switch supposed to send 720 be able to sw- sw- do 720 gigs of forwarding and it 00:25:45.667-->00:25:50.667 died in 5 seconds. Because of this because I sent uh, se- just su-300 packets per second 00:25:53.167-->00:25:58.167 specially crafted towards having them sent to the main CPU. And what happened? It got so busy it 00:26:00.667-->00:26:05.875 couldn't send out the the hello timers and basically all the routing information collapsed 00:26:05.875-->00:26:12.208 and it became a black hole and the network just collapsed. It was pretty cool. If you do 00:26:12.208-->00:26:18.167 things correctly. But it was an unsecured device. As soon as I enable the security on that 00:26:18.167-->00:26:23.167 device, no problem. So how can it defend against those type of things? So let's learn from 00:26:27.500-->00:26:32.500 history. This is interesting. Castles. Back in the old times these guys were actually uhh 00:26:34.875-->00:26:40.958 they were trying to defend against attacks. So they built castles. And castles are usually 00:26:40.958-->00:26:46.375 quite- quite difficult to get into. Like in this case if you want to get into the main tower 00:26:46.375-->00:26:52.000 up here where they hide all the goodies the uh jewelry and so on and so on then you need to get 00:26:52.000-->00:26:57.500 through multiple layers of defense. If you take a look at the aerial view of this sorry uh 00:26:57.500-->00:27:02.708 you'd probably not try to go up here. Not. Because these are high cliffs. You'd probably go 00:27:02.708-->00:27:08.833 here and if you look at the aerial view then you'll see this is actually a big area where 00:27:08.833-->00:27:15.292 the- we defend these walls first and if the attackers get through then you basically retreat to 00:27:15.292-->00:27:20.292 the next set of walls. Shorter wall easy to defend. And if that collapses then you move to the 00:27:22.333-->00:27:26.875 next one. So it's all about delaying the attacker. Seeing what they're doing. Gaining 00:27:26.875-->00:27:31.833 visibility into how they operate and so on and so on. So it actually makes a lot of sense, 00:27:31.833-->00:27:37.417 because as we know if someone really wants to get though he will get through in the end 00:27:37.417-->00:27:41.708 unless you unplug everything unplug shut down everything in existence. But then he has 00:27:41.708-->00:27:46.708 succeeded. And here's an interesting fact. Stairways. Who knows why I'm showing this 00:27:48.833-->00:27:53.833 picture? That's..don't tell them. OK some of you guessed. The thing is stairways in 00:27:56.625-->00:28:01.625 medieval castles were usually built clockwise and there's a reason for that. So if I'm down 00:28:04.250-->00:28:09.000 here, I'm trying to get up this these stairs and let's assume it's circular. I'm standing here 00:28:09.000-->00:28:14.000 with my ax or whatever and this damn thing is in the way. Which means I'll have to use my left 00:28:14.000-->00:28:19.875 hand. If I'm right handed that's a problem. If I'm standing up here and I'm right handed, I can 00:28:19.875-->00:28:24.875 really bust the s**t out of him [laughs][audience laughs] and gives giving me an advantage. So 00:28:27.250-->00:28:34.000 just the fact of building a castle with the stair going this way actually gives the defenders 00:28:34.000-->00:28:40.542 an advantage. So it's a small thing but actually ac- someone thought through these things and 00:28:40.542-->00:28:45.542 thought "This makes sense." And by the way is anyone from Scotland here? No one? Because 00:28:48.333-->00:28:53.958 the Scots did it the other way around. [crowd laughs] And the reason for that is that the one 00:28:53.958-->00:28:58.958 of the last families in Scotland in the medieval times they were predominantly left handed which 00:29:01.583-->00:29:07.333 so they built the stairway such that it would give them an advantage. Which sort of makes 00:29:07.333-->00:29:10.250 sense, the only problem is by building the stairs that way that made it they made it 00:29:10.250-->00:29:16.667 actually easier for the right handed guys coming up. Ok so this is yeeeah ok not sure if it 00:29:16.667-->00:29:21.667 actually made sense but that's how they did. So coming back from castles. Layered defenses, 00:29:24.208-->00:29:29.833 building your network so it's suh- in such a way that it can actually withstand attacks, can 00:29:29.833-->00:29:34.292 detect what's doing on, and so on and so on. The interesting thing is that the service 00:29:34.292-->00:29:38.583 providers have been doing this for the last 20 years because they are in exactly this 00:29:38.583-->00:29:43.958 situation. They cannot uh rely on anyone they cannot trust anyone. They get attacked by the 00:29:43.958-->00:29:49.625 customers they get attacked by other people and so on and so on and they aren't they need they 00:29:49.625-->00:29:56.042 really need to build the networks so they can survive almost any kind of attack. And 00:29:56.042-->00:30:01.042 the thing is they actually use a 6 phase- 6 phase methodology. The first thing is preparation. 00:30:04.708-->00:30:09.958 You need to harden your network you need to design your network in such a way that it's able to 00:30:09.958-->00:30:14.875 withstand these type of attacks. That means using a lot of time and effort to actually imp- 00:30:14.875-->00:30:21.167 implement security, put segmentation, put axis list and so on and so on, and just that 00:30:21.167-->00:30:26.458 they are in the best way best shape possible to withstand the attacks. Then when things go 00:30:26.458-->00:30:32.625 wrong you have to first of all identify that you're being attacked. Sometimes you don't 00:30:32.625-->00:30:38.000 you're not able to see that. If it's a if it's a stealth attack it could be just going on 00:30:38.000-->00:30:43.833 underneath the uh underneath the what's happening. Someone could launch a big DDoS attack while 00:30:43.833-->00:30:49.708 they're trying to hack their way into your network. So you need identification. That's the first 00:30:49.708-->00:30:55.917 thing. Then you need to be able to classify what type of attack this is. Is it this kind or that 00:30:55.917-->00:31:00.917 kind and so on and so on. Then you need to understand where is the attack coming from. And then 00:31:04.542-->00:31:09.542 and only then you do something. The biggest cause of all outages is when people do something. 00:31:12.250-->00:31:17.583 They panic they start pressing buttons and they implement this or that. And they in many cases 00:31:17.583-->00:31:20.792 they are just helping the attacker because they've absolutely no clue what's going 00:31:20.792-->00:31:26.250 on. So you need to follow theses steps to actually understand what's going on. Then when 00:31:26.250-->00:31:31.417 you're finished with this, before you go to the pub and say hey we did good and we're good 00:31:31.417-->00:31:36.792 guys and everything is fine, understand what went wrong. Learn from the different phases 00:31:36.792-->00:31:42.542 and then make sure you actually can do things in a better way. So you can also look at it from 00:31:42.542-->00:31:47.542 this this side. Just implement network segmentation understand p- well the process and use flow 00:31:49.583-->00:31:55.708 telemetry and this is actually for free this is NetFlow, uh which almost every device has. 00:31:55.708-->00:31:59.500 And you can take the NetFlow information and it will actually give you understanding of what's 00:31:59.500-->00:32:05.375 going on. It will detect those scanning attacks it will detect all the attacks it will show you 00:32:05.375-->00:32:09.542 what's happening. And by the way everything I'm saying here is actually in the white paper 00:32:09.542-->00:32:14.542 which you can download with all the nitty gritty details. And then you should scan for your 00:32:16.625-->00:32:22.000 own services. You don't want someone to use your own DNS server to launch a reflection 00:32:22.000-->00:32:28.500 attacks a reflection attack against yourself. So find those services which are not secured 00:32:28.500-->00:32:33.500 properly, harden them configure them correctly and basically [clears throat] if if you think 00:32:35.708-->00:32:41.083 that any- everyone is out to get you, that's the right way to think. Don't trust anyone. Not 00:32:41.083-->00:32:46.125 your customers, not your employees, anyone. It can all be become some reason to attack 00:32:46.125-->00:32:50.833 you. And there's all kinds of features which can implement on the network devices which are 00:32:50.833-->00:32:55.833 disabled by default for some interesting reason. Like uh res uh ERPF ETP snopings Moscat and 00:32:59.125-->00:33:04.125 so on most of them will just stop all those things from happening. So summary. The 00:33:07.917-->00:33:12.917 attackers are now inside the house. This hasn't happened yet but someone took the time and 00:33:16.125-->00:33:22.875 effort to write the code to do exactly these things. For some reason they didn't go live. We 00:33:22.875-->00:33:29.583 don't know why. It was the test it was the mistake or just someone having fun we don't 00:33:29.583-->00:33:33.625 know. But the thing is, the binary is out there, anyone can download them it's easy to 00:33:33.625-->00:33:38.250 reverse them. Which means basically anyone an- anyone else can actually now go on and do 00:33:38.250-->00:33:43.500 exactly the same thing. And now as I've just presented on about all the threats about these 00:33:43.500-->00:33:48.083 things then yes maybe someone else will actually think "Hey this is cool, let's do it." But 00:33:48.083-->00:33:53.917 still the idea is to give you information. So I would say this is real. You need to secure your 00:33:53.917-->00:34:00.292 network before someone actually uses the network against you. And as I said earlier service 00:34:00.292-->00:34:06.125 providers and large enterprises which are really security conscious, then if your company 00:34:06.125-->00:34:11.125 is secured well enough you actually take care of these things. So it can be done but it 00:34:13.375-->00:34:17.958 involves work. The problem is a lot of people want to buy a box with blinking lights because 00:34:17.958-->00:34:22.083 it'll solve all their problems right? And if it doesn't solve the problem you go off and buy 00:34:22.083-->00:34:26.042 another box with a lot of blinking lights. [audience chuckles] In this case it's just 00:34:26.042-->00:34:31.625 a matter of engineering. Network engineering, doing the right thing. Making sure that that 00:34:31.625-->00:34:37.000 thing actually is secure. It's effort but it's worth well doing it. Because if you do it 00:34:37.000-->00:34:41.625 properly, you not only secure yourself against these things but you secure yourself again- 00:34:41.625-->00:34:46.042 against Wanna Cry and basically almost everything out there because you've segmented your 00:34:46.042-->00:34:50.500 network you've hardened it and you can actually protect yourself against most things. 00:34:50.500-->00:34:55.500 But it requires time and effort. So hopefully this presentation will help people to understand 00:34:58.708-->00:35:04.083 the threat- threats are out there and why they have to do those things. So at that I'll 00:35:04.083-->00:35:09.083 basically say thank you [crowd applause] and if you have questions, I'll be outside.