We really appreciate being here today. We're going to give our attention to Jason Street.
Who's that? Have you given anybody awkward hugs lately? I've given a few. Alright.
.
.
We're going to give our attention to Jason Street. His theme is how to protect your banks and enterprises.
A talk by someone who robs banks and enterprises.
.
So I like to start these kind of talks with a legal disclaimer.
I'm not a lawyer, but I've played one on the internet.
This is it. I'm adorable, okay?
I will not try to steal from you, kill you, or ruin you financially unless you pay me first.
There's always a contract. So when I talk about some really horrible things
and in some of these versions of this talk, every talk I've done
this year has been different.
Every version has one thing in common. It's really, really evil.
So when I get to some of those points, just remember the kittens.
I'm adorable. I'm not a bad guy. I'm just really good at playing one
for good reasons.
So the key thing about this talk, you're going to see a common thread, and it's just how we suck at risk assessments
and how we're not worried about trying to defend our stuff so much
of what's really going after us. We're defending ourselves
from things that really may not actually be going after us,
and we need to go and start scaling back and actually defending the stuff
that we can do immediately and effectively right now
instead of worrying about all those other threats that are coming out there.
This is the perfect example because this was the Super Bowl from this year.
The Vice President was there, 5,000 police officers, Secret Service,
probably some in the audience right now. Hi, guys.
And a lot of other kinds of law enforcement and feds
there at that event. High security event. Tier level one security.
Three teenagers went through a chain link fence.
They found a ladder, and they were like,
hey, let's just carry this ladder in and see what happens.
And guess what happened? Everybody let them through.
There's three guys carrying one ladder, 5,000 cops.
Yeah, seems legit.
What's up with that, right?
The best part about it is they YouTube'd all of it.
Guy Fieri and TMZ made cameos on this YouTube video.
It was amazing. So there's your high level security event.
It's like they were worried about all these other kinds of threats,
but they were, you know, not prepared for teenagers
and a chain link fence with a hole in it. It's like you may want to worry
about those things. Least important slide, but it's got to be in there.
I'm a blue team and a red team guy. So I don't
just try to destroy the stuff. I like try to fix it as well.
But how can you properly defend your networks and your companies and your
corporations and your enterprises if you don't really know how they're attacked?
And that's one of the other main themes of this talk is how do you
attack them? So, because we suck at
risk assessment. Remember in 2015? It was the Ebola's.
Oh my God, the Ebola's came to America.
Everybody flip. This is worse than Shark Week, right? Or the Summer of the Shark.
It's like Ebola's came to America.
How many people died from Ebola in America?
Two people. Two people died. And that's tragic. That's not funny. Two people died
from Ebola. That's horrible, right?
Why are y'all laughing?
Y'all are horrible. Now you make me laugh and I look like a jerk.
It's like, okay, at that same
Okay, yes, that is true. I am a jerk. But still, it's like that same
year that two people died from Ebola, 55,000
Americans died from the flu.
So while you were out there preparing for the Ebola to come and get you,
maybe you should have taken a flu shot.
That's all I'm saying. Well, I mean, I'm saying it to them because they're dead and that's still once again tragic.
Okay? But seriously, that's their threat they were
looking at was something so out there and scary that the news kept reporting.
But what they could have been doing is taking basic care of themselves
and maybe surviving. And, because what do we fear?
And what do we actually go after? The leading cause of death in perspective.
The leading cause of death in perspective. The leading cause of death in perspective.
One, heart and circulatory disorders. That's something I'm worried about.
You know how much bacon I consume every day? It's like, that's horrible. I've got to worry about that. That's a big threat for me.
I've already had cancer, so yolo.
But look at the very, very, very, very, very bottom.
Right there. Terrorism.
You know? But what do we fear the most? What's driven
our economy so much? It's like, what's empowered the TSA to be so
idiotic? Terrorism.
I have to grab your cotch serves for the security of America.
You know? And that leads to another
problem. Because once again, we may not even know what we're supposed
to be protecting ourselves from, but what we do is we put
in these institute, these policies and these things of saying, and telling the employees
and not informing them properly of what they need to look at, so they do
pattern matching. They'll go like, well this is the scenario and this is
how I need to react. We don't give them the leeway to actually think critically.
There's no critical thinking in a lot of the security postures
of a lot of corporations, enterprises, and let's say governments.
Because this is my actual USB drive.
That was confiscated by that TSA agent.
Do you know why that USB drive was confiscated?
Because it looked like a grenade.
It matched the pattern. That's it.
It matched the pattern, exactly.
Well no, I tell you, I pulled the top off, showed them that it was a USB drive,
and then they're like, well you can't take it, we have to take it. And I'm like, no, I've got to destroy it.
Because I actually had some malware that would actually mess with their machines, and if they plugged it in, then it would be my fault.
And then it's like, I mean, I was like, no, I've got to destroy that one
because I'm not getting another wrap, right?
I now carry
a USB drive grenade in my bag.
But I take the top off and put it in another pocket, it goes fine. It's good.
I've got a machine gun and a pistol
in my bag, USB drives, but I put them
separately in two different pieces. It's like, they're totally cool.
It's like, because it doesn't match the pattern.
Don't we all feel secure when we fly out of Vegas on Monday?
Right? So that's one of the problems as well.
And what are we actually looking at? It's like, it doesn't just go from physical,
it's also from online. Everybody's worried about
zero days. You know, zero days. Oh my gosh, they're dropping
O days in here. Well not here in this talk, obviously. But you know, it's like
in DEF CON, they're dropping O days. We've got to worry about this, worry about that.
Uh, SQL Injection has surfaced as the number one attack in
2015, probably 2017. SQL Injection
is not a security vulnerability. It's crappy coding.
Stop treating it as a security vulnerability. And people will say, well
Jason, still, you know, crappy coding can be a security vulnerability. SQL Injection
is not a security vulnerability, it is crappy coding.
If you got a, if you're getting owned by SQL Injection,
you need to talk to your coders, not to your security department.
Well, you need to talk to your security department to watch out for those coders, because they're up to some sketchy stuff
if they're still putting SQL Injections in their stuff. Alright? But who's
coming after you? What are your threats? Is it nation states? Are you worried
about nation states? I mean, I wouldn't be worried about nation states, well,
maybe a little bit. But um, uh, but look at these, you know,
it's like, you got nation states, unless you're running a centrifuge in Iran
maybe, or maybe you're, uh, owning a telecom company,
maybe, or you're the pope. Seriously, we spy on the pope.
Not that sketchy one with the red shoes, but this pope, the current one.
The guy who dresses up as a regular priest in Vatican City at night
and feeds the homeless. He's like the Batman of popes, he's awesome.
And it's like, and they still spy on him. What's up with that? So,
uh, and also, we don't have to worry too much, this was actually from the vault, uh,
Seven Lulls. The root password for the SSH, uh, um,
system was 123abcdef.
So it's nice that our government is actually using, you know, upper and lower case and numbers.
I guess. Uh, so that's awesome. Are you worried
about anonymous? You know, how many people in here is from anonymous?
You failed!
So it's like, uh, are we really worried about them? Cause it's like, I mean, I like that last article
where it says, could the hacker group anonymous do any real damage to Donald Trump's
campaign, uh, in the, in the, as it's foretold or, or threatened?
No. Sorry. It's a moment of silence for that one.
Um, how about criminals?
Maybe criminals are out to be your threat.
Maybe you should worry about getting robbed.
Maybe they're the ones that are actually, nation states,
with nation state tools, uh, hacking
activist groups. Yes, those are threats and potential threats for certain areas.
But the majority of people, you need to worry about your stuff getting stolen.
People want to rob you. It's like, you know, you don't want
to be a target of cyber crime. Couldn't resist the pun. Sorry, that was awesome.
Target lost over a hundred million dollars from that breach so far.
So far. It's still losing. It's like, uh,
it's horrible. Did they, did their security
controls, were they the vector of compromise? It was an
HVAC system company that had a trust relationship.
They, uh, compromised the HVAC system
with a spear phishing campaign that they like to say was a sophisticated attack.
Whatever. Um, and they, uh, they attacked the target.
And that's how they got compromised. Because of the trust relationship.
It's like, and, and
that's one of the things we're going to go after a little bit more as well. And
talking about spear phishing emails, you talk about zero days, phish
gets me every time. It's like majority of workers blindly open email attachments,
attachments, especially if they think it's from someone they know.
Because why would someone send you something, you know, that's malicious? That's just me en route.
Right? So, what I usually do at this
point is, when I gave this talk in South
Africa, I googled biggest bank in South Africa.
That totally didn't work as well as I thought it would. Uh, but, uh, but
when I went to Paris, I googled biggest, uh, bank in France.
And I randomly would pick a
target from that search. So I would be, and, and
every single one of those, I actually, the person who was an employee from that bank
in all those different countries were in the audience. It was sort of awkward but fun.
Uh, and it shows you.
That it can be that much of an impact. It can be that random and
arbitrary. You're being attacked right now. But this is
DEFCON. And it's like I didn't want to just go after our biggest bank because y'all would be all cheering me on
and go woohoo and the banker person doesn't care. So it's like they're probably not in here, right?
So I thought I'd do a little twist because Chris, uh, you know, he's like invited me here.
I wanted to make something special for him. So I decided to put a little bit of a different theme on it.
And let's go F society on this one. Let's take down the government.
Anybody with me?
Awesome.
So just like, uh, F society, I'm just gonna go random and I'm gonna try to find a
and it's based in New York. So let's go after one of those one percenter
one percenter companies. The Power 100 in New York. That's where they list
all those fancy companies making all those money with the hedge funds and the Ferraris and
all those people, right? Evil Corp. Uh, I did some searching on there
and I see the, the might have been best exemplified by related
companies. Hold on. Related companies.
I didn't even know that was real. I mean, that's just like E Corp, right? That's just like
a random name that's like, doesn't sound like it's real. That's one of those generic names.
So, yeah. Let's attack them, right? So I'm going after related
companies now. So this is my now target. So
as I'm targeting related companies, I just Google related companies. It's
that easy. Uh, I know the CEO's name. I know their headquarters.
I know the founder. I know when it was founded. The subsidiaries. Uh, subsid...
whatever. Uh, the type of businesses and the profiles cause they're on YouTube
and Instagram cause they're hip related companies, right? Uh, so let's go
look at some of their, their stuff. Uh, let's go to their, uh, website.
That's a pretty website. And that's how normal people
see the website. When normal people go to a company's
website, this is what they see. Have I ever been accused of being normal?
No. Never. So, how do
I see and an attacker see this website? Well, with this
wonderful thing called extensions. So now,
from just going to the website, all I have is
their IP addresses, their hosting information, the NS lookup
numbers. Uh, I know, it's sort of disappointing because they're actually
really well protected and sort of irritating. Uh, cause they're using a lot of third party
services to help them like SunGuard DNS and, uh,
pphhosted.com for their mail
server. Uh, really no joy. I was really unhappy about that cause
usually I've got a lot more information at this point and y'all going, ooh, wow,
but now you're just like, yeah, it's lame, Jason. You're right. Um, I did come up with this.
All the domains that are listed on that IP address were things like
onewarpark.com, related.com, then a whole bunch of
.CNN, uh, I mean a .CNN, .CNN, there we go.
A lot of China domains. And I'm fsociety, right?
So is Dark Army involved in this? I don't know.
I'm a little nervous now though. I'm a little nervous about this. Let's see what happens.
So it's like, uh, I go on from there. Uh, let's look at some of their social media profiles.
There's YouTube cause who wants to, I mean, Bloomberg
seems very exciting and interesting so yeah, they got a lot of views on that one.
What was it, 36 in three months? Yes. Uh, so y'all, uh, so
sorry, I don't mean to disrelated .com. Um, but here's their
Instagram. That's hip and those are some nice pictures of
buildings. Um, but they've got 1,800 followers and they're only following
170 cause they're very selective. Uh, that's nice.
Let's go over their, uh, LinkedIn profile. Here's, I love LinkedIn. LinkedIn's like the
Facebook of corporations. It's like, I will accept, by the way,
I will accept every LinkedIn invite that I've gotten. I've accepted all of them.
I've enjoyed my, my connections. So if you want to send me a LinkedIn invite, feel free.
Uh, I'll take it. Um, and so right here at LinkedIn you see on the
related companies, you see there's 1,600 targets, I'm sorry, employees.
Uh, on LinkedIn, uh, that I can go after.
Uh, which is awesome. And then you look over here, this is their
Twitter profile. That's sad. It's like, uh, cause everybody knows I love to tweet.
They're following four people. They have 309 followers.
They've got one like, and they haven't
tweeted yet. What the, how do you get
309 followers without even tweeting? It's like, I don't know how that happens.
But, uh, but they, they manage that. Um,
here's their social profile, Facebook, cause, you know,
I usually like to go after Facebook to go after employees. Uh, I, mostly
every attack I've done, uh, successfully through a company has gone
through their Facebook profile or their Twitter profile. But remember,
I'm F Society. Okay? I'm going after the man.
I ain't going after the employee. Okay? So here's the about
page. This is where I usually go and pick my targets. So I'm looking at this
long list of, you know, diversity here, and uh, I'm trying to figure out which person
uh, I'm trying to attack. Right? And
uh, I come across this one guy
it's like, that's straight out of Mr. Robot, right?
Timmer F. Galen. If that's not a made up name
then it's like, that's an alias. He's like, he did something shady in his youth right now. You can tell
that's a really poorly done alias. Sorry Timmer, or Tommer, or whatever it is. Uh,
he's the executive vice president. He's gonna be my patsy. He's the guy I'm gonna act
like I'm, I'm gonna assume his identity. And it's like, and how do you assume identity? You gotta find
information about him. So, here's already some right now. Uh, he's been around.
He was at Goldman Sachs. So, he's part of the man still. You know, part of
the 1% there. Uh, these are some of the things that he's done. Some of the places he's been. That's
good information. Uh, I do a little bit more Googling on him. Uh,
get a little bit more information. Um, I get to his LinkedIn profile.
Sad.
Alias, right? That does not look like a legit profile of some kind of executive
person in a company. It's like, he like, he created it and then like stopped halfway
when he realized how horrible LinkedIn is.
It's like, it's like I'm, I'm just done. Um, but that, I didn't
stop there, right? So, I, I need, I don't need to find that much information out about him, you know,
cause I'm just trying to assume his identity. It's not like I need to really find out where he lives,
his home phone number, uh, his address, and where he was born. Uh,
but I did. Um, so, that's
cool. It's like, cause he, and you know what? Maybe we wanna like
send him off onto the Hamptons and take over his apartment. It's like, uh, and that's
cool cause we can Google Map it. Uh, and we know where it's at. And
we can do something like that. So, now we've got a pretty good amount of information
on Mr. Timmer, right? Um, what do we need to do now?
We need to find out the victim. The person we're going to attack and compromise.
So we can take over everything, right? Let's go back to this wonderful list here.
Um, I literally, let's, let's just look down the list and I see that
poor guy at the very bottom just like a, what about me?
It's George Perez.
So let's go after George Perez. He seems like real,
I don't know what movie he was in, but it was a bad one, right?
It's like, he's a C. That guy's got like a,
like a Persian cat somewhere in a big armchair that he's done, he's done
horrible things in his life is all I'm saying. Sorry. Uh,
here's some more information about him. He's a vibrant urban sinner. He's reflected,
he's really a nice guy. He helps with the art and he's like, it's not going to stop me
from attacking him, but I just want to note that he seems like a really nice guy, uh, even
though he does wear those shorts in public. Um, so, uh,
this gives me some more information about his art. It gives me some more information about where he lives.
All information that I can use to make the spear phishing email real.
I want as much information that I can make the spear phishing email
real. How do I send the email though? I gotta figure out what their email addresses
are, and that's hard. Um, no it's not, sorry. Um,
I go to email-format.com. I type in the domain
name, and then they give you a nice little list of first name, last
name, how the, uh, their emails are sent out. And
this one was actually sort of funny. Because when I did this one,
it came up with another, uh, it comes up with another tab.
And this tab actually shows you where those email addresses have been used.
And when it did, I saw that one that was highlighted right
there. It was really weird. It was, uh, unionsquare
leasing at related.com. And it went to this website
and it said guest, and it had a number.
And usually I don't do this, but all about hacking is usually just going on your instincts
and just going, well what if I do this? So I went there.
That doesn't look good. Does that look good to anybody? I mean,
I got into social engineering so I wouldn't have to be technical, but, you know, even from my perspective,
that don't look good. So I went through that, that code a little
bit. It's like, I tried to act like I did, you know, like CSI, but not typing on two
keyboards. Um, and I went to the main website
and I'm thinking, yeah, that's not good for them. So they may want to fix that, FYI.
Uh, I don't give, uh, warnings. I just let you see it and see. Um,
so hopefully they'll fix that eventually when they get to this, or start the, uh,
restraining order. Um, so now the next step is very important.
Uh, this is the part where I do have to do an extra kitten warning, okay?
Because if I send you an email about
something good, something nice, like you won money,
what are you going to do? What the ever. That's
fake. No one sends me anything free. Ever.
So, that doesn't usually work. So
what happens if you send them something bad? Something that's
horrible that's happened. After the Boston bombing,
within a day or so, I got an email. It said, Boston
News. It literally had an IP
address on it, slash Boston. That was it!
Your daughter
was running in the Boston Marathon that day.
You had relatives that live in Boston. You didn't
know what was going on. CNN was giving you news about what was happening.
Did you click that link? When
tragedy strikes, we want to know more information. During
different, uh, times in this, in this talk, in different places, I've
used the murder of two girls. I've used a terrorist attack
in Paris. I've used, uh, political unrest in South
Africa to create my emails. Remember the kittens?
But I'm an evil mother, because I'm trying to steal from you.
What part do we forget about that? Have you
ever been robbed by someone going, I'm sorry about having to do
this, dude. It's like, uh, I know this is a little overkill. I mean, no pun intended, but I need all
your money in your wallet. Okay? I mean, I'm, this shouldn't even have to
be necessary, but I will kill you if you don't give me your money, okay? Please, I'm sorry.
It has to be like, but I need your money. You don't get mugged like that
unless you're in Canada, right?
It's like, seriously. I am trying to steal from you.
I broke into a building in a wheelchair before. I am a horrible
person. I'm trying to rob you.
So of course I'm going to use deaths of people. I'm going to use tragic
events. You know why? It increases my odds of you clicking the link.
And that's what I want. So what do I need
to do now? I need to Google up some tragedy.
Problems in Miami, quote,
related group, which is our company. So, I mean, you know how hard
it is to Google freaking related anything? It's like,
this was like the worst assignment I gave myself ever, okay?
Usually this thing takes under an hour to get ready and done. It took me
forever. I mean, like at least two hours. And I was not even playing Overwatch
at the time. It was like horrible. Okay? But I did find some dirt.
This was at the beginning of July
of this year. Did Miami's biggest developer avoid labor taxes?
The feds are investigating. Go on. Right?
It's like, this is by Nicholas Nihamas.
And it talks about the, at the very bottom,
yeah, that
building complex. So, I got it.
Let's send an email. Please note, it's in red, I used
a common on a dot, dear feds, fu, I didn't do anything bad.
This did not actually go out. This is a demo for hypothetical demo purposes.
So it went to george.perez from
timber.galem. Notice I'm using cccbcz because I didn't send it out.
Subject line is, this is very concerning, we need a response immediately.
Three exclamation points. You know why?
One exclamation point, I'm sort of excited.
Two exclamation points, I'm shouting. Three,
serious business. Okay? That means you gotta pay attention
to this one mother, something's going down. Right? So,
greetings George. I've just been contacted by Nicholas Nihamas who says
he's been reporting on our issues with that place. He just published
a more disturbing article, which if the accusations
regarding you bear out, will be leaving us with some tough decisions.
I've already made inquiries to some old colleagues from Goldman Sachs in Moscow to find
out what they can. We need to get ahead of this situation before it sinks our whole
enterprise. Take care, Timur F. Galem, sent from a mobile device.
Did I tell him to click that link?
Did I tell him he really needed to click that link?
Did that SOB click that link?
Probably. We're gonna go out on a limb for the demo person. I probably
think he would have clicked that link because he's like, because you want to know what's going on.
I'm not telling you to do something, I'm telling you about something horrible
that's happening and I'm giving you a way to find out more.
And that's all that's necessary. So, I also have a
confession to make. It's like, you know, just a little bit of one.
I lied. I'm sorry, my friends, but
my confession is I couldn't trust you. So, there was a
little bit more to this than I was letting you on to because
I'm trying to disrupt the government. I'm trying not to just take out
like the related dot com. So, what else did I decide to do?
This wasn't random.
All my other talks were pretty random and arbitrary.
But there was for a particular reason why I picked
George here. Just a small one.
I like that. George is bestie pals with somebody
that I may actually do want to attack.
So, what do I need to do? I needed to compromise George first.
Now I've compromised George
and now I can send emails out as George.
Who am I going to be sending out an email to?
Right. But how?
You know, someone, exactly, through Twitter.
Well played, sir.
It's like, so how do I contact him? I don't have this, you know,
how do you get the President's personal information?
Maybe Paceman. Please note to the
Feds, okay, I did obscure
information that was necessary to obscure because I heard
that he'd be pissed on, I'd be pissed off if I
let this out, information. Secret Service did tell me, he said, if you release
that, you're in trouble. And so I wouldn't do that.
So, this is his official, there's his birth date,
his social security number, all of Trump's personal email addresses that he
uses, also all his family members' personal email addresses,
all his Twitters, his YouTubes, all that on Paceman.
So, yeah, that happened.
But now that I've got a way to email him on his
personal email address, look at all those cameras coming up.
And I'm a horrible person because I should be clicking to the next slide, but
I'm waiting.
Are we good?
Hold on, I got it.
Okay. Had to be taking pictures of probably Secret Service to screw me
later, but, you know, whatever. So now I need to find a way to get him
and create the target, right? The email. I've got to create an email
that'll make him click the link. So I just Googled,
Reporter Trump Hates the Most.
That sounds like it's gonna work, right? So I found this
guy, Wayne Barrett, who authored a book that painted Trump's financial
history as at the least shady. Really?
That's my shocked face, by the way. Okay.
Clutching the pearls and everything. So now I've got everything I need to
know to create an email. And yes, there is a little thing because I really didn't change
the first one very much. Here it is to
chaosrq at Yahoo, which is his.
George from george.perez. This looks
it's going to be a huge issue. No matter our differences, we need to get
ahead of this. Three exclamation points. Now two things.
It's like I needed to do misspellings because that way you'd understand it better.
And two, they've had a falling out.
It's like actually George and Donald have actually had a falling out,
so it's like I need to make sure that I understood that because I'm actually coming in like I'm
trying to be concerned. So greetings, Donald. I've just been contacted
by Wayne Barrett who says he's been writing a new book about you. He just published
a very disturbing excerpt for his new book, which
the accusations regarding you pair out will be leaving us with some tough decisions.
I've already made inquiries to some old colleagues from Goldman Sachs and Moscow, which he probably
knows too, to find out what they
can. We need to get ahead of this situation before it gets worse. I still consider
you a friend. I do not want you to see you being attacked this way.
Take care, George Perez sent from a mobile device.
No way he's clicking on that link, right?
It'd be even funnier if he did it from his Android phone that he's no longer using and had a stage fright exploit
on there. So I think that's essentially how you would describe the government.
It's like you're taking over the control of the person who's actually supposedly
leading him. I'm sorry not to get too political.
I promise you, if you look at my DEFCON 18 talk, I showed you
how to assassinate President Obama. So I'm an equal opportunity attacker.
And also another thing is
I sent from a mobile device. And the reason why I do that is
because why? Because when you see that, you make allowances.
I don't know how they say hello, greetings, salutations,
what's up, dude? You know, I don't know those. I don't know how they say
take care, see you later, hasta la vista. It's like I don't know.
But when you see sent from a mobile device, the person goes, okay, well they were just in a hurry
and they're just typing it out. And so that's the reason why all my emails,
no matter what client I'm using, always say it came from a mobile device, because I don't care about
spelling. So I think we can all agree,
job done, right? Okay. Now guess what?
This is my dessert and vegetables talk.
Because I just gave you the dessert. I hope we all had a good laugh. We all
realized, more importantly, how simple and easy it is
to craft an attack. How an attacker will look at your system
and use your social media, use the information that you're
willing to give out against you, right? Can we all agree
that that was a good way to explain that and show an example?
So let's actually see what we can do now.
Give up?
Maybe.
How many people have been to a talk here where someone has gone and said,
I broke this and I dropped the O-Day and it's broken and I just trashed it.
The whole GUI needs to be written. The company didn't know what to do. They're not responding properly.
It's horribly trashed. Okay, I'm done. See you later.
And you're like,
how do you fix that? Well, I don't know. I just showed you how to break it.
Those suck.
If you're going to show me how something is broken, you better have some
ways to show me how I can fix it or you're wasting my time.
Period. So that's the way I look at this situation. So let's
start doing some defensive stuff now. Because this is what the whole thing is all about.
This next thing, this is a defensive talk. Surprise.
One of the things you can do for your company, if you don't know
how to do OSINT, if your employees don't know how to do OSINT,
there are assets and ways for them to learn and to get resources for that
that you don't have to work on. OSINTframework.com
will be one of those resources. It's a drop-down list
for your employees to go through to start looking at your site,
your company, as an attacker would. Because you have
to look at your company like an attacker would because attackers are
looking at your company. Here's another thing.
I'd like to thank April for pointing this one out to me. Mike Basil actually
has a distro that you can boot up on
for nothing but OSINT and social engineering purposes. It's like the
Kali Linux for OSINT. It's like a
Uber for hacking. But still, that's a great resource
right there to give you all the tools pre-configured,
pre-scripted out to help you do OSINT. To start looking
at your employees' profiles that may be damaging to your company.
That may be used against you. Also,
we've learned how awesome Pastebin is, right? We already know that.
Do searches on Pastebin.
Pastebin has an alert feature. Your company's
username, hackered, hacksword, carded,
bin number list. It has the way to send you an alert
when you put in the keywords to let you know, hey,
you just showed up on Pastebin. And just heads up, there's
hardly ever any reason you show up on Pastebin that's good.
I have never heard of one yet.
I'm like, oh look, I've been on Pastebin.
Yeah, awesome. Another thing that you could do
is see what your devices are doing out on the internet.
That's Shodan.
Look at this. Just like in a zombie movie, that many red dots is not
going to end well for you, right? That's never a good thing.
It's like all those are exposed and possibly
compromisable machines and servers.
And you know, a normal person would just leave it at that
and just let you know to worry about it. But no, I'd like to go further. Let's look at one of them.
This guy right here, 154.16.5.170.
That's a lot of ports to be opened to see. It's like,
I mean, a lot, right? So let's go and look at them.
Here they are. They're net stack limited.
And they're going to be even more limited after this is over.
There's the ports. They've got OpenSSH running.
That's nice. And look at the versions. That's what I like
looking at. The versions of all these different servers.
It's makingmoneycoach.com is their post-fix SMTPD server.
Awesome. They won't be making much money after this, right?
Not my fault. It's already out there. I go a little bit further.
I see the Apache. They're running an Apache server 2.4.25.
Yeah, that's concerning.
But we'll get to that a little bit later. What's on that Apache server?
Oh, that is. Who wants to guess
the user ID and password is admin admin?
I would not know. I'm not a bad person. I didn't actually
check. I'm just saying, it probably is.
But I was more concerned about the version.
Because you can just Google the Apache 2.4.25
and see vulnerabilities and see what comes up. And stuff like this
comes up. They may be having some issues.
If not now, in the near future, like by Monday.
And you have to ask yourself, okay, well, Jason, who's really
going through Shodan and trying to find vulnerabilities on servers
and companies? Why would someone do that? That's just mean. This mother does it every day.
Right?
I mean, he's doing this.
Why? Because he can.
Look at the things that he's found.
Before WannaCry came out, before WannaCry hit,
1.17 million hosts scanned.
33,468 found infected.
I mean, that's what he wants to do on a Friday night?
I'm not going to judge. It's cool. We all have hobbies.
That's already out there. People are attacking.
When you're physically at your house,
you forgot to go to the store real quick and pick something up. You feel safe.
Let me leave the door open or unlocked and just run out there. My neighbors will
watch me. When you connect a computer onto
the internet, your neighbors are now China,
Russia, Paraguay, Texas,
New York. It's everywhere. Especially Paraguay. You've got to watch out
for the Paraguayans. Any Paraguayans in here? I just like saying Paraguayans.
You've got to watch out for that because those are your neighbors and they are
constantly scanning. They are looking not for you.
They're not looking for you. They're looking for an IP
address that shows vulnerable. That shows that it's available to be attacked.
That's all they care about. Not nationality. Not political
correctness. Just you're vulnerable. I attack you.
If your teams are small and limited,
start using blue teams and boxes. You've got Tenable. You've got
Rapid7 does some good stuff. Pony Express does some good stuff.
Vthread is really cool because it actually does virtual threat
intel for your corporation's internal network. It actually shows you what an exfiltration
attack looks like.
I'm not here to hype products. I'm just here to tell you that those are some cool things that you can do.
Literally, the biggest tool in my toolbox
that I use more than any other tool ever
is this.
Or Bing if you want to get adventurous.
Like I said, I attack everybody equally.
What else can we do? What are some of the key things that we can do?
Here's some things that I learned from Ubix that I want to share.
This is one of my favorites. Wpad.
If you've got Wpad on your network, you're going to have a bad day.
Microsoft is anything but helpful.
Everything and helpful, right? That's what I was trying to say. Of course, Microsoft. Love you guys.
What do they do? They made it where
if there was a host name on the internal network or the corporate network
and the host name was Wpad, well that means
all your workstation traffic should go through it.
Guess what every attacker in the world's
computer name is? Yes. W.
Well, after they changed it from Kali Linux, they changed it to Wpad.
Right? So here's what you need to do.
Make a null route to 127.0.0.1 and the DNS
entry for Wpad. So that way just no routes. It doesn't go anywhere.
Keep Wpad from communicating. And if you possibly can, just
disable NetBIOS. I mean, unless you're running Windows XP.
Don't even raise your hand. Don't make me sad and cry.
That's bad and you should feel bad. So you're probably not running Windows XP
so maybe not so much with that. Another thing to use
and I love this one. I love this one the most.
But please understand my qualifier. If you don't do
step four, you're screwed. Not my fault. Step one.
Create a user called domainadmin underscore temp.
I mean literally create that in your domain, your main domain controller.
Put a password in the description. Say
password is, let me think, I want to be secure. Password
two. Okay. Delete account by
July 2016.
Make it realistic, right? And then you
add it to the domain admins group. You literally
make it a domain admin account. And you're saying, Jason, are you effing insane?
Yes, but that's not the point. Okay. Step four.
Under the login hours, you set to zero.
What that means is they can never log in.
The password is correct. It doesn't send an error that the password's wrong.
It just doesn't log in.
So you set up an email alert in the sim
in the event viewer that someone used that account. You now
have a zero false positive that
someone is attacking your network and has compromised your domain controller.
Zero false positives. Zero dollars. Very little evidence.
You detected a breach. No blinky boxes required.
That's something you should be using on Monday.
So what else do we do?
Credit where credit is due. That's all Rob Fuller.
Twitter is Mubix. Cool guy. Another thing that I see
way too often that really makes me sad, and I'm going to wait because everybody's taking
pictures of Mubix's info. Okay, there we go.
There we go.
Unsegmented networks. What's up with that?
Why are we keeping our networks
all nice and open on the inside? I literally had to
stop an engagement on the first day, tell the
client that I was not charging them, that they had to use the money
to actually put someone in how to create a network.
It was a flat network. And brother, when I say flat, I mean
the web servers were on the same 10.xxx
network
as the accountants, HR, web developers,
CEOs. Email server on the same network.
The kicker, the guest wireless
access point that was unencrypted had the name of the company's name
in guest. Where was it? On the same 10.xxx
network. I literally was like, how can you try
to pay me to pen test a network when you're just, it's open.
It's like you're asking me
to break into a house and you forgot to put walls up.
I don't know how to do this. You win.
I don't know. I literally have no idea.
If you're trying to confuse the attacker, you worked.
Segment your networks. Is there any
reason why HR needs to talk over the network to the web developers?
No.
Is there any reason why the accountants need to talk over the network to the web developers?
No. Is there any reason why the CEOs need to talk over the network to the web
developers? Does anybody need to talk to the web developers is what I'm trying to say.
It's like, no. It's like segment those networks.
Make it like a submarine. It's like if one part goes down,
it's like if a submarine gets hit and it doesn't destroy it, what happens?
One part is breached. But the rest is safe. That sucks for Bob in engineering,
but still, the rest of the sub is okay.
So you want to do that. You want to segment. Now here's a list of
tips and tricks that I want you to start using. The very first one is patch.
Aren't we tired of hearing that?
You know what's even more tiring? Having to keep saying it.
That's pretty tiring.
Remember WannaCry happened two months after the patch came out.
And you're thinking, well, that's horrible. They should have known better.
Listen here. DEF CON 2002.
The vulnerability for SQL Slammer came out.
September of 2002,
Microsoft came with the patch.
February 2003, SQL Slammer hit.
That's not the sad part, by the way.
I'm getting to it.
The firewall logs when you get back. Guess what you're going to see?
Traffic for SQL Slammer.
I don't want to go through the line, but you understand that's an unpatched system
that's running SQL that's unpatched on the internet
that's infected, still going on. If that doesn't make you want to drink, I don't know what does
and I don't drink. Okay? And so it's things like this
that make an impact. But it's also a false impact.
Because when something like this hits, people take notice.
When it gets this bad, like on the second day, they really take notice.
So there are probably more people patched for MS01117
than MS0867.
Because MS0867, if you do
pen testing, is the golden ticket, right? And everybody thought MS01117
was going to be, yay, it's the new one! But now, because of WannaCry,
it's like, no, they're all patched for that. They're like, oh no, we've got to get that patched.
But what about those ones from 2008? Oh no, we can leave those. It's like, who uses that, right?
It's like, let's make sure we've got that one patch on.
It's like, that's how they think. You have to make sure your policies dictate
patching every month. And not just
the OS, but all the applications that are out there.
Make sure you're patching your Adobe and your Java.
And your Adobe and Java. The Java and the Adobe.
Like, every week I'm maybe on those. But still, make sure you have a patching
policy for them. Another thing to do is a 1x1
pixel GIF. And I literally Googled, trust me, you can see that
I Googled 1.1 pixel GIF, and there's actually one there.
Put it on your website. Put a link to it to a page
that does nothing but record the IP address, the operating
system, and user agent string of that.
Of whoever clicked it. Because how many people do you know
that are on a website going, I wonder if there's a secret pixel. I wonder if there's a secret pixel.
I wonder if there's a secret pixel. Okay, I did that once, but I was bored and it was like 3 in the morning. Okay, don't judge me.
Okay? But what does click on those links?
Bots. Phishing people scraping the whole website
for a phishing attack. Nikto. OpenVAS.
And trust me, if you run a
bank site and Nikto's perusing your website, they're not looking for their
mortgage loan. Okay? Nikto's never there to check
to see if they qualify. It's just not going to happen.
So make sure you're alerting for those. And better yet,
just not alerting to the fact that those user agents are going onto
your website and people are scanning it. But then start blocking them.
Your user agent strings, you have a list
of bad user agent strings that you can tell your web server to
refuse. It's like, you know, no Nikto.
No OpenVAS. No Internet Explorer. It's like,
no, I'm sorry, sorry, sorry. That was my web server, sorry.
It's like, you can just say no to these user agent strings.
And shut them down. They don't eliminate your risk.
But it helps to narrow it. I'm not trying to tell you how to solve everything.
I'm trying to help you be a little bit better secured.
Another thing is, start blocking countries.
Anybody here do business in Paraguay?
You're shady. No, I'm sorry. It's like, but if you don't
do business in Paraguay, why is Paraguay allowed to see you on the Internet?
If you don't do business in Canada, because, you know, Canadians,
it's like, you should be blocking Canada from seeing your website.
Your whole entire network should be blocked at the firewall.
The ASN number should be blocked. If you don't do business in those countries.
It's like limiting the attack vector. Also limit spam.
You tell that to your executives, and they'll sign off on it immediately.
It'll help lower our spam. Oh, yeah, let's get that going. Let's get that done.
So, you want to do that. Speaking of spam, it's like,
in spear phishing and emails, do you own all the
different domains and variations
that could be used against you?
This is one of the saddest slides I've ever created.
This was a talk I did in 2012. And the reason why it was so sad
is, as you can tell, PearsonFoundation.org and
PearsonEd.com, one with a zero and the other one with a one,
were available. Seriously.
They're not available anymore. That was a popular talk.
It's like, I don't know who owns it. Hopefully Pearson does, but I doubt it.
They were available at the time that I gave the talk.
That's sad. You should own the variations of your website.
It's not going to solve your phishing problems.
But once again, it helps lower the risk. It helps to mitigate it.
Another thing is, sad but true, sometimes your employees need to click on a link.
They need to click and download an attachment.
First of all, you teach them how to be suspicious of those
with someone sending them if you weren't expecting it. But the next thing you can do is tell them
to go to places like Virustotal.com, tell them to upload the URL
or the package. If the attachment only has non-private,
non-secret confidential information,
tell them to upload the attachment. Because let's face it, this site's owned by Google.
They probably already have it, right? So it's not like you're divulging secrets.
It's something they already got. So tell them to do that. Scan it
to see if it's actually a virus, to see if it's actually something there.
Yeah, it's sort of five minutes, but maybe more.
Now, one of the next ones is web developers should be building
good code, which makes it more secure.
SQL injection is not a security vulnerability, it's crappy coding.
So, last but not least,
to the last but not least part,
create teachable moments for your employees.
Your employees don't always, I mean this is going to be a shock to you,
but maybe, just maybe, your employees don't learn the best lessons
by taking that 20 question quiz, multiple choice,
that they can go back and change the answer if they got it wrong on their internet
every quarter or year, right? Maybe not.
So create teachable moments for them.
Go and have your security team go around every building,
every site that you own, and look under the keywords for passwords.
Sad part is they'll probably find some. But more importantly, the employees will know
that you're looking for those things. That you have a security team that actually exists
and actually in the real world that could do something like that.
It's like that creates a teachable moment. I gave a talk a couple years ago where I went to
all these different security conferences,
and I got results from those conferences on a Wi-Fi pineapple showing people,
oh look, y'all connected on those. That's sad. It was very sad.
It was even sadder, I went to RSA, they invited me to speak, never since.
But within 7 minutes, 42 people
connected to my Wi-Fi pineapple. RSA.
A security event. Full of security people.
I heard a lot of the SSPs go there.
It's like 7 minutes, 42. I mean, I could have gotten more, but come on.
The lucky number 7 and the answer for the life, the universe, and everything. I had to stop there.
But you're thinking, Jason, that's an old example.
What's a teachable moment for us now?
How many people have gone to this website? Raise your hand.
The answer is none. None of you have gone to this website.
All you guys went to this website.
See? You thought you were going
here, you went there. To make it a little bit more
clear, I've put a different graphic on the website now
that I showed you the first time. It's this one.
Social-engineering.org
.cgi-bin.email
.confirmation .index.php.
If you actually go there right now, you will see that llama judging you harshly.
As well it should.
I own cgi-bin.email.
So that means I can make everything my subdomain.
Humans, when they're looking at the web,
even if it's Eastern culture or Western culture, no matter which way they write,
on a website, they read left to right. Computers always read
right to left on a web address bar. So they don't care what my
subdomains are. But humans look at the email,
they look at the URL, they go social-engineering.org.
That seems legit. I've seen cgi-bin before. Email, this is an email
that they sent me. I'm getting a confirmation. Yeah, I should click on this.
Oops. So there you go.
Now I want to leave it with one last important thing.
There are good employees.
This is an example of an actually pretty good response
from Mandalay Bay for Black Hat coming in
the first part of the week. They used that conference
as a teachable moment for their employees. Not by going and saying,
oh, close down, we don't accept USB drives now because
only email attachments because we're going to get pwned because the hacker's in town.
UPS.
No, they didn't do that. Okay? What they did was say,
hey, this is a good time to be security weak. Learn here's
a good security tip on email phishing. It actually tried to teach
them a lesson using this as a way for a teachable moment
by having the conference there. That's a proper way to do it.
And once again, that's a positive thing to do.
Are you doing positive messages to your company, to your executives
when they do something right? When they actually get security
right? Do you create a positive teachable moment?
Or is it always negative, something that someone's failed at?
Results may vary. So I'm going to leave it there.
But I've got 14 seconds, so screw the questions. Sorry, we're just going to go with
several minutes of uncomfortable silence. And I'm going to drink here.
No, I'm serious. It's done.
Thank you.
.
.
.
.
.
.
.
.