start	end	text
18650	24970	Hello everyone, AfterPacket here. We have another great speaker for you today.
25130	32430	We have Alan with FireNameVirus with a spreadsheet and we're very excited to
32430	37030	have him. And with that, I will let Alan take it away. Thank you.
39780	46020	Yeah, I'm Alan Baranov. I'm from Melbourne, Australia. Today I'll be taking you through
46360	53120	a real life story that happened to me. Mostly real life. Names and places have been changed
53120	60380	to protect the innocent. What we'll do is we'll start at the successful end and we'll rewind
61020	67440	a couple of months back to see exactly what steps were taken by me and my team to ensure
67440	74100	that everything worked out okay. Yeah, whole thing will be done in Excel because that's
74100	83300	what we're on about. A bit about me. So I started off as a technical person about 20 years ago.
83420	92220	Worked my way through firewalls and other kind of technical security controls and am now a GIC
92220	97840	consultant. So yeah, that's where I am and who knows where the future will be. If you want to
97840	107420	reach out to me, I'm A. Baranov or Alan Baranov on most social media. And yeah, let's take it away.
108140	114480	All right. So on this slide, one of my friends who works in a Blue Team environment said
114480	118480	I must definitely put a warning here because some of the stuff that we were about to talk about
118480	127020	can be quite scary for Blue Teamers. So yeah, Tuesday, the 27th of June, 2017.
129580	137660	I arrive into work and yeah, my boss Trevor was waiting for me. He was sipping on a milkshake,
137660	142820	which was a bad sign for me because when he does that, that means it's going to be an interesting
142820	151480	day. And he said that he just wanted to get in before the big people came to speak to me. So
151480	156280	essentially the CIO and what they called the security board came in and said that they wanted
156280	162260	to speak to me. I'm like, okay, I'm not sure what's going on, but okay. They took me into a
162260	168900	meeting and they told me that there was something called MS17-010 and that it had been used. We
168900	174980	didn't know what it was called just yet, but now it's got a name called NotPetya. It had taken
174980	180200	down many of the Australian businesses and businesses around the world like Maersk and Merck
180200	185800	and they were worried about our infrastructure. And they were worried that we were going to be
185800	192880	brought down. And so could I actually get involved and help them out with that? So, yeah,
192880	204340	that's all good. And so what actually happened in that was I went back to them and I said,
204340	210140	listen, we've got no problems because we're fully patched. And they were like, they didn't believe
210140	214960	me. And I said, okay, that's fine. No problem. I've got all the information in spreadsheets. I
214960	221600	can show you how we've tracked the patching that we've done over time. And they were a bit
221600	225040	impressed, but they're also a bit disappointed because I think they actually wanted to put up
225160	232780	a bit of a fight against this piece of malware. But anyway, we were successful. And so now I want
232780	238240	to take you back through a bit of the history before this as to how we got to this point,
238240	243560	and I could actually say, yep, all good. That virus is not going to come anywhere close to us.
244140	252140	All right. So, yeah, while I was working there, my manager, he came out with this idea that he
252140	260460	wanted big monitors and he wanted us to look like NASA. And, well, yes, we had Pew Pew maps and all
260460	267780	of that on there, but he also wanted to put some other information up there. And so, yeah, he got
267780	274380	me to do that. And I actually coined the phrase security through big monitors. And I Googled this
274380	281960	and there were no search results that came out for that. So, basically, I think I invented the term.
281960	288480	So, if anyone wants to use it, you're welcome. You just need to pay me royalties. So, the first
288480	293240	thing I decided that we'll do is put up some traffic lights. Because any time you have a
293240	300240	manager and they want information, traffic light, all the things, of course. Because bosses like to
300240	309040	be given pretty pictures to look at. So, what we did, yep, we came out and did a graph where we
309040	314640	took all the patches, all the servers, sorry, all the patches, divided them by all the servers and,
314640	321460	of course, got a lovely diagram. Some months we had more than 90% of patches applied. Some months
321460	331620	we had less than that. And so, we tracked against the stats there. And, of course, because we're
331620	336700	using traffic lights, you always want to make sure that you're in the yellow. Just basically because
336700	340260	if you're in the red, that means you're not doing your job. And if you're in the green, it means
340260	349020	that you've got way too much budget. So, that's... you've got to keep it in the yellow. Which is a
349020	353840	what you're looking at now. If Microsoft release a lot of patches, you'll probably go into the
353840	358120	yellow. If they don't release a lot of patches, you'll go into the green. If they release a lot,
358260	363760	a lot of patches, then you might hit the red. So, you're tracking Microsoft and that doesn't really
363760	369140	help you. It doesn't give you any direction of where to go. But some of the stuff that we were
369140	374960	looking at at this time to try and improve the whole process is, is it really the total number
374960	380240	of patches? Did we get them all right? Is it improved patches? Are there other servers that
380240	388620	we could be looking at, et cetera? So, that was that. And then the other thing that... so, then
388620	392600	what I did was I thought, okay, well, let's enhance it. Let's see if we can actually dig
392600	398900	into the information a bit deeper. So, you'll see I've taken this kind of list of computers,
398900	406040	total patches, installed patches. All in all, we came out 93.6%. Which is good. Which is great.
406040	409700	Which gets us in the green. But if you have a look at the actual computers themselves,
410840	415660	you'll see that there's some issues here. So, some of them are below what we're supposed to be
415660	424460	having. Some of them are good. Most of them are good. But this one you'll see even is 76.5%. That
424460	430760	may or never have received any patches in the lifetime of that server at all.
433700	439820	So, it's good to do that. Because, of course, it gives us direction. Let me just go back to that
439820	445060	one. So, it gives us direction as to where to go. So, we can see... oh, hang on. Most of these are
445060	450620	okay. We can just leave them. They seem to be updating. Everything's fine. The two that aren't,
450620	456540	we can fix that out. That might be just one month that just didn't quite work out properly. Maybe
456540	463060	they just need to be rebooted. Who knows? So, you can sort those. And then the one that is getting
463060	469180	no patches at all, that's the one where you're gonna want to concentrate and get everything
469180	477700	sorted out. Yeah. So, I mean, I can talk about an hour on each one of these kind of slides.
478560	485140	But unfortunately, I can't. But if anyone wants to catch me on the Discord, yeah, I'm available
485140	490940	there. Or if you want to drop me a tweet, whatever, we can talk further. But essentially, the reason
490940	496240	why I put this in here is, you know, once you've sorted out stuff, if you see that stuff is
496240	503720	recurring, then you can do... you can check against it and see why it's happening and just keep on
503720	508480	working through it. And over time, what you'll find is that you're actually improving. And that's
508580	512520	a good thing. So, you're no longer tracking whether Microsoft has released too many patches
512520	517700	for you to patch or not. What you're actually tracking now is how well are you doing and how
517700	530800	well are you getting patched? Okay. So, what I just wanted to point out at this point is that
531780	539940	a many-many-two relationship is actually a very difficult thing to get right. And we have
539940	544280	one in this particular case. So, what we're looking at here is we have multiple servers,
544280	549980	we have multiple patches. And if you have a case like that, then you need to start working out
549980	556860	because it's too much information to try and work with all at once. So, you kind of summarize
556860	561900	it down to, okay, how many servers do we have? Okay. These are the servers. Okay. And then,
561900	567540	what patches are there? But you can get more interesting information once you start looking
567540	573680	at the patches. So, you can have a look at whether they're a high, medium, or low-risk patch. And
573680	577660	maybe you have different rules for each of those. So, now you're starting to get into
578660	585280	understanding the information at an even higher level. And also, you can start looking at the
585280	591840	actual ages of the patches. So, what you might do is you might say, okay, well, we haven't actually
593080	597180	patched these patches here, but we're not expecting to because they only came out this month and we
597180	601600	just haven't had time to test them. We haven't had time to apply them. And they're not critical
601600	607060	that we need to do it immediately. So, that's okay that they haven't been patched. All good.
608180	614220	You might have some that are one month out. And that's a problem because they haven't gone through.
614220	617660	But at least you know that. And the next time you patch, okay, well, then that's fine. We'll
617660	624240	patch them that time. You might then have a process... you might have it where the process has failed
625000	630280	twice. And now you're going to have a bit of a problem. Why is your process not working? That's
630380	635520	a bit of an issue. And then, of course, if it fails three times, then hang on a sec. Okay, now we have
635660	639400	a huge issue. Because we've looked at it three times and we still haven't been able to work it
639400	644900	out. Hopefully something is being worked out to get that sorted eventually.
647360	653060	And now that you have that information, you have meaningful information that you can graph.
653080	658160	And you can go back to doing the red, the yellow, and the green like a Ghana flag.
658500	662440	And it actually means something. Because what you can say is, like, hang on a sec,
662440	667300	where you see red is where our processes are failing. And we can actually start to work on
667300	677110	that. And you can bring that down over time. All right. But wait.
679090	683070	What about MS17010 from the beginning of our discussion?
685870	692010	So what we were doing before this point was we were actually trying to patch all the different
692010	696390	servers over time. We weren't looking at the patches, really. We were just looking at the
696390	704490	servers and trying to patch server by server. And now, all of a sudden, you have this really bad
706630	716050	vulnerability. It can be remotely attacked. And, yeah, it's just a very, very bad
716790	722690	vulnerability. It came out bad. And then, of course, one of the things that Joshua
722690	731370	Coleman came out with is something called H.D. Moore's Law, which is... it's basically a pun on
731370	740630	Moore's Law. And essentially, what it is, is as virus... well, as vulnerabilities get easier and
740630	746850	easier to exploit, they become more and more dangerous. And so what happened with this one
746850	754130	is it slowly... I noticed that exploits were being built, theoretical exploits and real
754130	760210	exploits and metasploits. And then I saw that and I thought, oh, okay, this thing is going to
760210	773220	become a worm in the not-too-distant future. So going back into this slide here, as I said,
773220	778000	many-to-many relationships are not good because they bring in complexity. But
779660	783460	sometimes they are good because now we can actually pivot and we can say, okay, well,
783460	788920	we were looking at servers and how many patches we had running on the different servers. Now,
788920	793180	we can actually go back and we can say, okay, well, now let's look at this one single patch
793180	805610	and how many servers have this patch installed on it. And so if we work out that information,
805610	812110	we can see, okay, well, these servers, A, B, C, D, E, G, A, N, H, have the patch installed.
812350	817610	And then these three computers have the patch missing. Now, remember, we're also using...
818530	822970	so the reason why we've got so many computers that actually have it patched is because we're
822970	828430	going through the computers and we will attack the critical patches while we're doing it. And
828430	833250	also at the same time, we were looking for computers that were missing. So we actually
833250	839030	managed to get all the computers and got them mostly patched. And then, hang on, these three,
839030	843470	for some reason, just don't have this one single patch. And it could be that they're
843470	848110	new computers. They just haven't had patches applied at all ever. And so therefore, boom,
848110	854350	we can just basically apply the patch. And so that's what we did. And that's why we were
854350	860530	successful. So essentially, we built the information over time and got to this point.
860530	867790	And then we managed to flip it and managed to change our processes.
868050	871550	So there's a couple of takeaways. Well, there's more than a couple of takeaways. There's a few
871550	877570	takeaways that I'd like to show you here. Number one, get information. There's always information
877570	883030	out there. The information I got directly from the Microsoft guys, they just basically pulled
883030	889410	it out and sent it my way. Raw information, stick it into Excel. And then number two,
889410	895370	play with it, manipulate it, move it around, experiment, keep changing it. It's low risk.
895370	901090	You have no issue with playing around with information. It's all in your spreadsheet.
901090	906030	It's all good. Number three, use it to improve things. Try and say, okay, well, hang on a sec,
906030	912770	our processes need to be improved or not. Do we know or don't we know? And then, of course,
913690	916770	get the information that will tell you exactly what you need to know,
916770	923390	whether your processes are working or not. Always ask why. Don't just fix stuff. Work out,
923390	927830	why was it broken in the first place? Because if it happens again, you'll know and you'll be able
927830	936710	to fix it up. Also, just note that you don't need expensive tools. We have Excel. And that's all I
936710	944970	used. So, basically, that was... I didn't have to go out and buy anything, any special tools or
944970	950390	anything. I had it already. All I needed was the information and some of my time to get it working.
951530	959510	WSSZ Excel was free. Yeah. Okay. Yeah. So, doing security right is hard. There's no easy wins.
959730	966270	So, it looks easy from what I've shown you here. But there was a lot of hard work behind the scenes.
966290	972510	Once I got the information in place, sitting with the IT team and getting them to patch and repatch
972510	979810	and get it right and research and find out what was going wrong, there was a lot of work. The
979810	989010	one thing that I could point out at this point now is that having that extra good information
989010	994970	that I could give to them made them more excited about the job that they were doing. It wasn't me
994970	998630	just coming as a security person and saying, listen, you need to patch your servers because
998630	1003250	patching servers is a good thing to do. It was me coming to them and saying, hey,
1003250	1009410	this computer, it doesn't seem to be working, doesn't seem to be getting its patches. Can you
1009410	1014630	work out why that is? And then they come back to me and say, listen, this is the story and we can
1014630	1020970	actually sort it out and fix it. So, that's what comes out of having the information. It makes life
1021090	1030250	a lot easier for you and for your IT team. And, yeah, as I said, work with your teams.
1032070	1037710	Yeah, you can say, okay, well, if you're asking why, can you help them? A lot of times they would
1037710	1042270	come back to me and say, listen, I have no idea why this isn't working. And we dig in the history
1042270	1047530	and we can see, okay, well, it patches sometimes, sometimes not. There must be something strange
1047530	1052310	with that box. Or it's never been patched before. And then you can work out stuff like maybe there's
1052410	1059250	a firewall in the way, et cetera, et cetera. Keep digging deeper. So, as I showed you,
1059250	1063230	the first things we were monitoring were just like the total number of patches across everything
1063230	1069270	and divided by the total number of computers. And it didn't really tell us very much. It didn't
1069270	1076270	give us a good, deep amount of information that we could work with. And usually that information's
1076270	1081490	there. You're just not looking at it. So, always keep getting more information. And don't be scared
1081490	1087090	to get information from two different places. Like, for instance, what I was saying earlier is
1087700	1094810	you want to... we had all the computers that we knew about. But when I found some other lists
1094810	1098650	of computers, those were different. And then the question is, well, why are they different?
1099170	1107050	And then that helps you to actually get a more... a bigger understanding of your total...
1107850	1113490	the total issue that you need to deal with. And number 10, don't be scared to change your
1113490	1119830	process. So, we had a good process. We were getting... we were making leeway against what
1119830	1125350	we had to do. So... sorry, making headway against what we were trying to do. So, we were getting
1125350	1129650	our servers patched. And we were getting more servers patched. And the lines were coming down
1129650	1134890	because less and less critical patches were missing. Less and less non-critical patches
1134890	1139330	were missing. But then when all of a sudden I saw that there was one patch that was really,
1139330	1142990	really important that we really needed to get out of the way,
1142990	1147750	changed everything. Okay. This is the one. This is what we need to sort out first. Everything else
1147750	1154650	needs to take... we'll get to that. We'll get to it eventually. But this is what we need to
1154650	1163010	get right now. And, yeah, next steps. So, if you're interested in this, the next step for you
1163010	1169510	would be get your information. Go find where you can get it from. Get CSVs. Get some JSON. Get text.
1170150	1176230	And convert it. Put it all into Excel. Start fiddling with it. Learn how to join the sources
1176230	1181790	together. Learn how to use pivot tables. Learn how to use graphs. And play. And play and play
1181790	1189650	until you get the information that you need. Just, yeah. You're a hacker. So, use your hacking
1189650	1199730	ability to work with Excel. And that's pretty much it. Just a shout out to my Baranoff clan
1200550	1210530	and to the DEF CON group of Melbourne. Hey, guys. Also to the Australian B-Sides team.
1210530	1218030	B-Sides Melbourne. And, yeah, to all of you that are there taking your time out to watch this
1218030	1223270	presentation, thank you very much for that. And thank you very much to the DEF CON team and to
1223270	1232710	the Blue Team Village for having me. It's a great honor to be able to speak in this forum. And,
1232710	1237050	yeah, if there's anyone that does have any questions, I'm not sure. There might be a bit
1237050	1245310	of time left. Alternatively, just find me in other DEF CON, the DEF CON Discord or alternatively
1245310	1249990	in the Blue Team Village Discord. And, yeah, I'll answer any questions that you have.
1250250	1256750	Thank you very much. Awesome. Thank you for the wonderful presentation, Alan. As always,
1256750	1264230	we suggest that you join the Blue Team Village Discord and direct your questions to
1265310	1272810	texttalktrack1. Okay, I will do for sure. The presenter will take a look and be able to answer
1272810	1280410	your questions. And other than that, I appreciate that and thank you again. Thank you.