WEBVTT 00:18.650 --> 00:22.490 Hello everyone, AfterPacket here. 00:22.490 --> 00:24.970 We have another great speaker for you today. 00:25.130 --> 00:32.970 We have Alan with FireNameVirus with a spreadsheet and we're very excited to have him. 00:32.970 --> 00:35.490 And with that, I will let Alan take it away. 00:35.530 --> 00:37.030 Thank you. 00:39.780 --> 00:42.100 Yeah, I'm Alan Baranov. 00:42.100 --> 00:43.860 I'm from Melbourne, Australia. 00:44.380 --> 00:49.100 Today I'll be taking you through a real life story that happened to me. 00:49.100 --> 00:50.480 Mostly real life. 00:50.900 --> 00:54.860 Names and places have been changed to protect the innocent. 00:56.040 --> 01:09.220 What we'll do is we'll start at the successful end and we'll rewind a couple of months back to see exactly what steps were taken by me and my team to ensure that everything worked out okay. 01:10.660 --> 01:15.580 Yeah, whole thing will be done in Excel because that's what we're on about. 01:16.600 --> 01:18.360 A bit about me. 01:18.500 --> 01:23.300 So I started off as a technical person about 20 years ago. 01:23.420 --> 01:33.420 Worked my way through firewalls and other kind of technical security controls and am now a GIC consultant. 01:34.200 --> 01:37.340 So yeah, that's where I am and who knows where the future will be. 01:37.340 --> 01:39.160 If you want to reach out to me, I'm A. 01:39.160 --> 01:43.860 Baranov or Alan Baranov on most social media. 01:44.740 --> 01:47.420 And yeah, let's take it away. 01:48.140 --> 01:49.000 All right. 01:49.000 --> 02:02.480 So on this slide, one of my friends who works in a Blue Team environment said I must definitely put a warning here because some of the stuff that we were about to talk about can be quite scary for Blue Teamers. 02:02.720 --> 02:07.020 So yeah, Tuesday, the 27th of June, 2017. 02:09.580 --> 02:16.200 I arrive into work and yeah, my boss Trevor was waiting for me. 02:16.200 --> 02:23.640 He was sipping on a milkshake, which was a bad sign for me because when he does that, that means it's going to be an interesting day. 02:24.460 --> 02:31.320 And he said that he just wanted to get in before the big people came to speak to me. 02:31.320 --> 02:37.100 So essentially the CIO and what they called the security board came in and said that they wanted to speak to me. 02:37.100 --> 02:40.560 I'm like, okay, I'm not sure what's going on, but okay. 02:41.120 --> 02:48.540 They took me into a meeting and they told me that there was something called MS17-010 and that it had been used. 02:48.540 --> 02:53.200 We didn't know what it was called just yet, but now it's got a name called NotPetya. 02:53.480 --> 03:02.300 It had taken down many of the Australian businesses and businesses around the world like Maersk and Merck and they were worried about our infrastructure. 03:03.440 --> 03:06.800 And they were worried that we were going to be brought down. 03:07.860 --> 03:12.260 And so could I actually get involved and help them out with that? 03:12.260 --> 03:14.220 So, yeah, that's all good. 03:17.460 --> 03:27.560 And so what actually happened in that was I went back to them and I said, listen, we've got no problems because we're fully patched. 03:27.560 --> 03:30.740 And they were like, they didn't believe me. 03:31.020 --> 03:32.500 And I said, okay, that's fine. 03:32.500 --> 03:33.000 No problem. 03:33.000 --> 03:34.900 I've got all the information in spreadsheets. 03:34.900 --> 03:39.240 I can show you how we've tracked the patching that we've done over time. 03:40.140 --> 03:48.720 And they were a bit impressed, but they're also a bit disappointed because I think they actually wanted to put up a bit of a fight against this piece of malware. 03:49.100 --> 03:52.140 But anyway, we were successful. 03:52.140 --> 04:00.720 And so now I want to take you back through a bit of the history before this as to how we got to this point, and I could actually say, yep, all good. 04:00.800 --> 04:03.560 That virus is not going to come anywhere close to us. 04:04.140 --> 04:05.160 All right. 04:05.160 --> 04:16.580 So, yeah, while I was working there, my manager, he came out with this idea that he wanted big monitors and he wanted us to look like NASA. 04:17.040 --> 04:24.320 And, well, yes, we had Pew Pew maps and all of that on there, but he also wanted to put some other information up there. 04:25.100 --> 04:28.880 And so, yeah, he got me to do that. 04:29.540 --> 04:33.460 And I actually coined the phrase security through big monitors. 04:33.460 --> 04:39.180 And I Googled this and there were no search results that came out for that. 04:39.560 --> 04:41.960 So, basically, I think I invented the term. 04:41.960 --> 04:43.780 So, if anyone wants to use it, you're welcome. 04:43.780 --> 04:45.460 You just need to pay me royalties. 04:46.860 --> 04:51.860 So, the first thing I decided that we'll do is put up some traffic lights. 04:51.860 --> 04:58.820 Because any time you have a manager and they want information, traffic light, all the things, of course. 04:59.080 --> 05:03.180 Because bosses like to be given pretty pictures to look at. 05:03.680 --> 05:16.980 So, what we did, yep, we came out and did a graph where we took all the patches, all the servers, sorry, all the patches, divided them by all the servers and, of course, got a lovely diagram. 05:17.420 --> 05:20.860 Some months we had more than 90% of patches applied. 05:20.860 --> 05:24.240 Some months we had less than that. 05:25.060 --> 05:28.040 And so, we tracked against the stats there. 05:30.240 --> 05:35.200 And, of course, because we're using traffic lights, you always want to make sure that you're in the yellow. 05:35.600 --> 05:38.780 Just basically because if you're in the red, that means you're not doing your job. 05:38.780 --> 05:41.960 And if you're in the green, it means that you've got way too much budget. 05:42.780 --> 05:46.660 So, that's... you've got to keep it in the yellow. 05:46.960 --> 05:50.780 Which is a what you're looking at now. 05:51.060 --> 05:54.280 If Microsoft release a lot of patches, you'll probably go into the yellow. 05:54.280 --> 05:56.780 If they don't release a lot of patches, you'll go into the green. 05:56.860 --> 06:00.980 If they release a lot, a lot of patches, then you might hit the red. 06:01.720 --> 06:04.720 So, you're tracking Microsoft and that doesn't really help you. 06:04.720 --> 06:06.980 It doesn't give you any direction of where to go. 06:07.780 --> 06:15.820 But some of the stuff that we were looking at at this time to try and improve the whole process is, is it really the total number of patches? 06:15.880 --> 06:17.380 Did we get them all right? 06:17.540 --> 06:19.120 Is it improved patches? 06:19.200 --> 06:22.020 Are there other servers that we could be looking at, et cetera? 06:24.520 --> 06:25.940 So, that was that. 06:26.460 --> 06:31.040 And then the other thing that... so, then what I did was I thought, okay, well, let's enhance it. 06:31.040 --> 06:34.580 Let's see if we can actually dig into the information a bit deeper. 06:35.040 --> 06:40.900 So, you'll see I've taken this kind of list of computers, total patches, installed patches. 06:40.900 --> 06:43.520 All in all, we came out 93.6%. 06:43.520 --> 06:45.320 Which is good. 06:45.320 --> 06:46.040 Which is great. 06:46.040 --> 06:47.160 Which gets us in the green. 06:47.160 --> 06:52.600 But if you have a look at the actual computers themselves, you'll see that there's some issues here. 06:52.600 --> 06:56.760 So, some of them are below what we're supposed to be having. 06:57.080 --> 06:59.260 Some of them are good. 06:59.260 --> 07:00.560 Most of them are good. 07:00.720 --> 07:04.000 But this one you'll see even is 76.5%. 07:04.000 --> 07:10.760 That may or never have received any patches in the lifetime of that server at all. 07:13.700 --> 07:15.420 So, it's good to do that. 07:15.540 --> 07:18.620 Because, of course, it gives us direction. 07:18.660 --> 07:20.300 Let me just go back to that one. 07:20.420 --> 07:23.120 So, it gives us direction as to where to go. 07:23.120 --> 07:24.420 So, we can see... oh, hang on. 07:24.420 --> 07:25.340 Most of these are okay. 07:25.340 --> 07:26.260 We can just leave them. 07:26.260 --> 07:27.560 They seem to be updating. 07:28.540 --> 07:29.500 Everything's fine. 07:29.540 --> 07:32.060 The two that aren't, we can fix that out. 07:32.060 --> 07:36.400 That might be just one month that just didn't quite work out properly. 07:36.400 --> 07:37.700 Maybe they just need to be rebooted. 07:37.700 --> 07:38.580 Who knows? 07:39.140 --> 07:40.460 So, you can sort those. 07:40.460 --> 07:50.420 And then the one that is getting no patches at all, that's the one where you're gonna want to concentrate and get everything sorted out. 07:51.780 --> 07:52.200 Yeah. 07:52.200 --> 07:57.700 So, I mean, I can talk about an hour on each one of these kind of slides. 07:58.560 --> 08:00.080 But unfortunately, I can't. 08:00.080 --> 08:05.860 But if anyone wants to catch me on the Discord, yeah, I'm available there. 08:05.860 --> 08:08.760 Or if you want to drop me a tweet, whatever, we can talk further. 08:09.000 --> 08:25.200 But essentially, the reason why I put this in here is, you know, once you've sorted out stuff, if you see that stuff is recurring, then you can do... you can check against it and see why it's happening and just keep on working through it. 08:25.200 --> 08:28.220 And over time, what you'll find is that you're actually improving. 08:28.220 --> 08:29.320 And that's a good thing. 08:29.320 --> 08:34.380 So, you're no longer tracking whether Microsoft has released too many patches for you to patch or not. 08:34.400 --> 08:39.480 What you're actually tracking now is how well are you doing and how well are you getting patched? 08:44.500 --> 08:45.180 Okay. 08:45.180 --> 08:57.160 So, what I just wanted to point out at this point is that a many-many-two relationship is actually a very difficult thing to get right. 08:58.300 --> 09:01.500 And we have one in this particular case. 09:01.500 --> 09:05.680 So, what we're looking at here is we have multiple servers, we have multiple patches. 09:05.900 --> 09:15.320 And if you have a case like that, then you need to start working out because it's too much information to try and work with all at once. 09:15.380 --> 09:20.460 So, you kind of summarize it down to, okay, how many servers do we have? 09:20.460 --> 09:20.600 Okay. 09:20.600 --> 09:21.400 These are the servers. 09:21.400 --> 09:21.560 Okay. 09:21.560 --> 09:23.160 And then, what patches are there? 09:23.420 --> 09:28.300 But you can get more interesting information once you start looking at the patches. 09:28.300 --> 09:33.040 So, you can have a look at whether they're a high, medium, or low-risk patch. 09:33.240 --> 09:36.120 And maybe you have different rules for each of those. 09:36.120 --> 09:41.760 So, now you're starting to get into understanding the information at an even higher level. 09:43.400 --> 09:48.160 And also, you can start looking at the actual ages of the patches. 09:48.580 --> 09:58.980 So, what you might do is you might say, okay, well, we haven't actually patched these patches here, but we're not expecting to because they only came out this month and we just haven't had time to test them. 09:58.980 --> 10:00.740 We haven't had time to apply them. 10:00.820 --> 10:03.520 And they're not critical that we need to do it immediately. 10:03.700 --> 10:06.400 So, that's okay that they haven't been patched. 10:06.400 --> 10:07.060 All good. 10:08.180 --> 10:11.400 You might have some that are one month out. 10:11.400 --> 10:14.220 And that's a problem because they haven't gone through. 10:14.220 --> 10:15.620 But at least you know that. 10:15.620 --> 10:17.560 And the next time you patch, okay, well, then that's fine. 10:17.560 --> 10:18.740 We'll patch them that time. 10:20.080 --> 10:25.640 You might then have a process... you might have it where the process has failed twice. 10:26.140 --> 10:28.520 And now you're going to have a bit of a problem. 10:28.520 --> 10:29.900 Why is your process not working? 10:29.960 --> 10:31.260 That's a bit of an issue. 10:31.800 --> 10:34.940 And then, of course, if it fails three times, then hang on a sec. 10:34.940 --> 10:36.180 Okay, now we have a huge issue. 10:36.180 --> 10:39.800 Because we've looked at it three times and we still haven't been able to work it out. 10:39.800 --> 10:44.900 Hopefully something is being worked out to get that sorted eventually. 10:47.360 --> 10:53.060 And now that you have that information, you have meaningful information that you can graph. 10:53.080 --> 10:58.160 And you can go back to doing the red, the yellow, and the green like a Ghana flag. 10:58.500 --> 11:00.140 And it actually means something. 11:00.140 --> 11:05.280 Because what you can say is, like, hang on a sec, where you see red is where our processes are failing. 11:05.280 --> 11:07.680 And we can actually start to work on that. 11:07.680 --> 11:10.200 And you can bring that down over time. 11:14.970 --> 11:15.970 All right. 11:16.010 --> 11:17.110 But wait. 11:19.090 --> 11:23.070 What about MS17010 from the beginning of our discussion? 11:25.870 --> 11:33.830 So what we were doing before this point was we were actually trying to patch all the different servers over time. 11:33.830 --> 11:35.550 We weren't looking at the patches, really. 11:35.550 --> 11:39.790 We were just looking at the servers and trying to patch server by server. 11:40.630 --> 11:47.750 And now, all of a sudden, you have this really bad vulnerability. 11:48.290 --> 11:52.010 It can be remotely attacked. 11:52.670 --> 11:57.850 And, yeah, it's just a very, very bad vulnerability. 11:57.850 --> 11:59.330 It came out bad. 11:59.330 --> 12:06.410 And then, of course, one of the things that Joshua Coleman came out with is something called H.D. 12:06.410 --> 12:12.430 Moore's Law, which is... it's basically a pun on Moore's Law. 12:13.210 --> 12:23.790 And essentially, what it is, is as virus... well, as vulnerabilities get easier and easier to exploit, they become more and more dangerous. 12:24.270 --> 12:36.570 And so what happened with this one is it slowly... I noticed that exploits were being built, theoretical exploits and real exploits and metasploits. 12:36.730 --> 12:43.550 And then I saw that and I thought, oh, okay, this thing is going to become a worm in the not-too-distant future. 12:44.450 --> 12:57.540 So going back into this slide here, as I said, many-to-many relationships are not good because they bring in complexity. 12:57.560 --> 13:08.140 But sometimes they are good because now we can actually pivot and we can say, okay, well, we were looking at servers and how many patches we had running on the different servers. 13:08.440 --> 13:19.240 Now, we can actually go back and we can say, okay, well, now let's look at this one single patch and how many servers have this patch installed on it. 13:22.730 --> 13:32.110 And so if we work out that information, we can see, okay, well, these servers, A, B, C, D, E, G, A, N, H, have the patch installed. 13:32.350 --> 13:36.290 And then these three computers have the patch missing. 13:36.350 --> 13:37.610 Now, remember, we're also using... 13:38.530 --> 13:47.710 so the reason why we've got so many computers that actually have it patched is because we're going through the computers and we will attack the critical patches while we're doing it. 13:48.010 --> 13:51.890 And also at the same time, we were looking for computers that were missing. 13:52.150 --> 13:57.230 So we actually managed to get all the computers and got them mostly patched. 13:57.230 --> 14:02.330 And then, hang on, these three, for some reason, just don't have this one single patch. 14:02.570 --> 14:04.070 And it could be that they're new computers. 14:04.070 --> 14:06.630 They just haven't had patches applied at all ever. 14:07.090 --> 14:10.490 And so therefore, boom, we can just basically apply the patch. 14:11.590 --> 14:13.330 And so that's what we did. 14:13.330 --> 14:15.090 And that's why we were successful. 14:15.090 --> 14:20.530 So essentially, we built the information over time and got to this point. 14:20.530 --> 14:27.790 And then we managed to flip it and managed to change our processes. 14:28.050 --> 14:29.790 So there's a couple of takeaways. 14:29.910 --> 14:31.250 Well, there's more than a couple of takeaways. 14:31.250 --> 14:34.330 There's a few takeaways that I'd like to show you here. 14:34.930 --> 14:36.510 Number one, get information. 14:36.510 --> 14:38.530 There's always information out there. 14:38.770 --> 14:45.270 The information I got directly from the Microsoft guys, they just basically pulled it out and sent it my way. 14:45.270 --> 14:47.430 Raw information, stick it into Excel. 14:48.150 --> 14:54.130 And then number two, play with it, manipulate it, move it around, experiment, keep changing it. 14:54.330 --> 14:55.370 It's low risk. 14:55.370 --> 14:59.910 You have no issue with playing around with information. 14:59.910 --> 15:01.090 It's all in your spreadsheet. 15:01.090 --> 15:01.950 It's all good. 15:02.710 --> 15:04.610 Number three, use it to improve things. 15:04.610 --> 15:08.670 Try and say, okay, well, hang on a sec, our processes need to be improved or not. 15:08.770 --> 15:11.870 Do we know or don't we know? 15:11.930 --> 15:19.450 And then, of course, get the information that will tell you exactly what you need to know, whether your processes are working or not. 15:20.250 --> 15:21.290 Always ask why. 15:21.290 --> 15:22.750 Don't just fix stuff. 15:22.750 --> 15:24.910 Work out, why was it broken in the first place? 15:24.910 --> 15:29.710 Because if it happens again, you'll know and you'll be able to fix it up. 15:31.150 --> 15:34.530 Also, just note that you don't need expensive tools. 15:34.530 --> 15:35.630 We have Excel. 15:35.730 --> 15:37.550 And that's all I used. 15:37.570 --> 15:45.570 So, basically, that was... I didn't have to go out and buy anything, any special tools or anything. 15:45.570 --> 15:46.790 I had it already. 15:46.790 --> 15:50.390 All I needed was the information and some of my time to get it working. 15:51.530 --> 15:53.250 WSSZ Excel was free. 15:54.230 --> 15:54.830 Yeah. 15:55.050 --> 15:55.610 Okay. 15:55.610 --> 15:56.070 Yeah. 15:56.070 --> 15:58.010 So, doing security right is hard. 15:58.010 --> 15:59.510 There's no easy wins. 15:59.730 --> 16:03.390 So, it looks easy from what I've shown you here. 16:03.390 --> 16:06.270 But there was a lot of hard work behind the scenes. 16:06.290 --> 16:19.770 Once I got the information in place, sitting with the IT team and getting them to patch and repatch and get it right and research and find out what was going wrong, there was a lot of work. 16:19.770 --> 16:34.430 The one thing that I could point out at this point now is that having that extra good information that I could give to them made them more excited about the job that they were doing. 16:34.430 --> 16:40.830 It wasn't me just coming as a security person and saying, listen, you need to patch your servers because patching servers is a good thing to do. 16:40.990 --> 16:48.410 It was me coming to them and saying, hey, this computer, it doesn't seem to be working, doesn't seem to be getting its patches. 16:48.870 --> 16:50.930 Can you work out why that is? 16:51.030 --> 16:56.310 And then they come back to me and say, listen, this is the story and we can actually sort it out and fix it. 16:56.310 --> 17:00.350 So, that's what comes out of having the information. 17:00.350 --> 17:04.410 It makes life a lot easier for you and for your IT team. 17:07.130 --> 17:10.250 And, yeah, as I said, work with your teams. 17:12.070 --> 17:16.430 Yeah, you can say, okay, well, if you're asking why, can you help them? 17:16.430 --> 17:21.130 A lot of times they would come back to me and say, listen, I have no idea why this isn't working. 17:21.190 --> 17:26.390 And we dig in the history and we can see, okay, well, it patches sometimes, sometimes not. 17:26.390 --> 17:28.550 There must be something strange with that box. 17:28.650 --> 17:30.550 Or it's never been patched before. 17:30.550 --> 17:35.050 And then you can work out stuff like maybe there's a firewall in the way, et cetera, et cetera. 17:36.370 --> 17:37.850 Keep digging deeper. 17:38.310 --> 17:45.770 So, as I showed you, the first things we were monitoring were just like the total number of patches across everything and divided by the total number of computers. 17:46.270 --> 17:49.050 And it didn't really tell us very much. 17:49.050 --> 17:53.970 It didn't give us a good, deep amount of information that we could work with. 17:54.630 --> 17:56.570 And usually that information's there. 17:56.570 --> 17:58.810 You're just not looking at it. 17:58.810 --> 18:00.870 So, always keep getting more information. 18:00.910 --> 18:04.210 And don't be scared to get information from two different places. 18:04.770 --> 18:12.130 Like, for instance, what I was saying earlier is you want to... we had all the computers that we knew about. 18:12.310 --> 18:16.350 But when I found some other lists of computers, those were different. 18:16.350 --> 18:18.650 And then the question is, well, why are they different? 18:19.170 --> 18:27.050 And then that helps you to actually get a more... a bigger understanding of your total... 18:27.850 --> 18:30.550 the total issue that you need to deal with. 18:31.850 --> 18:33.990 And number 10, don't be scared to change your process. 18:33.990 --> 18:35.250 So, we had a good process. 18:35.250 --> 18:40.890 We were getting... we were making leeway against what we had to do. 18:41.570 --> 18:44.790 So... sorry, making headway against what we were trying to do. 18:44.790 --> 18:47.270 So, we were getting our servers patched. 18:47.270 --> 18:48.630 And we were getting more servers patched. 18:48.630 --> 18:53.290 And the lines were coming down because less and less critical patches were missing. 18:53.290 --> 18:55.770 Less and less non-critical patches were missing. 18:55.990 --> 19:04.230 But then when all of a sudden I saw that there was one patch that was really, really important that we really needed to get out of the way, changed everything. 19:04.230 --> 19:04.470 Okay. 19:04.470 --> 19:05.390 This is the one. 19:05.390 --> 19:07.110 This is what we need to sort out first. 19:07.110 --> 19:12.390 Everything else needs to take... we'll get to that. 19:12.390 --> 19:13.610 We'll get to it eventually. 19:13.710 --> 19:15.910 But this is what we need to get right now. 19:18.330 --> 19:20.010 And, yeah, next steps. 19:20.010 --> 19:24.490 So, if you're interested in this, the next step for you would be get your information. 19:24.490 --> 19:25.930 Go find where you can get it from. 19:25.930 --> 19:27.330 Get CSVs. 19:27.330 --> 19:28.530 Get some JSON. 19:28.530 --> 19:29.510 Get text. 19:30.150 --> 19:31.370 And convert it. 19:31.370 --> 19:33.230 Put it all into Excel. 19:33.230 --> 19:34.590 Start fiddling with it. 19:34.590 --> 19:36.870 Learn how to join the sources together. 19:36.870 --> 19:38.470 Learn how to use pivot tables. 19:38.470 --> 19:39.890 Learn how to use graphs. 19:40.110 --> 19:41.030 And play. 19:41.030 --> 19:44.490 And play and play until you get the information that you need. 19:45.110 --> 19:46.710 Just, yeah. 19:47.610 --> 19:48.530 You're a hacker. 19:48.530 --> 19:54.650 So, use your hacking ability to work with Excel. 19:55.390 --> 19:56.890 And that's pretty much it. 19:56.890 --> 20:06.690 Just a shout out to my Baranoff clan and to the DEF CON group of Melbourne. 20:07.050 --> 20:08.250 Hey, guys. 20:08.250 --> 20:10.530 Also to the Australian B-Sides team. 20:10.530 --> 20:12.470 B-Sides Melbourne. 20:13.490 --> 20:20.270 And, yeah, to all of you that are there taking your time out to watch this presentation, thank you very much for that. 20:20.810 --> 20:25.710 And thank you very much to the DEF CON team and to the Blue Team Village for having me. 20:25.970 --> 20:31.790 It's a great honor to be able to speak in this forum. 20:32.290 --> 20:36.270 And, yeah, if there's anyone that does have any questions, I'm not sure. 20:36.270 --> 20:38.310 There might be a bit of time left. 20:38.310 --> 20:47.470 Alternatively, just find me in other DEF CON, the DEF CON Discord or alternatively in the Blue Team Village Discord. 20:47.470 --> 20:49.990 And, yeah, I'll answer any questions that you have. 20:50.250 --> 20:51.430 Thank you very much. 20:51.550 --> 20:52.130 Awesome. 20:52.130 --> 20:55.010 Thank you for the wonderful presentation, Alan. 20:55.510 --> 21:06.430 As always, we suggest that you join the Blue Team Village Discord and direct your questions to texttalktrack1. 21:06.650 --> 21:08.630 Okay, I will do for sure. 21:09.050 --> 21:13.870 The presenter will take a look and be able to answer your questions. 21:14.570 --> 21:19.210 And other than that, I appreciate that and thank you again. 21:19.490 --> 21:20.410 Thank you.