WEBVTT

00:08.600 --> 00:13.000
Welcome everyone to the Blue Team Village incident response panel.

00:13.040 --> 00:19.940
We have an awesome group here for you today with unique experiences and perspectives on security incidents and incident response.

00:19.940 --> 00:22.140
I'm really excited for today's discussion.

00:22.320 --> 00:32.620
But before we get started, take a look at the poll we posted on the Blue Team Village Twitter earlier today about ransomware and whether or not victims of ransomware should pay the ransom.

00:32.740 --> 00:36.740
We are going to get on that topic in a bit and we would like your input in the poll.

00:37.140 --> 00:45.260
Also, please post questions for the panel in the Blue Team Village Discord in the Talks Track 1 channel, which we'll be monitoring.

00:46.140 --> 00:47.700
My name is Russell Mosley.

00:47.700 --> 00:51.240
I go by SmokeEm on Twitter and I'm a lead with the Blue Team Village.

00:51.240 --> 00:57.740
I've been a Blue Teamer for my entire career, building and managing security operations at small and mid-sized companies.

00:58.000 --> 00:59.740
So I wear a lot of hats.

00:59.740 --> 01:01.600
I've done everything from sysadmin.

01:01.600 --> 01:09.920
I've been an IT director, a security ops lead, a compliance auditor, and today I'm a CISO at a rapidly growing government contractor.

01:10.160 --> 01:14.180
All my experiences involve developing and managing small teams.

01:14.240 --> 01:21.500
And as a result, I've had the opportunity to do a lot of different things in the security field and build decent security programs without a huge budget.

01:21.680 --> 01:24.980
I'd like to introduce my co-host, Xavier Ashe.

01:25.500 --> 01:26.540
Xavier?

01:26.760 --> 01:29.840
Good afternoon, everyone, or good morning to where you're at.

01:29.840 --> 01:31.840
So my name is Xavier Ashe.

01:31.840 --> 01:33.700
I go by Rubix1138.

01:33.980 --> 01:37.380
My IR experience is a little varied.

01:37.380 --> 01:42.460
I was an IR team lead at bit nine slash carbon black.

01:42.480 --> 01:48.680
And also I was able to start the first IR team at SunTrust, now Truist.

01:48.740 --> 01:52.620
So 28-year veteran, been around for a while.

01:52.620 --> 01:57.900
I can remember when my IR plan was you have to scan every floppy by hand.

01:57.900 --> 01:59.320
That's me.

01:59.720 --> 02:00.560
Cool.

02:00.560 --> 02:03.220
Next I'd like to introduce Lip Moose.

02:03.220 --> 02:09.660
Moose is frequently posting to Twitter, comments on exciting things that she encounters doing IR.

02:09.760 --> 02:14.160
And this week it was jump boxes that look like flaming toilets, I think was one of the highlights.

02:14.740 --> 02:27.940
She refers to herself as many things, including Florida woman, a DFIR violinist, and recently completed a cross-country hacker road trip with cats and snails on board.

02:27.940 --> 02:29.620
Isn't that right, Lip Moose?

02:30.840 --> 02:32.380
That's fairly accurate.

02:32.380 --> 02:34.640
I did remote DEF CON.

02:34.740 --> 02:36.280
We got to see a few goons.

02:36.280 --> 02:37.240
It was nice.

02:37.240 --> 02:42.760
So I go by Lip Moose on Twitter, also known as Moose.

02:42.760 --> 02:44.500
My name is also Heather.

02:44.540 --> 02:46.500
I'm currently working at CrowdStrike.

02:46.500 --> 02:51.560
I'll dox myself today, which is not a thing I usually do at DEF CON.

02:51.620 --> 02:54.420
But I'm very proud of where I work and what I do.

02:54.420 --> 02:58.880
I work with a lot of companies of all sizes.

02:58.880 --> 03:19.160
I come from a background for financial giants, as well as manufacturing giants, and have been doing this long enough to where I think I've been awake and can engage myself in the 60s if I add all of my cumulative IR experiences together without sleep.

03:19.160 --> 03:21.860
So I'm looking forward to retirement.

03:21.860 --> 03:25.100
I don't know when that will be, but I do love what I do.

03:25.100 --> 03:27.880
Outside of work, I herd cats and I play violin.

03:28.240 --> 03:33.720
And so I'd actually like to pivot and introduce somebody that I've worked with a little bit.

03:33.720 --> 03:37.660
1099, one of my favorite people in the world.

03:38.300 --> 03:42.640
Look, I'm sober right now, which is a problem.

03:42.640 --> 03:45.760
But, Brian, I'll go ahead and pass it over to you.

03:46.640 --> 03:48.860
Well, hello, all you cool cats and kittens.

03:48.860 --> 03:53.020
My name is Brian Moran, and I go by the incredibly clever Brian J.

03:53.020 --> 03:54.080
Moran on Twitter.

03:55.360 --> 03:57.820
I've worked primarily in the Air Force.

03:57.820 --> 04:10.760
That's where I started my career, worked for a three-letter agency, did that for a bit, got out of the military, bounced around a couple of private sector companies, and eventually, back in 2014, started working completely for myself.

04:10.760 --> 04:14.000
So I started my own company, and I am an IR consultant.

04:14.000 --> 04:17.620
That's what I do probably about 60% of the time.

04:17.620 --> 04:36.180
The other 20, 30% is probably primarily focused on training and development plans, and the other 10% of my time is primarily spent trying to keep the DFIR FIT going, where it's all about just trying to get a little bit more active, and hopefully we can all be on this little blue dot a little bit longer.

04:37.940 --> 04:38.620
Cool.

04:38.620 --> 04:45.400
Yeah, I certainly was going to mention Brian's Twitter seems to generally be filled with DIR FIT and comments on rum.

04:45.660 --> 04:47.180
You left the rum out.

04:47.880 --> 04:50.260
Well, I have some right here.

04:50.580 --> 04:52.540
Oh, funny you should mention that.

04:54.900 --> 04:56.900
I thought you were going to be better than me, Brian.

04:58.800 --> 05:01.420
Let's hear from Virus before we have our toast.

05:01.420 --> 05:15.340
Virus, so he says he's only been a blue teamer for about a year and a half with a background in red team, and he's currently doing what I call kind of red-blue and innovative network defense for a large financial organization.

05:15.340 --> 05:17.860
If you want to elaborate, welcome, Virus.

05:17.860 --> 05:21.160
Yeah, so I work at Stripe currently.

05:21.440 --> 05:25.300
I'm the threat detection team.

05:27.040 --> 05:34.360
I guess the word for it is adversary direct engagement and threat hunting.

05:34.360 --> 05:43.040
Background-wise, started in the dark gray end of the pool as a young kid, like my first DEF CON, I was 17.

05:44.640 --> 05:52.980
Fell into penetration testing and then red teaming, like full-spectrum threat stuff, and passed around the world doing that for a while.

05:53.420 --> 06:07.040
Kind of drifted back towards pen testing, and then, surprise, had a kid, and, you know, turns out that gallivanting around the world, breaking into buildings in random countries, and getting arrested is not a good way to be a dad, so had to pivot for a while.

06:07.760 --> 06:13.160
Did a stint doing mergers and acquisitions security at Salesforce and found out I'm not bureaucrat.

06:13.740 --> 06:16.640
Now I'm doing blue team, so, yeah.

06:18.700 --> 06:20.280
Cool, that's awesome.

06:20.280 --> 06:26.080
Really looking forward to sharing some of your perspectives that we heard in our planning meeting yesterday.

06:26.800 --> 06:32.680
So before we get going, we wanted to carry out the DEF CON tradition of first-time speaker drink.

06:35.780 --> 06:38.020
Everybody have their glass ready?

06:38.720 --> 06:39.620
Awesome.

06:39.620 --> 06:40.900
Cheers to IR.

06:49.530 --> 06:54.790
All right, so to kick it off, you know, we're in a unique situation here in 2020, right?

06:55.370 --> 06:59.150
With COVID forcing work from home for so many people.

06:59.370 --> 07:05.590
So I wanted to start with a question for full-time incident responders, Moose and Brian.

07:05.690 --> 07:09.670
What types of incidents are you seeing the most of right now?

07:09.710 --> 07:15.830
What are the trends in attack methods, persistence, and anything else you've observed lately in your work?

07:18.050 --> 07:20.250
Yes, I can go ahead and start.

07:21.710 --> 07:25.130
It hasn't changed too, too much.

07:25.130 --> 07:28.030
The volume has been a huge uptick.

07:28.070 --> 07:31.370
I'm still seeing a ton of ransomware attacks.

07:31.530 --> 07:43.150
A curious thing that I'm seeing more of now is actually, I would say, more intrusion via remote code execution has had an uptick recently.

07:43.150 --> 07:52.530
With a lot of the bots out there, vulnerability scanning, I would say that those are getting hit before people can catch just a little bit faster than I used to see.

07:53.490 --> 08:04.470
But a lot of the end game for what I'm seeing now is either encryption and then extortion or exfil and then extortion.

08:04.530 --> 08:10.290
And I would say that the volume has just gone up versus what it was like a year ago.

08:11.430 --> 08:14.130
Yeah, I would 100% agree.

08:14.230 --> 08:21.470
The exact same stuff that's happening now has been happening for the past probably two to three years has been the general trend.

08:21.470 --> 08:25.030
But the volume of it has just immensely increased.

08:25.030 --> 08:32.430
And probably part of that is the bad actors have nothing else to do except stay at home, just like we have nothing else to do.

08:32.430 --> 08:37.850
So the idle hands will play, I believe, is the phrase that's used there.

08:37.850 --> 08:49.970
So the one thing that I have seen more recently an uptick of than I have over the past year or so is actually O365 and not necessarily intrusions.

08:49.970 --> 08:59.710
It's users clicking on links they shouldn't click on, and then the attackers getting access to stuff that they shouldn't necessarily be able to get.

08:59.710 --> 09:02.750
So it's not necessarily a 365 intrusion.

09:02.750 --> 09:08.310
It's just phishing, which is kind of directed more towards with the overall goal of getting some O365 access.

09:12.300 --> 09:13.700
Yeah, that's interesting.

09:13.700 --> 09:25.760
I wanted to ask, a lot of companies have focused a lot of their security on their networks, and perhaps not as much on their endpoints and cloud services.

09:26.280 --> 09:41.680
And now that many of their workers are remote, they don't have the option to do monitoring on their network, and maybe aren't as well prepared to monitor from their endpoints and their cloud services.

09:42.060 --> 09:44.340
Would you agree that that's the case?

09:44.340 --> 09:48.280
And how is that impacting what you're seeing out there?

09:49.960 --> 09:52.700
So I would say it definitely does.

09:52.700 --> 10:06.020
But the caveat to that, and I already kind of doxxed where I work, is I'm getting calls because they're not necessarily using an EDR to begin with, or maybe there's not as much focus on the endpoint.

10:06.140 --> 10:14.680
And I think that what's neglected in cloud is that there's this perception of security that's not really there.

10:14.680 --> 10:18.260
You're just working on a server in somebody else's data farm.

10:18.260 --> 10:29.700
And so you still need to put the same protections on it, and monitor your VPC flow logs, and look at what VPC you're putting stuff in, or what segment, rather.

10:29.700 --> 10:34.220
And you would monitor it just like you would something on-prem in your environment.

10:34.240 --> 10:40.960
And I'm seeing that being so quick to set up that sometimes those steps are missed, and then I'll get a call.

10:42.600 --> 10:52.640
Yeah, I think as we talked about a little bit last night, one of the things is the data that you need to actually respond to a breach of some sort, it's always been there.

10:52.640 --> 11:01.520
It's just never really been used or even thought of being looked at, because before it was all, well, we're just going to block everything at the network layer because everything is controlled.

11:01.520 --> 11:04.600
But now that everything's spidered out, all the logs are still there.

11:05.240 --> 11:06.340
All of that's still there.

11:06.340 --> 11:09.360
It just never was bothered to actually be configured properly in the first place.

11:09.360 --> 11:11.560
So that's why we're seeing what we're seeing.

11:12.680 --> 11:24.380
So with the more distributed, I'm hearing more endpoints and more cloud, has that really changed the way that we're doing IR now?

11:28.630 --> 11:30.650
I would say yes and no.

11:30.830 --> 11:36.630
So we're still asking for logs that are representative of the same data.

11:36.630 --> 11:42.390
Instead of asking for firewall logs in this case, you're looking for NetFlow, which might be DPC flow.

11:42.710 --> 11:52.470
We're still asking to run scripts to an endpoint, which whether or not it's in a cloud or on-prem, it's going to be capturing the same artifacts.

11:52.470 --> 12:02.030
We're looking at the same things on Linux that we're looking at on an AWS Linux server that we would look at in a server in your environment that's physically there.

12:02.030 --> 12:18.430
So I would say that while things have changed in slight ways in how we capture the data, so converting an EBS snapshot versus a VMPK versus I'm going to run FTK to it, those little minor changes are there.

12:18.430 --> 12:22.650
But I think just getting creative about, I'm still caring about the same things.

12:22.650 --> 12:25.350
I'm still caring about how the thread actor got there.

12:25.590 --> 12:29.170
So your original access point, I'm going to look at all logs.

12:29.170 --> 12:33.730
I'm going to look at, has there been any exfil, file creation, file deletion.

12:33.730 --> 12:37.410
So the same questions we've been asking forever, we're still going to keep asking.

12:37.410 --> 12:41.850
It's just that creativity around, we're in a different environment now.

12:42.890 --> 12:48.350
Unfortunately, those logs are generally there for companies that rely on Office 365.

12:48.650 --> 12:53.150
A lot of times you just have to have the right licenses to go look at them in cloud app security and other places.

12:53.410 --> 13:02.750
So what happens when an organization hasn't really invested in logging on their endpoints or anything beyond the defaults that come with Windows?

13:02.750 --> 13:10.870
You have a situation where you have people getting phished or getting malware, and there's really not much to go on.

13:10.870 --> 13:12.790
What do you do in that case?

13:13.210 --> 13:24.970
Generally, you're not going to have the easy access to get a forensic image and conduct analysis on the device because it's somewhere far away from you, maybe on a slow link.

13:24.970 --> 13:26.430
How do you deal with that?

13:28.650 --> 13:36.670
Well, I think the old way of, well, we would just show up and collect data from somebody's computer in the event that something happened.

13:36.810 --> 13:41.050
Obviously, that is no longer going to be existing.

13:41.390 --> 13:51.130
So you have to get creative with essentially trying to get the same people together on a call like this and figure out what you actually have access to.

13:51.130 --> 13:59.890
Not necessarily what you have, because more than likely in the event that someone like myself or Moose gets called in, stuff has already happened that's really, really bad.

14:00.150 --> 14:03.390
We're pretty much the last people you want to see in the event of an incident.

14:03.550 --> 14:13.470
So you have to get creative with essentially figuring out what you have access to and then how far back that goes, if it goes back at all, and then try to build out from there.

14:13.470 --> 14:19.770
Because a lot of times when we show up somewhere, the first question is, well, okay, do you have NetFlow?

14:19.770 --> 14:20.530
Do you have logs?

14:20.530 --> 14:22.190
Do you have X, Y, and Z?

14:22.250 --> 14:26.470
And a lot of times, the initial part of an incident isn't even actually responding to something.

14:26.470 --> 14:36.510
It's figuring out what we actually have access to and then trying to get creative with ways to get access to that data, get it as quickly as possible, and then turn that into usable information that we can use as quickly as possible.

14:39.790 --> 14:41.570
So what are some things...

14:43.730 --> 14:44.470
Go ahead, Moose.

14:44.470 --> 14:45.030
Sorry.

14:45.210 --> 14:51.730
I was just going to say, I think one of the boons right now is that so many people have invested in cloud security, so it almost negates the problem.

14:52.650 --> 15:06.790
A lot of times, a threat actor's pivot point of getting into a lot of devices, we can think about, and I almost want to turn it over to Byers for this one, but if you think like an attacker, you have a better chance of getting the data you need.

15:06.810 --> 15:22.850
And I worked a case recently where, you know, I couldn't run the scripts I wanted to, but I looked at what they did, and I said, well, let's just replicate what the red team did, or what the threat actor did in this case, and let's red team it, and I got the data I needed.

15:22.950 --> 15:27.550
So that's... sometimes you just got to look at the problem a little bit.

15:28.830 --> 15:53.830
I think another curveball that I started to see is, you know, for companies that use Wwise terminals, you really can't take those thin clients home, and so we're seeing an increased use of other devices like Chromebooks, and so I wanted to see any advice out there if somebody that's listening is going to be doing any type of instant response involving Chromebooks used as,

15:54.590 --> 15:56.830
you know, thin clients.

15:57.130 --> 16:00.010
Is there any advice that you can give to those folks out there?

16:02.630 --> 16:04.590
Looks like we lost Moose for a minute.

16:05.090 --> 16:11.670
Well, so I know that there's been some research into essentially the data that you can collect from Chromebooks.

16:11.670 --> 16:18.650
I know Jessica Hyde from Magnet Forensics has done quite a bit on that, and I believe this past year she's given a few talks on that.

16:18.650 --> 16:20.390
So there is data you can get from Chromebooks.

16:20.390 --> 16:30.450
You have to get clever with it, but one of the things that's interesting is if you use Chromebooks, more than likely you're using some sort of Google instance, and Google has a ton of data about you.

16:30.450 --> 16:36.570
Whether you use Google or not, Google has a ton of data about you, and because you're able to get all of that data back from them.

16:36.570 --> 16:39.490
And admittedly, there's a lot of stuff to go through.

16:39.870 --> 16:41.830
But it's not necessarily...

16:41.830 --> 16:43.450
like Chromebooks are incredibly secure.

16:43.450 --> 16:45.090
I love Chromebooks.

16:45.090 --> 16:49.270
I recommend Chromebooks to pretty much everybody who gets click-happy with any kind of links.

16:49.270 --> 16:54.330
Just use a Chromebook for a while, and hopefully that's going to eliminate a big portion of your attack surface.

16:54.330 --> 16:58.350
It's not going to completely eliminate it, but it's going to take a big portion of that away.

16:58.590 --> 17:07.770
But essentially, at the end of the day, you know, we're still trying to look for the oddity outlier information of data access, you know, data exfil, stuff like that.

17:07.770 --> 17:11.610
And with the stuff that you can get from Google specifically, like all of that's there.

17:11.610 --> 17:16.150
It's just a matter of being able to get it, being able to process it, and being able to digest it.

17:17.250 --> 17:27.150
What are your thoughts, Virus, on doing IR with cloud and distributed endpoints without the hardened network of tradition?

17:29.570 --> 17:35.090
In some ways, I guess I haven't been around in the Blue Team ecosystem enough to know the difference.

17:36.110 --> 17:46.930
Like, the few roles that I've had that are hard in Blue Team, I've always had the power to at least have a say in kind of what our telemetry looks like.

17:46.930 --> 17:52.410
And I mean, coming from the red side, I've frankly never really bothered wanting network stuff.

17:52.410 --> 17:59.490
It's always, you know, anything that's a network artifact, I only care about it in the context of what the endpoint did in terms of interaction.

17:59.490 --> 18:06.030
And so it's just usually easier to filter on down and kind of pinhole what I want.

18:07.090 --> 18:17.510
I have definitely, within the past year, I've dealt with some vendor breaches, which are all public, so I can say that, but I guess I won't say exactly what they are.

18:17.510 --> 18:19.830
So, you know, I won't get fired immediately.

18:20.950 --> 18:23.570
And it's kind of interesting.

18:23.570 --> 18:38.530
One of the nice things about, I shouldn't say nice, but one of the interesting things about kind of being tangentially related to a breach that gets released public is suddenly you have like a legal stick to beat them with to actually get IOCs back from the breach,

18:38.530 --> 18:43.070
as opposed to just reading the news and having a Twitter opinion like the rest of the world.

18:44.270 --> 18:53.290
And from what I've seen, it definitely, like, the game for the vectors in terms of the game for getting in doesn't seem to have changed.

18:53.290 --> 18:55.430
It's usually not the server.

18:55.670 --> 18:58.650
It's usually it's way easier to get on a laptop.

18:58.650 --> 19:08.310
And then because no one knows how to network in the cloud, like everything is just grabbing the AWS token or the Azure token off disk and then going to town.

19:08.310 --> 19:18.110
And then usually from there, it's a, oh, by the way, either there's no logs or there's a ton of logs, but nobody's ever actually triaged them to find out which logs are useful and which ones aren't.

19:18.110 --> 19:19.770
So there's no logs.

19:19.870 --> 19:30.970
And then it's usually going back and being like, oh, well, after they took this token from your machine, then they directly logged in with this super weird user agent that no one's ever heard of and stole all your data and you did nothing.

19:32.490 --> 19:35.730
At least that's been the trend from what I've seen.

19:36.110 --> 19:59.430
The Chromebook thing, there actually is, I don't have a lot of specific details that I can share, but I do know that there has been some publicly released stuff on Google implementing a kind of AuditD type thing that is going to be very similar to like OS X's security center in terms of accessible data.

19:59.430 --> 20:05.810
So I think that's going to be a game changer with all of the EDR tools that are out there that are hooking into AuditD as kind of a funnel for data.

20:05.810 --> 20:07.270
I think that'll be really cool.

20:07.590 --> 20:20.830
And then also anybody who's looking to do DFIR on Chrome locked devices in general, I would actually route you to some research from about eight or nine years ago from Mike Osmond and Kyle Osborne.

20:20.830 --> 20:30.530
They did some offensive research on basically how everything in Chrome is a browser and the browser doesn't know the difference between a file system link and a remote link.

20:30.530 --> 20:40.050
And while Google has obviously tried to address the security concerns that they found with some of that research, you can actually use a lot of those vectors to gather debug information about the Chrome browser environment.

20:40.050 --> 20:43.970
And that ends up being almost equivalent to system logs on a Chrome locked device.

20:45.210 --> 20:51.830
And you started your comments there with, you know, first getting on the laptop and then pivoting out from there.

20:52.010 --> 20:54.930
What's the most common method for getting on the laptop ?

20:55.810 --> 20:56.770
It's the usual.

20:56.770 --> 21:00.490
It's either phishing or I've seen some supply chain stuff recently.

21:02.410 --> 21:06.810
I came out relatively recently that I know affected a bunch of shops.

21:06.950 --> 21:18.630
I've seen some slightly less talked about in the media because the Go ecosystem is so blurred in terms of the concept of standard lib versus some person's stuff on GitHub.

21:18.630 --> 21:23.450
But I have seen some bugs there that have caused some supply chain issues.

21:23.950 --> 21:34.910
There's little known fact, I have seen, well, it's a more known fact that OSX attacks are on the rise, but it's a lesser known fact that Perl is still on the OSX boxes.

21:34.910 --> 21:45.910
So, I have seen kind of some like, you know, oh, I haven't seen that attack since like Red Hat 5, but, you know, that Perl subsystem is still on OSX and way more people look at Python on OSX than Perl.

21:45.910 --> 21:47.190
So, there's a little more of that.

21:48.170 --> 21:48.890
That's great.

21:48.970 --> 21:55.650
I'm curious, Brian, your observations, you know, how they compare to viruses feedback, you know, and what you're seeing.

21:56.990 --> 22:02.730
Yeah, I think it's... so, I don't think the methods have changed.

22:02.730 --> 22:04.530
The methods haven't changed.

22:04.530 --> 22:08.430
And honestly, the methods don't really need to change because they still work.

22:08.430 --> 22:21.970
So, if they're still effective, there's no reason to burn some, you know, some zero day exploit or even go the route of looking for like RCE or anything like that, when if you can get somebody to click on a link and get the information you need, and that still works,

22:21.970 --> 22:23.530
like, that's what the attackers are going to do.

22:23.530 --> 22:28.050
Because, you know, again, at the end of the day, like, the attackers are human just like us.

22:28.050 --> 22:32.450
Like, they will do just as much efforts as needed to get them the goal that they need.

22:32.450 --> 22:35.330
And, you know, you have to be able to account for that.

22:36.350 --> 22:43.230
One of the tools I haven't heard yet so far for telemetry is, you know, cloud-based DNS.

22:43.370 --> 22:48.010
So, a couple providers where you can get that from a centralized source.

22:48.190 --> 22:53.070
Are we seeing more people, you know, take that on as we get to a more distributed environment?

22:53.170 --> 23:03.850
Or is that still an afterthought of like, oh, yeah, we can't get good DNS telemetry because everybody's at home using their home DNS?

23:05.370 --> 23:07.790
Has anybody got any experience with that?

23:08.410 --> 23:09.670
I do.

23:09.670 --> 23:14.170
I've had some that have it, but not very many.

23:14.170 --> 23:20.510
And with the caveat of saying that if they're calling me, something's gone terribly wrong.

23:20.510 --> 23:29.930
Or, or counter, we do do security assessments in environments that might be something to come back with because they've set up a cloud environment and they want advice on how to make it better.

23:29.930 --> 23:41.130
So, I will say that I have a little bit of a bias at answering this because even though I don't see it as much, it's usually because they're calling for help.

23:41.750 --> 23:46.070
Yeah, I mean, control is kind of a crapshoot.

23:46.070 --> 23:54.630
But in terms of telemetry, like, man, the combination of a low-level passive DNS service and OS Query seems amazing for DNS to me.

24:00.120 --> 24:04.000
Yeah, so I'm going to say pretty much the exact same thing that Moose did.

24:04.000 --> 24:06.000
Like, I would like to see it more.

24:06.000 --> 24:08.080
However, a lot of places don't see it.

24:08.080 --> 24:15.440
And the places that call us, more than likely, there have been several shortcomings that led to calling people like us in the first place.

24:15.440 --> 24:22.820
So, typically, we wouldn't see something like that because we're not the security architects or anything like that.

24:22.820 --> 24:25.900
Like, something horrible has happened, everything's on fire.

24:25.900 --> 24:28.540
I'll call them in and they're hopefully going to calm us down.

24:28.720 --> 24:40.980
So, before we pivot to another topic, if you were called in to give advice to a company today, and they wanted to spend some additional budget for security with people working from home, where would you advise them to focus?

24:45.100 --> 24:48.800
I mean, I can tell you where we have an entirely remote workforce right now.

24:48.800 --> 24:55.380
And there is some scatter in terms of operating the system layout.

24:55.380 --> 25:00.680
And pretty much 100% of our EDR effort at this point is done using OS Query.

25:00.680 --> 25:01.980
That's pretty public information.

25:01.980 --> 25:04.900
I don't really feel like I'm giving away secret sauce saying that.

25:04.900 --> 25:11.420
And at least from a telemetry perspective, even with specific regard to DNS, I can tell you, it's pretty amazing.

25:11.420 --> 25:18.160
Like, we have other issues, but DNS telemetry is certainly not one of them from my perspective.

25:20.340 --> 25:24.920
I think the one piece of advice I could give is don't ignore any front.

25:24.920 --> 25:31.300
I see a lot of people spending very heavily in one arm rather than maybe ignoring the other.

25:31.300 --> 25:36.660
So, they'll focus just on end point or they'll focus predominantly on network side.

25:36.660 --> 25:40.480
And I think that the balance is still very, very important.

25:40.680 --> 25:48.980
And I would say to borrow something that we all as a team talked about yesterday, too many people are trying to eat the elephant hole.

25:49.160 --> 25:50.440
So, don't do that.

25:50.440 --> 25:52.380
Don't keep your network flat either.

25:52.380 --> 25:57.660
So, my top advice to people is make a list of priorities in your environment.

25:57.660 --> 26:00.560
What would hurt the worst if that went public?

26:00.940 --> 26:03.100
And start segmenting there.

26:03.100 --> 26:04.260
Start segmenting.

26:04.260 --> 26:06.040
Know your group permissions.

26:06.180 --> 26:08.160
Run some of these Red Team tools.

26:08.160 --> 26:10.480
Run Blood Pound, Sharp Pound in your environment.

26:10.480 --> 26:13.780
Get a better picture of what it looks like and then make a decision .

26:13.780 --> 26:23.020
But make an educated decision, not just a flat blanket decision because not all businesses are the same and not all businesses have the same needs.

26:24.980 --> 26:35.920
I think before spending any money , the first thing that a company truly has to do is take a look at what they already have, the people they already have, and then try to build a solution from that.

26:35.920 --> 26:42.380
Just like Moose said, a lot of times when I go to places, they don't even have something basic like a network map.

26:42.380 --> 26:52.140
So, then I look for the attackers when essentially they dump IP.txt to some system and then I have an actual network map that I can go on because the attackers have left their forest, fortunately.

26:52.140 --> 26:57.160
So, that's literally the only insight that we have to what's actually on the network is what the attackers have done.

26:57.200 --> 27:03.020
So, you can't be just spending money while you have all of these gaping holes that just have never been addressed.

27:03.020 --> 27:12.760
You have to do a serious and honest and truthful evaluation of what you currently have already before you make a decision on what you're actually going to do to try to improve.

27:13.480 --> 27:16.600
And related to that, skills versus tools, right?

27:16.600 --> 27:29.660
Should you be investing in your staff and in their skills, training, sending them to conferences like DEF CON where they can learn from the community what others are doing and increase their capabilities instead of buying tools?

27:29.840 --> 27:31.320
Thoughts on that, anyone?

27:32.440 --> 27:34.420
I have strong feelings.

27:35.220 --> 27:39.300
So, I think it's both.

27:40.080 --> 27:48.980
So, you really need to invest in your people but don't overtax them so much that you're not giving them the tools to work with so that they're getting alert.

27:49.240 --> 27:56.480
You don't want to have them working with the bare nothing and then getting mad at them when they miss something.

27:56.480 --> 28:12.960
So, you know, take the team you have and really build them up but then also listen to them on their level of what they'd like to use and what they'd like to have and use that training of sending them to conferences and coming back and gathering that information to inform your decisions.

28:12.960 --> 28:22.460
And I think that it really needs to be that whole cycle of you're investing in their education and then going to conferences and networking and letting them come back to you with a solution.

28:22.580 --> 28:26.060
And that is going to sometimes be investing in tools for them.

28:27.080 --> 28:29.060
Yeah, I agree 100%.

28:29.060 --> 28:34.760
You know, you really want to listen to your team, you know, listen to their experience, right?

28:35.060 --> 28:47.980
You know, get them to get out there and participate in the community and learn what works and, you know, take their advice on those areas, you know, and figuring out where to invest in your team.

28:48.260 --> 28:54.100
So I wanted to talk a little bit about IR teams and folks who want to get into IR.

28:54.100 --> 29:04.380
So, you know, I think they're two related topics, but a lot of people have asked if we could give, you know, what's your best advice for people who are interested in getting into the incident response field?

29:07.680 --> 29:10.300
And that's for anyone who wants to go first.

29:10.300 --> 29:11.640
I'll go first.

29:11.640 --> 29:26.420
So my personal opinion on how to get into IR or really kind of any info sec, like specific sort of doctrine at all is just to simply be curious, like ask questions, try to research stuff on your own, figure things out.

29:26.420 --> 29:35.660
Like you may not be the best person at assembly or firmware architecture or IR or malware reversing or anything like that.

29:35.660 --> 29:44.140
But as you find questions and, you know, find things that you're curious about and want to research and learn more about, like you'll generally kind of find an area that you want to go down.

29:44.140 --> 29:53.520
And at the end of the day, like you have to kind of decide if you want it to be a typical job where you work eight to five every day and show up and you get paycheck and that's it.

29:53.520 --> 30:03.100
Or if you want it to be a career and you actually want to be good and want to actually, you know, be better at what you do and be more effective and be more efficient and network with people and all of that.

30:03.100 --> 30:12.700
And it's not really a lifestyle decision so much as it has to be an internal passion and desire that you actually want to do something.

30:18.120 --> 30:20.460
Anyone else want to comment on that one?

30:22.080 --> 30:30.420
I want to say that you're safe, but I will, I'll chime in and say everything that Brian said absolutely settled down on that.

30:30.420 --> 30:40.740
But just know that there's no wrong path and that to you can do anything in your spare time that you're passionate about and turn it into IR.

30:40.740 --> 30:47.760
The difference is what I typically see in good IR is you don't stop at the first answer.

30:47.980 --> 30:50.680
So, and you don't stop at the second answer either.

30:50.820 --> 30:59.520
It's this stubbornness and that drive of being stubborn to where, okay, make yourself a home lab, image your own devices, break them.

30:59.520 --> 31:05.120
Like see what you can do and see what you're seeing and use that to train yourself.

31:05.260 --> 31:12.800
And it really is something that it takes a lot of training and that there's not just you're there one day.

31:12.800 --> 31:19.640
So, I'll admit myself, I get imposter syndrome a lot, but that's because every day I have to Google.

31:19.640 --> 31:27.060
There will be something every day that I don't know the answer to or I haven't seen before and I am researching the hell out of it.

31:29.600 --> 31:40.100
I'm saying sometimes it feels like I'm banging my head against the wall, but that doesn't go away.

31:40.100 --> 31:45.340
And so, if you're okay with that and you have the personality that has that drive, you're going to do great.

31:45.920 --> 31:52.520
And being, like listening to this right now, it shows enough that you're willing to listen to the five of us ramble for an hour.

31:52.560 --> 31:57.720
You're probably in good company and you should probably just keep pursuing this.

31:59.920 --> 32:14.400
One of the, on that line, you know, talking about getting into IR, talk to the, you know, more along the lines of the type of work and particularly about the stress.

32:14.820 --> 32:19.320
You know, typically IRs, you're more like a fireman.

32:19.780 --> 32:24.380
You're dealing with sometimes some high stress situations.

32:24.740 --> 32:38.140
And so, any comments or suggestions for the listeners around, you know, kind of dealing with the excitement and the stress that can come along with being part of an IR engagement?

32:39.180 --> 32:49.140
Well, I think one of the things that you have to take into account is, so first of all, like from an IR perspective, like you have to try your best to be calm.

32:49.140 --> 32:57.100
Like you can't overreact like everybody else, like let everybody else overreact, let everybody else run around and scream and yell and all of that.

32:57.100 --> 32:58.720
Like you have to be the calming voice.

32:58.740 --> 33:03.500
However, that doesn't mean internally, you're not screaming and yelling too, because you absolutely are.

33:03.500 --> 33:06.980
You just have to portray yourself as having that calming presence.

33:07.260 --> 33:17.880
And you also have to essentially, not necessarily, not necessarily have the right answer, but you have to have a answer because the path to recovery always starts with one step forward.

33:17.880 --> 33:22.660
And it doesn't matter if that step is even down the wrong path initially, like you just have to go forward.

33:22.660 --> 33:29.780
Because the takeaway that you can always have, no matter what, is somebody out there has it much worse than you currently do.

33:29.780 --> 33:41.280
And you always have to remind yourself, like as bad as everything is, like there's some company out there that got owned and they are in, unbelievably, an even worse situation right now than you are.

33:43.400 --> 33:50.780
I think that everybody in IR is a little bit of an adrenaline junkie, and that you're kind of lying to yourself if you're not.

33:50.780 --> 33:55.700
Brian, didn't you go like space jumping or something at one of the cons that we've been to recently?

33:55.920 --> 34:02.100
Yeah, I jumped off the stratosphere in Vegas a couple of years ago, twice, because I wanted to.

34:04.540 --> 34:12.120
I was going to take the question and ask each of you individually, you know, how do you get away from it?

34:12.120 --> 34:13.700
How do you deal with the stress?

34:14.660 --> 34:18.700
So Brian goes jumping off the stratosphere in Las Vegas.

34:19.580 --> 34:21.120
How about you, Moose?

34:21.120 --> 34:22.340
How do you get away from this?

34:22.340 --> 34:23.480
What are your breaks?

34:25.760 --> 34:28.480
Well, it's twofold, right?

34:28.480 --> 34:34.200
Like, everything I see on a daily basis, it's somebody else's worst day.

34:34.200 --> 34:36.220
I don't work for their company.

34:36.220 --> 34:41.520
And I had to realize this about myself and every job I've had.

34:41.520 --> 34:43.160
So I've not always been IT.

34:43.160 --> 34:46.760
I used to be vet tech, I used to be medical, I was a lifeguard.

34:46.760 --> 34:53.680
All of these things have a similar, like, vibe in that it's really high stress, but it involves helping.

34:53.820 --> 34:59.880
So I think, to me, my release is in seeing that step forward and that progression.

34:59.880 --> 35:11.540
And even if it's not happening right away, being able to reassure the people that I'm working with that it is truly happening, at the end of this, their environment will be better than we left, than it started at.

35:11.760 --> 35:25.500
And then, if that doesn't do it, I have cats and a violin, and on the worst day, I'll just shut everything down, everything gets unplugged, and I open up the violin case, and I walk away.

35:25.500 --> 35:30.560
And I think that's really important, is that you don't have to eat, sleep, and breathe this.

35:30.560 --> 35:33.040
You really should walk away sometimes.

35:33.180 --> 35:35.180
And that's what's kept me alive.

35:38.380 --> 35:39.760
And how about you, Virus?

35:39.760 --> 35:47.540
I mean, it sounds like you certainly have some of the adrenaline junkie in your experiences, in your past, breaking into buildings, you know?

35:47.540 --> 35:50.100
So what do you do for breaks?

35:51.960 --> 35:52.760
Shenanigans.

35:55.000 --> 35:58.940
I mean, I guess the first thing is, like, don't get stressed.

35:58.940 --> 36:00.380
Like, that's a big part of it.

36:00.380 --> 36:09.980
I mean, I've made a lot of... I've definitely steered a fair amount of my career decisionary of, like, you know, when I finish an arc, I go, did I like that?

36:10.080 --> 36:12.980
Or was it just stress in the bad kind of way?

36:13.100 --> 36:16.620
And then I use those takeaways to just not do that anymore.

36:16.620 --> 36:19.140
You know, kind of quantify how much my time is worth.

36:19.140 --> 36:26.420
Because if I spend the whole time when I'm not at work, stressed out about work, then I'm essentially working for free.

36:26.420 --> 36:29.660
So if I factor that into my paycheck, I'm like, oh, this isn't that worth it.

36:29.660 --> 36:32.880
So that's definitely the first step, is just don't do stuff that stresses you out.

36:32.880 --> 36:34.680
You know, know what your zeal is.

36:35.480 --> 36:40.140
But on a practical level, like, I played music for, like, 25, 30 years, semi-professionally.

36:40.140 --> 36:41.020
So, you know, I do that.

36:41.020 --> 36:42.140
I kind of zen out.

36:42.600 --> 36:43.340
I cook.

36:43.340 --> 36:44.100
I dry-age meat.

36:44.100 --> 36:45.300
I make my own gin.

36:45.300 --> 36:46.500
You know, I like scotch.

36:46.500 --> 36:47.680
I do a lot of drugs.

36:49.240 --> 36:51.540
And then I play with my boy.

36:51.540 --> 36:55.780
You know, I'll stand up from my desk when I'm working on a hard problem and just say, hey, let's go for a rock.

36:55.780 --> 36:56.340
And he's great.

36:56.340 --> 36:57.420
So that's amazing for him.

36:57.420 --> 36:57.820
It's great.

36:57.820 --> 36:59.780
He just runs around.

37:01.500 --> 37:07.680
But yeah, it's, I mean, you know, I think a lot of it is just you got to be holistic about your approach.

37:07.680 --> 37:10.160
And if you love the chase, you got to love the chase.

37:10.160 --> 37:11.560
And you got to love your chase.

37:11.560 --> 37:15.660
You got to love the chase that you're in and know where it is and just not lie to yourself.

37:15.660 --> 37:17.480
You can't, you know, do it.

37:17.480 --> 37:22.360
And I mean, there's definitely an undercurrent if I'm being extremely frank and extremely personal about it.

37:22.360 --> 37:39.380
I do think people that, I think there's a fair amount of people on the blue side, specifically, who have a very, I don't want to say ethical, but they have a very empathetic attachment to the world, slightly larger, maybe than most red teamers do, where at some level,

37:39.380 --> 37:41.780
they're kind of in it because they want to, they want to fix something.

37:41.780 --> 37:43.180
They want to make something a little better.

37:43.800 --> 37:51.700
And I don't know, I mean, I wouldn't call myself a complete prick, but I'm definitely on the side of like, yeah, I like money.

37:51.700 --> 37:52.580
Yeah.

37:53.860 --> 37:57.540
Long as I moved the needle a little bit and I got paid, I'm not too worried.

37:58.000 --> 37:59.900
Maybe that's a whole other conversation.

38:00.200 --> 38:05.180
If someone knows you from the outside, you're one of the nicest people I know, so that's a lie.

38:08.100 --> 38:27.580
If we could get back on the topic of, you know, of the IR field and IR teams , we had a question in the BTV discord about, you know, what are your top recommendations, and maybe some don'ts, you know, for growing your SOC and your IR team?

38:27.580 --> 38:43.120
You know, if you're at a company and, you know, it's growing and, you know, you get budget to have some full-time folks doing security operations and, you know, skills and tools ready to do incident response, you know, where do you want to focus?

38:43.120 --> 38:45.620
You know, what skills do the folks need to have?

38:45.940 --> 38:47.820
What are some of your preferred tools?

38:47.820 --> 38:52.540
And I know it depends a lot, but just in general, you know, where would you focus?

38:52.540 --> 38:53.920
Brian, why don't you go first?

38:54.980 --> 39:08.640
Well, I think it goes back to... it very much does depend, but it also depends on what you currently have already and essentially what you have the ability... what you want to essentially try to strive for.

39:08.640 --> 39:21.040
Like, if you want to go a very, very, you know, cheap route as much as possible, you would use something like OS query or use something like Velociraptor and, you know, try to essentially keep it on the cheaper side.

39:21.040 --> 39:23.760
But, you know, at the end of the day, it's still going to be able to work.

39:23.880 --> 39:29.360
Of course, if you have unlimited budget, like, you just line up boxes, you know, like crazy, and then you have all the tools and everything.

39:29.360 --> 39:33.500
But, you know, to be completely honest, that's not feasible for anybody.

39:33.500 --> 39:39.720
Like, companies will not just blindly give you ridiculous amounts of money to spend on people and tools and resources.

39:39.720 --> 39:44.340
So, you have to try to make whatever you have work with what you can.

39:44.340 --> 39:45.860
And that's one of the things that I stress.

39:45.860 --> 39:49.300
It doesn't necessarily matter what the dollar amount is.

39:49.300 --> 39:52.580
It's trying to make every dollar count as much as possible.

39:52.580 --> 39:56.080
So, that way, at the end of the day, you end up with a truly better result.

39:56.080 --> 39:58.400
If you have a very high budget, great.

39:58.400 --> 39:59.860
Like, you can afford expensive tools.

39:59.860 --> 40:01.880
But do you really need those expensive tools?

40:01.900 --> 40:11.680
Do you really need an expensive person to come in maybe for, like, you know, three, six months or something like that and help train and make the team better to already use the stuff that they already have?

40:11.680 --> 40:21.580
You know, in that case, you could argue very much that bringing somebody in external for a little bit and helping them not really as a staff log, more of kind of like an overseeing mentorship almost.

40:21.580 --> 40:27.760
Like, that is a much better investment than just blindly buying, you know, a million dollars worth of random tools.

40:27.860 --> 40:30.220
So, it truly does depend.

40:30.220 --> 40:32.600
But, you know, it's like everything else.

40:32.600 --> 40:40.120
Like, you have to make a business decision about it and essentially try to maximize every dollar and get the best value for that as much as possible.

40:43.040 --> 40:48.300
You know, and we've used the word a few times in this panel, telemetry.

40:49.100 --> 41:04.040
You know, so, from my perspective, one of the first things that I would want to do is, you know, is set all that up, is set up, you know, a central logging system, whether it's SIEM, whether it's, you know, something much simpler.

41:04.220 --> 41:10.480
But, you know, for me, doing incident response, you know, those are the keys, right?

41:10.480 --> 41:13.040
I mean, I've heard it said, you know, logs are everything.

41:14.360 --> 41:30.440
And that that would be one of your first steps would be to make sure that you, you know, you're gathering enough information so that, you know, when an incident happens and just in general, you know, having logs has so much value for IT support, for everything that we do in security.

41:31.060 --> 41:35.040
My approach to this is really, it's like a three-step.

41:35.040 --> 41:37.600
It's like a three-layer moniker.

41:38.880 --> 41:51.940
So, I think the first thing that it's important to grasp is that a program, we talk about a program, whether it's an IR program or a security program, large or blue team program, a program is business process.

41:51.940 --> 41:53.060
That's what a program is.

41:53.060 --> 41:54.180
It's not blinky boxes.

41:54.180 --> 41:56.920
It's not even the talent in your bullpen.

41:56.920 --> 41:59.320
It's documented process.

41:59.320 --> 42:01.720
That is the definition of your program.

42:01.920 --> 42:05.720
So, the first rule is if you're going to build a program, build a program.

42:05.720 --> 42:13.180
That means encourage your people to, and this kind of leads into the second thing, which is tribal knowledge is the enemy, right?

42:13.180 --> 42:20.440
So, like the first job of everybody on the team is to take everything in their head and inject it into business process.

42:20.580 --> 42:21.540
That is your job.

42:21.540 --> 42:29.300
It doesn't matter if you are, you know, the self-proclaimed bottom rung of the team or if you're the epic gangster rock star at the top.

42:29.360 --> 42:34.600
Your job is to take whatever is in your head that applies to the program and to build the program.

42:34.600 --> 42:41.060
And the more that you encourage people to do that and the more that you reward them for doing that, it's like a self-incentivizing loop, right?

42:41.360 --> 42:47.720
That's how you balance burnout and all this other stuff because it's not focused on one person or one tool.

42:48.260 --> 42:54.820
And then, like I said, the second thing is, and I feel like this is way more common on red teams than it is on blue teams, and I kind of don't know why.

42:54.820 --> 43:02.580
It is extremely common on the red side to not use tools that are touted as being the latest and greatest thing just because you don't know them, right?

43:02.580 --> 43:08.660
I mean, as a red teamer, I feel like there's this moniker that is accepted more and I feel like it's true on both sides.

43:08.660 --> 43:10.460
So, I kind of don't understand why it's a lopsided .

43:10.460 --> 43:12.780
We're like, you know, it's the old ninja moniker, right?

43:12.780 --> 43:14.900
We're like, not every ninja uses every weapon, right?

43:14.900 --> 43:19.460
You have your weapon and it's got your epic moves in it and you know it like the back of your hand.

43:19.460 --> 43:21.940
It's almost an extension of yourself and that's the point.

43:22.000 --> 43:24.460
I don't really think that's different on blue team.

43:24.460 --> 43:36.820
I mean, case in point, the team I'm part of at Stripe that kind of got built about a year and a half ago, we were all very new to the company and was, you know, granted we were very fortunate to have leadership with a lot of experience and so they reached out and you know,

43:36.820 --> 43:42.900
there's a lot, there's an extremely high amount of experience and talent on my team that's a little bit askew for most.

43:42.900 --> 43:49.580
I'm not saying that to brag, I'm just saying, you know, a lot of teams don't have that in their tool bin.

43:49.580 --> 43:53.220
But the first thing we did was take what EDR we had and rip it out.

43:53.260 --> 43:59.540
We ripped out almost everything and then built everything off of bare bones telemetry because those were the systems we could use better.

43:59.540 --> 44:02.040
That would, that yielded better to our kung fu.

44:02.040 --> 44:07.980
And then from there, the third thing is build, like tool your kung fu.

44:07.980 --> 44:18.720
You know, take your brain dump, put it into your program and then hypothetically start from scratch and go what tools do we need to do this, what's written better?

44:19.420 --> 44:22.380
Frankly, every deviation from that is a waste of time and money.

44:22.900 --> 44:28.880
So you said that you ripped out your EDR and you built up bare bones telemetry are the things that are most useful to you.

44:28.880 --> 44:30.700
Can you elaborate on what those are?

44:31.200 --> 44:33.840
I mean, it's literally just stuff that's built into the OS.

44:33.840 --> 44:40.960
I mean, we use OS query at scale so that because we use the fleet manager concept in order to kind of achieve orchestration goals.

44:40.960 --> 44:44.160
But our detection system is entirely homegrown.

44:44.160 --> 44:46.980
Our response system is entirely homegrown.

44:46.980 --> 44:51.420
Our orchestration elements and the way that we do log tracking is entirely homegrown.

44:51.420 --> 44:53.080
Even our pace reporting.

44:53.080 --> 44:58.540
I mean, we're kind of sort of bubbling around the hive right now, but it's honestly, it's all Jupyter notebooks and Python.

44:58.540 --> 45:02.060
It's all just kind of manual tooling.

45:02.180 --> 45:13.340
And at the end of the day, if I take that and I put that in the ROI bin, we spent way less on human time writing some Python than we would ever spend on third-party utilities.

45:13.340 --> 45:17.540
And to be honest, most of the third-party utilities are trash.

45:17.540 --> 45:30.720
I mean, I won't pull any out just because I don't want anybody to kind of, you know, have to be under the boot because I said something, but like, man, there's just so much money spent on these tools that just don't even do what they say on the side of the box.

45:30.720 --> 45:33.040
I just, I don't understand why that flies.

45:33.040 --> 45:35.000
And then that's just, you know, I don't know.

45:35.000 --> 45:38.860
Say what you will about red team or blue team infra, at least the red team stuff does what it says.

45:38.860 --> 45:40.000
It just doesn't say a lot.

45:40.000 --> 45:41.840
Blue team stuff, man, this seems to be a problem.

45:41.840 --> 45:44.340
Cereal box, nutrient banks are just wrong.

45:48.420 --> 45:52.160
So, Rubix, you've built an IR team, right?

45:52.160 --> 45:55.300
I'm curious, you know, your thoughts on all this.

45:56.220 --> 46:04.220
Yeah, you know, it was, I always go back to the, you know, kind of build it using the fireman analogy.

46:04.320 --> 46:12.740
So IR for, you know, a, you know, we're in financial services, there's a whole lot of downtime.

46:12.800 --> 46:30.780
And so figuring out how to practice and be ready for the big event and giving them enough work of a real, you know, I guess, you know, smaller level incidents to be able to stay busy and relevant, but then also, you know, plenty of time to prepare for,

46:30.780 --> 46:32.920
you know, bigger stuff.

46:32.920 --> 46:46.960
And so, you know, lots and lots of practices, you know, tabletops, drills, and, you know, encouraging our red team to really give us some good scenarios.

46:46.960 --> 47:07.700
And so I think that if you are, you know, not balancing that, you know, if your guys are all, or folks are always spending time, you know, doing, you know, we talk about being really busy, that they might not be honing their skills enough.

47:07.700 --> 47:14.920
And so, you know, finding that balance between, you know, doing and training and practicing was very key.

47:19.800 --> 47:27.700
I think the one thing I have to add to that, and everybody else has given really good advice here.

47:28.200 --> 47:34.020
And this is a part that I'm really passionate about, because it's one of the reasons that we lead companies.

47:34.180 --> 47:37.780
Don't silo your people and listen to what they have to say.

47:37.780 --> 47:42.720
If you have somebody on your team, it doesn't matter what notch in the chain they are.

47:42.800 --> 47:55.400
If you're calling on them for some kind of instant response, whether it be a SOC person, somebody who's doing sys admin work, someone who's a network admin, you're trusting them with that role.

47:56.060 --> 48:00.200
Trust them if they say they have a passion in response as well.

48:00.200 --> 48:10.600
Let them play in other fields, because there is not a silo in incident response for our attackers, so there really shouldn't be a silo for our responders.

48:11.000 --> 48:18.140
And one of the reasons that I work where I work is because there are some days where I'm not incident response.

48:18.140 --> 48:20.540
I have the freedom to do red team stuff.

48:20.540 --> 48:24.840
I have the freedom to help build our tools if I want to, or scripts.

48:25.260 --> 48:33.820
Some of the most brilliant scripts I've seen to date were built by my teammates in response to the Citrix vulnerability, for instance.

48:34.260 --> 48:43.060
So, you know, knowing where your strengths are on your team and building those, and then listening to them and what they say they need.

48:43.060 --> 49:05.460
Because, you know, if you're the one building, that assumes that you're at a higher level position, and I think that's really key, is to... my cats are wrecking the apartment right now, so if you hear anything bad, that's what I keep looking over for,

49:05.460 --> 49:07.900
is anytime I'm on one of these, they wreck something.

49:07.900 --> 49:15.980
So anyways, but listening to those people that you've hired, and obviously you trusted them enough in the first place to hire them.

49:15.980 --> 49:26.560
They're smart people, and we're smarter not because we know something, but because we know who to go to when we need certain knowledge.

49:26.560 --> 49:38.080
And I think leaning on your teammates, no matter what level they are in your company, having that kind of group decision is still important.

49:38.720 --> 49:58.680
Yeah, I think that's really great advice, you know, that more companies should heed, to try to cross-train their folks and give folks time for training and for research, right, and have budget for tools and devices, right, and lab time.

49:58.680 --> 50:01.100
I think it's really important.

50:02.420 --> 50:08.760
So I wanted to pivot and talk about ransomware.

50:08.780 --> 50:17.760
So we had a passionate discussion about this yesterday, and I'd like to try to rehash some of that for our attendees.

50:18.140 --> 50:29.040
And to kick it off, earlier today, the Blue Team Village Twitter, we posted a poll, and we were looking for people to give us their opinions.

50:29.280 --> 50:34.680
The poll question is, your organization is the victim of a ransomware attack.

50:34.680 --> 50:36.660
Should you pay the ransom?

50:36.980 --> 50:43.280
And about 89% of the responders said no, and about 11% said yes.

50:44.080 --> 50:50.260
I think, you know, in summary of our discussion yesterday is, it's not that simple.

50:50.400 --> 51:00.580
But, you know, for the benefit of everyone who wasn't in our private discussion yesterday, you know, what goes into the decision of paying the ransom or not?

51:00.580 --> 51:04.820
And I think Moose started first yesterday, if you want to go first again today.

51:06.220 --> 51:07.100
Sure.

51:07.680 --> 51:14.860
This is the most, like, let me tell you right now, this question made my blood pressure, like, go up a little bit.

51:14.860 --> 51:18.780
Because for me, when somebody says, do I pay the ransom?

51:19.100 --> 51:25.920
On any call I have, or even if I've been in person, I look at them and say, well, what does your legal team say?

51:25.920 --> 51:32.800
And that's still kind of my answer, is that I don't think you should make that decision for your business in a vacuum.

51:32.920 --> 51:43.400
And I usually recommend that people talk to either their internal counsel or have external counsel involved in that decision making process.

51:44.020 --> 51:47.680
And not necessarily make a decision for themselves.

51:48.540 --> 51:58.020
Because these are, if you look at it this way, the way I like to frame it, because I'm not going to say yes or no, spoiler alert, I'm not going to say yes or no, because it really does depend.

51:58.280 --> 52:01.380
And that's not my decision as a responder to make.

52:01.380 --> 52:07.120
But I think that the most intelligent things I've seen done was calling on experts who do this every day.

52:07.120 --> 52:11.660
Because if you think about who hit you, you're not their first hit.

52:12.000 --> 52:17.400
You're not the first people, they've probably ransomed, they've hit other companies.

52:17.560 --> 52:23.520
These are professional criminals that are going after you almost all the time, if they're exporting you for something.

52:23.840 --> 52:26.360
So get a professional to represent you.

52:26.360 --> 52:27.740
That's kind of my opinion.

52:27.740 --> 52:30.440
And I will preface that with that as well.

52:32.340 --> 52:33.500
Okay.

52:35.280 --> 52:42.800
Brian, you kind of immediately had a, you know, from the heart response that you then elaborated on.

52:42.800 --> 52:45.220
Could you share that with all of us?

52:45.260 --> 52:52.180
So as Brian Moran, human being, my first response is always no.

52:52.180 --> 53:00.640
However, that is simply me as a human being, because I don't feel that it's right to pay criminals for doing a crime.

53:00.860 --> 53:08.940
However, we'll preface all of that with put on the consultant hat, the business process hat and all of that.

53:08.940 --> 53:17.700
And honestly, the answer is more than likely, it's usually cheaper to pay the ransom than it is to deal with the cost of everything else involved.

53:17.700 --> 53:26.560
Like, it should never, just like it should never be anybody on the InfoSec team ever.

53:26.560 --> 53:28.260
It should never, ever be their call.

53:28.260 --> 53:31.500
It should be legal's call because legal absolutely needs to be involved.

53:31.500 --> 53:34.740
Not just from the perspective of, is this okay with the company?

53:34.740 --> 53:42.200
Also from this perspective of, you know, you're potentially looking at paying somebody in another country, like, are there sanctions against that country?

53:42.200 --> 53:46.500
Like right there, you could violate even more laws just by paying the ransom.

53:46.580 --> 53:59.140
So now you're in double because all your debt is gone and now you're getting sanctions and fines and investigations levied on you because you are literally, you know, potentially financing something that you shouldn't be financing.

53:59.240 --> 54:01.840
So it's not our call to make at the end of the day.

54:01.840 --> 54:07.420
Like, you know, we can respond and say, here's X, Y, and Z, here's our thought process.

54:07.420 --> 54:17.120
But generally from the overall business perspective, it's usually much cheaper just to pay the ransom and be done with it than to deal with any of the public scrutiny, deal with any of that.

54:17.120 --> 54:19.120
But, you know, we're not lawyers.

54:19.120 --> 54:22.460
I don't think any of us are even going to pretend ever to be a lawyer.

54:22.460 --> 54:26.740
Like, even if we say at a Holiday Inn Express, we are definitely not lawyers by any stretch of the bean.

54:26.740 --> 54:39.440
So we can have our opinion and we can give you thoughtful, evaluated opinions, but like our actual thoughts at the end of the day truly don't matter because it 100% decides on legal and what the course forward is from them.

54:40.640 --> 54:42.040
Yeah, thank you.

54:42.860 --> 54:50.520
You know, I think a lot of folks have that reaction of, no, you know, I don't want to pay criminals, but there is so much to the decision to be made.

54:50.920 --> 54:56.400
And Virus, you came at this from a different angle than I've ever really thought about it.

54:56.400 --> 55:04.220
And that angle was about ransoms and kidnappings and kind of relating ransomware to that type of crime.

55:04.220 --> 55:06.900
Could you, could you rehash that for everyone?

55:06.960 --> 55:17.660
So I basically distill everything that I tried to kind of get across in our joint meeting as ransomware is a crisis.

55:17.660 --> 55:19.520
The breach that put together is an incident.

55:19.980 --> 55:29.920
So if you have a flat out answer on whether or not you should pay the ransom when it comes to ransomware, you're doing it wrong because that's not how crisis management works.

55:31.220 --> 55:51.620
And I don't understand why as even an industry InfoSec would try to solve crisis management when every major Western power, every branch of every military and military contractor that's worth their salt, every political, you know, wing contractor, I mean,

55:51.620 --> 56:04.060
crisis management is a well understood science that has been researched by every tactical engagement and business risk school in the world forever.

56:04.240 --> 56:11.180
And the fact that the thing that's being ransomed is a piece of electronic capital versus human capital does not change the game.

56:11.180 --> 56:15.480
I just don't understand why people would insist on coming up with a pat answer for that.

56:15.480 --> 56:16.880
I think it's stupid.

56:16.880 --> 56:29.220
And while I think that, you know, the response to a ransomware crisis, because it is a crisis, will likely involve legal, I don't necessarily think that legal is the end all be all shop on that.

56:29.220 --> 56:30.680
It probably is at most shops.

56:30.680 --> 56:31.340
But you know what?

56:31.340 --> 56:32.980
The world is bigger than the law.

56:33.780 --> 56:45.240
You know, I could tell you all day long about, and all of you could too, about every major insert fortune 500 company here, where they have a crisis management team that has nothing to do with computers.

56:45.240 --> 56:52.760
And I guarantee you, the first stop they call when the CEO gets kidnapped by, you know, random activists in South America on a business trip is not the lawyer.

56:52.760 --> 56:53.960
They're like the third.

56:54.040 --> 56:57.320
So I don't know why it's different because it's a computer and not them.

56:57.360 --> 57:03.460
And then after you handle the crisis, however you handle it, maybe it's paying, maybe it's not, maybe it's using shadow currency.

57:03.460 --> 57:04.220
I don't know.

57:04.220 --> 57:04.820
Right?

57:04.820 --> 57:08.860
Then you handle the incident, which is if you have ransomware, you were breached.

57:08.860 --> 57:09.940
Don't handle that.

57:09.940 --> 57:11.120
That's your incident.

57:11.120 --> 57:12.880
The ransomware, that's not an incident.

57:12.880 --> 57:14.320
That's a crisis.

57:15.500 --> 57:31.840
With the shift of a lot of ransomware actors, for example, Maze, to not only just destroy anymore, but also, you know, steal the data, threaten to, you know, do more stuff with it than just destroy it.

57:32.360 --> 57:36.860
Has that changed your way of dealing with ransomware?

57:40.370 --> 57:42.750
It has in my advice.

57:42.850 --> 57:56.870
So I'll go ahead and speak to that in that I have given a little bit of advice, you know, working with a legal team, of course, if it makes sense for the company and with their backing.

57:57.030 --> 57:58.750
So all of that included.

57:58.750 --> 58:01.110
So assume that to from the get-go.

58:01.110 --> 58:09.190
But, you know, a lot of these groups that do extortion, they're saying that they have something and usually they'll serve up what they have.

58:09.770 --> 58:22.790
If there is at all 24 hours that you can buy your IR team to investigate if that claim is true or not, negotiate and buy the team time.

58:22.790 --> 58:43.810
If you can figure out if what they say was exposed is true, and if there's any more to that, so if they've gotten more than they say they have, take that time and lean on your investigations team to see that extra piece and see if you can see that creation and that within your system.

58:43.830 --> 58:56.230
And that's a very hard thing to do in a short amount of time, especially because it assumes that you have full visibility at every endpoint on the network of your company.

58:56.950 --> 59:05.010
And to have that kind of visibility to begin with is incredibly difficult for your team, let alone the outside team.

59:05.250 --> 59:18.230
So I would say that the good things that come out can come out of that, not that I'm for negotiating with jurists, so to speak, that are withholding your data and extorting you for money.

59:19.230 --> 59:33.810
But, you know, sometimes I've seen outside counsel get a lower price so that if you are going to pay, but time is valuable too, and having that on your side is important.

59:37.410 --> 59:49.410
Yeah, I think one of the things that is hugely important, but also at the same time incredibly underrated, is the way that ransomware works.

59:49.410 --> 59:50.770
Ransomware is a business.

59:50.930 --> 59:54.810
Just like any other business, ransomware at the end of the day is just a business.

59:54.810 --> 01:00:07.070
And I don't recall seeing personally, and I'm sure it's happened, but I don't recall a case personally where the actors have claimed to have something and they truly did not, that they were bluffing.

01:00:07.290 --> 01:00:13.130
Because if you're running a successful business, you're not going to lie about what you have and everything.

01:00:13.130 --> 01:00:15.150
Well, unless you're Enron and stuff like that.

01:00:15.150 --> 01:00:20.470
But for the most part, you're not going to actually not tell the truth about certain things.

01:00:20.590 --> 01:00:29.210
So if they claim that they exfil data and you as a company have no way to prove that, like number one, you're already in way worse problems than having ransomware.

01:00:29.210 --> 01:00:32.550
Like you have so many other problems that you need to deal with.

01:00:32.670 --> 01:00:38.950
But if they claim that they have something and they more than likely do, and then you have to evaluate the cost of all that.

01:00:38.950 --> 01:00:40.270
Well, what if that data goes public?

01:00:40.270 --> 01:00:42.850
What if that data goes even more publicly widespread?

01:00:42.850 --> 01:00:46.070
What if that data is then sold to other places and everything like that?

01:00:46.070 --> 01:00:49.310
And you have to take all of that into account with the entire process.

01:00:49.310 --> 01:00:56.990
And we often try to look at it much as a pure like, essentially, is there a correct answer?

01:00:56.990 --> 01:00:58.230
Or is there not a correct answer?

01:00:58.230 --> 01:00:58.910
Is it a yes?

01:00:58.910 --> 01:00:59.670
Or is it a no?

01:00:59.670 --> 01:01:02.410
And it's never just a yes or no.

01:01:02.410 --> 01:01:06.490
There are so many factors that you have to take into account all of that through it.

01:01:06.490 --> 01:01:12.830
And we in the information securities field, we only see a very small portion of all of that.

01:01:12.830 --> 01:01:16.610
So you have to involve other people, you have to involve other people in the process.

01:01:16.610 --> 01:01:27.450
But just like it was said, if you have ransomware, I guarantee you have at least five other problems besides just how ransomware got there.

01:01:27.450 --> 01:01:30.590
You have a lot of problems that need to be addressed.

01:01:30.590 --> 01:01:33.710
Ransomware is the big public facing thing on all of that.

01:01:33.710 --> 01:01:36.890
But there are so many problems that need to be addressed internally.

01:01:36.930 --> 01:01:44.490
And then you as the practitioner have to take into account, all right, here's my little take on the ransomware, here's all that.

01:01:44.490 --> 01:01:47.770
And then essentially, that decision goes to somebody else.

01:01:47.770 --> 01:01:53.190
But ransomware, I've never seen anywhere where like, oh, well, we got infected with ransomware.

01:01:53.190 --> 01:01:54.770
And that's the only problem that they have.

01:01:54.770 --> 01:01:57.410
There are many, many other gaping holes that they absolutely have.

01:01:57.410 --> 01:01:59.190
I can guarantee that.

01:02:00.110 --> 01:02:08.830
And on that note, unless somebody else wanted to say something else on ransomware virus, were you about to speak up?

01:02:08.870 --> 01:02:11.770
I was just going to answer Rubik's question.

01:02:11.770 --> 01:02:13.310
Yeah, go for it.

01:02:13.310 --> 01:02:19.870
If I understand the question correctly, it was in a nutshell does introducing extortion into the ransomware topic change the game?

01:02:20.210 --> 01:02:29.670
So my answer to that would be no, at least not for me, because I've already given my two cents on how I think that the orchestration of the conversation on ransomware is wrong.

01:02:30.890 --> 01:02:34.590
In terms of have I seen it change the game?

01:02:35.290 --> 01:02:36.750
I would say yes.

01:02:36.750 --> 01:02:42.730
And I would say the way that I think it is changing the game is that counterintelligence is a thing.

01:02:42.890 --> 01:02:43.890
Counterterrorism is a thing.

01:02:43.890 --> 01:02:45.930
Black on black kill squads are a thing.

01:02:45.970 --> 01:02:48.290
And they have always been a thing in blue team.

01:02:48.290 --> 01:02:50.570
They just haven't been very talked about.

01:02:50.950 --> 01:02:58.830
Because until words like hacking backs that are being introduced into the info set conversation, those were mostly gray areas to a lot of professionals.

01:02:58.850 --> 01:03:08.510
My experience is that the reintroduction, because I have seen it before, especially dealing with like adult fields, it's way more common than what I've seen in corporate space.

01:03:08.510 --> 01:03:10.770
And now I'm seeing it a lot more in the corporate space.

01:03:11.750 --> 01:03:16.110
I think those areas are getting a lot less gray.

01:03:16.110 --> 01:03:21.810
And they're showing up on the radar of a lot of risk teams, because they're starting to realize that that's how you fight this.

01:03:22.330 --> 01:03:26.990
But again, is my prescriptive advice that there should be more of that?

01:03:26.990 --> 01:03:30.510
No, that doesn't answer the question.

01:03:32.550 --> 01:03:33.130
Awesome.

01:03:33.130 --> 01:03:33.710
Thank you.

01:03:33.710 --> 01:03:35.730
Any other comments on ransomware?

01:03:37.510 --> 01:03:56.030
I will say that the other thing that I've seen is ransomware used to be kind of a singular program that executes and they've got this programmatic way of doing destruction, is that now when you hear of ransomware, it's a full-on incident.

01:03:56.030 --> 01:04:01.150
They have a number of backdoors, they have a number of accounts, right?

01:04:01.150 --> 01:04:10.550
You can't just go and contain it and say, we found ransomware on five machines, we've re-imaged those five machines, we're good.

01:04:10.710 --> 01:04:19.050
Now they're going to have spent some time in your environment, stolen accounts, have other ways of getting back in.

01:04:19.050 --> 01:04:26.390
And so you really have to do a full incident response, find out all the things that the attacker got.

01:04:26.390 --> 01:04:30.870
It's no longer a simple case like we used to deal with.

01:04:32.930 --> 01:04:47.450
The only other thing that I would add, this is the hill I die on, because I'm one of our, say, Linux enthusiasts, where I work, is most people associate ransomware with Windows.

01:04:48.010 --> 01:04:53.710
And while that's the case, that doesn't mean you should ignore your Linux environment and never assume.

01:04:53.710 --> 01:05:13.530
So make sure that you're building that up and you're looking at it, and don't ever assume that it's just, you know, if I have access to your environment and I'm a bad guy, if you give me an easy pivot point, why shouldn't I do good?

01:05:13.990 --> 01:05:17.510
So kind of have that in the back of your mind.

01:05:17.550 --> 01:05:22.230
And don't, like, go tunnel vision only on your Windows systems.

01:05:22.590 --> 01:05:24.890
And don't make it easier.

01:05:27.440 --> 01:05:29.440
Sorry, Virus, I didn't mean to.

01:05:30.800 --> 01:05:34.940
I just never heard anyone say that ransomware is a Windows thing.

01:05:34.940 --> 01:05:40.260
I'm like, there's been ransomware on mobile phone boot roms since, like, 2001.

01:05:40.260 --> 01:05:41.980
Who are these people?

01:05:41.980 --> 01:05:45.240
I hear it.

01:05:45.240 --> 01:05:45.940
I do.

01:05:45.940 --> 01:05:46.620
I hear it.

01:05:46.620 --> 01:05:53.200
I hear that this usually only hits Windows and look at the Windows environment and all that.

01:05:53.200 --> 01:05:55.860
And sometimes that's absolutely true.

01:05:55.860 --> 01:06:00.340
But you should be scanning for lateral movement to everything.

01:06:00.340 --> 01:06:01.140
Don't assume anything.

01:06:01.140 --> 01:06:01.820
What about Max?

01:06:01.820 --> 01:06:03.660
I thought Max were immune from viruses.

01:06:07.540 --> 01:06:08.080
Mainframe.

01:06:08.080 --> 01:06:09.740
Move everything to the mainframe.

01:06:09.740 --> 01:06:12.060
There's no mainframe viruses.

01:06:12.180 --> 01:06:12.840
Yeah.

01:06:13.060 --> 01:06:17.040
So we've already gone over time a little bit, but I think we have about 10 minutes left.

01:06:17.060 --> 01:06:26.640
And so I wanted to kind of reward the folks who have stuck around through all of this very, very serious conversation on incident response and try to end on a lighter note.

01:06:26.980 --> 01:06:40.040
And so I was going to ask each of you if you could share one good story about, like, one of the craziest things that you've seen, whether it was on a response or, you know, in some of your own actions, Varys.

01:06:40.040 --> 01:06:43.240
And I will remind you that this is being recorded.

01:06:46.040 --> 01:06:47.900
So who wants to go first?

01:06:51.640 --> 01:06:53.360
Anybody got one queued up?

01:06:54.120 --> 01:06:57.240
I have one kind of queued up a little bit.

01:06:57.240 --> 01:07:00.500
So this is actually a combination of two.

01:07:00.500 --> 01:07:04.440
So one is the worst thing that I've ever seen in an environment.

01:07:04.540 --> 01:07:14.400
The worst thing that I've ever seen in an environment was there's a firewall company, who is a very, very popular, very, very known firewall company.

01:07:14.940 --> 01:07:21.600
And for whatever reason, they somehow implemented all of these firewall rules that were okay.

01:07:21.600 --> 01:07:22.260
They weren't great.

01:07:22.260 --> 01:07:23.360
They were just okay.

01:07:23.360 --> 01:07:26.660
And then somebody put in a triple anti-firewall rule.

01:07:26.660 --> 01:07:29.020
Not a double, an actual triple any.

01:07:29.020 --> 01:07:30.400
So it was any, any, any.

01:07:30.640 --> 01:07:38.680
Come to find out from speaking with someone who will rename nameless, but is on this panel, that company actually allows you to have as many as five anys.

01:07:38.680 --> 01:07:47.580
So not only is there a problem with five anys, like even the option for you to be able to put that many anys in something, like, that doesn't make any sense.

01:07:47.580 --> 01:07:49.680
Like, what are they possibly thinking?

01:07:49.680 --> 01:07:55.000
Like, we're just going to make sure no matter what, that you can actually find some way through our firewall.

01:07:55.440 --> 01:08:00.500
So the hybrid of that is it was with the same client.

01:08:00.860 --> 01:08:09.260
It was kind of a cool story, because we had a chance to talk about it, I believe, last year in New Orleans, because the actual indictment came down.

01:08:09.360 --> 01:08:15.260
So they were a part of a breach that was essentially targeting the aerospace industry.

01:08:15.400 --> 01:08:17.740
And the attackers did all kinds of stuff.

01:08:17.740 --> 01:08:30.420
So we were able to actually go through essentially, like, their Gen 1 through Gen 5 of their malware, including, like, the last ditch absolute effort where it was incredibly sophisticated, because it was worth burning something that was amazing on it.

01:08:30.420 --> 01:08:33.540
And when I found out, like, that was just incredible.

01:08:33.540 --> 01:08:34.120
It was amazing.

01:08:34.120 --> 01:08:37.000
I actually did a little dance, because like, all right, now we found this.

01:08:37.000 --> 01:08:39.680
Now we have to find out how we're actually going to get rid of it.

01:08:39.740 --> 01:08:47.240
But the way that we're able to track back to exactly where it was is, again, because attackers are human beings, and they make mistakes.

01:08:47.240 --> 01:08:53.280
So for the most part, they bounce their IP through other countries, and everything was just fine.

01:08:53.280 --> 01:09:05.240
Except we had a total of 11 instances over the course of, I believe, it was a three-month period where they forgot, or they just made the connection before it actually made all the hops.

01:09:05.240 --> 01:09:17.580
And we had 11 times where we were actually able to pin down pretty much to the exact building in a certain company that rhymes with Rhina of exactly where the attacker was, exactly what they were doing, and exactly what they were after.

01:09:17.600 --> 01:09:25.340
And that was amazing, because we literally had gigabytes of logs of all this access in, and in, and in, and in.

01:09:25.340 --> 01:09:29.560
And then we happened to find, like, oh, well, here's this web shell that they had put in.

01:09:29.560 --> 01:09:32.160
The only person to access it was this person.

01:09:32.160 --> 01:09:33.360
We know that for sure.

01:09:33.360 --> 01:09:37.360
And 11 times, they just made a mistake, and we were able to pin down where they were.

01:09:37.360 --> 01:09:43.860
So it literally takes just one time of messing up, and like, okay, now we can actually build an investigation.

01:09:43.860 --> 01:09:46.580
And we turned all that over to law enforcement.

01:09:46.580 --> 01:09:53.760
And unfortunately, it took them about five years to actually go through the process, because they had so much stuff to investigate, primarily for our case.

01:09:53.760 --> 01:10:02.780
But it was also kind of disheartening to see, like, flash reports get put out that is essentially the summary of our report that we had written, and just has an agency logo at the top of it.

01:10:02.780 --> 01:10:04.660
Like, it's like, that's my stuff.

01:10:04.660 --> 01:10:06.640
Like, don't do that.

01:10:11.780 --> 01:10:12.580
All right.

01:10:12.580 --> 01:10:14.040
So who can go next?

01:10:15.520 --> 01:10:16.220
Oh, man.

01:10:16.220 --> 01:10:25.020
I guess I should follow, just because, Brian, at the time, I had told you, I saw five enemies on a firewall, and I was like, what in the hell?

01:10:25.600 --> 01:10:29.940
And it was like a horror for me, because I was just like, it was at the top, too.

01:10:30.040 --> 01:10:36.000
So if you think of how firewalls work, if you've ever done any kind of architecture on them, it's top-down.

01:10:36.580 --> 01:10:43.300
And it was five, and it's any source, any destination, any application, any user.

01:10:44.540 --> 01:10:46.960
And I don't know which one I left out.

01:10:49.060 --> 01:10:50.660
Location and service.

01:10:50.660 --> 01:10:54.040
There are actually six that can be set, and they set one as deny.

01:10:54.040 --> 01:10:58.140
And I didn't even know why they set one as deny, because I was just like, it basically just works.

01:10:58.140 --> 01:11:00.740
That's the answer I got, by the way, was it just works.

01:11:01.940 --> 01:11:05.340
But my worst story is actually recent.

01:11:05.780 --> 01:11:07.380
I have a lot of empathy.

01:11:07.380 --> 01:11:28.660
I see a lot of stuff in ransomware, but one of the coolest things that I've worked a couple of was not too long ago, there was a salt stack vulnerability that came out that allowed for, basically, the long story short is it allowed you to get root to anything that was exposed that was a salt master.

01:11:28.660 --> 01:11:36.020
So a salt is used, salt stack is used to manage and administer a Linux environment.

01:11:36.760 --> 01:11:38.480
And it's a really cool thing.

01:11:38.480 --> 01:11:42.100
I actually really like it for administration purposes.

01:11:42.620 --> 01:11:48.160
But there was a vulnerability, and if it wasn't patched, you could get root into anything that was internet exposed.

01:11:48.260 --> 01:11:51.220
And I just happened to see it in a couple of cases.

01:11:51.320 --> 01:12:00.820
I thought going into this, man, if I had root on something automatically that was internet exposed, what could I do?

01:12:00.820 --> 01:12:06.620
And I spent a long time looking at this environment, thinking I'm going to find something cool.

01:12:06.660 --> 01:12:13.900
We got in and they used it to spam mining bots everywhere using the minion service.

01:12:13.920 --> 01:12:16.400
And that was literally it.

01:12:16.400 --> 01:12:23.960
And so I want to tell that boring horror story because I live too for the cool, like, when am I going to find an Oday?

01:12:23.960 --> 01:12:24.740
And I've seen them.

01:12:24.740 --> 01:12:25.680
Don't get me wrong.

01:12:25.680 --> 01:12:30.900
I've seen some really cool stuff from APTs and some really cool tactics.

01:12:30.900 --> 01:12:39.560
I've seen people absolutely stomp out servers to where I have to go into unallocated space and get really creative about carving things out.

01:12:39.560 --> 01:12:50.940
But this one was one where I was going in going, I'm going to see like something absolutely crazy because you automatically had root access and you could do all of these things.

01:12:51.280 --> 01:12:52.460
And that was not the case.

01:12:52.460 --> 01:13:01.400
And I've seen so much of that over the course of doing IR where I'm just like, you know, you have this level and you worked at this level.

01:13:01.540 --> 01:13:11.000
And I think that's something to keep in mind just when you're doing these things is, you know, I was super happy to go back to the client and say, I have great news.

01:13:11.340 --> 01:13:13.800
All they did is run up your cloud build.

01:13:14.360 --> 01:13:22.680
But at the same time, like never assume anything because I was thinking like I'm going to boil the ocean and find something and I did and I didn't.

01:13:24.800 --> 01:13:40.920
In 2005, I was on a plane coming back from a job and a co-worker of mine is sitting next to me on the plane and we're talking about war stories and he tells me a war story from the week before, which is why he was late to the job that we were on.

01:13:41.000 --> 01:13:42.360
And I go, what did you do?

01:13:42.460 --> 01:13:48.500
And he goes, oh, I was doing IR on an old Windows XP network that was locked down by this government thing because it was a defense contractor.

01:13:48.720 --> 01:13:51.220
I'm like, oh, well, how'd the bug get in?

01:13:51.220 --> 01:13:56.620
It's like old Java bug, super like 265 day, right?

01:13:56.620 --> 01:13:58.920
Like old Java on Windows XP.

01:13:59.040 --> 01:14:00.120
What was the vector?

01:14:00.400 --> 01:14:01.200
Facebook.

01:14:01.380 --> 01:14:01.760
Yeah.

01:14:01.760 --> 01:14:05.380
Ops were on there, you know, running Facebook and click something got infected.

01:14:05.500 --> 01:14:06.400
Oh, that's interesting.

01:14:06.400 --> 01:14:07.960
Why did it take you a week to clean up?

01:14:08.000 --> 01:14:11.720
Well, didn't have a lot of ambient room on the operating system to install tools.

01:14:11.720 --> 01:14:12.440
Why?

01:14:12.440 --> 01:14:15.300
Well, it was a drone control station for a Predator 3.

01:14:20.000 --> 01:14:30.600
Yeah, I had a similar story to Moose about, you know, tracking down a, what we realized was a O -Day for a printer.

01:14:31.160 --> 01:14:48.020
And, you know, we thought for sure that this was a very advanced threat actor burning an O-Day for this situation and found out it was just to run a ware server off of our printers because they have so much storage.

01:14:48.020 --> 01:14:52.860
And so that, you know, again, yeah, really excited.

01:14:52.860 --> 01:14:53.160
All right.

01:14:53.160 --> 01:14:53.300
Yeah.

01:14:53.300 --> 01:14:57.060
This is going to be like going to make me famous, right?

01:14:57.060 --> 01:14:58.780
No, they're just running ware.

01:14:59.040 --> 01:15:05.720
So, but they somehow managed to get an O-Day and, you know, that was what they spent it on.

01:15:08.680 --> 01:15:09.340
Cool.

01:15:09.340 --> 01:15:23.600
Well, I certainly don't have any stories as exciting as those that the rest of you have shared in my somewhat boring career in InfoSec, not getting to go around and do incident response all over the place.

01:15:23.600 --> 01:15:38.880
But, you know, I just want to take the opportunity to thank all of you for accepting our invitations and coming here and sharing your experience and, you know, helping all the attendees, you know, who are here at the Blue Team Village to learn from you.

01:15:38.880 --> 01:15:40.560
I've learned a lot from you.

01:15:40.660 --> 01:15:54.460
I think this is, you know, this is such great, valuable information and getting, you know, a variety of people's perspectives, you know, to help us all, you know, learn new things and different ways to approach problems.

01:15:54.460 --> 01:15:55.320
It's awesome.

01:15:55.320 --> 01:15:57.680
I want to thank you so much for participating.

01:15:59.000 --> 01:16:07.920
And for the attendees who are here in the BTV Discord, we're going to move over to the voice talks chat.

01:16:08.280 --> 01:16:14.200
Anyone who's available, panelists who are available, pop over there and take some questions like hallway con.

01:16:16.240 --> 01:16:18.340
So I guess that's a wrap.

01:16:18.340 --> 01:16:19.400
Thanks, everyone.

01:16:21.320 --> 01:16:22.100
Thank you.

01:16:22.100 --> 01:16:22.520
Transcribed by https://otter.ai