1
00:00:01,540 --> 00:00:11,160
Mosa and I do a lot of pentesting, red teaming, and we were kind of surprised by lack of deception technology.

2
00:00:11,180 --> 00:00:19,920
We didn't encounter it too much, and when we did, it was mostly on the internal networks, nothing on the perimeter level, recon level.

3
00:00:20,200 --> 00:00:27,500
And we both love Sacha Baron Cohen and his trolling, so we decided, let's start trolling.

4
00:00:27,500 --> 00:00:31,740
So that's why the talk is called How Blue Penetrates You, a.k.a.

5
00:00:31,740 --> 00:00:33,100
Trolling Hackers.

6
00:00:34,160 --> 00:00:35,940
So let's do it really quick.

7
00:00:36,520 --> 00:00:42,660
First of all, all of us are into the art of war, so all warfare is based on deception.

8
00:00:43,680 --> 00:00:55,120
So a little bit about us, I'm Danny Golan, I'm the CTO of NetAlpha Financial Systems, and I'll let Mo introduce himself.

9
00:00:57,560 --> 00:01:01,100
Mo Sanfried, I'm an advisor for Ledger Ops.

10
00:01:04,700 --> 00:01:07,380
All right, so Mo, you take over now.

11
00:01:07,380 --> 00:01:09,000
You start with the slide.

12
00:01:10,660 --> 00:01:11,620
Sure.

13
00:01:11,760 --> 00:01:14,240
So is everyone able to see my slides here?

14
00:01:20,810 --> 00:01:27,110
Okay, so as Danny mentioned, you know, deception has been around for quite some time.

15
00:01:27,110 --> 00:01:36,350
And, you know, the issue that we've had as of late with, you know, deception is that it's been heavily cited in favor of the red.

16
00:01:36,350 --> 00:01:46,930
You know, you've got everything from phishing, cloned login pages, legitimate credential use, phishing, farming, smishing, HIDs, thumb drives.

17
00:01:46,930 --> 00:01:51,450
It's been heavily lopsided in the deception game.

18
00:01:51,450 --> 00:02:10,630
So, you know, as a red teamer and a pen tester who originally started out on the blue side, I always felt that it's been, you know, just completely skewed as far as, you know, how much in favor it's been on the red.

19
00:02:10,630 --> 00:02:30,030
And, you know, personally to me, nothing's more frustrating as someone that's on the offensive side of security than running into, you know, red tape, bureaucracy, anything that, you know, results in wasted time.

20
00:02:30,030 --> 00:02:41,890
And, you know, my personal experience with deception is that it may lead you to a few, you know, trails that are off the beaten path.

21
00:02:41,890 --> 00:02:55,090
But over time, you start recognizing these patterns and it just isn't advanced and sophisticated enough where it's causing, you know, an adversary brutal pain.

22
00:02:55,090 --> 00:02:56,290
What's brutal pain?

23
00:02:56,290 --> 00:03:03,490
Well, you know, wasted time, burnt hours, you know, how am I going to, what's the best way to deter me?

24
00:03:03,490 --> 00:03:10,670
Not really in terms of, you know, deterrence for me isn't detecting payloads or things like that.

25
00:03:10,670 --> 00:03:18,750
Deterrence to me is just something that I spent, you know, let's say a week on to find out that it's not even a legitimate thing.

26
00:03:18,750 --> 00:03:24,630
So my personal and our personal belief is to let's make deception even better.

27
00:03:24,630 --> 00:03:37,830
Let's make deception so real so that, you know, it takes adversaries weeks, months, even if not longer to identify that, hey, you've just been pounding sand.

28
00:03:38,050 --> 00:03:41,050
And so this is really what, you know, this is for the blue guys.

29
00:03:41,050 --> 00:03:43,250
This is for, you know, the team that's in blue.

30
00:03:43,250 --> 00:03:55,110
Currently, and, you know, referring to the ATT&CK model, you know, a lot of the deception is currently happening in, you know, a few portions of the model.

31
00:03:55,110 --> 00:04:01,510
You know, we may see some deception inside of, you know, lateral movement.

32
00:04:01,510 --> 00:04:12,550
We might see some deception in the discovery phase, but really not so much in the other aspects of the ATT&CK framework, the model.

33
00:04:12,550 --> 00:04:22,410
So what we're suggesting is let's include, you know, what we're really trying to get at is like, let's get inception going in different phases.

34
00:04:22,850 --> 00:04:35,550
Let's try to sprinkle in deception in as many places as possible to kind of, you know, make it even more complicated and difficult for adversaries to compromise systems.

35
00:04:35,550 --> 00:04:40,230
So really, we just want to mislead people, mislead as much as possible.

36
00:04:40,230 --> 00:04:49,350
So, you know, we're really kind of attacking the ATT&CK framework, you know, in order to make it better, in order to make deception better.

37
00:04:49,410 --> 00:04:52,550
So, you know, as I mentioned, it's very limited.

38
00:04:53,130 --> 00:04:56,350
You know, we need to go beyond reconnaissance and lateral movement.

39
00:04:56,390 --> 00:05:00,370
And, you know, we want to take a multi-phase approach.

40
00:05:00,370 --> 00:05:03,390
We want to have deception in as many phases as possible.

41
00:05:05,110 --> 00:05:16,110
So, you know, we're talking about including at the recon phase, we want to have, you know, decoys for OSINT.

42
00:05:16,110 --> 00:05:19,830
We want to insert fake employees into an organization.

43
00:05:19,830 --> 00:05:23,690
And this is basically your organization's social media.

44
00:05:24,750 --> 00:05:28,790
You know, we want to have basically decoys all over the place.

45
00:05:28,790 --> 00:05:33,870
You know, we want to have decoys as far as password leaks.

46
00:05:33,870 --> 00:05:53,450
Let's go and leak, you know, password dumps, you know, include false information and wait for that information to be used on our decoy, you know, DPNs, decoy OWA, decoy Citric Access, RDP, SharePoint.

47
00:05:53,450 --> 00:05:58,490
Even when an attacker is enumerating your page, we want to have decoy subdomains.

48
00:05:58,490 --> 00:06:00,850
And, you know, Daniel has a demo for that.

49
00:06:00,850 --> 00:06:09,150
But what we really want to do is we just want to just make it so that people are getting completely frustrated targeting your organization.

50
00:06:09,450 --> 00:06:10,870
That's the objective.

51
00:06:10,870 --> 00:06:13,450
We want to, you know, hit them where it hurts.

52
00:06:13,530 --> 00:06:22,290
And for, you know, if it's just a script kitty or if it's someone that doesn't have infinite resources, they'll go away after some time.

53
00:06:22,290 --> 00:06:27,810
But if it's a targeted group, if it's an APT group, then, you know, they have all the time in the world.

54
00:06:27,810 --> 00:06:30,370
So what can we do is we can burn their time.

55
00:06:30,370 --> 00:06:32,390
We can make it very, very frustrating for them.

56
00:06:32,390 --> 00:06:35,470
And that's the objective of, you know, our talk here.

57
00:06:35,550 --> 00:06:43,850
So even, you know, some ideas that we've come up with is virtualized environments where, you know, adversaries are...

58
00:06:43,850 --> 00:06:58,150
where we're intentionally running malicious payloads and providing them access into, you know, decoy environments so that that way we can kind of track and trace what they're doing.

59
00:06:58,150 --> 00:07:05,170
We want to lure them in and provide new credentials to accounts that aren't even legitimate within Active Directory.

60
00:07:05,390 --> 00:07:11,950
You know, really whatever we can to burn their time to, you know, eat up their resources.

61
00:07:11,950 --> 00:07:12,630
All

62
00:07:21,300 --> 00:07:22,960
right.

63
00:07:25,420 --> 00:07:30,820
So we came up with this little framework we call the triple D.

64
00:07:31,060 --> 00:07:37,760
So we got on first, like, when you want to do deception, we don't want to do it to legitimate users.

65
00:07:37,760 --> 00:07:42,100
So we want to detect when someone is tampering or trying to scan our site.

66
00:07:42,100 --> 00:07:43,900
So we were looking at doing that.

67
00:07:43,900 --> 00:07:47,080
You have a bunch of tools doing automated scans.

68
00:07:47,080 --> 00:07:49,060
So we're able to fingerprint some of them.

69
00:07:49,060 --> 00:07:58,000
We left some breadcrumbs in the front end code, like some development environment links and different credentials.

70
00:07:58,000 --> 00:08:02,400
So if someone is using them, we can know that he's tampering with us.

71
00:08:02,400 --> 00:08:11,380
If someone's doing active enumeration, whether it's a dare buster or doing subdomain enumeration, we can see the amount of requests is not reasonable.

72
00:08:11,380 --> 00:08:12,980
So we can mark that.

73
00:08:12,980 --> 00:08:22,360
And the last thing we did is we actually went into the application layer, into the code, and we implemented some small vulnerabilities that are pretty common.

74
00:08:22,540 --> 00:08:25,040
But they changed the application flow.

75
00:08:25,040 --> 00:08:27,240
I will demo this in a couple of minutes.

76
00:08:28,220 --> 00:08:30,740
And then there's the deception part.

77
00:08:30,740 --> 00:08:37,680
So we do, if we do detect someone trying to attack, we want to manipulate the application flow.

78
00:08:37,860 --> 00:08:41,860
So it will look like everything is going well, like everything is working.

79
00:08:41,860 --> 00:08:50,900
But in reality, he's going to a whole different environment with everything looks real, but he'll be just wasting a lot of time.

80
00:08:51,300 --> 00:08:58,700
In terms of deception, there's also, we're doing some tests, adding like different headers using Nginx or proxy.

81
00:08:58,700 --> 00:09:03,520
We're just putting headers for different frameworks and seeing how the tools react to that.

82
00:09:04,340 --> 00:09:09,800
And for last, we did want to lure them in into a whole internal environment.

83
00:09:09,800 --> 00:09:16,300
So we did put out a vulnerable service for that, which will also be demoed.

84
00:09:16,580 --> 00:09:24,060
And in terms of deterrence, which is a third D, we wanted to force them to do as much manual work as we can.

85
00:09:24,240 --> 00:09:33,340
And a lot of resources exhaustion, especially with hashed passwords, if they're trying to crack them, we just want to waste their time and resources.

86
00:09:33,420 --> 00:09:36,560
And we saw that as deterrence.

87
00:09:39,500 --> 00:09:45,400
So for manipulating subdomains, we took the top five tools for subdomain enumeration.

88
00:09:45,700 --> 00:09:52,680
And we wanted to see how we can make them break or basically give a lot of noise so they don't really give the attackers value.

89
00:09:53,560 --> 00:09:59,180
Because when we use them, you know, if you get 10, 20 domains, and they're legit, it's fine, you go over them.

90
00:09:59,180 --> 00:10:06,040
But we want to give them as much noise as possible, like 100, 500, like 1000 subdomains.

91
00:10:06,040 --> 00:10:10,520
So there's no way to actually automatically know which ones are real or not.

92
00:10:10,520 --> 00:10:11,980
And it takes time.

93
00:10:13,220 --> 00:10:20,240
So one of the ways that those tools actually detect subdomains is they look for SSL certificates.

94
00:10:20,460 --> 00:10:24,000
So today with Let's Encrypt, it's free.

95
00:10:24,340 --> 00:10:30,100
You can do up to 100 subdomains per certificate and up to 50 certificates per week.

96
00:10:30,400 --> 00:10:34,260
So you can basically do 5000 subdomains.

97
00:10:35,340 --> 00:10:37,100
It's a one-liner.

98
00:10:37,200 --> 00:10:39,580
It's pretty easy, as you can see.

99
00:10:39,740 --> 00:10:43,660
And under the domains flag, you can put a bunch of domains.

100
00:10:43,660 --> 00:10:45,180
This is all automated.

101
00:10:45,180 --> 00:10:46,600
It's free.

102
00:10:46,840 --> 00:10:52,000
And then we wanted to do something for active enumeration as well.

103
00:10:52,000 --> 00:10:59,560
So Nginx, which is like a really popular proxy, has a random index module, which lets you serve random pages.

104
00:10:59,560 --> 00:11:05,800
So combine that with downloading 1000 pages from Wayback Machine.

105
00:11:08,920 --> 00:11:16,500
And this block, which did not show up well, but as you can see, there's this HTTP block and the server block.

106
00:11:16,820 --> 00:11:19,880
Ignore the part in the middle, which did not disappear.

107
00:11:19,880 --> 00:11:21,180
Sorry about that.

108
00:11:21,400 --> 00:11:26,860
But under the location block, you can see that there's the random index.

109
00:11:26,860 --> 00:11:32,300
And it will just, every time you go to any subdomain, it will serve you a random page.

110
00:11:32,620 --> 00:11:41,880
And since Nginx works on top-down, so you put your legit server blocks above, so they will have your real servers.

111
00:11:42,120 --> 00:11:45,740
Anything else will just go to random pages.

112
00:11:45,800 --> 00:11:51,720
And it did break a couple of tools and even tools that do like spider-style scans.

113
00:11:52,220 --> 00:11:58,900
It broke them as well because a bunch of random pages have a bunch of random links, and it just went haywire.

114
00:11:59,340 --> 00:12:05,800
And in terms of DNS, you just put a CNAME record with a wildcard, and that worked really well for us.

115
00:12:07,040 --> 00:12:11,400
So like we said, we love Sacha Baron Cohen, so this is a warning.

116
00:12:11,400 --> 00:12:17,220
We did break a lot of tools, and I'll show you a demo right now.

117
00:12:17,220 --> 00:12:22,490
So I'm using Amass to do enumeration.

118
00:12:23,240 --> 00:12:35,800
So this video was about five minutes, and my computer was basically burning hot after those five minutes, because the active enumeration just did not give so many results.

119
00:12:35,800 --> 00:12:39,620
And the other two tools just legit froze.

120
00:12:39,620 --> 00:12:41,540
We couldn't even keep going with them.

121
00:12:42,280 --> 00:12:46,980
So you can see there's just a simple certificate with 100 domains.

122
00:12:46,980 --> 00:12:49,820
Most of them are fake domains.

123
00:12:51,180 --> 00:12:55,900
Let me just freeze that at the bottom at the end of this.

124
00:12:55,920 --> 00:13:05,860
So I gave those domains names like Jenkins, like dev environment, staging environment, things that look legit.

125
00:13:05,860 --> 00:13:13,460
So basically an attacker, this was only 100, but if I do 5,000, he would have to manually go and look at them.

126
00:13:15,240 --> 00:13:19,180
So for the second thing, we're thinking like app level deception.

127
00:13:19,280 --> 00:13:25,340
So the two solutions we've thought about were either going into the app's code and actually changing things.

128
00:13:25,340 --> 00:13:31,060
So it's more work, it's custom for every web server you have, but it's very, very flexible.

129
00:13:31,060 --> 00:13:35,880
You can basically implement any vulnerability you want.

130
00:13:36,580 --> 00:13:48,560
And the other way was if you're using open source WAF, like Naxi or ModSecurity, you can do it more generalized, especially for SQL injections and XSS.

131
00:13:48,840 --> 00:13:56,220
But for this presentation, I'm just going to look at a simple code for a Flask web server.

132
00:13:56,400 --> 00:14:01,480
So the vulnerability I chose, I've seen it a bit.

133
00:14:01,480 --> 00:14:06,860
And it's a very bad vulnerability once you see it in the wild.

134
00:14:07,080 --> 00:14:24,840
So I got a little Flask server, and I used JWT, Flask JWT, which basically checks the JWT token, takes the identity out, and it checks if it's a valid token or not, if it was tampered with based on the signature.

135
00:14:24,840 --> 00:14:34,620
And there was an attack, which basically you put a non-null algorithm in the field, and it bypasses the signature validation.

136
00:14:35,260 --> 00:14:43,640
So what you can see here is I made a custom function that checks that identity.

137
00:14:43,640 --> 00:14:58,060
But if it gets an exception for invalid signature or invalid algorithm, it's not going to return an A user that will keep everything going regularly, but we're going to manipulate the flow of the application.

138
00:14:58,160 --> 00:15:08,840
So you can see that I did a print attacker detected, and on the endpoint itself, you can see that I'm checking for the current user from that token.

139
00:15:08,840 --> 00:15:11,060
If it's a valid user, it's a regular flow.

140
00:15:11,060 --> 00:15:17,440
I use my ORM, which sanitizes the input and returns the user.

141
00:15:17,440 --> 00:15:22,700
But under the else statement, you can see the tailored deceptive flow.

142
00:15:23,260 --> 00:15:37,640
I have an on-purpose vulnerable line for SQL injection, and I'm basically going to let him do a SQL injection and return him just a bunch of bogus users with their hashed passwords.

143
00:15:38,060 --> 00:15:40,780
And that's what he's going to get.

144
00:15:40,780 --> 00:15:57,740
You can see the super simple SQL injection, and I've minimized it so it doesn't show all the users, but you can think of how long it'll take someone to actually put the time to crack those passwords when they're actually... they don't mean anything.

145
00:15:58,140 --> 00:16:01,100
So this was a super simple example.

146
00:16:01,100 --> 00:16:08,780
You can generalize it to all of your Flask servers or any other framework by using decorators in Python.

147
00:16:11,020 --> 00:16:17,320
So we made a couple people mad when we asked them to test the website, because, you know, who likes wasting time?

148
00:16:19,000 --> 00:16:22,020
And at some point, like, which news do you want?

149
00:16:22,020 --> 00:16:23,720
You never know if it's real or not.

150
00:16:24,140 --> 00:16:30,200
As long as you make it look 100% real, you know, people waste their time.

151
00:16:30,240 --> 00:16:37,040
And we found that, especially with the subdomain enumeration, we used to get a lot of scans on the demo site.

152
00:16:37,040 --> 00:16:43,260
We put just a bunch of tools, and once we implemented some of these techniques, it went down by around 70%.

153
00:16:43,260 --> 00:16:46,000
So we're super happy to see that.

154
00:16:47,460 --> 00:16:56,040
The second thing I want to show is, if you're familiar or not familiar with, I'll do a quick intro to FUSE, which is file system and user space.

155
00:16:57,240 --> 00:17:05,840
It's an interface to let you export a file system to the kernel, and you get full control over reading, writing, listing.

156
00:17:05,840 --> 00:17:18,200
And we took advantage of this to just sprinkle the file system with a bunch of interesting files, like bb-backup, vm-backups, like finance and accounting, Excel sheets.

157
00:17:18,300 --> 00:17:25,460
And the nice thing is, it's all virtual, so you have full control of how the file looks in terms of the size.

158
00:17:25,460 --> 00:17:32,480
So we put, like, here you can see that the fake file name is bb-backup.eng for encrypted.

159
00:17:32,540 --> 00:17:34,580
It's a 5-dig file.

160
00:17:34,580 --> 00:17:44,220
And under the read function definition, you can see that it will, if you try to read it, it will just generate random bytes.

161
00:17:44,220 --> 00:17:46,500
It can do it, like, for days.

162
00:17:48,220 --> 00:18:00,640
And this other thing we're experimenting with is adding random timeouts when copying the files, because who... I mean, it's awful, you know, you copy a 50-gig file, and then you get a timeout randomly.

163
00:18:02,920 --> 00:18:06,680
So there we have Borad saying this file is real, not.

164
00:18:07,260 --> 00:18:16,240
And first thing is, here I start the script called the DeceptiveFuse, and I'm going to mount it to this folder called bb.

165
00:18:22,380 --> 00:18:27,080
And now when I list the folder, we can see that this is a 4.7-gigabyte file.

166
00:18:28,280 --> 00:18:30,560
And let's just try to read out the contents.

167
00:18:41,240 --> 00:18:44,340
Yeah, so this will go on and go on and go on.

168
00:18:44,340 --> 00:18:47,980
And since it's an uninterrupted file, it could be legit.

169
00:18:50,840 --> 00:18:55,020
So now we're thinking, okay, we did the perimeter.

170
00:18:55,020 --> 00:18:56,460
We did some app-level stuff.

171
00:18:56,460 --> 00:19:00,580
We want to lure them in to our Declan environment.

172
00:19:01,060 --> 00:19:05,060
So Vulnhub, for the win, great resource.

173
00:19:05,060 --> 00:19:14,660
So these days with the cloud and DevOps, Dockers, Vulnhub, the GitHub page is full of Docker images vulnerable to specific vulnerabilities.

174
00:19:14,800 --> 00:19:18,380
I chose Jenkins because who doesn't like popping a Jenkins server?

175
00:19:18,380 --> 00:19:23,180
It's a goldmine for API keys, for source code.

176
00:19:24,420 --> 00:19:30,240
Yeah, it's a goldmine for getting some info about the organization and the code they're running.

177
00:19:30,860 --> 00:19:34,360
So I deployed this on AWS, on ECS.

178
00:19:34,380 --> 00:19:36,380
It's in a Docker image.

179
00:19:36,840 --> 00:19:39,800
There's a link at the bottom of the slide.

180
00:19:39,800 --> 00:19:47,040
This is a vulnerability found by OrangeSci, which gives you a remote cloud execution.

181
00:19:48,060 --> 00:20:00,420
And with the vulnerability added to the file, I was able to add some users to the shadow file, which will... let's see.

182
00:20:00,420 --> 00:20:03,660
Okay, so... sorry about that.

183
00:20:05,850 --> 00:20:09,170
So I'm going to start Netcat, just import 8080.

184
00:20:09,170 --> 00:20:15,050
I'm going to use ngrok to give myself a publicly accessible address.

185
00:20:23,680 --> 00:20:28,020
So this is the POC by OrangeSci.

186
00:20:28,500 --> 00:20:31,560
Did a little bit of editing to make it work in Python 3.

187
00:20:31,560 --> 00:20:32,680
It wasn't too bad.

188
00:20:32,920 --> 00:20:34,740
This is the address.

189
00:20:34,740 --> 00:20:39,020
You can see the address to the container running on AWS.

190
00:20:39,220 --> 00:20:44,720
And I'm just going to post our curl command to read the shadow file and send it over.

191
00:20:52,360 --> 00:20:54,240
Yeah, and there we go.

192
00:20:54,240 --> 00:21:04,580
You can see that we have LEG, Admiral, General, Aladin, Borat, Zagdaev, and Iran Marad with pretty complex passwords.

193
00:21:04,580 --> 00:21:16,120
The only one we left as an easy password was LEG, because that's what we're going to use as credential reuse to hop into the AD environment, which Mo will show in a minute.

194
00:21:16,340 --> 00:21:19,040
So, yeah, let's go internal.

195
00:21:19,040 --> 00:21:25,720
And I will post on GitHub the edited Docker file and all the code that I showed.

196
00:21:27,380 --> 00:21:28,840
So, Mo?

197
00:21:29,860 --> 00:21:31,400
Thank you, Danny.

198
00:21:31,460 --> 00:21:33,540
That was really fun to watch.

199
00:21:33,700 --> 00:21:38,460
So essentially, as Danny mentioned, we've got credential reuse.

200
00:21:38,460 --> 00:21:50,860
So we intentionally have one user with a very easy password break in our lab environment, pivoting from the external to internal.

201
00:21:51,460 --> 00:21:57,020
Let's say in theory that this organization has a VPN accessible.

202
00:21:57,740 --> 00:22:01,300
We're working with, let's say, a non-interactive login account.

203
00:22:01,680 --> 00:22:05,000
We've got the user who has VPN access.

204
00:22:05,040 --> 00:22:07,080
He hops into the internal.

205
00:22:07,080 --> 00:22:11,880
He can't authenticate to any of the boxes because he has a non-interactive account.

206
00:22:11,880 --> 00:22:16,480
Let's say he finds a box with null sessions.

207
00:22:16,480 --> 00:22:19,600
He enumerates active directory.

208
00:22:19,600 --> 00:22:39,680
What we're really doing is we're just basically replicating the flow of what an adversary would do in the event that they have limited access, just kind of like your typical post-exploitation flow.

209
00:22:39,680 --> 00:22:55,080
So we set up a fake active directory environment, and we didn't give the user the ability to access anything with the actually login to a system.

210
00:22:55,760 --> 00:23:00,940
So what we're doing is we're creating the environment.

211
00:23:00,940 --> 00:23:14,400
We're creating a mock AD environment and putting out a low-hanging fruit that does not actually come to fruit, if that makes sense.

212
00:23:14,400 --> 00:23:19,560
So what we're doing is essentially we are leading people into...

213
00:23:20,080 --> 00:23:26,560
we're luring them in with a whole bunch of low-hanging fruit, but they're all going to be dead ends.

214
00:23:26,700 --> 00:23:32,120
So yes, the attacker enumerates AD, but it's a mock AD.

215
00:23:32,200 --> 00:23:33,560
The attributes are fake.

216
00:23:33,560 --> 00:23:36,320
The users are non-existent.

217
00:23:36,320 --> 00:23:43,540
They're basically in a sandbox, and they're just digging deeper and deeper without even knowing that they're in a sandbox.

218
00:23:43,960 --> 00:23:46,360
We have anonymous shares out there.

219
00:23:46,660 --> 00:23:49,340
We lure them in with sensitive info.

220
00:23:49,780 --> 00:24:01,760
We have the attacker upload malicious SCF files, have them fire up Responder or different LMR NVT poisoning attacks.

221
00:24:02,060 --> 00:24:04,100
We're going to respond to them.

222
00:24:04,100 --> 00:24:09,200
We're effectively just throwing them into...

223
00:24:09,200 --> 00:24:13,260
giving them breadcrumbs that ultimately lead to nowhere.

224
00:24:13,860 --> 00:24:21,020
So we will have SMB boxes with SMB signing disabled.

225
00:24:21,020 --> 00:24:23,500
They're going to have relay attempts.

226
00:24:23,620 --> 00:24:32,460
We're going to give them net NTLM hashes with passwords that are incredible to crack, just exceptionally difficult to crack.

227
00:24:32,460 --> 00:24:38,780
Just have them burn up resources, burn up time, pound on sand, if you will.

228
00:24:39,220 --> 00:24:42,980
So this includes exhausting different man-in-the-middle attacks.

229
00:24:43,000 --> 00:24:56,840
What we really want to do is just have them run the gamut before they really actually either, number one, give up, or number two, are in it so deep that they typically get tunnel vision, will have canaries out there.

230
00:24:56,840 --> 00:25:02,420
Just kind of really want to, at the end of the day, just aggravate people.

231
00:25:02,420 --> 00:25:09,840
If you have a really good product, you're going to aggravate people, which is going to really just kind of...

232
00:25:09,840 --> 00:25:17,020
the nature of a pen tester or someone that's on the offensive side is typically you get tunnel vision.

233
00:25:17,020 --> 00:25:20,960
You kind of start beating up on the same boxes, or you're repeating the same thing.

234
00:25:20,960 --> 00:25:22,600
You kind of get into a routine.

235
00:25:22,600 --> 00:25:30,600
So that's the kind of flow that we want to get people into.

236
00:25:30,800 --> 00:25:34,960
Ultimately, we have telemetry in place.

237
00:25:35,040 --> 00:25:47,080
We want to make it so that the attacker is going to get gradually louder and louder, and the whole time we're just following their actions.

238
00:25:47,080 --> 00:25:48,760
We're monitoring what they're doing.

239
00:25:48,760 --> 00:25:52,320
So just a quick look at our user here, Ali G.

240
00:25:52,620 --> 00:25:53,820
Respect.

241
00:25:53,880 --> 00:25:59,780
And our mock environment here that we set up that we use for testing.

242
00:26:01,080 --> 00:26:05,020
So a couple of tools, a couple of shout outs.

243
00:26:05,480 --> 00:26:06,900
Number one, Deja Vu.

244
00:26:06,900 --> 00:26:11,100
It's an open source deception framework that we used.

245
00:26:11,440 --> 00:26:17,620
And Detection Lab, which the links will be available within the slides.

246
00:26:17,620 --> 00:26:20,660
I highly recommend it for our internal environment.

247
00:26:20,660 --> 00:26:29,100
We were able to spin something up within AWS and locally very, very quickly, very cost effective.

248
00:26:29,100 --> 00:26:35,720
And on top of that, we leveraged Deception and Active Directory.

249
00:26:35,720 --> 00:27:09,620
Nickel, he wrote Deploy Deception, an exceptional set of PowerShell scripts that will allow you to create an entire mock Active Directory environment with objects and attributes where you can create a fake user with different permissions and really just kind of take out the tedious work that's involved in creating this sort of environment.

250
00:27:09,620 --> 00:27:13,700
Obviously, you want to, you know, customize it as much as possible.

251
00:27:13,700 --> 00:27:19,460
But, you know, a lot of respect for Nickel for putting this together.

252
00:27:19,600 --> 00:27:30,160
You know, it allows the adversary to enumerate decoy objects with aggressive logging enabled and just makes it exceptionally easy to set up.

253
00:27:30,160 --> 00:27:46,400
And, you know, really sets up different types of attacks, different types of, you know, users with passwords that don't expire, people with members of elevated privilege groups, users with ACL rights.

254
00:27:47,640 --> 00:27:58,600
Ultimately, what this allows is that it increases the time that an attacker is within your environment, in your mock environment, and it increases a higher detection rate.

255
00:27:59,680 --> 00:28:04,080
And it's, you know, as I mentioned, it's very easy to deploy with PowerShell.

256
00:28:05,940 --> 00:28:18,320
So, you know, hopping on Ali G, we've got, you know, going into the lateral movement aspect, we've got hunting creds, hunting tokens, hunting users.

257
00:28:18,320 --> 00:28:21,980
Now, this is pretty typical of a lot of decoy products.

258
00:28:21,980 --> 00:28:29,980
We're going to create a decoy admin account, and we have logging enabled for this account.

259
00:28:30,300 --> 00:28:33,760
And we're going to deny login for this DA account.

260
00:28:33,760 --> 00:28:46,500
So in the event that, you know, when the attacker does stumble upon our hunting creds or hunting tokens, we'll get an alert for this account, someone attempting to log in.

261
00:28:46,500 --> 00:29:00,720
And, you know, one of the methods that we leverage is by, you know, allowing, you know, making sure that this dummy honey DA account doesn't have the ability to log on to any systems.

262
00:29:00,720 --> 00:29:09,240
And we do this, one of the methods is by, you know, assigning that account to a computer that does not exist.

263
00:29:09,600 --> 00:29:15,420
And this is the type of, you know, alert that you would get.

264
00:29:18,760 --> 00:29:23,220
And, you know, that account is heavily logged and alerted.

265
00:29:23,220 --> 00:29:34,840
And then a few things, you know, that in my research for this was going into different types of detection that's in place for, you know, decoy environments.

266
00:29:34,840 --> 00:29:53,420
And one of the projects that I stumbled upon is called the Honey Pot Buster, which helps you, you know, kind of audit and test your environment, your decoy environment, just to see what is the ability to actually detect, you know, your attackers within a decoy environment.

267
00:29:53,420 --> 00:30:01,560
This kind of gives you an understanding of the legitimacy, how real does it, you know, does your decoy environment look.

268
00:30:07,670 --> 00:30:25,550
So, some of the things that we could do to make your, to identify, some of the things that we could do to identify whether your environment is a, let's say, you know, you're in a decoy environment.

269
00:30:25,550 --> 00:30:41,910
You could look at some of the products, and this is coming from Nicole's, and I apologize for mispronouncing your name, but some of the things that he identified in his research was that, you know, the object SID, the last login, the last logon timestamp,

270
00:30:41,910 --> 00:30:43,630
login count, bad password count.

271
00:30:43,630 --> 00:31:04,170
This is from his research in identifying attributes within the mock Active Directory environment that can basically, an attacker can look at and say, okay, you know, here's a user that's never logged on and he has zero login attempts, zero failed password attempts.

272
00:31:04,510 --> 00:31:07,870
You know, these are all attributes that can give away your decoy environment.

273
00:31:07,870 --> 00:31:15,670
So, some of the things that you want to take into consideration when building your mock environment to kind of make it look as real as possible.

274
00:31:16,630 --> 00:31:29,990
Some of the other tools that, you know, that we've, that I've seen for detecting LMR and MBT poisoning, there's, you know, honeypots that detect this sort of behavior.

275
00:31:30,330 --> 00:31:32,090
It's fairly simple.

276
00:31:32,090 --> 00:31:48,550
A lot of them will, you know, broadcast to 255.255.255.255, and this is a clear indication that you're looking at an LMR and MBT poisoning, you know, layer 2 honeypot.

277
00:31:48,550 --> 00:31:55,870
And really simple bypass or workaround is to just set up TCP dump or Wireshark to look for that.

278
00:31:55,870 --> 00:32:02,670
And, you know, ignore within, you know, whatever poisoning tool that you prefer.

279
00:32:03,590 --> 00:32:10,510
And obviously, whenever you hop on a network, you want to use respond and analyze only mode.

280
00:32:11,450 --> 00:32:21,910
So, you know, the final point, what we're getting at and kind of coming full circle is that when building these types of environments, you want to keep it as realistic as possible.

281
00:32:21,910 --> 00:32:44,290
You know, the objective is to, you know, make it so that the attacker, it takes an exceptionally long time for the attacker to, you know, identify that they're in a staged environment, that it's false and that they're kind of just being run around in circles.

282
00:32:44,930 --> 00:32:52,390
And, you know, at the end of the day, this industry and this game, the nature of this game is always going to be a game, cat and mouse.

283
00:32:52,470 --> 00:33:05,590
But if you can make it so that it takes the adversary a really long time, hours and hours of their time has been wasted sitting around in this environment.

284
00:33:05,590 --> 00:33:14,570
If you can burn their time, that is something that is finite and will ultimately never can, no matter who you are, you can never buy more time.

285
00:33:14,570 --> 00:33:19,710
So that's our objective and, you know...

286
00:33:19,710 --> 00:33:40,450
Yeah , a lot of it was looking into how do we change this whole process from what Mo showed, which is like the recon, the LinkedIn fake users and just like sprinkling passwords and fake password dumps or like in real password dumps.

287
00:33:40,450 --> 00:33:47,370
But getting all that out there and those little click baits for like going into those emails.

288
00:33:47,710 --> 00:34:07,170
And then from there, how we take it to the perimeter level and the app level and just like pull them down into the rabbit hole until they get into that AV environment and they've been just wasting weeks or like days, weeks, as long as they need for realizing that it was all nothing.

289
00:34:07,290 --> 00:34:19,950
So, I mean, that's part of like the more sophisticated attackers, they will go in deeper and deeper because they have the resources to actually crack all those passwords and do the manual labor.

290
00:34:19,950 --> 00:34:32,310
But the deterrence is more for the strip kiddies or the lower level attackers that, you know, once you hit them with 100 hashes and they actually need to start cracking it, they need to get those resources.

291
00:34:32,630 --> 00:34:35,230
It deters a lot of attackers.

292
00:34:35,930 --> 00:34:50,290
And then especially for perimeter and app level, since you do not have really tools for that, and it's mostly custom, so it's kind of easier to implement that into your flow without...

293
00:34:50,290 --> 00:34:52,530
because there are no tools to detect.

294
00:34:53,150 --> 00:35:11,450
And I mean, this was just the start, you know, we had one presentation, we were working on more cloud-related deception, utilizing the AWS agent and fake access keys, which we hope that for next time we'll have something great with that.

295
00:35:11,450 --> 00:35:14,330
We will, but it'll just take us some time.

296
00:35:14,330 --> 00:35:17,690
But yeah, this is an endless journey on going this path.

297
00:35:21,420 --> 00:35:22,160
All right.

298
00:35:22,160 --> 00:35:23,380
Great talk, everyone.

299
00:35:23,380 --> 00:35:25,080
Really appreciate it.

300
00:35:25,220 --> 00:35:27,420
Our first question comes from Mark.

301
00:35:28,440 --> 00:35:32,840
Are you looking at any disruptions in Office 365 or Azure AD?

302
00:35:36,850 --> 00:35:38,770
Oh, you want to take that one?

303
00:35:39,210 --> 00:35:44,270
I'll just say that we did not look at Azure AD at all.

304
00:35:44,390 --> 00:35:49,730
We did spin up an AD environment that's more similar to an internal network.

305
00:35:50,070 --> 00:35:55,490
So most of the things we did on cloud was related to the web apps and the perimeter.

306
00:35:55,690 --> 00:36:00,270
And then from there, it was like a pivot into an internal network.

307
00:36:05,090 --> 00:36:06,030
Right.

308
00:36:06,030 --> 00:36:12,410
As Danny mentioned, this is just kind of the... Mark, thank you for the question.

309
00:36:12,470 --> 00:36:18,570
And no, not yet, but we would love to work on that.

310
00:36:19,110 --> 00:36:27,730
And, you know, if anyone's willing to... is interested in collaborating on this, Danny and I are beyond excited to do so.

311
00:36:28,930 --> 00:36:32,590
And I guess one last question real quick for me.

312
00:36:32,590 --> 00:36:41,170
I've seen a lot of companies and solutions, open source solutions, pop up in the active defense honeypots kind of arena.

313
00:36:41,250 --> 00:36:47,670
Do both of you have any sort of predictions or where do you see the future of these tool sets going?

314
00:36:49,350 --> 00:37:00,650
I'll say from my side that most tools that we saw and encountered in Pentest or Red Teaming, like I said in the beginning, they were focused on internal networks.

315
00:37:00,650 --> 00:37:16,690
And then today with this whole migration to the cloud and microservices and Docker containers, which are replacing a lot of big web servers, these to be big like monolith web servers or Microsoft servers.

316
00:37:16,690 --> 00:37:23,050
And we did not see any tools or anything relevant for that.

317
00:37:23,050 --> 00:37:39,250
So we do hope that, you know, it will go to that path because like we saw in the second slide, where we have the comparison of Deception and Red Team and Blue Team, like Blue Teaming is way, way behind on Deception technologies.

318
00:37:39,550 --> 00:37:44,630
And then, I mean, we did this talk because we are trying to push this forward in this research.

319
00:37:44,630 --> 00:37:48,630
So hopefully, it'll advance a lot.