start	end	text
1540	11160	Mosa and I do a lot of pentesting, red teaming, and we were kind of surprised by lack of deception technology.
11180	19920	We didn't encounter it too much, and when we did, it was mostly on the internal networks, nothing on the perimeter level, recon level.
20200	27500	And we both love Sacha Baron Cohen and his trolling, so we decided, let's start trolling.
27500	33100	So that's why the talk is called How Blue Penetrates You, a.k.a. Trolling Hackers.
34160	42660	So let's do it really quick. First of all, all of us are into the art of war, so all warfare is based on deception.
43680	55120	So a little bit about us, I'm Danny Golan, I'm the CTO of NetAlpha Financial Systems, and I'll let Mo introduce himself.
57560	61100	Mo Sanfried, I'm an advisor for Ledger Ops.
64700	69000	All right, so Mo, you take over now. You start with the slide.
70660	74240	Sure. So is everyone able to see my slides here?
80810	87110	Okay, so as Danny mentioned, you know, deception has been around for quite some time.
87110	96350	And, you know, the issue that we've had as of late with, you know, deception is that it's been heavily cited in favor of the red.
96350	106930	You know, you've got everything from phishing, cloned login pages, legitimate credential use, phishing, farming, smishing, HIDs, thumb drives.
106930	111450	It's been heavily lopsided in the deception game.
111450	130630	So, you know, as a red teamer and a pen tester who originally started out on the blue side, I always felt that it's been, you know, just completely skewed as far as, you know, how much in favor it's been on the red.
130630	150030	And, you know, personally to me, nothing's more frustrating as someone that's on the offensive side of security than running into, you know, red tape, bureaucracy, anything that, you know, results in wasted time.
150030	161890	And, you know, my personal experience with deception is that it may lead you to a few, you know, trails that are off the beaten path.
161890	175090	But over time, you start recognizing these patterns and it just isn't advanced and sophisticated enough where it's causing, you know, an adversary brutal pain.
175090	176290	What's brutal pain?
176290	183490	Well, you know, wasted time, burnt hours, you know, how am I going to, what's the best way to deter me?
183490	190670	Not really in terms of, you know, deterrence for me isn't detecting payloads or things like that.
190670	198750	Deterrence to me is just something that I spent, you know, let's say a week on to find out that it's not even a legitimate thing.
198750	204630	So my personal and our personal belief is to let's make deception even better.
204630	217830	Let's make deception so real so that, you know, it takes adversaries weeks, months, even if not longer to identify that, hey, you've just been pounding sand.
218050	221050	And so this is really what, you know, this is for the blue guys.
221050	223250	This is for, you know, the team that's in blue.
223250	235110	Currently, and, you know, referring to the ATT&CK model, you know, a lot of the deception is currently happening in, you know, a few portions of the model.
235110	241510	You know, we may see some deception inside of, you know, lateral movement.
241510	252550	We might see some deception in the discovery phase, but really not so much in the other aspects of the ATT&CK framework, the model.
252550	262410	So what we're suggesting is let's include, you know, what we're really trying to get at is like, let's get inception going in different phases.
262850	275550	Let's try to sprinkle in deception in as many places as possible to kind of, you know, make it even more complicated and difficult for adversaries to compromise systems.
275550	280230	So really, we just want to mislead people, mislead as much as possible.
280230	289350	So, you know, we're really kind of attacking the ATT&CK framework, you know, in order to make it better, in order to make deception better.
289410	292550	So, you know, as I mentioned, it's very limited.
293130	296350	You know, we need to go beyond reconnaissance and lateral movement.
296390	300370	And, you know, we want to take a multi-phase approach.
300370	303390	We want to have deception in as many phases as possible.
305110	316110	So, you know, we're talking about including at the recon phase, we want to have, you know, decoys for OSINT.
316110	319830	We want to insert fake employees into an organization.
319830	323690	And this is basically your organization's social media.
324750	328790	You know, we want to have basically decoys all over the place.
328790	333870	You know, we want to have decoys as far as password leaks.
333870	353450	Let's go and leak, you know, password dumps, you know, include false information and wait for that information to be used on our decoy, you know, DPNs, decoy OWA, decoy Citric Access, RDP, SharePoint.
353450	358490	Even when an attacker is enumerating your page, we want to have decoy subdomains.
358490	360850	And, you know, Daniel has a demo for that.
360850	369150	But what we really want to do is we just want to just make it so that people are getting completely frustrated targeting your organization.
369450	370870	That's the objective.
370870	373450	We want to, you know, hit them where it hurts.
373530	382290	And for, you know, if it's just a script kitty or if it's someone that doesn't have infinite resources, they'll go away after some time.
382290	387810	But if it's a targeted group, if it's an APT group, then, you know, they have all the time in the world.
387810	390370	So what can we do is we can burn their time.
390370	392390	We can make it very, very frustrating for them.
392390	395470	And that's the objective of, you know, our talk here.
395550	403850	So even, you know, some ideas that we've come up with is virtualized environments where, you know, adversaries are...
403850	418150	where we're intentionally running malicious payloads and providing them access into, you know, decoy environments so that that way we can kind of track and trace what they're doing.
418150	425170	We want to lure them in and provide new credentials to accounts that aren't even legitimate within Active Directory.
425390	431950	You know, really whatever we can to burn their time to, you know, eat up their resources.
431950	442960	All right.
445420	450820	So we came up with this little framework we call the triple D.
451060	457760	So we got on first, like, when you want to do deception, we don't want to do it to legitimate users.
457760	462100	So we want to detect when someone is tampering or trying to scan our site.
462100	463900	So we were looking at doing that.
463900	467080	You have a bunch of tools doing automated scans.
467080	469060	So we're able to fingerprint some of them.
469060	478000	We left some breadcrumbs in the front end code, like some development environment links and different credentials.
478000	482400	So if someone is using them, we can know that he's tampering with us.
482400	491380	If someone's doing active enumeration, whether it's a dare buster or doing subdomain enumeration, we can see the amount of requests is not reasonable.
491380	492980	So we can mark that.
492980	502360	And the last thing we did is we actually went into the application layer, into the code, and we implemented some small vulnerabilities that are pretty common.
502540	505040	But they changed the application flow.
505040	507240	I will demo this in a couple of minutes.
508220	510740	And then there's the deception part.
510740	517680	So we do, if we do detect someone trying to attack, we want to manipulate the application flow.
517860	521860	So it will look like everything is going well, like everything is working.
521860	530900	But in reality, he's going to a whole different environment with everything looks real, but he'll be just wasting a lot of time.
531300	538700	In terms of deception, there's also, we're doing some tests, adding like different headers using Nginx or proxy.
538700	543520	We're just putting headers for different frameworks and seeing how the tools react to that.
544340	549800	And for last, we did want to lure them in into a whole internal environment.
549800	556300	So we did put out a vulnerable service for that, which will also be demoed.
556580	564060	And in terms of deterrence, which is a third D, we wanted to force them to do as much manual work as we can.
564240	573340	And a lot of resources exhaustion, especially with hashed passwords, if they're trying to crack them, we just want to waste their time and resources.
573420	576560	And we saw that as deterrence.
579500	585400	So for manipulating subdomains, we took the top five tools for subdomain enumeration.
585700	592680	And we wanted to see how we can make them break or basically give a lot of noise so they don't really give the attackers value.
593560	599180	Because when we use them, you know, if you get 10, 20 domains, and they're legit, it's fine, you go over them.
599180	606040	But we want to give them as much noise as possible, like 100, 500, like 1000 subdomains.
606040	610520	So there's no way to actually automatically know which ones are real or not.
610520	611980	And it takes time.
613220	620240	So one of the ways that those tools actually detect subdomains is they look for SSL certificates.
620460	624000	So today with Let's Encrypt, it's free.
624340	630100	You can do up to 100 subdomains per certificate and up to 50 certificates per week.
630400	634260	So you can basically do 5000 subdomains.
635340	639580	It's a one-liner. It's pretty easy, as you can see.
639740	643660	And under the domains flag, you can put a bunch of domains.
643660	646600	This is all automated. It's free.
646840	652000	And then we wanted to do something for active enumeration as well.
652000	659560	So Nginx, which is like a really popular proxy, has a random index module, which lets you serve random pages.
659560	665800	So combine that with downloading 1000 pages from Wayback Machine.
668920	676500	And this block, which did not show up well, but as you can see, there's this HTTP block and the server block.
676820	681180	Ignore the part in the middle, which did not disappear. Sorry about that.
681400	686860	But under the location block, you can see that there's the random index.
686860	692300	And it will just, every time you go to any subdomain, it will serve you a random page.
692620	701880	And since Nginx works on top-down, so you put your legit server blocks above, so they will have your real servers.
702120	705740	Anything else will just go to random pages.
705800	711720	And it did break a couple of tools and even tools that do like spider-style scans.
712220	718900	It broke them as well because a bunch of random pages have a bunch of random links, and it just went haywire.
719340	725800	And in terms of DNS, you just put a CNAME record with a wildcard, and that worked really well for us.
727040	731400	So like we said, we love Sacha Baron Cohen, so this is a warning.
731400	737220	We did break a lot of tools, and I'll show you a demo right now.
737220	742490	So I'm using Amass to do enumeration.
743240	751220	So this video was about five minutes, and my computer was basically burning hot after those five minutes,
751220	755800	because the active enumeration just did not give so many results.
755800	759620	And the other two tools just legit froze.
759620	761540	We couldn't even keep going with them.
762280	766980	So you can see there's just a simple certificate with 100 domains.
766980	769820	Most of them are fake domains.
771180	775900	Let me just freeze that at the bottom at the end of this.
775920	785860	So I gave those domains names like Jenkins, like dev environment, staging environment, things that look legit.
785860	793460	So basically an attacker, this was only 100, but if I do 5,000, he would have to manually go and look at them.
795240	799180	So for the second thing, we're thinking like app level deception.
799280	805340	So the two solutions we've thought about were either going into the app's code and actually changing things.
805340	811060	So it's more work, it's custom for every web server you have, but it's very, very flexible.
811060	815880	You can basically implement any vulnerability you want.
816580	822040	And the other way was if you're using open source WAF, like Naxi or ModSecurity,
822040	828560	you can do it more generalized, especially for SQL injections and XSS.
828840	836220	But for this presentation, I'm just going to look at a simple code for a Flask web server.
836400	841480	So the vulnerability I chose, I've seen it a bit.
841480	846860	And it's a very bad vulnerability once you see it in the wild.
847080	854680	So I got a little Flask server, and I used JWT, Flask JWT,
854680	859900	which basically checks the JWT token, takes the identity out,
859900	864840	and it checks if it's a valid token or not, if it was tampered with based on the signature.
864840	871820	And there was an attack, which basically you put a non-null algorithm in the field,
871820	874620	and it bypasses the signature validation.
875260	883640	So what you can see here is I made a custom function that checks that identity.
883640	889840	But if it gets an exception for invalid signature or invalid algorithm,
889840	894780	it's not going to return an A user that will keep everything going regularly,
894780	898060	but we're going to manipulate the flow of the application.
898160	902080	So you can see that I did a print attacker detected,
902080	908840	and on the endpoint itself, you can see that I'm checking for the current user from that token.
908840	911060	If it's a valid user, it's a regular flow.
911060	917440	I use my ORM, which sanitizes the input and returns the user.
917440	922700	But under the else statement, you can see the tailored deceptive flow.
923260	929960	I have an on-purpose vulnerable line for SQL injection,
929960	932760	and I'm basically going to let him do a SQL injection
932760	937640	and return him just a bunch of bogus users with their hashed passwords.
938060	940780	And that's what he's going to get.
940780	943680	You can see the super simple SQL injection,
943680	948900	and I've minimized it so it doesn't show all the users,
948900	954000	but you can think of how long it'll take someone to actually put the time to crack those passwords
954560	957740	when they're actually... they don't mean anything.
958140	961100	So this was a super simple example.
961100	968780	You can generalize it to all of your Flask servers or any other framework by using decorators in Python.
971020	975020	So we made a couple people mad when we asked them to test the website,
975020	977320	because, you know, who likes wasting time?
979000	982020	And at some point, like, which news do you want?
982020	983720	You never know if it's real or not.
984140	990200	As long as you make it look 100% real, you know, people waste their time.
990240	993680	And we found that, especially with the subdomain enumeration,
993680	997040	we used to get a lot of scans on the demo site.
997040	1000960	We put just a bunch of tools, and once we implemented some of these techniques,
1000960	1003260	it went down by around 70%.
1003260	1006000	So we're super happy to see that.
1007460	1012360	The second thing I want to show is, if you're familiar or not familiar with,
1012360	1016040	I'll do a quick intro to FUSE, which is file system and user space.
1017240	1021500	It's an interface to let you export a file system to the kernel,
1022040	1025840	and you get full control over reading, writing, listing.
1025840	1030040	And we took advantage of this to just sprinkle the file system
1030040	1035360	with a bunch of interesting files, like bb-backup, vm-backups,
1035360	1038200	like finance and accounting, Excel sheets.
1038300	1041960	And the nice thing is, it's all virtual, so you have full control
1041960	1045460	of how the file looks in terms of the size.
1045460	1051300	So we put, like, here you can see that the fake file name is bb-backup.eng
1051300	1054580	for encrypted. It's a 5-dig file.
1054580	1060720	And under the read function definition, you can see that it will,
1060720	1064220	if you try to read it, it will just generate random bytes.
1064220	1066500	It can do it, like, for days.
1068220	1072360	And this other thing we're experimenting with is adding random timeouts
1072360	1076380	when copying the files, because who... I mean, it's awful, you know,
1076380	1080640	you copy a 50-gig file, and then you get a timeout randomly.
1082920	1086680	So there we have Borad saying this file is real, not.
1087260	1092980	And first thing is, here I start the script called the DeceptiveFuse,
1092980	1096240	and I'm going to mount it to this folder called bb.
1102380	1107080	And now when I list the folder, we can see that this is a 4.7-gigabyte file.
1108280	1110560	And let's just try to read out the contents.
1121240	1124340	Yeah, so this will go on and go on and go on.
1124340	1127980	And since it's an uninterrupted file, it could be legit.
1130840	1135020	So now we're thinking, okay, we did the perimeter.
1135020	1136460	We did some app-level stuff.
1136460	1140580	We want to lure them in to our Declan environment.
1141060	1145060	So Vulnhub, for the win, great resource.
1145060	1148400	So these days with the cloud and DevOps, Dockers,
1148900	1152500	Vulnhub, the GitHub page is full of Docker images vulnerable
1152500	1154660	to specific vulnerabilities.
1154800	1158380	I chose Jenkins because who doesn't like popping a Jenkins server?
1158380	1163180	It's a goldmine for API keys, for source code.
1164420	1168260	Yeah, it's a goldmine for getting some info about the organization
1168260	1170240	and the code they're running.
1170860	1174360	So I deployed this on AWS, on ECS.
1174380	1176380	It's in a Docker image.
1176840	1179800	There's a link at the bottom of the slide.
1179800	1182900	This is a vulnerability found by OrangeSci,
1182900	1187040	which gives you a remote cloud execution.
1188060	1192860	And with the vulnerability added to the file,
1192860	1197980	I was able to add some users to the shadow file,
1197980	1200420	which will... let's see.
1200420	1203660	Okay, so... sorry about that.
1205850	1209170	So I'm going to start Netcat, just import 8080.
1209170	1215050	I'm going to use ngrok to give myself a publicly accessible address.
1223680	1228020	So this is the POC by OrangeSci.
1228500	1231560	Did a little bit of editing to make it work in Python 3.
1231560	1232680	It wasn't too bad.
1232920	1234740	This is the address.
1234740	1239020	You can see the address to the container running on AWS.
1239220	1243560	And I'm just going to post our curl command to read the shadow file
1243560	1244720	and send it over.
1252360	1254240	Yeah, and there we go.
1254240	1261400	You can see that we have LEG, Admiral, General, Aladin, Borat, Zagdaev, and Iran Marad
1261400	1264580	with pretty complex passwords.
1264580	1267960	The only one we left as an easy password was LEG,
1267960	1271180	because that's what we're going to use as credential reuse
1271180	1276120	to hop into the AD environment, which Mo will show in a minute.
1276340	1279040	So, yeah, let's go internal.
1279040	1285720	And I will post on GitHub the edited Docker file and all the code that I showed.
1287380	1288840	So, Mo?
1289860	1291400	Thank you, Danny.
1291460	1293540	That was really fun to watch.
1293700	1298460	So essentially, as Danny mentioned, we've got credential reuse.
1298460	1303680	So we intentionally have one user with a very easy password break
1304400	1310860	in our lab environment, pivoting from the external to internal.
1311460	1317020	Let's say in theory that this organization has a VPN accessible.
1317740	1321300	We're working with, let's say, a non-interactive login account.
1321680	1325000	We've got the user who has VPN access.
1325040	1327080	He hops into the internal.
1327080	1331880	He can't authenticate to any of the boxes because he has a non-interactive account.
1331880	1336480	Let's say he finds a box with null sessions.
1336480	1339600	He enumerates active directory.
1339600	1344240	What we're really doing is we're just basically replicating the flow
1344240	1353180	of what an adversary would do in the event that they have limited access,
1353480	1359680	just kind of like your typical post-exploitation flow.
1359680	1366020	So we set up a fake active directory environment,
1366380	1371040	and we didn't give the user the ability to access anything
1371040	1375080	with the actually login to a system.
1375760	1380940	So what we're doing is we're creating the environment.
1380940	1387540	We're creating a mock AD environment and putting out a low-hanging fruit
1387540	1394400	that does not actually come to fruit, if that makes sense.
1394400	1399560	So what we're doing is essentially we are leading people into...
1400080	1402940	we're luring them in with a whole bunch of low-hanging fruit,
1402940	1406560	but they're all going to be dead ends.
1406700	1412120	So yes, the attacker enumerates AD, but it's a mock AD.
1412200	1413560	The attributes are fake.
1413560	1416320	The users are non-existent.
1416320	1421160	They're basically in a sandbox, and they're just digging deeper and deeper
1421160	1423540	without even knowing that they're in a sandbox.
1423960	1426360	We have anonymous shares out there.
1426660	1429340	We lure them in with sensitive info.
1429780	1435800	We have the attacker upload malicious SCF files, have them fire up Responder
1436520	1441760	or different LMR NVT poisoning attacks.
1442060	1444100	We're going to respond to them.
1444100	1449200	We're effectively just throwing them into...
1449200	1453260	giving them breadcrumbs that ultimately lead to nowhere.
1453860	1461020	So we will have SMB boxes with SMB signing disabled.
1461020	1463500	They're going to have relay attempts.
1463620	1470300	We're going to give them net NTLM hashes with passwords that are incredible to crack,
1470300	1472460	just exceptionally difficult to crack.
1472460	1478780	Just have them burn up resources, burn up time, pound on sand, if you will.
1479220	1482980	So this includes exhausting different man-in-the-middle attacks.
1483000	1485380	What we really want to do is just have them run the gamut
1485380	1489880	before they really actually either, number one, give up,
1489880	1494780	or number two, are in it so deep that they typically get tunnel vision,
1494780	1496840	will have canaries out there.
1496840	1502420	Just kind of really want to, at the end of the day, just aggravate people.
1502420	1506940	If you have a really good product, you're going to aggravate people,
1506940	1509840	which is going to really just kind of...
1509840	1513040	the nature of a pen tester or someone that's on the offensive side
1513040	1517020	is typically you get tunnel vision.
1517020	1520960	You kind of start beating up on the same boxes, or you're repeating the same thing.
1520960	1522600	You kind of get into a routine.
1522600	1530600	So that's the kind of flow that we want to get people into.
1530800	1534960	Ultimately, we have telemetry in place.
1535040	1542100	We want to make it so that the attacker is going to get gradually louder and louder,
1542100	1547080	and the whole time we're just following their actions.
1547080	1548760	We're monitoring what they're doing.
1548760	1552320	So just a quick look at our user here, Ali G.
1552620	1553820	Respect.
1553880	1559780	And our mock environment here that we set up that we use for testing.
1561080	1565020	So a couple of tools, a couple of shout outs.
1565480	1566900	Number one, Deja Vu.
1566900	1571100	It's an open source deception framework that we used.
1571440	1577620	And Detection Lab, which the links will be available within the slides.
1577620	1580660	I highly recommend it for our internal environment.
1580660	1589100	We were able to spin something up within AWS and locally very, very quickly, very cost effective.
1589100	1595720	And on top of that, we leveraged Deception and Active Directory.
1595720	1604180	Nickel, he wrote Deploy Deception, an exceptional set of PowerShell scripts
1604180	1612040	that will allow you to create an entire mock Active Directory environment
1612040	1621520	with objects and attributes where you can create a fake user with different permissions
1621520	1629620	and really just kind of take out the tedious work that's involved in creating this sort of environment.
1629620	1633700	Obviously, you want to, you know, customize it as much as possible.
1633700	1639460	But, you know, a lot of respect for Nickel for putting this together.
1639600	1645320	You know, it allows the adversary to enumerate decoy objects with aggressive logging enabled
1645320	1650160	and just makes it exceptionally easy to set up.
1650160	1654160	And, you know, really sets up different types of attacks,
1655520	1660100	different types of, you know, users with passwords that don't expire,
1660100	1666400	people with members of elevated privilege groups, users with ACL rights.
1667640	1675260	Ultimately, what this allows is that it increases the time that an attacker is within your environment,
1675260	1678600	in your mock environment, and it increases a higher detection rate.
1679680	1684080	And it's, you know, as I mentioned, it's very easy to deploy with PowerShell.
1685940	1694480	So, you know, hopping on Ali G, we've got, you know, going into the lateral movement aspect,
1694480	1698320	we've got hunting creds, hunting tokens, hunting users.
1698320	1701980	Now, this is pretty typical of a lot of decoy products.
1701980	1709980	We're going to create a decoy admin account, and we have logging enabled for this account.
1710300	1713760	And we're going to deny login for this DA account.
1713760	1721020	So in the event that, you know, when the attacker does stumble upon our hunting creds or hunting tokens,
1721020	1726500	we'll get an alert for this account, someone attempting to log in.
1726500	1731860	And, you know, one of the methods that we leverage is by, you know, allowing, you know,
1731860	1740720	making sure that this dummy honey DA account doesn't have the ability to log on to any systems.
1740720	1749240	And we do this, one of the methods is by, you know, assigning that account to a computer that does not exist.
1749600	1755420	And this is the type of, you know, alert that you would get.
1758760	1763220	And, you know, that account is heavily logged and alerted.
1763220	1770020	And then a few things, you know, that in my research for this was going into different types of detection
1770020	1774840	that's in place for, you know, decoy environments.
1774840	1778520	And one of the projects that I stumbled upon is called the Honey Pot Buster,
1778520	1784500	which helps you, you know, kind of audit and test your environment, your decoy environment,
1784500	1793420	just to see what is the ability to actually detect, you know, your attackers within a decoy environment.
1793420	1801560	This kind of gives you an understanding of the legitimacy, how real does it, you know, does your decoy environment look.
1807670	1815150	So, some of the things that we could do to make your, to identify,
1815150	1822170	some of the things that we could do to identify whether your environment is a,
1822170	1825550	let's say, you know, you're in a decoy environment.
1825550	1833650	You could look at some of the products, and this is coming from Nicole's, and I apologize for mispronouncing your name,
1833650	1839370	but some of the things that he identified in his research was that, you know, the object SID,
1839370	1843630	the last login, the last logon timestamp, login count, bad password count.
1843630	1850870	This is from his research in identifying attributes within the mock Active Directory environment
1850870	1858950	that can basically, an attacker can look at and say, okay, you know, here's a user that's never logged on
1858950	1864170	and he has zero login attempts, zero failed password attempts.
1864510	1867870	You know, these are all attributes that can give away your decoy environment.
1867870	1872630	So, some of the things that you want to take into consideration when building your mock environment
1872630	1875670	to kind of make it look as real as possible.
1876630	1886210	Some of the other tools that, you know, that we've, that I've seen for detecting LMR and MBT poisoning,
1886210	1889990	there's, you know, honeypots that detect this sort of behavior.
1890330	1899570	It's fairly simple. A lot of them will, you know, broadcast to 255.255.255.255,
1899570	1908550	and this is a clear indication that you're looking at an LMR and MBT poisoning, you know, layer 2 honeypot.
1908550	1915870	And really simple bypass or workaround is to just set up TCP dump or Wireshark to look for that.
1915870	1922670	And, you know, ignore within, you know, whatever poisoning tool that you prefer.
1923590	1930510	And obviously, whenever you hop on a network, you want to use respond and analyze only mode.
1931450	1936210	So, you know, the final point, what we're getting at and kind of coming full circle
1936730	1941910	is that when building these types of environments, you want to keep it as realistic as possible.
1941910	1953070	You know, the objective is to, you know, make it so that the attacker, it takes an exceptionally long time
1953070	1961050	for the attacker to, you know, identify that they're in a staged environment, that it's false
1961050	1964290	and that they're kind of just being run around in circles.
1964930	1970410	And, you know, at the end of the day, this industry and this game, the nature of this game
1970410	1979330	is always going to be a game, cat and mouse. But if you can make it so that it takes the adversary
1979650	1985590	a really long time, hours and hours of their time has been wasted sitting around in this environment.
1985590	1992350	If you can burn their time, that is something that is finite and will ultimately never can,
1992350	1994570	no matter who you are, you can never buy more time.
1994570	1999710	So that's our objective and, you know...
1999710	2008710	Yeah, a lot of it was looking into how do we change this whole process from what Mo showed,
2008710	2018070	which is like the recon, the LinkedIn fake users and just like sprinkling passwords and fake password dumps
2018070	2024030	or like in real password dumps. But getting all that out there and those little click baits
2024030	2030830	for like going into those emails. And then from there, how we take it to the perimeter level
2030830	2037410	and the app level and just like pull them down into the rabbit hole until they get into that AV environment
2037410	2047170	and they've been just wasting weeks or like days, weeks, as long as they need for realizing that it was all nothing.
2047290	2052390	So, I mean, that's part of like the more sophisticated attackers, they will go in deeper and deeper
2052390	2059950	because they have the resources to actually crack all those passwords and do the manual labor.
2059950	2065770	But the deterrence is more for the strip kiddies or the lower level attackers that, you know,
2065770	2072310	once you hit them with 100 hashes and they actually need to start cracking it, they need to get those resources.
2072630	2081310	It deters a lot of attackers. And then especially for perimeter and app level, since you do not have really tools for that,
2081310	2090290	and it's mostly custom, so it's kind of easier to implement that into your flow without...
2090290	2097170	because there are no tools to detect. And I mean, this was just the start, you know, we had one presentation,
2097170	2105070	we were working on more cloud-related deception, utilizing the AWS agent and fake access keys,
2105070	2114330	which we hope that for next time we'll have something great with that. We will, but it'll just take us some time.
2114330	2117690	But yeah, this is an endless journey on going this path.
2121420	2127420	All right. Great talk, everyone. Really appreciate it. Our first question comes from Mark.
2128440	2132840	Are you looking at any disruptions in Office 365 or Azure AD?
2136850	2144270	Oh, you want to take that one? I'll just say that we did not look at Azure AD at all.
2144390	2149730	We did spin up an AD environment that's more similar to an internal network.
2150070	2155490	So most of the things we did on cloud was related to the web apps and the perimeter.
2155690	2160270	And then from there, it was like a pivot into an internal network.
2165090	2172410	Right. As Danny mentioned, this is just kind of the... Mark, thank you for the question.
2172470	2178570	And no, not yet, but we would love to work on that.
2179110	2187730	And, you know, if anyone's willing to... is interested in collaborating on this, Danny and I are beyond excited to do so.
2188930	2192590	And I guess one last question real quick for me.
2192590	2201170	I've seen a lot of companies and solutions, open source solutions, pop up in the active defense honeypots kind of arena.
2201250	2207670	Do both of you have any sort of predictions or where do you see the future of these tool sets going?
2209350	2217050	I'll say from my side that most tools that we saw and encountered in Pentest or Red Teaming,
2217050	2220650	like I said in the beginning, they were focused on internal networks.
2220650	2229470	And then today with this whole migration to the cloud and microservices and Docker containers,
2229470	2236690	which are replacing a lot of big web servers, these to be big like monolith web servers or Microsoft servers.
2236690	2243050	And we did not see any tools or anything relevant for that.
2243050	2251150	So we do hope that, you know, it will go to that path because like we saw in the second slide,
2251150	2255110	where we have the comparison of Deception and Red Team and Blue Team,
2255110	2259250	like Blue Teaming is way, way behind on Deception technologies.
2259550	2264630	And then, I mean, we did this talk because we are trying to push this forward in this research.
2264630	2268630	So hopefully, it'll advance a lot.