1 00:00:00,000 --> 00:00:03,380 Thanks everyone for attending my talk. 2 00:00:03,400 --> 00:00:10,880 So those of you who don't know me, I am a PhD candidate at Arizona State University. 3 00:00:11,180 --> 00:00:18,560 I am specializing in use of artificial intelligence and machine learning in the field of cybersecurity. 4 00:00:18,560 --> 00:00:22,200 I'm also a security consultant at Bishop Fox. 5 00:00:22,340 --> 00:00:31,620 I also authored a book known as Software Defined Virtual Network Security, dealing with security in software-defined systems. 6 00:00:31,840 --> 00:00:37,760 I'm also co-founder of DevilSec, which is the hacking club that we have at ASU. 7 00:00:37,760 --> 00:00:46,920 I've worked for BlackBerry and Public Services and Computer Sciences Corporation in the past, and this is my contact information. 8 00:00:46,980 --> 00:00:51,280 So let's dive into the overview of the talk. 9 00:00:51,280 --> 00:00:53,940 What is the motivation? 10 00:00:53,940 --> 00:00:58,180 What would be the overview of our system, ASAP? 11 00:00:58,260 --> 00:01:02,500 There are three main modules in the system. 12 00:01:02,500 --> 00:01:12,100 Stringer, which is used for the discovery of information, both services and vulnerability in the network. 13 00:01:12,100 --> 00:01:18,960 Americano, which is used for analysis of different paths an attacker can take in a network. 14 00:01:18,980 --> 00:01:25,180 And Cappuccino, which is our AI-based autonomous attack plan generator. 15 00:01:25,900 --> 00:01:36,260 And finally, we do the validation of these attack plans, and we will jump into the demo after the end of the presentation. 16 00:01:36,920 --> 00:01:40,880 So let's see what is machine learning. 17 00:01:40,880 --> 00:01:51,520 It's a statistical way of learning from the information present in your network, what kind of network traffic you have, the logs on your system. 18 00:01:51,520 --> 00:02:01,820 So using some pattern recognition to identify some attack patterns in a network, we use machine learning techniques for that. 19 00:02:01,820 --> 00:02:08,080 And it's already been used successfully in things like spam detection on your email. 20 00:02:08,080 --> 00:02:16,360 You don't get those Nigerian Prince emails these days because of amazing job done by spam detection systems. 21 00:02:17,080 --> 00:02:32,760 Artificial intelligence, on the other hand, it perceives the network traffic, what kind of activities are going on within the environment, and uses that information to take some decisions. 22 00:02:32,760 --> 00:02:39,560 So it basically acts on the information provided by different agents in the environment. 23 00:02:39,560 --> 00:02:58,100 You can think of smart ideas that we can design in a system, which basically collects information from different parts of the system, updates its beliefs, and then takes some intrusion prevention system measure. 24 00:02:58,100 --> 00:03:03,680 So that is something that we can take the help of AI in designing. 25 00:03:05,740 --> 00:03:14,180 AI and machine learning have found some useful applications in cyber security, both in industry and research. 26 00:03:14,180 --> 00:03:22,880 We use the attack patterns for detection to basically identify malicious actors within our network. 27 00:03:22,880 --> 00:03:29,080 And we try to see if the attacks are very stealthy in nature. 28 00:03:29,080 --> 00:03:36,860 There are attacks like advanced persistent threat, which are basically slow and low kind of attacks, which are hard to detect. 29 00:03:36,860 --> 00:03:41,020 They are carried over like multiple days. 30 00:03:41,620 --> 00:03:47,360 A good example is Sony hack, which was carried out over a period of several months. 31 00:03:47,380 --> 00:03:56,780 So identifying some valuable patterns from those kinds of attacks is some place where we can definitely utilize machine learning. 32 00:03:57,500 --> 00:04:38,360 And there are recent investigation in the use of AI to design deception based system, moving target defense and cyber deception in general are two ways or two fields of research that explore how to identify the attack patterns in a network and basically use that information to present a fake view of the network to an attacker and deceive him into honeypots where they can do further analysis of his attack intentions. 33 00:04:40,640 --> 00:04:45,120 So why do we need AI and machine learning in cybersecurity? 34 00:04:45,120 --> 00:04:56,000 And I did some background research and it's estimated that there will be 25 billion IoT devices in US by 2021. 35 00:04:56,000 --> 00:05:02,760 And the investment in cybersecurity will be up to a trillion dollars. 36 00:05:02,980 --> 00:05:10,580 With penetration testing, if we look at it, market size would be 3.2 billion US dollars. 37 00:05:10,580 --> 00:05:22,400 So the number of devices are growing perhaps at a quadratic scale, but we have a shortage of cybersecurity workforce. 38 00:05:22,400 --> 00:05:34,500 It's estimated that 65% of the organizations feel that their staff is not very well equipped in cybersecurity. 39 00:05:35,110 --> 00:05:49,160 And 36% of the organization reported that there is a lack of training or skills in existing cybersecurity workforce. 40 00:05:49,340 --> 00:05:55,470 So that is where we plan to use AI to kind of bridge this gap. 41 00:05:59,090 --> 00:06:13,020 So if you look at a very practical example of application of artificial intelligence, DARPA Cyber Grand Challenge was one place where AI was successfully applied. 42 00:06:13,020 --> 00:06:32,020 There were seven participating schools, seven or eight, who took part in a hacking competition where each school was trying to target the infrastructure of everybody else while keeping its own infrastructure secure. 43 00:06:32,040 --> 00:06:40,980 So the important catch was that all of these participants were AI, not AI, but autonomous systems. 44 00:06:40,980 --> 00:06:47,240 And there was no human involved in this competition. 45 00:06:47,240 --> 00:06:56,240 So Mayhem, which was a company based out of CMU, they automated what white hat hackers could do. 46 00:06:56,240 --> 00:07:02,380 So they found and exploited the weaknesses present in these system. 47 00:07:02,380 --> 00:07:09,080 What they did was they created a mathematical model of the paths that attacker can take. 48 00:07:09,080 --> 00:07:13,220 And then they used two techniques, symbolic execution and fuzzing. 49 00:07:13,220 --> 00:07:21,780 So symbolic execution was the way to point out interesting code paths. 50 00:07:21,780 --> 00:07:33,740 And fuzzing was kind of a hammer, which was hammering through those code paths to exploit the vulnerabilities pointed out using symbolic execution. 51 00:07:33,780 --> 00:07:44,440 And they won this championship and they managed to find 14,000 vulnerabilities on Debian system as well. 52 00:07:44,440 --> 00:07:47,060 And 250 of these vulnerabilities were new. 53 00:07:47,060 --> 00:07:54,940 So imagine a human attacker trying to do all this, it's kind of difficult. 54 00:07:54,940 --> 00:08:03,320 And this shows a successful motivation to use machine learning and AI in the field of cybersecurity. 55 00:08:04,520 --> 00:08:10,320 So if you look at our system, ASAP, there are four main modules. 56 00:08:10,320 --> 00:08:14,280 Stinger, which is, S stands for scanning. 57 00:08:14,280 --> 00:08:17,180 So we use Stinger for scanning and Recon. 58 00:08:18,060 --> 00:08:21,640 The information from Stinger is fed into Americano. 59 00:08:21,640 --> 00:08:23,940 So A stands for attack analysis. 60 00:08:23,940 --> 00:08:34,500 And we use this information from Americano to identify the attack states in the network. 61 00:08:34,500 --> 00:08:39,580 Latte, which is a module, L stands for log here. 62 00:08:39,580 --> 00:08:46,240 So it's a module which identifies network and host logs to gather the threat evidence. 63 00:08:46,240 --> 00:09:04,440 And Cappuccino, which is kind of the network controller, it takes all this information from Americano and Latte to encode in form of AI model, Markov decision process. 64 00:09:04,720 --> 00:09:19,720 And based on that model, it identifies some attack plans, like if a penetration tester were to test or attack this network, what kind of plan would yield him maximum output? 65 00:09:20,660 --> 00:09:33,780 And eventually we can execute these attack plans on a cloud or web application and update the risk score and attack graph, which is basically Americano. 66 00:09:35,760 --> 00:09:40,340 So I am addicted to caffeine. 67 00:09:40,340 --> 00:09:46,460 That is why I chose the name of these modules based on different kinds of coffee flavors. 68 00:09:47,360 --> 00:09:50,460 So let's dive deeper into Stinger. 69 00:09:50,460 --> 00:09:58,040 So Stinger basically scans the network topology for service information and discovers the vulnerability. 70 00:09:58,040 --> 00:10:08,060 So we have automated Nessus and OpenVS APIs to identify this attack information. 71 00:10:08,820 --> 00:10:15,000 And this attack information is then fed into Americano, which is attack graph generation tool. 72 00:10:16,540 --> 00:10:21,040 So let's look at one of the known vulnerabilities. 73 00:10:21,180 --> 00:10:30,980 This is a shell shock vulnerability, and there are different parameters from common vulnerability scoring system for this particular vulnerability. 74 00:10:30,980 --> 00:10:38,260 Like you need just a network access to execute this attack and it has a low access complexity. 75 00:10:38,260 --> 00:10:46,100 So you don't need to do a lot of investment as an attacker to exploit this vulnerability. 76 00:10:46,100 --> 00:10:59,820 So this is a example of kind of vulnerability where we can implement some sort of automation once we are able to identify this vulnerability. 77 00:11:01,440 --> 00:11:18,630 And the reason of providing this information is that we will see later that how we can use these CVSS parameters like access complexity and possibly CVSS score to encode the information in our AI solver. 78 00:11:20,270 --> 00:11:36,280 These are some other parameters like the impact on confidentiality, integrity and availability is very high and attacker can take full control of that system if he were to exploit this particular vulnerability. 79 00:11:37,380 --> 00:11:55,660 So let's take a look at a motivating example where attacker is located on internet and his goal is to reach this database server and exfiltrate the information out of database server to his command and control center. 80 00:11:55,660 --> 00:12:01,120 And there are some publicly known vulnerabilities on these machines. 81 00:12:03,640 --> 00:12:15,660 So basically attacker is trying to exfiltrate the information from database server but there is a firewall on his way so he cannot directly access this database server. 82 00:12:15,660 --> 00:12:31,160 So he either needs to go through the web server or wait for internal user to download some of his malicious code and use that as a pivot to go to the database server. 83 00:12:32,460 --> 00:12:37,120 And the web server is the only publicly available service in this network. 84 00:12:38,500 --> 00:12:55,540 So attacker can try to exploit the web server using unknown vulnerability or he can have some malicious script on a popular website that a user downloads and that way he can gain access into his workstation. 85 00:12:56,280 --> 00:13:12,420 And using this, he can then take advantage of the access control list which basically allows any network traffic from web server to go to database server or any workstation traffic to go to database server. 86 00:13:12,420 --> 00:13:32,300 And that way the attacker can exploit the SQL injection vulnerability that is present on the database server and then use it to gain persistent access to his command and control center. 87 00:13:33,220 --> 00:13:41,280 So you will see that there are two attack paths in this small network to achieve the same goal. 88 00:13:41,300 --> 00:13:55,380 So imagine a very giant network with tens of thousands of instances and you are asked to perform a penetration test for that network in a limited period of time. 89 00:13:55,720 --> 00:14:10,120 So you need some kind of autonomy or automation in that particular case to be able to have a good coverage in your penetration test. 90 00:14:12,400 --> 00:14:15,040 So we saw this example, but what about it? 91 00:14:15,040 --> 00:14:18,920 Like, how do we basically use this information? 92 00:14:19,000 --> 00:14:42,040 We can do some initial attack analysis based on this example and see that attack is multi-stage and attacker had specific attack vectors for this vulnerability and he went through multiple hosts and he circumvented some of the defenses that were present on the systems to achieve his goal of data exfiltration. 93 00:14:44,200 --> 00:14:55,560 So let's discuss on kind of a philosophical level why AI can be used to hack faster. 94 00:14:55,560 --> 00:15:19,920 So imagine you are going home on a particular day and you decide to take a turn on Arizona Avenue and Main Street and you have been taking this route forever to reach your home, but you encounter a traffic jam on the way. 95 00:15:21,480 --> 00:15:28,020 So you went by your intuition and this got you into a traffic jam. 96 00:15:28,020 --> 00:15:34,020 But if you had a GPS to help you navigate, you could have avoided that jam. 97 00:15:34,860 --> 00:15:48,040 So similarly, as penetration testers, when we try to go after certain vulnerabilities, we have kind of a preset methodology. 98 00:15:48,040 --> 00:15:52,640 So we will go through some authentication issues, authorization issues. 99 00:15:52,640 --> 00:15:57,140 We will see if we can use the user management in some way. 100 00:15:57,180 --> 00:16:02,580 We can try to see if we can get horizontal privilege escalation. 101 00:16:02,640 --> 00:16:05,000 We go after data stores. 102 00:16:05,380 --> 00:16:07,480 We go after application logic. 103 00:16:07,480 --> 00:16:23,940 If it involves the code review, we go through the procedure of code review and use all of that to see like what's the maximum we can get in this penetration test. 104 00:16:24,360 --> 00:16:27,560 But here is the challenge. 105 00:16:27,560 --> 00:16:53,920 Like if you have say 20 hours for a particular assessment, do you think on environment where you have to do pen test on application as well as the cloud part of the backend components, it's very challenging to get a good coverage in that scenario. 106 00:16:54,640 --> 00:17:06,300 So AI and machine learning can act as kind of navigator for us on these assessments. 107 00:17:06,300 --> 00:17:16,280 So we can think of ASAP as kind of AI based GPS to navigate the attack surface. 108 00:17:16,280 --> 00:17:34,820 And it may not work on all kind of unknown vulnerabilities like say data encryption issues, which you identify which is a vulnerability, but it can help us in semi-automating some of the tasks that we may miss out. 109 00:17:34,820 --> 00:17:50,520 So the worst thing would be that there is a very low complexity vulnerability that was present on the system, but you just ran out of time on your pen test and you couldn't exploit that vulnerability. 110 00:17:50,520 --> 00:17:54,360 And later the client finds out, hey, why did you miss it? 111 00:17:54,360 --> 00:17:57,300 So then you are in a tough situation. 112 00:17:57,540 --> 00:18:02,160 So that is another kind of motivation to develop this kind of a system. 113 00:18:03,900 --> 00:18:19,940 So with Americano, we get the information from Stinger and we use these vulnerabilities and software configuration to pass to a first order logic based framework. 114 00:18:20,160 --> 00:18:25,680 And that framework basically generates a multi-stage multi-hop attack graph. 115 00:18:25,680 --> 00:18:36,060 And attack graph basically shows that different paths an attacker can take in a network to be able to reach his desired goal. 116 00:18:37,980 --> 00:18:46,000 So if you look at the definition of attack graph, we have some nodes and edges which are a property of a given graph. 117 00:18:46,040 --> 00:18:49,080 There are some fact nodes, NF. 118 00:18:49,400 --> 00:18:57,800 Fact nodes will be something like the existence of vulnerability or the existence of network connections. 119 00:18:58,260 --> 00:19:11,260 And conjunct node are denoted by NC, the disjunct node are denoted by ND and root node, which is basically goal of attack is denoted by NR. 120 00:19:13,020 --> 00:19:24,380 So conjunct node can be something that you can achieve based on your initial exploitation of certain vulnerability. 121 00:19:24,380 --> 00:19:37,360 So you have some fact nodes that you combine with these interaction rules that we provide in first order logic to achieve some other conjunct nodes like exact code. 122 00:19:37,360 --> 00:19:46,060 So suppose there is a vulnerability buffer overflow on web server and the attacker can access the web server. 123 00:19:46,060 --> 00:19:53,120 So if attacker is located on internet, then that can lead to execution of code on web server. 124 00:19:54,640 --> 00:20:02,000 And based on that example, the root node in our case would be to gain a root privilege on database server. 125 00:20:04,290 --> 00:20:07,770 So there are two kinds of edges. 126 00:20:07,770 --> 00:20:15,670 E pre denotes the precondition edge and E post denotes the post condition edge. 127 00:20:15,870 --> 00:20:29,850 So a precondition edge basically combines the fact nodes and conjunct node to show that the next possible state that an attacker can achieve. 128 00:20:30,030 --> 00:20:37,310 And E post means the edges that are triggered if some preconditions are satisfied. 129 00:20:37,770 --> 00:20:45,530 And we have some base initial condition nodes in this attack graph that we can denote using NI. 130 00:20:48,900 --> 00:20:57,300 So to simplify this, we have some advisories that we identify based on the scanning of the network. 131 00:20:57,600 --> 00:21:02,740 We have host configuration information, we have network configuration information. 132 00:21:03,080 --> 00:21:10,040 The principle indicate like who has ownership on which machine. 133 00:21:10,600 --> 00:21:23,940 And we use interaction rules and policies to provide input to this attack graph with reasoning engine, which then generates attack graph for us. 134 00:21:27,040 --> 00:21:40,020 So before going any further, let's look at some information of these Mulwell rules. 135 00:21:40,020 --> 00:21:45,040 Mulwell is basically a reasoning system which encodes this information. 136 00:21:45,040 --> 00:21:54,100 And it's a work by University of Kansas, which we kind of used in our development of the ASAP system. 137 00:21:54,100 --> 00:22:08,500 So advisories show that what kind of vulnerability exists in the network, vulnerability property, host configuration shows that the web server has Apache software, it's running on port 80. 138 00:22:08,960 --> 00:22:10,720 This is the daemon. 139 00:22:10,780 --> 00:22:24,100 Network configuration is basically the access control list, which says that from internet to web server, there is a TCP connection that can be established on port 80. 140 00:22:25,360 --> 00:22:37,040 And principle show that a user has a user account on this PC and there is another system admin, which is kind of a root level account on the web server. 141 00:22:37,040 --> 00:22:50,020 So all these information we can obtain by scanning the network and by obtaining the host configuration information, the network rules. 142 00:22:51,060 --> 00:22:56,640 And then they go through these first order logic rules. 143 00:22:56,640 --> 00:23:19,260 So this is one of the rules, which says that if there is a vulnerability existing on host with vulnerability ID and the vulnerability has a property that it's a remote exploit, and there is a network service corresponding to this host and the attacker has a network access on this host and attacker is malicious, 144 00:23:19,680 --> 00:23:22,300 then this will lead to a code execution. 145 00:23:23,380 --> 00:23:39,460 So these are basically predicates of this rule and this is executed code by attacker on host and gaining of privilege is basically the host condition that is obtained when all these preconditions are satisfied. 146 00:23:40,880 --> 00:23:54,020 And we also use the policies which show the user access on different resources in the system to encode into these interaction rules. 147 00:23:55,860 --> 00:24:03,340 So this will be a logical attack graph of our system that we saw. 148 00:24:03,340 --> 00:24:08,560 You can think of attacker located on internet as this node zero. 149 00:24:09,140 --> 00:24:16,440 Then the node zero interacts with different nodes and these ovals represent the rules. 150 00:24:16,800 --> 00:24:20,940 So like one of this oval will be interaction rule. 151 00:24:22,040 --> 00:24:26,300 And based on that, the attacker progresses to the next privilege node. 152 00:24:26,300 --> 00:24:51,900 So we can think of this as like a root exploit on say Apache web server, then attacker probably gains some other network level access using another host condition of that graph and eventually reaches his goal of gaining root access on a database server by exploiting SQL injection. 153 00:24:53,580 --> 00:25:00,080 So the main brain or AI in this work is Cappuccino. 154 00:25:00,240 --> 00:25:20,580 So what Cappuccino does is it takes the information from attack graph and information about different configurations and vulnerability from this CV search database and log information from the Latte module to create a MDP graph. 155 00:25:22,020 --> 00:25:33,840 So MDP graph can then be used to derive attack plan that we as penetration testers will implement on the network. 156 00:25:34,820 --> 00:25:39,200 So let's see how the states can be extracted from attack graph. 157 00:25:39,200 --> 00:25:52,540 So there were fact nodes which shows that attacker was at internet initially and the next privilege node that he gained was a network access on say another machine FTP. 158 00:25:54,160 --> 00:26:05,140 So there are two things that attacker can do when he is located on internet, either he can take no action or he can exploit this vulnerability. 159 00:26:06,420 --> 00:26:13,100 Let's say the CV ID of this vulnerability is CV 2013 4124. 160 00:26:13,100 --> 00:26:27,660 So these will be the states that we can extract from attack graph to be used in our Markov game or our Markov decision process. 161 00:26:28,180 --> 00:26:44,600 So let's revisit the attack graph and let's see that for this another example, if there are two paths that attacker needs to take to be able to exploit this FTP machine. 162 00:26:44,600 --> 00:26:57,940 So one way he can go about is that he goes from SSH and then tries to exploit the FTP or another way is that he first exploit this web server and goes to FTP. 163 00:26:59,740 --> 00:27:19,120 So the corresponding attack graph for this network will be that attacker has SSH access, there is a SSH vulnerability, he exploits SSH, he gains a root on SSH or the attacker can also go through the exploitation of web server. 164 00:27:19,120 --> 00:27:29,620 So basically he goes through the web server to exploit some vulnerability on web server and then he reaches the FTP server. 165 00:27:29,620 --> 00:27:34,000 So in this graph, there are basically two paths that attacker can take. 166 00:27:35,480 --> 00:27:46,820 So if we are to obtain a Markov decision process from this, basically MDP has some components, state, action, transition and reward. 167 00:27:47,580 --> 00:27:53,900 So state represents the access that an attacker can obtain at any point in the network. 168 00:27:53,900 --> 00:28:00,540 So he can be a user in SSH, if he exploits the vulnerability, he can be a root user on SSH. 169 00:28:00,700 --> 00:28:09,120 If he exploits the web server, he can obtain a root on the web server and eventually he can also obtain a root on FTP. 170 00:28:10,460 --> 00:28:18,500 There are two actions that we use to simplify this Markov decision process. 171 00:28:18,500 --> 00:28:27,500 So in each state, attacker can either choose to take no action or he can choose to exploit the next vulnerability. 172 00:28:27,960 --> 00:28:33,020 And there are some probability values that are associated with these actions. 173 00:28:33,020 --> 00:28:41,120 And these probability values we will explain like how we derive meaningful probability values for the MDP. 174 00:28:42,580 --> 00:28:47,180 And we kind of relate these to the access complexity of the vulnerability. 175 00:28:47,180 --> 00:28:58,540 So if the access complexity is low, then probably it's easier to exploit that vulnerability and there is a higher probability of transitioning to the next state. 176 00:29:01,500 --> 00:29:07,880 And the rewards are the values attacker obtains by being in a particular state. 177 00:29:07,880 --> 00:29:12,100 Say attacker does not want to exploit that vulnerability. 178 00:29:12,100 --> 00:29:15,240 So he will have kind of a low reward. 179 00:29:15,240 --> 00:29:21,760 The reward is that basically he is not detected by say an intrusion detection system. 180 00:29:21,760 --> 00:29:27,420 So that's kind of a reward for him but it's not very big reward. 181 00:29:28,380 --> 00:29:35,760 As compared to if he is able to obtain a root account on one of the external services, that's a high positive reward. 182 00:29:36,660 --> 00:29:45,700 So we put this value like a plus five and we use the CVSS score of the vulnerabilities to derive the reward. 183 00:29:46,400 --> 00:29:51,320 So the reward can at any point be between zero and 10. 184 00:29:52,580 --> 00:30:01,020 And if there are uncertainty in the attacker action, this can be considered as a partially observable Markov decision process. 185 00:30:01,980 --> 00:30:11,020 But in this work, we are using the simple Markov decision process to show how we encode this attack information. 186 00:30:12,100 --> 00:30:22,840 And when we solve this Markov decision process using a value iteration solver, we obtain some policies. 187 00:30:22,840 --> 00:30:30,640 So policies are different paths that attacker can take to obtain some of his goals. 188 00:30:31,740 --> 00:30:34,120 And the reward for each path. 189 00:30:34,120 --> 00:30:46,060 So value iteration tries to maximize the value that an attacker can gain by following a particular policy. 190 00:30:46,060 --> 00:30:58,900 So there are two policies, like he can either exploit SSH, then exploit FTP, or he can exploit SSH, then go to web server and then exploit FTP. 191 00:30:58,900 --> 00:31:04,500 So obviously the reward in second policy is higher compared to first policy. 192 00:31:04,800 --> 00:31:06,560 But this is for a simplified network. 193 00:31:06,560 --> 00:31:12,420 We can hand encode these values and solve this Markov decision process. 194 00:31:12,420 --> 00:31:23,380 But as a penetration tester, if you are dealing with a very gigantic network, we would want to encode this information using some of the MDP solvers. 195 00:31:25,180 --> 00:31:32,400 So, as I mentioned, the states are the privilege level of the attacker. 196 00:31:33,440 --> 00:31:44,700 The value for the transition metric, which is basically the probability of transitioning from one state to next state using an action. 197 00:31:44,700 --> 00:31:55,660 So suppose S0 was a state of user access on SSH and S1 is the state of root access on SSH. 198 00:31:57,420 --> 00:32:04,580 And the access complexity of this vulnerability is low. 199 00:32:04,580 --> 00:32:09,960 That means that there is a high probability of transitioning to state S1. 200 00:32:09,960 --> 00:32:32,420 So we encode the value 0.9 for low access complexity, vulnerability 0.6 for medium, and 0.2 for a high access complexity because the vulnerabilities for which access complexity is high, they are obviously difficult to exploit. 201 00:32:32,420 --> 00:32:38,120 So there is a good chance that attacker will stay in state S0 if he tries to take an action. 202 00:32:39,140 --> 00:32:53,680 And the reward value basically for transitioning to state S1, if the CVSS score of the vulnerability is 6.4, that will be the reward that attacker will gain by transitioning to that state. 203 00:32:57,580 --> 00:33:08,700 So as we discussed, the states represent the current privilege level of attacker and the actions are the actions that attacker will take. 204 00:33:09,040 --> 00:33:18,640 And the transition probabilities are the values we derive from the access complexity of each CVSS vulnerability. 205 00:33:20,540 --> 00:33:41,410 And if we encode this information for action exploit SSH in a form of a transition metric, so by taking action exploit SSH, there is a 0.9% probability that attacker will go from state S0 to S1. 206 00:33:41,410 --> 00:33:47,630 So let's consider the rows 0, 1, and 2 and columns 0, 1, and 2. 207 00:33:47,630 --> 00:34:02,150 So S0, S1, which is 0, 1 row and column, will show that there is a 0.9% probability that attacker will transition from S0 to S1 by taking that action. 208 00:34:02,150 --> 00:34:06,130 But that action has no implication on other states. 209 00:34:06,130 --> 00:34:16,750 So if he was in state S1, then exploit SSH doesn't do a whole lot for going to state of S2. 210 00:34:16,830 --> 00:34:21,270 So attacker will remain in state S1 if he takes that action. 211 00:34:23,930 --> 00:34:32,730 So there is a high probability of being in state S1 and S2 if he takes action exploit SSH in S1 and S2. 212 00:34:33,670 --> 00:34:44,250 And the reward, as we discussed, is the values he obtained by the CVSS score of those vulnerabilities. 213 00:34:44,250 --> 00:34:50,850 So if he takes action A in state S, it maps to a real number between 0 and 10. 214 00:34:53,730 --> 00:35:10,430 So as we discussed that taking no action will have a low reward, and exploiting SSH will have a positive reward, which, like if the CVSS score for this vulnerability was 6.4, that will be the reward of being in state S1. 215 00:35:10,430 --> 00:35:16,570 And similarly, the reward of being in state S2 will correspond to the FTP vulnerability. 216 00:35:20,290 --> 00:35:27,430 So bridging it all together, how we arrive at Markov decision process from ATT&CK graph. 217 00:35:27,430 --> 00:35:30,750 So this is the algorithm that I designed. 218 00:35:30,750 --> 00:35:37,910 Basically, you pass the ATT&CK graph to get the nodes, which show the privilege of the attacker in step one. 219 00:35:38,270 --> 00:35:47,150 You find the CVIDs of these vulnerability that lead to this exploitation in step two. 220 00:35:47,170 --> 00:35:52,170 In step three from ATT&CK graph, you fetch the CVSS score of the vulnerabilities. 221 00:35:53,110 --> 00:36:06,850 In step four A, you use the CVSS score to create a reward metric, which show the actions and state transition mapping to a real value. 222 00:36:06,850 --> 00:36:13,850 So basically it will be say a column matrix for different CVSS score. 223 00:36:13,930 --> 00:36:22,910 In state four B, basically you use the access complexity to derive the transition metric. 224 00:36:23,530 --> 00:36:28,890 And you provide all this information to MDP solver. 225 00:36:28,990 --> 00:36:35,950 So the reward metric, the transition metric, the different states and the action. 226 00:36:35,950 --> 00:36:59,250 And we use the PyMDP solver as a solver with the value iteration function to generate an ATT&CK plan, which then we provide to this module PyMetaExploit that executes the ATT&CK plan and shows that how fast is this ATT&CK plan that we obtained. 227 00:37:01,010 --> 00:37:20,030 So for the validation of ATT&CK plan, like if the ATT&CK plan says that first exploit SSH and then FTP, we have MSRPC, which is a daemon of Metasploit, which is running and basically it uses the Python scripts to execute different plans. 228 00:37:20,630 --> 00:37:30,310 And tells us like what is the cost of running different ATT&CK plans, like how much time it took for different ATT&CK plans. 229 00:37:31,490 --> 00:37:46,430 So for MSRPC, you will need to have one of the MSRPC session running on one window and then on another window, you will execute your ATT&CK plan and see how it goes. 230 00:37:48,250 --> 00:37:50,670 So let's look. 231 00:37:52,290 --> 00:37:55,290 Yeah, so let's look at the demo. 232 00:37:55,290 --> 00:37:58,190 So we'll first go to here. 233 00:37:59,070 --> 00:38:11,280 So we can perform port scan to identify the services that are running on the network. 234 00:38:11,280 --> 00:38:17,480 What are the software versions of those services that are present? 235 00:38:17,480 --> 00:38:20,100 It will take some time. 236 00:38:20,100 --> 00:38:30,290 So in that meantime, we will go and check out the vulnerability scan that we have in our network. 237 00:38:30,290 --> 00:38:33,540 Basically, we have like a and 238 00:38:40,130 --> 00:38:50,670 we can see like this scan obtained a lot of vulnerability on a machine that we set up. 239 00:38:50,950 --> 00:39:02,070 There were about 71 vulnerabilities, which were a mixture of critical, high vulnerability 240 00:39:05,840 --> 00:39:08,740 and low vulnerability. 241 00:39:08,740 --> 00:39:16,420 So our ports can reveal some information that we basically need from the Stinger module. 242 00:39:17,050 --> 00:39:37,250 We have the CVE search API, basically, which provides us information on different vulnerability, like if you provide the CVE ID, it tells us the access complexity and CVSS score, which we will later use in Cappuccino. 243 00:39:41,750 --> 00:39:49,830 We have Nessus scanning APIs, which can be used for connecting with the backend 244 00:39:53,360 --> 00:40:11,240 of the Nessus on the provided port and basically check the state of the network scan, basically create policies and see like if the scan is running or not. 245 00:40:11,780 --> 00:40:16,400 We can basically export the scan using these APIs. 246 00:40:16,400 --> 00:40:27,920 One thing is that in latest version of Nessus, I think they have disabled some of these APIs, but if you are using the old version of Nessus, you can use these APIs. 247 00:40:27,920 --> 00:40:39,260 So the scan that we obtained from Nessus, we need to provide as input to the attack graph, which is our Americano module. 248 00:40:43,720 --> 00:40:48,460 And the Nessus scan file we obtained 249 00:40:52,340 --> 00:40:57,600 is this ASAP underscore something dot Nessus. 250 00:40:57,600 --> 00:41:03,220 This will serve as input to the attack graph. 251 00:41:05,680 --> 00:41:11,040 So Malware is a tool which uses this information. 252 00:41:11,040 --> 00:41:22,990 Basically translate the dot Nessus file using Nessus vulnerability translate. 253 00:41:24,670 --> 00:41:38,700 And this will generate a list of interaction rules and another script, which is a graphgen.sh can be used for obtaining the attack graph from this translated information. 254 00:41:38,700 --> 00:41:41,900 So I already have these files. 255 00:41:41,900 --> 00:41:51,460 So you will need to set up Nessus and XSB if you want to use the Americano module and I have the details in the readme file. 256 00:41:54,330 --> 00:42:17,540 So we run the malware module and the attack graph that we obtained, it has some nodes edges, which show the information about the network services, the different vulnerabilities that are present on this network, the interaction rules. 257 00:42:19,080 --> 00:42:27,440 If we check the visual representation, it will look something like this, like the attacker was initially on internet. 258 00:42:27,500 --> 00:42:40,460 Then he used some rules of access control list, which allowed the access to a particular port to have direct access on another machine. 259 00:42:41,560 --> 00:42:44,040 In the network, so he can network access. 260 00:42:44,040 --> 00:42:50,920 Then he used some other vulnerability to mount a remote exploit on one of the server programs. 261 00:42:50,920 --> 00:42:59,500 So this information is represented using a dot file. 262 00:42:59,500 --> 00:43:08,780 And we can obviously use some D3 libraries to improve the visualization, but this is how the attack graph will look like. 263 00:43:09,690 --> 00:43:20,640 So now we use this attack graph and we provide this information to the MDP solver, 264 00:43:23,860 --> 00:43:27,040 which is present in our Cappuccino module. 265 00:43:38,390 --> 00:43:48,370 So the attack graph parser basically parses the attack graph, obtains the information about the access complexity from the CV search. 266 00:43:48,370 --> 00:44:04,290 It checks the predecessor and successor nodes of the network, obtains the attributes that I described in the state transition. 267 00:44:04,470 --> 00:44:14,730 And basically it encodes this information in form of a Markov decision process. 268 00:44:15,650 --> 00:44:29,070 So if you run this code, basically the edge information will tell us if you are transitioning between two edges. 269 00:44:29,070 --> 00:44:39,230 So let's see, between 1007 and 994, the edge has labeled CV 2011-04-11. 270 00:44:39,230 --> 00:44:55,950 And then we will use this information to obtain the access complexity of that particular vulnerability from the attack graph and encode it in form of like a reward metric. 271 00:44:55,950 --> 00:45:06,830 Then the value iteration algorithm will learn the attack policy that is beneficial for the pentester in this case. 272 00:45:06,830 --> 00:45:22,610 I took a subset of the entire graph to run the value iteration algorithm and it tells us that taking action of exploit, so zero represents no action and one represents the exploit action. 273 00:45:22,710 --> 00:45:29,130 So in this state, taking a particular action will be beneficial for the attacker. 274 00:45:30,470 --> 00:45:39,910 So it will take some time to basically run the value iteration solver and it will give you a attack plan. 275 00:45:46,930 --> 00:45:53,270 We use the attack plan validator to basically validate the plan of attack. 276 00:45:53,270 --> 00:46:02,830 So we use the attack plan to exploit FTP and another SSH vulnerability. 277 00:46:02,830 --> 00:46:07,350 And basically you can see we obtained two shells in this case. 278 00:46:08,610 --> 00:46:13,890 And it took 0.35 seconds to complete. 279 00:46:14,130 --> 00:46:28,690 And basically using this attack plan validation, we can validate how much time it took for our attack plan to be finalized. 280 00:46:31,430 --> 00:46:44,030 So basically for the attack plan validation to work, you should have the MSF RPC daemon running in one shell, one session and you need to execute your attack plan in another session. 281 00:46:46,090 --> 00:47:06,550 So in summary, the threat landscape is very complex and ever-growing and the autonomous pen testing solution, like the one that we have used in ASAP, can help us navigate through this complex attack surface. 282 00:47:07,270 --> 00:47:13,790 And it is effort towards the generation of autonomous attack plans and their validation. 283 00:47:15,170 --> 00:47:37,910 So that is another module that we still have in progress and in future our plan is to use the log information to validate these attack plans and possibly also work for some kind of report generation tool, which help us generate the report on how these validation was performed for individual exploits. 284 00:47:43,060 --> 00:47:46,440 So thank you everyone for attending my talk. 285 00:47:46,440 --> 00:47:52,640 The source code is posted on the GitHub repo, the link which you can see. 286 00:47:52,640 --> 00:47:59,320 And if you want to contact me, here is my contact information. 287 00:47:59,460 --> 00:48:11,980 I appreciate the organizers of Red Team Village to give me a chance to speak at this year's Def Con Red Team Village and have fun, everyone.