1
00:00:02,660 --> 00:00:03,880
Hi, DEF CON.

2
00:00:03,880 --> 00:00:05,140
I'm Shai Nechman.

3
00:00:05,280 --> 00:00:10,580
Today, I'll present InfectionMonkey, an open-source breach and attack simulation tool.

4
00:00:10,580 --> 00:00:19,140
We'll cover what the monkey is, how you can use it to improve your network defenses, or step up your testing, and we'll go through a deep demo.

5
00:00:19,180 --> 00:00:22,380
But first, let's dive into the breach.

6
00:00:22,380 --> 00:00:28,820
We're going to see a simulation of a breach that we saw in one of our real customers' networks.

7
00:00:29,720 --> 00:00:33,640
As always, a server was breached.

8
00:00:33,640 --> 00:00:35,320
That's how it starts.

9
00:00:35,320 --> 00:00:47,920
Once inside the network, the attackers were able to move laterally using a vulnerable out-of-date Hadoop service on a Linux server to jump to that Linux server.

10
00:00:48,260 --> 00:00:51,100
That's the red line you're seeing on the map here.

11
00:00:51,680 --> 00:00:59,260
And the attackers exfiliated information back to their original breach server through an uncommon port.

12
00:00:59,260 --> 00:01:02,100
That's the gray line on the map.

13
00:01:04,620 --> 00:01:12,500
After the original propagation, the attackers were able to scan and find even more servers, both Windows and Linux machines.

14
00:01:12,500 --> 00:01:17,000
They stole credentials, breached more servers using other protocols like SSH.

15
00:01:17,000 --> 00:01:19,940
They even set up a tunneling station there in the middle.

16
00:01:20,140 --> 00:01:21,980
That's the blue line.

17
00:01:22,380 --> 00:01:26,060
Into a different sub-network entirely.

18
00:01:26,960 --> 00:01:32,800
And started hopping, started stealing, and basically took over the network.

19
00:01:32,800 --> 00:01:37,600
And my question to you is, how would your organization respond?

20
00:01:37,720 --> 00:01:41,220
Now, this being DEF CON, obviously, I don't only mean your organization.

21
00:01:41,220 --> 00:01:45,120
I also mean the organization that you might be testing right now.

22
00:01:46,100 --> 00:02:01,920
How would your organization respond to specific attack scenarios like someone stealing credentials, someone compromising a web server, a malicious device logging into the network, some blast radius attacks like pasty hash or connectivity checks?

23
00:02:01,920 --> 00:02:04,380
What would the security do?

24
00:02:04,380 --> 00:02:06,040
Would alerts be thrown?

25
00:02:06,040 --> 00:02:07,380
Would the SOC respond?

26
00:02:07,380 --> 00:02:09,980
Would you know the attacker's visibility?

27
00:02:11,880 --> 00:02:14,220
Let's take a look at a case study.

28
00:02:14,220 --> 00:02:22,640
We have an environment, a large development network, with a mix of Linux and Windows servers.

29
00:02:22,640 --> 00:02:32,460
Multiple security products deployed on-site, McAfee Move, an IDS on the network, and the firewall between different segments.

30
00:02:32,460 --> 00:02:42,880
And the scope of this test, the test scenarios, were malicious devices logging into the network and stealing some credentials.

31
00:02:43,420 --> 00:02:44,980
What happened?

32
00:02:45,740 --> 00:02:48,020
Well, what you would expect.

33
00:02:48,020 --> 00:02:58,120
There were no security alerts, even though we had more than 5,000 different attack attempts, and there were no alerts on brute force attempts as well.

34
00:02:58,120 --> 00:03:04,080
The antivirus solution was completely irrelevant to stop the lateral movement inside the network.

35
00:03:04,340 --> 00:03:09,700
The firewalls, while deployed, did not stop the cross-segment traffic.

36
00:03:09,720 --> 00:03:26,540
And doing some credentials analysis, we saw that a single old password that we stole allowed login to all the Linux servers, and some Windows machines had the domain admin passwords cached on them, therefore were usable for propagation.

37
00:03:26,920 --> 00:03:30,460
This all brings me to the point of our talk today.

38
00:03:32,020 --> 00:03:34,520
What is InfectionMonkey?

39
00:03:34,740 --> 00:03:39,400
So let's try to answer that by looking at a few key ideas.

40
00:03:40,100 --> 00:03:44,080
The monkey is a breach and attack simulation tool.

41
00:03:44,080 --> 00:03:52,420
It simulates an internal attacker, which tests whether your security systems work, whether they detect, they alert, they actually block something.

42
00:03:52,880 --> 00:03:58,220
The monkey helps you make sure that changes don't open up new holes.

43
00:03:58,780 --> 00:04:01,880
It's automated, semi-automated.

44
00:04:01,880 --> 00:04:08,440
You have to run it manually the first time, and it's exhaustive as much as it can be.

45
00:04:08,760 --> 00:04:13,440
The second key idea to take a look at, it's open source and free.

46
00:04:13,520 --> 00:04:15,540
This is a community project.

47
00:04:15,540 --> 00:04:19,800
It's managed by GuardiCore Labs, but it is completely free, completely open source.

48
00:04:20,180 --> 00:04:29,400
We have over 3,200 stars on GitHub, a big active user base, hundreds of downloads a week.

49
00:04:29,420 --> 00:04:34,160
This is by the community, for the community.

50
00:04:34,820 --> 00:04:41,180
The third key idea to take a look at is the fact that the monkey is safe for production networks.

51
00:04:42,160 --> 00:04:58,550
The monkey is being executed right now by large organizations in various verticals, big telecom companies, education, school counties, universities, healthcare, in their production network.

52
00:04:58,900 --> 00:05:06,900
The monkey is built to run on these infrastructures, on these critical infrastructures, and not crash them.

53
00:05:06,900 --> 00:05:13,980
That puts some limitations on what the monkey can do while attempting to breach, while attempting to attack.

54
00:05:13,980 --> 00:05:23,200
But safety is the first priority, since we do want people to run this in production networks and not lose their jobs.

55
00:05:23,440 --> 00:05:25,200
And it's useful for you.

56
00:05:25,200 --> 00:05:35,020
If you're a network engineer, a security engineer, a red teamer, a blue teamer, a purple teamer, a CISO, the monkey could be useful for you.

57
00:05:35,020 --> 00:05:37,140
And stick around to figure out why.

58
00:05:37,940 --> 00:05:44,040
Since this is DEF CON, let's try to explain what is the infection monkey by comparing it to existing solutions.

59
00:05:44,080 --> 00:05:51,120
You're all very familiar with classic manual penetration testing and with vulnerability scanners.

60
00:05:51,440 --> 00:05:56,060
Let's see how does the monkey compare to these solutions that you know.

61
00:05:56,740 --> 00:05:59,260
So here's a data center we visualized.

62
00:05:59,260 --> 00:06:02,280
Each node in the graph represents a machine.

63
00:06:02,280 --> 00:06:10,100
Each link in the graph, each edge represents a possible route between two machines.

64
00:06:10,980 --> 00:06:15,560
If we're talking about vulnerability scanners, and we plop one down here.

65
00:06:16,640 --> 00:06:25,420
And when we test the network using this vulnerability scanner, we place it in one or more places across the network.

66
00:06:25,420 --> 00:06:33,560
And as you can see, it sort of checks every single route to that machine.

67
00:06:33,880 --> 00:06:44,260
If we place enough scanners properly, we can probably test most parts of our network for remote vulnerabilities on an ongoing basis.

68
00:06:44,820 --> 00:06:48,860
But it won't be able to simulate an attacker's move.

69
00:06:49,120 --> 00:06:53,160
So talking about coverage depends on how you deploy it.

70
00:06:53,160 --> 00:06:58,680
Frequency, you can do it whenever you want, since this is an automated tool.

71
00:06:58,680 --> 00:07:02,320
But it does not simulate an attack at all.

72
00:07:02,340 --> 00:07:07,740
Therefore, sometimes the results of vulnerability scanners are exaggerated.

73
00:07:07,740 --> 00:07:12,620
It's huge lists of CVEs that you can't deal with.

74
00:07:12,620 --> 00:07:16,380
And they don't actually simulate what happens.

75
00:07:16,380 --> 00:07:23,020
So they might be closing routes, which are completely irrelevant for attackers that attackers will never use.

76
00:07:23,460 --> 00:07:27,580
On the other end of the spectrum, you have penetration testing.

77
00:07:27,580 --> 00:07:33,520
Here, we place the penetration tester on one side of the network, the red team.

78
00:07:33,540 --> 00:07:38,640
And we give them a goal, some valuable assets.

79
00:07:39,200 --> 00:07:43,320
And as you can see, some machines are exploited, some are not.

80
00:07:43,440 --> 00:07:46,200
Eventually, the red team reaches their goal.

81
00:07:46,380 --> 00:07:49,360
This is another popular method.

82
00:07:49,360 --> 00:07:51,700
The pen tester can start from the internet.

83
00:07:51,920 --> 00:07:55,680
Sometimes that includes phishing attempts or whatever.

84
00:07:55,920 --> 00:08:02,460
But in the end, he gets to the network and simulates an APT.

85
00:08:02,800 --> 00:08:12,360
On the one hand, you get yourself a professional in-depth testing, especially if the penetration tester is good.

86
00:08:12,360 --> 00:08:16,600
Which sort of unveiled a weak path here, the red path.

87
00:08:18,460 --> 00:08:23,680
And sort of discovered some weak points across the data center.

88
00:08:23,680 --> 00:08:25,540
So the testing is in-depth.

89
00:08:26,260 --> 00:08:29,600
But what if there are more routes?

90
00:08:29,600 --> 00:08:34,340
Obviously, the human tester cannot cover all possible paths.

91
00:08:34,340 --> 00:08:36,860
So the coverage might be low.

92
00:08:36,860 --> 00:08:47,420
What happens if a few days after this penetration tester stops his or her work and leave?

93
00:08:47,440 --> 00:08:54,110
The highly dynamic data center sets up a ton of new resources and deploys three new apps.

94
00:08:54,940 --> 00:09:00,190
How would these results help those network changes?

95
00:09:00,440 --> 00:09:03,860
After all, penetration testers don't work on a daily basis.

96
00:09:03,860 --> 00:09:05,600
That just won't work.

97
00:09:05,600 --> 00:09:13,880
So the coverage is low, the frequency is low, but it does simulate an attacker, so it does do in-depth testing.

98
00:09:14,340 --> 00:09:19,280
The monkey tries to take the best of both worlds.

99
00:09:19,460 --> 00:09:24,360
It's automatic, so the coverage and frequency are high.

100
00:09:24,480 --> 00:09:32,300
It's in-depth, since it simulates an attacker and it actually propagates across the network.

101
00:09:32,300 --> 00:09:36,000
And the best of all, it's free, since it's open source.

102
00:09:36,920 --> 00:09:41,420
Let's take a quick look at the main features of InfectionMonkey.

103
00:09:42,050 --> 00:09:46,960
The monkey is highly configurable, so it can fit different use cases.

104
00:09:47,200 --> 00:09:51,120
It has various attack techniques.

105
00:09:51,560 --> 00:09:56,860
It uses brute forcing, it steals credentials and passes the hash around.

106
00:09:56,860 --> 00:09:59,660
It has wormable CVEs that are optional.

107
00:09:59,660 --> 00:10:04,140
If you're worried about running CVEs in your network, you can turn these off.

108
00:10:04,320 --> 00:10:06,820
Same for credential brute forcing, by the way.

109
00:10:07,060 --> 00:10:11,760
So you get quite a lot of attack techniques built into the tool.

110
00:10:13,580 --> 00:10:14,780
Actionable reporting.

111
00:10:14,780 --> 00:10:17,480
This is really the meat of the matter.

112
00:10:17,480 --> 00:10:21,920
You're going to see the reports later on in the demo, so we won't delay on this now.

113
00:10:21,920 --> 00:10:24,600
But the monkey has three reports.

114
00:10:24,600 --> 00:10:32,680
The first one being a security report aimed towards whomever wants the details.

115
00:10:32,700 --> 00:10:36,280
This is the most actionable report out of all of them.

116
00:10:36,280 --> 00:10:37,800
A Zero Trust Report.

117
00:10:37,800 --> 00:10:55,280
If the organization you're testing or your organization is using the Zero Trust lingo, the Zero Trust Extended Framework by Forrester, this is the first-of-its-kind report card on where are you in your Zero Trust journey.

118
00:10:57,020 --> 00:11:00,000
And lastly, the MITRE ATT&CK Report.

119
00:11:00,000 --> 00:11:15,740
If you're familiar with the MITRE ATT&CK Framework, the monkey maps its actions to the techniques that this framework offers, and you get actionable mitigations on each technique that the monkey successfully used.

120
00:11:15,740 --> 00:11:20,320
We're going to take a deeper look into those reports later on in the demo.

121
00:11:21,140 --> 00:11:23,260
And lastly, it's easily deployable.

122
00:11:23,260 --> 00:11:26,980
We didn't want some expert, super-hard tool.

123
00:11:27,000 --> 00:11:31,660
This is supposed to democratize penetration testing and be easy for the community.

124
00:11:31,800 --> 00:11:37,600
We have one-click options for cloud environments, so if you're testing a cloud environment, just hop onto the Marketplace.

125
00:11:37,600 --> 00:11:38,440
It's free.

126
00:11:38,520 --> 00:11:55,780
If you're not using a cloud environment, there is a Windows Installer, a Linux Installer, a Debian package, a Docker machine, a Docker image ready with the Infection Monkey installed, and a VMware OVA file.

127
00:11:55,820 --> 00:12:01,760
So no matter where you're running, no matter which way you like to deploy machines, we've got you covered.

128
00:12:02,000 --> 00:12:10,320
And it's very easy to use with a friendly web interface aimed towards getting results quickly.

129
00:12:10,320 --> 00:12:15,340
The monkey should be able to offer you is a different perspective.

130
00:12:16,460 --> 00:12:21,520
What you have, what your organization have is a very nice, you know, Visio chart.

131
00:12:21,520 --> 00:12:27,420
You always see these in presentations that shows everything is segmented.

132
00:12:27,420 --> 00:12:28,560
Everything is beautiful.

133
00:12:28,560 --> 00:12:30,080
We have no problems.

134
00:12:30,580 --> 00:12:34,440
But we have the monkey telling us what's really happening.

135
00:12:34,440 --> 00:12:43,640
So on the other hand, you can see the attacker's knowledge and maybe find paths that you didn't think were possible.

136
00:12:43,960 --> 00:12:52,320
And you have the application diagrams and our tools can tell us who's really communicating with whom.

137
00:12:52,360 --> 00:12:59,320
And obviously, as we know, in reality, it's all just a big mess that is just waiting to burst up in flames.

138
00:12:59,940 --> 00:13:04,420
So which use cases is the monkey relevant for?

139
00:13:05,300 --> 00:13:14,700
Going back to the beginning of this presentation, it can help you test specific attack scenarios in a continuous and automatic manner.

140
00:13:16,420 --> 00:13:20,600
Demonstrate breach detection, test for segmentation.

141
00:13:21,760 --> 00:13:31,240
If we're talking about some specific scenarios, credentials tapped, you can feed the monkey with credentials of an IT team member and see how far it can go.

142
00:13:31,240 --> 00:13:36,480
You can test what damage results from having specific servers compromised.

143
00:13:36,480 --> 00:13:48,060
Let's say testing from one location, maybe the web applications of your organization, something happens in the databases, stuff like that.

144
00:13:49,200 --> 00:14:07,520
Malicious device, someone added a malicious machine, like a contractor maybe bringing his laptop to on-site and connecting to the internal network, but that laptop is completely full of malware and seeing how far the attack can go from there.

145
00:14:07,520 --> 00:14:11,360
Or blast radius, let's try to limit damage from a breach.

146
00:14:11,360 --> 00:14:16,000
Are your firewalls and the routing rules and whatever separating different networks?

147
00:14:16,000 --> 00:14:19,660
Let's say the development network and the production network.

148
00:14:20,260 --> 00:14:23,900
Another example could be past the hash attack.

149
00:14:23,900 --> 00:14:34,110
Can attackers build a path that shouldn't exist from a server to a domain controller using cached credentials or SSH keys that are left on the machine?

150
00:14:34,920 --> 00:14:58,880
The monkey can help you test the existing security setup, the security strategy of an organization, see if alerts are popping up, check if the SOC is responding correctly to an attack, where the organization stands in their zero trust journey, or how much of the MITRE ATT&CK framework are they limiting?

151
00:14:58,880 --> 00:15:00,820
How much are they covering?

152
00:15:01,240 --> 00:15:26,620
And the main thing, the main benefit that the monkey can give you, if you want to test your network or if you want to present your findings as a red teamer, is to show the visibility from the attacker's point of view, not in the sort of high-level way that the visios usually show it.

153
00:15:27,180 --> 00:15:30,640
So, we're going to jump into a demo.

154
00:15:30,680 --> 00:15:44,140
In this demo, the first thing we're going to do is run a simulation with a few different use cases in the configuration, and I'm just going to pop into it.

155
00:15:44,980 --> 00:15:56,780
So, when you open the InfectionMonkey island, that's the command and control server of InfectionMonkey, for the first time after you deploy it, this is what you're going to see.

156
00:15:56,780 --> 00:16:03,300
A friendly UI, one, two, three, four, that's the stuff you need to do to get started.

157
00:16:03,300 --> 00:16:04,820
So, let's get started.

158
00:16:04,960 --> 00:16:13,800
It tells us to go ahead and run the monkey, and we jump here, and it offers us to configure the monkey to fine-tune its behavior.

159
00:16:13,800 --> 00:16:21,160
Since I already have a test scenario in mind, I will choose this option and hop into the configuration.

160
00:16:21,600 --> 00:16:25,820
Here you can see we have a few different tabs for configuration.

161
00:16:25,820 --> 00:16:33,440
If you want to mess with the monkey, choose which techniques it will attempt and which techniques it will not attempt.

162
00:16:33,440 --> 00:16:44,100
If you're familiar with the MITRE ATT&CK framework, and that's how you like to use stuff, we mapped everything that the monkey does to the MITRE ATT&CK framework.

163
00:16:44,100 --> 00:16:46,100
We're not going to do this today.

164
00:16:46,180 --> 00:16:54,820
What we are going to do is first hop onto the network tab and define the scope of this test.

165
00:16:56,000 --> 00:17:02,500
And this is important since this is what will aim the monkey towards specific servers.

166
00:17:02,500 --> 00:17:06,100
Now, the monkey doesn't have to be aimed towards specific servers.

167
00:17:06,100 --> 00:17:19,020
We can check this and the monkey will just try to propagate to any machines it can find along with the targets that we will manually configure.

168
00:17:19,020 --> 00:17:26,300
But in this instance, I only want it to run on the targets that I've defined.

169
00:17:26,620 --> 00:17:34,780
And I want it to hop from the initial infection point three deep.

170
00:17:35,820 --> 00:17:47,780
Sort of giving a spoiler here, but jumping to the map, the monkey started from here, but you can see it hopped pretty deep, three deep from the original place where it started.

171
00:17:47,780 --> 00:17:51,620
This is the scan depth configuration.

172
00:17:52,140 --> 00:18:00,520
Moving on to the target list, this is the list of the targets that the monkey tried to scan and obviously attack.

173
00:18:00,520 --> 00:18:05,120
So we have quite a... just a bunch of IP addresses here.

174
00:18:05,840 --> 00:18:13,240
This is just the IPs that I know I want to test in this demo, in this simulation.

175
00:18:14,280 --> 00:18:19,220
And lastly, I also configured the monkey to test for network segmentation.

176
00:18:19,220 --> 00:18:23,060
I know I have these three different segments.

177
00:18:23,060 --> 00:18:32,260
This network range of a segment, 10.2.0 from 11 to 12.

178
00:18:32,260 --> 00:18:34,800
So basically a two server segment.

179
00:18:35,060 --> 00:18:42,420
This segment, which is a single IP segment, a network segment that only has one machine.

180
00:18:42,420 --> 00:18:47,160
And the slash 24 segment here at 10.2.2.

181
00:18:47,160 --> 00:18:55,840
So what I'm telling the monkey is to try and test for network segmentation, see if it can create cross segment communication.

182
00:18:56,620 --> 00:19:06,800
Other than setting up the scope of this test, you can also configure which exploits the monkey will try to attempt using the exploit selector here.

183
00:19:07,200 --> 00:19:25,380
In this instance, we went with the Struts2 exploiter, the Shellshock exploiter, SSH exploiter, which brute forces using credentials, the MSSQL exploiter, the WMI exploiter, and the SMB exploiter, which again is a brute force exploiter.

184
00:19:25,380 --> 00:19:28,760
As you can see here, we have some unsafe exploits.

185
00:19:28,760 --> 00:19:39,640
The Microsoft Bulletin 08-067 is an unsafe exploiter that might crash due to the fact that it uses buffer overflow.

186
00:19:39,640 --> 00:19:55,960
And we, you know, marking security of our users first, even if you were to check this and check all of the exploiters, and uncheck them and recheck all of them, you won't get the unsafe exploiter.

187
00:19:55,960 --> 00:19:57,850
You really have to opt into that.

188
00:19:58,360 --> 00:20:00,800
We also set up some passwords here.

189
00:20:00,800 --> 00:20:08,100
This is in order to simulate a credentials theft, let's say a phishing attempt was successful.

190
00:20:08,100 --> 00:20:17,000
So we got some passwords that the exploiters will try to use and some users here.

191
00:20:18,620 --> 00:20:24,920
And yeah, we can take a look at the infection map and see what happened.

192
00:20:25,060 --> 00:20:27,880
You can see we started from here.

193
00:20:27,880 --> 00:20:30,100
This is the Monkey Island.

194
00:20:30,100 --> 00:20:31,360
This is the server.

195
00:20:31,360 --> 00:20:36,400
We started from here because we clicked on run on Monkey Island server.

196
00:20:36,400 --> 00:20:44,080
And once we clicked on this, everything here went pretty wild.

197
00:20:44,080 --> 00:20:47,640
Every red line represents a successful exploitation attempt.

198
00:20:47,640 --> 00:20:57,560
So let's just take a look at the line from the Monkey Island to the server called struts2, which obviously is a struts server.

199
00:20:57,560 --> 00:20:59,240
Let's take a look at this line.

200
00:20:59,240 --> 00:21:05,460
And as you can see here, it was successfully exploited using the struts2 exploiter.

201
00:21:07,180 --> 00:21:12,340
And you can also see which services were found on this machine.

202
00:21:12,340 --> 00:21:16,860
So you get a mapping of which services were found.

203
00:21:17,160 --> 00:21:21,940
And once the monkey got here, did exactly the same.

204
00:21:23,100 --> 00:21:27,540
Yellow lines represents scans.

205
00:21:27,540 --> 00:21:36,360
These are the monkey trying to scan a machine and trying to find ways to attack it.

206
00:21:36,360 --> 00:21:39,560
But in this case, it didn't manage to attack.

207
00:21:39,560 --> 00:21:43,240
All the exploiters failed, but it did find open services.

208
00:21:43,240 --> 00:21:50,340
So it marks this interaction as a scan line, as a yellow line.

209
00:21:50,620 --> 00:22:02,920
Lastly, we have the island communication lines, which just show how the agent communicated back to the command and control server and reported everything back.

210
00:22:03,280 --> 00:22:08,260
We also have this nice configuration here with the blue lines.

211
00:22:08,260 --> 00:22:17,380
What we can see is the monkey started on the Monkey Island, moved to this server called tunneling-9.

212
00:22:17,380 --> 00:22:21,740
This is the first tunneling endpoint.

213
00:22:21,740 --> 00:22:26,620
This server connects two network segments.

214
00:22:26,620 --> 00:22:31,780
You can think of it like some sort of jump box that the organization is using.

215
00:22:32,560 --> 00:22:40,540
This server connects the 10.2.2 subnet to the 10.2.1 subnet.

216
00:22:40,540 --> 00:22:44,920
It has two network interfaces, one in each segment.

217
00:22:45,520 --> 00:22:51,060
Now the monkey hopped onto this machine and was able to propagate to this machine.

218
00:22:51,060 --> 00:22:53,160
For instance, using SSH.

219
00:22:54,140 --> 00:22:57,120
Now, what is this blue line?

220
00:22:57,120 --> 00:23:04,600
This blue line tells us that the monkey on tunneling-10 needed to send information back to the island.

221
00:23:04,600 --> 00:23:09,100
It needed to report back to the command and control server what it has found.

222
00:23:09,520 --> 00:23:13,400
However, that's easier said than done.

223
00:23:16,820 --> 00:23:26,120
If there was a path between the machine tunneling-10 and the island, the monkey could just send the information back, no problem.

224
00:23:26,120 --> 00:23:28,680
However, these two machines are not connected.

225
00:23:28,680 --> 00:23:30,620
They are not in the same network segments.

226
00:23:30,620 --> 00:23:34,400
They don't have any direct communication in between them.

227
00:23:34,400 --> 00:23:43,380
In this case, the monkey on tunneling-9 turned itself into a tunneling server.

228
00:23:43,380 --> 00:23:52,540
And enabled tunneling-10 to report back to the monkey island over tunneling communication.

229
00:23:52,540 --> 00:24:05,400
In that exact same fashion, this happened twice again with tunneling-11 and tunneling-12 with a different subnetwork, 10.2.0.

230
00:24:05,400 --> 00:24:12,160
So what we really had here is two hops between the monkey and the island.

231
00:24:12,160 --> 00:24:19,420
And the monkeys helped themselves tunnel the communication back completely automatically.

232
00:24:19,480 --> 00:24:24,220
So what we're seeing here is sort of a very deep network test.

233
00:24:24,220 --> 00:24:34,620
And the monkey sort of bridging networks and showing how you can hop between different subnetworks in this test instance.

234
00:24:35,280 --> 00:24:41,100
Now we can hop on to the security reports section of the monkey.

235
00:24:42,160 --> 00:24:44,800
We have three different reports.

236
00:24:44,800 --> 00:24:47,620
The first report is the security report.

237
00:24:48,180 --> 00:24:53,760
As you can see here, the report starts with an overview.

238
00:24:54,060 --> 00:24:56,560
This is sort of the summary of what happened.

239
00:24:56,560 --> 00:25:01,340
First of all, it let us know that critical security issues were detected.

240
00:25:01,340 --> 00:25:10,460
Which is obviously the case when the monkey was able to run rampant in a network like this, do tunneling, use a ton of exploits and propagate to a ton of different servers.

241
00:25:12,420 --> 00:25:16,480
The monkey started propagating on this machine.

242
00:25:17,500 --> 00:25:19,860
And it tells us which machine it started on.

243
00:25:19,860 --> 00:25:22,500
In this case, it's the island Windows machine.

244
00:25:23,000 --> 00:25:27,000
It tells us the configuration we used, which we went over already.

245
00:25:27,000 --> 00:25:31,080
Which usernames and passwords were used for brute forcing.

246
00:25:31,160 --> 00:25:33,400
Which exploiters were selected.

247
00:25:33,480 --> 00:25:35,580
Which IPs were selected to scan.

248
00:25:35,580 --> 00:25:39,660
And it notes that the monkeys were configured to avoid scanning local network.

249
00:25:39,660 --> 00:25:44,400
This is a really useful feature to limit the spread of monkey.

250
00:25:44,400 --> 00:25:49,480
If you want to run it in a network and you're afraid the monkey will just spread all over your network.

251
00:25:49,480 --> 00:25:52,220
This is a pretty good way to avoid that scenario.

252
00:25:53,280 --> 00:25:55,280
And what did the monkey find?

253
00:25:55,340 --> 00:25:59,200
During the simulated attack, the monkey uncovered four threats.

254
00:25:59,280 --> 00:26:02,340
Stolen credentials that were used to exploit other machines.

255
00:26:02,340 --> 00:26:05,800
Machines that were vulnerable to shell shock.

256
00:26:05,800 --> 00:26:13,140
Machines that are accessible using the passwords we provided for brute forcing.

257
00:26:13,780 --> 00:26:17,140
And the struts2 vulnerability as well.

258
00:26:17,420 --> 00:26:20,240
So we have two wormable CVEs in our network.

259
00:26:20,240 --> 00:26:25,140
And we have two credentials-based attack vectors in our network.

260
00:26:25,140 --> 00:26:29,220
And we also found segmentation.

261
00:26:29,220 --> 00:26:33,200
Potential weak segmentation and actual segmentation issues.

262
00:26:33,200 --> 00:26:37,060
Communication from this segment to this segment.

263
00:26:37,060 --> 00:26:40,940
Which we defined as two different segments in the configuration.

264
00:26:40,940 --> 00:26:43,640
And from this segment to this segment.

265
00:26:44,320 --> 00:26:46,560
Jumping back to the map.

266
00:26:47,140 --> 00:26:49,520
This is these lines.

267
00:26:50,760 --> 00:26:56,140
From the 10.2.2 segment to the 10.2.1 segment.

268
00:26:56,140 --> 00:26:58,060
And these four lines.

269
00:26:58,060 --> 00:27:03,180
From the 10.2.1 segment to the 10.2.0 segment.

270
00:27:04,000 --> 00:27:10,220
Obviously, if you have your segmentation on lockdown, these communications just won't happen.

271
00:27:12,080 --> 00:27:18,460
And on every issue here, you can read more and get more specific details.

272
00:27:18,460 --> 00:27:20,500
Which services were used.

273
00:27:20,680 --> 00:27:24,800
To which IP was able to communicate, etc.

274
00:27:25,780 --> 00:27:29,300
Taking a look at machine-related recommendations.

275
00:27:29,300 --> 00:27:33,700
You can see which recommendations we have for each machine.

276
00:27:33,700 --> 00:27:38,840
So if we want to fix the critical app, the crown jewel, we can find it here.

277
00:27:38,840 --> 00:27:41,100
Let's say it's Tunneling11.

278
00:27:41,100 --> 00:27:48,080
And we see that we need to change the user monkey password to a complex one-use password.

279
00:27:48,080 --> 00:27:51,160
Because it's shared with other computers on the network.

280
00:27:51,160 --> 00:27:52,940
And again, you can read more.

281
00:27:53,140 --> 00:27:55,660
Specifically, this is vulnerable to SSH.

282
00:27:56,620 --> 00:28:04,080
And you need to do micro-segmentation policies to disable communications that aren't required.

283
00:28:04,280 --> 00:28:06,760
Because a tunnel was set up.

284
00:28:06,860 --> 00:28:10,360
Which obviously means that the machines aren't locked down.

285
00:28:10,360 --> 00:28:15,600
Because they can create communication paths that we didn't want them to create.

286
00:28:17,420 --> 00:28:19,840
Some different recommendations.

287
00:28:19,840 --> 00:28:21,800
The struts24 machine.

288
00:28:21,800 --> 00:28:23,880
Struts2-24 machine.

289
00:28:24,610 --> 00:28:27,780
You need to upgrade the struts version.

290
00:28:27,780 --> 00:28:35,820
Because the struts server at this machine, which is this IP, is vulnerable to a remote code execution attack.

291
00:28:36,500 --> 00:28:39,000
You can get even more details here.

292
00:28:39,000 --> 00:28:43,560
The attack was made possible because the server is using an old version of Jakarta.

293
00:28:43,560 --> 00:28:47,680
That does the multi-part parser thing.

294
00:28:47,680 --> 00:28:50,000
And there is more information.

295
00:28:50,000 --> 00:28:54,540
You can click on it and obviously see the CVE public information.

296
00:28:54,600 --> 00:28:59,980
And there are a ton of machine-related recommendations here.

297
00:28:59,980 --> 00:29:06,020
For example, the machine that was vulnerable to shell shock tells you that you need to update your bash version.

298
00:29:06,820 --> 00:29:14,220
And you need to segment your network to make sure that there is no communication between machines from different segments.

299
00:29:14,220 --> 00:29:17,760
The next section of the report shows us the network from the monkey's eyes.

300
00:29:17,760 --> 00:29:20,840
This is the part of the attacker's visibility.

301
00:29:21,380 --> 00:29:24,960
From the attacker's point of view, this is how the network looked like.

302
00:29:26,340 --> 00:29:27,980
Basically, Swiss cheese.

303
00:29:28,500 --> 00:29:33,420
It tells us that the monkey discovered 10 machines, successfully breached 9 of them.

304
00:29:33,440 --> 00:29:34,760
What's the last 10%?

305
00:29:34,760 --> 00:29:36,960
Well, it's just the machine we started on.

306
00:29:36,960 --> 00:29:39,400
Every single machine in this test was breached.

307
00:29:39,400 --> 00:29:43,440
Obviously, this is a test network and we set up this as an example.

308
00:29:43,440 --> 00:29:48,920
But this is not very different to the results we've seen when running with customers.

309
00:29:49,140 --> 00:29:54,860
Now, we can see a summary of which services and on which machines the monkey has found.

310
00:29:54,860 --> 00:29:58,500
This sort of maps your attack surface.

311
00:29:58,500 --> 00:30:04,580
This shows which ports can be knocked and see who's answering.

312
00:30:04,580 --> 00:30:19,840
For example, the tunneling machine, which has both of these IP addresses, as we've said, 2.2 and 2.1, is accessible from all of these machines using SSH.

313
00:30:20,660 --> 00:30:26,320
And the struts24 machine listens on 8080 as well.

314
00:30:26,580 --> 00:30:31,360
You can also see which exploits were used on each machine.

315
00:30:31,360 --> 00:30:36,400
So if you want a sort of vulnerability assessment summary, you can see that here.

316
00:30:36,400 --> 00:30:40,220
This machine was exploited using SMB.

317
00:30:41,220 --> 00:30:44,600
Specifically, credentials were stolen using Mimikatz.

318
00:30:46,680 --> 00:30:50,640
And you can see the post-breach actions that the monkey has performed.

319
00:30:50,640 --> 00:30:55,620
It performed 243 post-breach actions on 7 machines.

320
00:30:55,620 --> 00:30:56,600
Which actions?

321
00:30:56,600 --> 00:30:58,540
Well, we're going to see in a second.

322
00:30:58,540 --> 00:31:03,420
But if you want the whole list, you can see here.

323
00:31:04,340 --> 00:31:11,820
And you can see which credentials were stolen from machines in order to propagate further.

324
00:31:11,820 --> 00:31:17,000
So this is sort of a credential analysis part of the report.

325
00:31:17,380 --> 00:31:19,700
This is the security report.

326
00:31:19,700 --> 00:31:23,280
But we also have two other reports.

327
00:31:23,280 --> 00:31:33,420
The first one is the Zero Trust report, which is the first Zero Trust assessment report available.

328
00:31:33,920 --> 00:31:40,980
As you can see, we've mapped what the monkey does to the seven pillars of the Zero Trust Extended Framework.

329
00:31:41,240 --> 00:31:48,020
And we've got a lot of red in this report card because we failed a lot of the tests.

330
00:31:48,020 --> 00:31:56,920
The monkey tests for violation of principles defined in the Zero Trust security model.

331
00:31:57,160 --> 00:32:01,380
And maps it to each of the seven pillars.

332
00:32:01,420 --> 00:32:09,380
Networks, devices, people, workloads, data, visibility and analytics, and automation and orchestration.

333
00:32:10,220 --> 00:32:13,980
Now, the gray just means that this wasn't executed.

334
00:32:13,980 --> 00:32:20,360
In this test, in this simulation, there wasn't anything relevant for workloads, automation or orchestration.

335
00:32:20,520 --> 00:32:25,240
Red means that something related to this component failed.

336
00:32:25,240 --> 00:32:28,140
Something related to data failed.

337
00:32:28,420 --> 00:32:29,740
Well, what was it?

338
00:32:29,740 --> 00:32:33,380
We can take a look at the test results and see exactly what happened.

339
00:32:33,380 --> 00:32:35,760
So let's take a look at data, for example.

340
00:32:35,760 --> 00:32:47,620
We can see that other than everything else that the monkey has done in propagating, stealing credentials, running exploiters and giving us all this data back, it also scanned for unencrypted access to data.

341
00:32:47,620 --> 00:32:54,840
Because one of the Zero Trust principles in relation to data is that you need to secure data at transit by encrypting it.

342
00:32:54,840 --> 00:33:04,800
However, while the monkey wasn't able to find Elasticsearch instances, it was able to find unencrypted HTTP server.

343
00:33:04,800 --> 00:33:08,920
Someone is not using HTTPS and that's a problem.

344
00:33:09,240 --> 00:33:13,280
Now let's say we want to know even more data about this specific problem.

345
00:33:13,280 --> 00:33:14,140
Which servers?

346
00:33:14,140 --> 00:33:15,520
When did this happen?

347
00:33:15,740 --> 00:33:16,980
What's up with that?

348
00:33:16,980 --> 00:33:22,540
We can scroll down to the finding list and see that the monkey was able to access HTTP servers.

349
00:33:22,540 --> 00:33:30,460
And if we look at the specific events, we can see exactly which monkey tried to perform the network scan and when.

350
00:33:30,460 --> 00:33:33,280
We can see which services it found.

351
00:33:33,280 --> 00:33:42,140
It found TCP80 and then it mapped an HTTP service that was recognized as an open data endpoint.

352
00:33:42,140 --> 00:33:45,400
Specifically, it's an Apache server on Ubuntu.

353
00:33:45,400 --> 00:33:46,900
And this is the version.

354
00:33:47,740 --> 00:33:52,120
So, as you can see the details, it is a pretty detailed report.

355
00:33:52,120 --> 00:33:57,140
You can also export all the events to JSON.

356
00:33:57,140 --> 00:34:01,400
So you can run scripts on it, match it up with other APIs, etc.

357
00:34:02,780 --> 00:34:05,000
Let's take a look at a different test.

358
00:34:05,040 --> 00:34:07,420
Let's take a look at networks, for example.

359
00:34:07,420 --> 00:34:20,400
Obviously, with the monkey being a breach and attack simulation tool and GuardiCore being a network company, which sort of mainly maintains this tool, this is the part we invested the most into.

360
00:34:20,400 --> 00:34:22,800
And we do have quite a lot of tests here.

361
00:34:23,280 --> 00:34:27,620
Now it's time to circle back to all the segmentation problems we saw.

362
00:34:27,740 --> 00:34:36,020
The monkey tried to scan and find machines that it can communicate and do cross-segment communication.

363
00:34:36,020 --> 00:34:48,620
And it was able to, so this test failed because Zero Trust Networks tells us that the most important thing we need to do is to apply segmentation and micro-segmentation inside our network to lock that down.

364
00:34:48,620 --> 00:34:58,620
Again, if we go back to the findings, we can see that the monkey performed cross-segment communications and we can see exactly which violations occurred.

365
00:34:58,640 --> 00:35:06,940
In this instance, Tunneling 10 managed to talk to 10.2.10.11 in this segment.

366
00:35:06,940 --> 00:35:13,380
So you get a pretty detailed report on which segmentation violations occurred.

367
00:35:13,380 --> 00:35:20,680
If you have a firewall solution or a micro-segmentation solution, every single event here should be an alert.

368
00:35:20,680 --> 00:35:27,820
So you can export all these results and try to match them up with the alerts from your whatever security solution.

369
00:35:30,060 --> 00:35:36,460
You can see also that we failed the Network Policy Should Be As Restrictive As Possible test.

370
00:35:36,460 --> 00:35:40,040
This is because the monkey was able to tunnel traffic using other monkeys.

371
00:35:40,040 --> 00:35:45,300
We also failed this test, which appears in the people pillar as well.

372
00:35:45,300 --> 00:35:46,500
So let's take a look at that.

373
00:35:46,500 --> 00:35:47,460
What does people mean?

374
00:35:47,460 --> 00:35:49,160
Well, it talks about users.

375
00:35:49,340 --> 00:35:51,720
People means Zero Trust users.

376
00:35:51,720 --> 00:36:11,400
In this case, the monkey tested whether users' permissions to this network and to the resources inside the network is MAC only, mandatory access control, whether it's a need-to-know basis, whether only known users can access the small subset of resources that they should be able to.

377
00:36:12,360 --> 00:36:15,340
The way the monkey tests for this is pretty creative.

378
00:36:15,340 --> 00:36:25,800
It creates a new user, a new local user on the machine and tries to communicate online, tries to just go out to the internet with an unknown new user.

379
00:36:25,800 --> 00:36:29,560
This is a completely unknown user because it's a random username.

380
00:36:29,560 --> 00:36:33,120
There's no chance that it existed before.

381
00:36:33,120 --> 00:36:37,080
And as you can see, it was able to do that two times.

382
00:36:37,140 --> 00:36:51,780
It created a new user and reached out to infectionmonkey.com, so not even a super well-known domain, even though we do get quite a lot of traffic, with some new user and a bunch of random characters.

383
00:36:52,000 --> 00:36:53,660
And the process succeeded.

384
00:36:53,660 --> 00:36:57,620
It managed to create this communication with a new user.

385
00:36:57,620 --> 00:37:06,740
That means that our network, this sample network, doesn't block unknown users from communicating online.

386
00:37:07,300 --> 00:37:16,740
And as you can see, some tests can be mapped to quite a lot of different pillars, because this is about people, this is about networks, and this is about visibility.

387
00:37:16,740 --> 00:37:18,680
You should be able to see this stuff.

388
00:37:20,700 --> 00:37:38,640
The monkey also obviously maps every single device that was exploited as a problem, because you need to do some traditional endpoint security to stop the monkey from propagating across the network.

389
00:37:39,400 --> 00:37:47,920
And as you can see, the monkey was able to exploit those endpoints, and you need to check the logs to see if you can recognize this activity.

390
00:37:47,920 --> 00:37:51,540
Specifically here, we can see all the exploit attempts.

391
00:37:51,540 --> 00:37:58,480
Now, even failed exploit attempts should be logged, but successful attempts obviously should have been blocked.

392
00:37:59,040 --> 00:38:06,100
And again, you can export all these results to a JSON file that you can then match up and script to other stuff.

393
00:38:07,620 --> 00:38:10,560
The monkey also mapped whatever passed.

394
00:38:10,720 --> 00:38:22,860
So, in six different instances, the monkey wasn't able to create a new user, because of endpoint protection or maybe firewalls blocking the communication.

395
00:38:23,100 --> 00:38:27,960
So, even if some tests are failing, the monkey lists everything for you.

396
00:38:27,960 --> 00:38:32,060
So, you can see what you do have on lockdown and what you don't have on lockdown.

397
00:38:34,840 --> 00:38:40,220
The verify part of the report tells you the stuff that you need to verify manually.

398
00:38:40,220 --> 00:38:55,940
This is basically a list of everything bad that the monkey has done in this simulation, that you need to test and see whether you can find all the malicious activity in logs and alerts.

399
00:38:55,940 --> 00:39:01,440
This is sort of the, let's check how the organization will respond part of the report.

400
00:39:01,680 --> 00:39:14,740
And again, once you're done fixing all the holes, going over all the reports, pushing out all the information, you can start over, run again, and within a few minutes, you'll get this report anew.

401
00:39:14,740 --> 00:39:20,540
So, you can see if you actually closed all the issues, or maybe you did it incorrectly this time.

402
00:39:21,220 --> 00:39:24,840
Lastly, the monkey has the MITRE ATT&CK report.

403
00:39:24,840 --> 00:39:30,540
This shows information about the MITRE ATT&CK techniques that were used by InfectionMonkey.

404
00:39:32,120 --> 00:39:48,060
This enables you to see which techniques were successfully used by the monkey, which techniques the monkey tried to use, but it failed, which techniques just weren't attempted, and which techniques are disabled and you need to enable in order to run.

405
00:39:48,060 --> 00:39:53,480
In this case, we don't have anything disabled because we had monkey running full throttle.

406
00:39:54,200 --> 00:40:08,080
And if we want to get more information about some of the ways that the monkey utilized techniques, we can click on any of these techniques and see what the monkey exactly did when it tried to use this technique.

407
00:40:08,080 --> 00:40:11,200
Let's take a look at multi-hop proxy, for example.

408
00:40:11,200 --> 00:40:19,640
Let's say we want to completely lock down our network and disallow attackers from doing command and control.

409
00:40:19,640 --> 00:40:23,100
We want them to be completely lost, even if they manage to breach.

410
00:40:23,400 --> 00:40:25,760
So, what did the monkey do?

411
00:40:25,760 --> 00:40:31,080
Well, the monkey used multi-hop proxy, and we can see exactly which tunnels it created.

412
00:40:31,080 --> 00:40:37,160
It created tunnel from tunneling 11 to tunneling 9 with two hops.

413
00:40:37,160 --> 00:40:40,380
We saw that on the map before.

414
00:40:40,660 --> 00:40:43,020
This is these lines.

415
00:40:43,040 --> 00:40:47,580
Yes, this communication path is a multi-hop proxy.

416
00:40:48,280 --> 00:40:54,840
Now, let's say you are using the MITRE ATT&CK framework, but you don't exactly remember what's the multi-hop proxy technique.

417
00:40:54,840 --> 00:41:04,940
Well, you can just click on this question mark here, and we immediately show you the relevant page in the MITRE ATT&CK framework.

418
00:41:05,020 --> 00:41:11,520
The MITRE ATT&CK being an open source project as well, greatly beneficial to the security community.

419
00:41:12,700 --> 00:41:21,860
We also pull the mitigations, because the moment you find that a technique was successfully used, you want to know how to mitigate it.

420
00:41:21,860 --> 00:41:28,980
So we just list the mitigations from the MITRE ATT&CK database.

421
00:41:29,280 --> 00:41:31,940
Let's say uncommonly used port.

422
00:41:32,060 --> 00:41:34,700
Well, the monkey, you get, again, more details.

423
00:41:34,700 --> 00:41:38,340
The monkey used this port to communicate to the command and control server.

424
00:41:38,340 --> 00:41:40,200
And you also get mitigations.

425
00:41:40,200 --> 00:41:43,520
Obviously, popping up again is network segmentation.

426
00:41:44,620 --> 00:41:51,040
Some other stuff, you can see that the monkey did some persistence testing.

427
00:41:51,040 --> 00:41:53,400
It's important to note that this is only testing.

428
00:41:53,400 --> 00:41:55,940
The monkey doesn't persist on machines.

429
00:41:55,940 --> 00:41:58,340
It only tests if it can persist.

430
00:41:58,780 --> 00:42:01,220
For example, it used the create account technique.

431
00:42:01,220 --> 00:42:05,640
As we saw before, it was able to create a new user on the network system.

432
00:42:05,920 --> 00:42:10,280
And we can see the results for each attempt, even if it failed.

433
00:42:10,780 --> 00:42:13,740
And you can see different mitigations.

434
00:42:13,920 --> 00:42:16,820
Again, you should use multi-factor authentication.

435
00:42:16,820 --> 00:42:22,580
You need to configure your operating system so that malware can create new users, etc.

436
00:42:22,640 --> 00:42:30,160
As an accessibility feature, we also list all the techniques in a list instead of the matrix.

437
00:42:30,240 --> 00:42:32,100
So it's easier to navigate.

438
00:42:32,180 --> 00:42:37,100
And also, if you have problems seeing the colors of the report, you can see the icons.

439
00:42:37,340 --> 00:42:44,300
However, we found out that even our regular users love this display.

440
00:42:44,300 --> 00:42:49,340
So just all users like the display as a list as well.

441
00:42:49,340 --> 00:43:02,140
And again, you can open up the techniques and see that, for example, in the collection tactic, the monkey used the data from local system and gathered sensitive data, like SSH keys.

442
00:43:03,860 --> 00:43:07,140
These are the three reports.

443
00:43:07,360 --> 00:43:09,880
Deploying the monkey is super easy.

444
00:43:09,880 --> 00:43:16,860
You have the different deployment options, and you can see them or ask some questions.

445
00:43:16,860 --> 00:43:22,080
Let's say you're not sure what's the MSSQL exploiter or how does it work.

446
00:43:22,080 --> 00:43:45,080
Well, in this version, which comes out for DEF CON in a few days from when I'm recording this, we also brought up a new documentation site, which guides you towards setup guides, getting started guides, frequently asked questions, references for all the exploiters we're using and all the operating systems the monkey runs on,

447
00:43:45,080 --> 00:43:51,160
which operating system it supports, some scenarios that you can run.

448
00:43:53,100 --> 00:43:59,840
This is the test scenarios we talked about, like a breach from internet-facing servers, phishing.

449
00:43:59,840 --> 00:44:05,920
You want to test segmentation or you want to verify security solutions and the procedures and the teams.

450
00:44:05,920 --> 00:44:19,680
This is sort of the purple team, you know, magic option, a deep dive into all the reports and seeing how to integrate monkey into other stuff.

451
00:44:19,800 --> 00:44:38,760
At the time of this recording, we're supporting integration, deep integration with AWS, both the security hub, and automatically on your EC2 instances.

452
00:44:39,280 --> 00:44:47,160
And the guides are pretty deep about every single option that we provide.

453
00:44:47,160 --> 00:44:56,640
Let's say the Windows installer, well, it's supposed to be very user-friendly with troubleshooting, and it's open source like the rest of the project.

454
00:44:56,640 --> 00:45:03,980
So if you find something that you want added, you can just edit it or open an issue for us, and we'll take care of that.

455
00:45:06,580 --> 00:45:07,960
Now what?

456
00:45:07,960 --> 00:45:09,720
So we're done with the demo.

457
00:45:09,720 --> 00:45:15,040
We took a look at how does the monkey work and what can it offer for you.

458
00:45:15,340 --> 00:45:29,780
So first of all, from us to you, we're releasing a new version, version 1.9.0 with more attack techniques, as you've seen in the report, the monkey runs faster and completes the simulation a lot quicker.

459
00:45:29,780 --> 00:45:38,220
The server itself has great performance improvements as well, so you can run it on large-scale networks, and the UI is improved.

460
00:45:38,720 --> 00:45:46,340
Compared to old versions, maybe you can pull up old versions of the tool and see that the UI has been vastly improved.

461
00:45:46,740 --> 00:45:49,780
It's also a lot more secure.

462
00:45:49,780 --> 00:45:58,660
We've integrated with Snyk IO, a service that checks the dependencies of a project for vulnerabilities.

463
00:45:58,820 --> 00:46:09,120
So we've vetted the product from having vulnerabilities in its bag, and we've run a lot of tests.

464
00:46:09,120 --> 00:46:18,920
This really coincides with the fact that we do have big enterprises running us in production networks that actually matter.

465
00:46:18,920 --> 00:46:20,940
So we had to step up there.

466
00:46:21,020 --> 00:46:24,600
And the monkey is secured by default.

467
00:46:24,600 --> 00:46:34,320
For this demo, I turned this feature off, but every single InfectionMonkey instance that you will deploy has password protected by default.

468
00:46:34,320 --> 00:46:38,640
You have to set up a user and password combination in order to access the monkey.

469
00:46:38,640 --> 00:46:53,820
So even if you set up the InfectionMonkey in a network and somehow lose access to the server, or maybe open up access to attackers to that server, that doesn't mean that they are going to take control of the monkey, because they will need the password combination as well.

470
00:46:54,380 --> 00:47:00,600
So you can download this version for free from InfectionMonkey.com, our homepage.

471
00:47:01,020 --> 00:47:06,340
You can also access articles and the documentation site from InfectionMonkey.com.

472
00:47:06,700 --> 00:47:11,480
And I'm inviting you, first of all, I'm inviting you to use the monkey.

473
00:47:11,480 --> 00:47:13,700
Use the InfectionMonkey.

474
00:47:13,700 --> 00:47:18,600
If you're doing red teaming, purple teaming, blue teaming, this is a great tool for you.

475
00:47:18,600 --> 00:47:23,740
It's automatic, it's free, covers a lot of ground, covers a lot of frameworks.

476
00:47:23,740 --> 00:47:27,880
If you're doing penetration testing, for me, the monkey is a no-brainer.

477
00:47:27,880 --> 00:47:39,160
It takes out all the skidding part of penetration testing, does it for you, gives you a pretty nice map, and from the results the monkey gives you, you can do much smarter stuff.

478
00:47:39,160 --> 00:47:45,960
You can focus on the harder parts of penetration testing, on the manual parts, maybe the human parts.

479
00:47:45,960 --> 00:48:04,640
I don't know if we're still doing physical examinations in COVID times, but if you're hacking a site physically, opening doors with credit cards and whatever, let the monkey take care of scanning ports and using the vulnerabilities and stealing credentials and remembering them.

480
00:48:04,640 --> 00:48:07,560
You don't need to do that manually anymore.

481
00:48:07,560 --> 00:48:21,920
If you want to do network analysis or even IT and security analysis, let's say you purchase a new security solution for your network, you want to test that stuff and you don't want to test it manually.

482
00:48:21,920 --> 00:48:26,520
Run the monkey after you install it and make sure you configured it correctly, make sure it actually works.

483
00:48:27,600 --> 00:48:32,000
So the main invitation for me to you is to use the monkey.

484
00:48:32,780 --> 00:48:34,460
Secondly, you can join us.

485
00:48:34,460 --> 00:48:36,840
You can join the monkey trainers community.

486
00:48:36,840 --> 00:48:37,920
You can contribute.

487
00:48:37,920 --> 00:48:43,920
User feedback is the number one priority setter for us on the roadmap.

488
00:48:43,980 --> 00:48:51,320
If a user has a question or a problem or discovers a bug, it jumps to the top of the backlog.

489
00:48:51,320 --> 00:48:54,760
So your feedback could really impact the project.

490
00:48:55,260 --> 00:49:00,740
Now with our new documentation site, you can also very easily contribute documentation.

491
00:49:00,740 --> 00:49:19,480
If you have new scenarios in mind, maybe you want to add more information about specific exploiters or share your screenshots, something you can add to the troubleshooting section, a whole new part of the documentation you think about, you can easily contribute documentation directly from the web.

492
00:49:19,900 --> 00:49:31,860
And obviously, if you're a developer, if you're a security developer, if you want to contribute new exploits, new scanners, new MITRE ATT&CK techniques to increase the coverage.

493
00:49:31,860 --> 00:49:36,660
If you're into Zero Trust and you want to add more Zero Trust tests, you can contribute code.

494
00:49:36,660 --> 00:49:40,360
The project is completely open source and completely free.

495
00:49:40,360 --> 00:49:42,200
There is no freemium version.

496
00:49:42,200 --> 00:49:43,600
There is no pro version.

497
00:49:43,600 --> 00:49:46,640
This is a 100% community project.

498
00:49:46,920 --> 00:49:50,300
And lastly, I invite you to spread the word.

499
00:49:50,920 --> 00:49:59,860
The monkey is completely dependent on the users and the community to do good in the world.

500
00:49:59,860 --> 00:50:04,460
And if you want to help it, you just need to tell other people about it.

501
00:50:04,760 --> 00:50:09,820
Since this is a recording, I can't take questions in the recording.

502
00:50:09,940 --> 00:50:16,140
But in DEF CON safe mode, I should be online on Discord right now to answer your questions.

503
00:50:16,140 --> 00:50:22,600
However, if you're watching this recording after the event happened, don't worry.

504
00:50:22,600 --> 00:50:30,820
You can reach out to the entire InfectionMonkey community by going to infectionmonkey.com and clicking on the community button.

505
00:50:30,820 --> 00:50:34,660
You will be able to access our public Slack.

506
00:50:34,660 --> 00:50:45,400
We have a public Slack workspace where all the developers and all the users hang out, answer troubleshooting questions, talk about features, and discuss security in general.

507
00:50:45,400 --> 00:50:50,300
You can also access it from the documentation site right here in our Slack.

508
00:50:50,300 --> 00:50:56,000
You can also reach us by support at infectionmonkey.com if you're having any issues.

509
00:50:56,000 --> 00:51:00,120
Take a look at the code at github.com slash Gartic or slash InfectionMonkey.

510
00:51:00,120 --> 00:51:03,900
And just take a look at our homepage, take a look at the articles.

511
00:51:04,740 --> 00:51:09,380
Thank you very much and enjoy the rest of DEF CON safely.

512
00:51:09,380 --> 00:51:15,500
Wash your hands, keep your mask on, but since we're at home, we can ignore these for now.

513
00:51:15,760 --> 00:51:17,480
Thank you very much.