start	end	text
2660	5140	Hi, DEF CON. I'm Shai Nechman.
5280	7740	Today, I'll present InfectionMonkey,
7740	10580	an open-source breach and attack simulation tool.
10580	12880	We'll cover what the monkey is,
12880	15480	how you can use it to improve your network defenses,
15480	17140	or step up your testing,
17140	19140	and we'll go through a deep demo.
19180	22380	But first, let's dive into the breach.
22380	24220	We're going to see a simulation of a breach
24800	28820	that we saw in one of our real customers' networks.
29720	33640	As always, a server was breached.
33640	35320	That's how it starts.
35320	37340	Once inside the network,
37340	39360	the attackers were able to move laterally
39360	42940	using a vulnerable out-of-date Hadoop service
42940	47920	on a Linux server to jump to that Linux server.
48260	51100	That's the red line you're seeing on the map here.
51680	54120	And the attackers exfiliated information
54540	57200	back to their original breach server
57200	59260	through an uncommon port.
59260	62100	That's the gray line on the map.
64620	66960	After the original propagation,
66960	70380	the attackers were able to scan and find even more servers,
70380	72500	both Windows and Linux machines.
72500	74600	They stole credentials, breached more servers
74600	77000	using other protocols like SSH.
77000	79940	They even set up a tunneling station there in the middle.
80140	81980	That's the blue line.
82380	86060	Into a different sub-network entirely.
86960	90040	And started hopping, started stealing,
90040	92800	and basically took over the network.
92800	94760	And my question to you is,
94760	97600	how would your organization respond?
97720	99680	Now, this being DEF CON, obviously,
99680	101220	I don't only mean your organization.
101220	105120	I also mean the organization that you might be testing right now.
106100	109660	How would your organization respond to specific attack scenarios
109660	112260	like someone stealing credentials,
112260	115120	someone compromising a web server,
115240	117760	a malicious device logging into the network,
117760	121920	some blast radius attacks like pasty hash or connectivity checks?
121920	124380	What would the security do?
124380	127380	Would alerts be thrown? Would the SOC respond?
127380	129980	Would you know the attacker's visibility?
131880	134220	Let's take a look at a case study.
134220	137580	We have an environment, a large development network,
137580	142640	with a mix of Linux and Windows servers.
142640	146440	Multiple security products deployed on-site,
146440	149720	McAfee Move, an IDS on the network,
149720	152460	and the firewall between different segments.
152460	156340	And the scope of this test, the test scenarios,
156340	159740	were malicious devices logging into the network
159740	162880	and stealing some credentials.
163420	164980	What happened?
165740	168020	Well, what you would expect.
168020	170760	There were no security alerts,
170760	174740	even though we had more than 5,000 different attack attempts,
174740	178120	and there were no alerts on brute force attempts as well.
178120	180780	The antivirus solution was completely irrelevant
180780	184080	to stop the lateral movement inside the network.
184340	189700	The firewalls, while deployed, did not stop the cross-segment traffic.
189720	192360	And doing some credentials analysis,
192360	195520	we saw that a single old password that we stole
195520	198820	allowed login to all the Linux servers,
198820	203940	and some Windows machines had the domain admin passwords cached on them,
203940	206540	therefore were usable for propagation.
206920	210460	This all brings me to the point of our talk today.
212020	214520	What is InfectionMonkey?
214740	219400	So let's try to answer that by looking at a few key ideas.
220100	224080	The monkey is a breach and attack simulation tool.
224080	226260	It simulates an internal attacker,
226260	229080	which tests whether your security systems work,
229080	232420	whether they detect, they alert, they actually block something.
232880	238220	The monkey helps you make sure that changes don't open up new holes.
238780	241880	It's automated, semi-automated.
241880	244420	You have to run it manually the first time,
244420	248440	and it's exhaustive as much as it can be.
248760	253440	The second key idea to take a look at, it's open source and free.
253520	255540	This is a community project.
255540	259800	It's managed by GuardiCore Labs, but it is completely free, completely open source.
260180	264760	We have over 3,200 stars on GitHub,
264960	269400	a big active user base, hundreds of downloads a week.
269420	274160	This is by the community, for the community.
274820	281180	The third key idea to take a look at is the fact that the monkey is safe for production networks.
282160	288820	The monkey is being executed right now by large organizations in various verticals,
288820	298550	big telecom companies, education, school counties, universities, healthcare, in their production network.
298900	306900	The monkey is built to run on these infrastructures, on these critical infrastructures, and not crash them.
306900	313980	That puts some limitations on what the monkey can do while attempting to breach, while attempting to attack.
313980	323200	But safety is the first priority, since we do want people to run this in production networks and not lose their jobs.
323440	325200	And it's useful for you.
325200	331740	If you're a network engineer, a security engineer, a red teamer, a blue teamer, a purple teamer, a CISO,
331740	335020	the monkey could be useful for you.
335020	337140	And stick around to figure out why.
337940	344040	Since this is DEF CON, let's try to explain what is the infection monkey by comparing it to existing solutions.
344080	351120	You're all very familiar with classic manual penetration testing and with vulnerability scanners.
351440	356060	Let's see how does the monkey compare to these solutions that you know.
356740	359260	So here's a data center we visualized.
359260	362280	Each node in the graph represents a machine.
362280	370100	Each link in the graph, each edge represents a possible route between two machines.
370980	375560	If we're talking about vulnerability scanners, and we plop one down here.
376640	385420	And when we test the network using this vulnerability scanner, we place it in one or more places across the network.
385420	393560	And as you can see, it sort of checks every single route to that machine.
393880	404260	If we place enough scanners properly, we can probably test most parts of our network for remote vulnerabilities on an ongoing basis.
404820	408860	But it won't be able to simulate an attacker's move.
409120	413160	So talking about coverage depends on how you deploy it.
413160	418680	Frequency, you can do it whenever you want, since this is an automated tool.
418680	422320	But it does not simulate an attack at all.
422340	427740	Therefore, sometimes the results of vulnerability scanners are exaggerated.
427740	432620	It's huge lists of CVEs that you can't deal with.
432620	436380	And they don't actually simulate what happens.
436380	443020	So they might be closing routes, which are completely irrelevant for attackers that attackers will never use.
443460	447580	On the other end of the spectrum, you have penetration testing.
447580	453520	Here, we place the penetration tester on one side of the network, the red team.
453540	458640	And we give them a goal, some valuable assets.
459200	463320	And as you can see, some machines are exploited, some are not.
463440	466200	Eventually, the red team reaches their goal.
466380	469360	This is another popular method.
469360	471700	The pen tester can start from the internet.
471920	475680	Sometimes that includes phishing attempts or whatever.
475920	482460	But in the end, he gets to the network and simulates an APT.
482800	492360	On the one hand, you get yourself a professional in-depth testing, especially if the penetration tester is good.
492360	496600	Which sort of unveiled a weak path here, the red path.
498460	503680	And sort of discovered some weak points across the data center.
503680	505540	So the testing is in-depth.
506260	509600	But what if there are more routes?
509600	514340	Obviously, the human tester cannot cover all possible paths.
514340	516860	So the coverage might be low.
516860	527420	What happens if a few days after this penetration tester stops his or her work and leave?
527440	534110	The highly dynamic data center sets up a ton of new resources and deploys three new apps.
534940	540190	How would these results help those network changes?
540440	545600	After all, penetration testers don't work on a daily basis. That just won't work.
545600	553880	So the coverage is low, the frequency is low, but it does simulate an attacker, so it does do in-depth testing.
554340	559280	The monkey tries to take the best of both worlds.
559460	564360	It's automatic, so the coverage and frequency are high.
564480	572300	It's in-depth, since it simulates an attacker and it actually propagates across the network.
572300	576000	And the best of all, it's free, since it's open source.
576920	581420	Let's take a quick look at the main features of InfectionMonkey.
582050	586960	The monkey is highly configurable, so it can fit different use cases.
587200	591120	It has various attack techniques.
591560	596860	It uses brute forcing, it steals credentials and passes the hash around.
596860	599660	It has wormable CVEs that are optional.
599660	604140	If you're worried about running CVEs in your network, you can turn these off.
604320	606820	Same for credential brute forcing, by the way.
607060	611760	So you get quite a lot of attack techniques built into the tool.
613580	617480	Actionable reporting. This is really the meat of the matter.
617480	621920	You're going to see the reports later on in the demo, so we won't delay on this now.
621920	624600	But the monkey has three reports.
624600	632680	The first one being a security report aimed towards whomever wants the details.
632700	636280	This is the most actionable report out of all of them.
636280	637800	A Zero Trust Report.
637800	644040	If the organization you're testing or your organization is using the Zero Trust lingo,
644040	647020	the Zero Trust Extended Framework by Forrester,
647020	655280	this is the first-of-its-kind report card on where are you in your Zero Trust journey.
657020	660000	And lastly, the MITRE ATT&CK Report.
660000	663160	If you're familiar with the MITRE ATT&CK Framework,
663940	670480	the monkey maps its actions to the techniques that this framework offers,
670480	675740	and you get actionable mitigations on each technique that the monkey successfully used.
675740	680320	We're going to take a deeper look into those reports later on in the demo.
681140	683260	And lastly, it's easily deployable.
683260	686980	We didn't want some expert, super-hard tool.
687000	691660	This is supposed to democratize penetration testing and be easy for the community.
691800	694460	We have one-click options for cloud environments,
694460	698440	so if you're testing a cloud environment, just hop onto the Marketplace. It's free.
698520	704020	If you're not using a cloud environment, there is a Windows Installer, a Linux Installer,
704120	710980	a Debian package, a Docker machine, a Docker image ready with the Infection Monkey installed,
710980	715780	and a VMware OVA file.
715820	720340	So no matter where you're running, no matter which way you like to deploy machines,
720340	721760	we've got you covered.
722000	730320	And it's very easy to use with a friendly web interface aimed towards getting results quickly.
730320	735340	The monkey should be able to offer you is a different perspective.
736460	741520	What you have, what your organization have is a very nice, you know, Visio chart.
741520	747420	You always see these in presentations that shows everything is segmented.
747420	750080	Everything is beautiful. We have no problems.
750580	754440	But we have the monkey telling us what's really happening.
754440	757920	So on the other hand, you can see the attacker's knowledge
757920	763640	and maybe find paths that you didn't think were possible.
763960	772320	And you have the application diagrams and our tools can tell us who's really communicating with whom.
772360	779320	And obviously, as we know, in reality, it's all just a big mess that is just waiting to burst up in flames.
779940	784420	So which use cases is the monkey relevant for?
785300	788700	Going back to the beginning of this presentation,
788700	794700	it can help you test specific attack scenarios in a continuous and automatic manner.
796420	800600	Demonstrate breach detection, test for segmentation.
801760	805540	If we're talking about some specific scenarios, credentials tapped,
805540	811240	you can feed the monkey with credentials of an IT team member and see how far it can go.
811240	816480	You can test what damage results from having specific servers compromised.
816480	823320	Let's say testing from one location, maybe the web applications of your organization,
823320	828060	something happens in the databases, stuff like that.
829200	832440	Malicious device, someone added a malicious machine,
832440	838440	like a contractor maybe bringing his laptop to on-site and connecting to the internal network,
838440	847520	but that laptop is completely full of malware and seeing how far the attack can go from there.
847520	851360	Or blast radius, let's try to limit damage from a breach.
851360	856000	Are your firewalls and the routing rules and whatever separating different networks?
856000	859660	Let's say the development network and the production network.
860260	863900	Another example could be past the hash attack.
863900	869860	Can attackers build a path that shouldn't exist from a server to a domain controller
869860	874110	using cached credentials or SSH keys that are left on the machine?
874920	881380	The monkey can help you test the existing security setup, the security strategy of an organization,
881380	888120	see if alerts are popping up, check if the SOC is responding correctly to an attack,
888120	893200	where the organization stands in their zero trust journey,
893200	898880	or how much of the MITRE ATT&CK framework are they limiting?
898880	900820	How much are they covering?
901240	905860	And the main thing, the main benefit that the monkey can give you,
905860	912380	if you want to test your network or if you want to present your findings as a red teamer,
912380	916800	is to show the visibility from the attacker's point of view,
916800	926620	not in the sort of high-level way that the visios usually show it.
927180	930640	So, we're going to jump into a demo.
930680	936020	In this demo, the first thing we're going to do is run a simulation
936020	944140	with a few different use cases in the configuration, and I'm just going to pop into it.
944980	949360	So, when you open the InfectionMonkey island,
949360	953360	that's the command and control server of InfectionMonkey,
953360	956780	for the first time after you deploy it, this is what you're going to see.
956780	963300	A friendly UI, one, two, three, four, that's the stuff you need to do to get started.
963300	964820	So, let's get started.
964960	969460	It tells us to go ahead and run the monkey, and we jump here,
969460	973800	and it offers us to configure the monkey to fine-tune its behavior.
973800	977060	Since I already have a test scenario in mind,
977060	981160	I will choose this option and hop into the configuration.
981600	985820	Here you can see we have a few different tabs for configuration.
985820	991400	If you want to mess with the monkey, choose which techniques it will attempt
991400	993440	and which techniques it will not attempt.
993440	996560	If you're familiar with the MITRE ATT&CK framework,
996560	999660	and that's how you like to use stuff,
999660	1004100	we mapped everything that the monkey does to the MITRE ATT&CK framework.
1004100	1006100	We're not going to do this today.
1006180	1010120	What we are going to do is first hop onto the network tab
1011000	1014820	and define the scope of this test.
1016000	1022500	And this is important since this is what will aim the monkey towards specific servers.
1022500	1026100	Now, the monkey doesn't have to be aimed towards specific servers.
1026100	1032340	We can check this and the monkey will just try to propagate to any machines it can find
1033900	1039020	along with the targets that we will manually configure.
1039020	1046300	But in this instance, I only want it to run on the targets that I've defined.
1046620	1054780	And I want it to hop from the initial infection point three deep.
1055820	1059260	Sort of giving a spoiler here, but jumping to the map,
1059260	1064320	the monkey started from here, but you can see it hopped pretty deep,
1064320	1067780	three deep from the original place where it started.
1067780	1071620	This is the scan depth configuration.
1072140	1077600	Moving on to the target list, this is the list of the targets that the monkey tried to scan
1077600	1080520	and obviously attack.
1080520	1085120	So we have quite a... just a bunch of IP addresses here.
1085840	1093240	This is just the IPs that I know I want to test in this demo, in this simulation.
1094280	1099220	And lastly, I also configured the monkey to test for network segmentation.
1099220	1103060	I know I have these three different segments.
1103060	1112260	This network range of a segment, 10.2.0 from 11 to 12.
1112260	1114800	So basically a two server segment.
1115060	1122420	This segment, which is a single IP segment, a network segment that only has one machine.
1122420	1127160	And the slash 24 segment here at 10.2.2.
1127160	1131520	So what I'm telling the monkey is to try and test for network segmentation,
1131520	1135840	see if it can create cross segment communication.
1136620	1140800	Other than setting up the scope of this test,
1140800	1146800	you can also configure which exploits the monkey will try to attempt using the exploit selector here.
1147200	1152860	In this instance, we went with the Struts2 exploiter, the Shellshock exploiter,
1152860	1156520	SSH exploiter, which brute forces using credentials,
1157360	1165380	the MSSQL exploiter, the WMI exploiter, and the SMB exploiter, which again is a brute force exploiter.
1165380	1168760	As you can see here, we have some unsafe exploits.
1168760	1179640	The Microsoft Bulletin 08-067 is an unsafe exploiter that might crash due to the fact that it uses buffer overflow.
1179640	1184980	And we, you know, marking security of our users first,
1184980	1189940	even if you were to check this and check all of the exploiters,
1189940	1193600	and uncheck them and recheck all of them,
1193600	1195960	you won't get the unsafe exploiter.
1195960	1197850	You really have to opt into that.
1198360	1200800	We also set up some passwords here.
1200800	1208100	This is in order to simulate a credentials theft, let's say a phishing attempt was successful.
1208100	1217000	So we got some passwords that the exploiters will try to use and some users here.
1218620	1224920	And yeah, we can take a look at the infection map and see what happened.
1225060	1227880	You can see we started from here.
1227880	1230100	This is the Monkey Island.
1230100	1231360	This is the server.
1231360	1236400	We started from here because we clicked on run on Monkey Island server.
1236400	1244080	And once we clicked on this, everything here went pretty wild.
1244080	1247640	Every red line represents a successful exploitation attempt.
1247640	1255620	So let's just take a look at the line from the Monkey Island to the server called struts2,
1255620	1257560	which obviously is a struts server.
1257560	1259240	Let's take a look at this line.
1259240	1265460	And as you can see here, it was successfully exploited using the struts2 exploiter.
1267180	1272340	And you can also see which services were found on this machine.
1272340	1276860	So you get a mapping of which services were found.
1277160	1281940	And once the monkey got here, did exactly the same.
1283100	1287540	Yellow lines represents scans.
1287540	1296360	These are the monkey trying to scan a machine and trying to find ways to attack it.
1296360	1299560	But in this case, it didn't manage to attack.
1299560	1303240	All the exploiters failed, but it did find open services.
1303240	1310340	So it marks this interaction as a scan line, as a yellow line.
1310620	1315760	Lastly, we have the island communication lines,
1315760	1322920	which just show how the agent communicated back to the command and control server and reported everything back.
1323280	1328260	We also have this nice configuration here with the blue lines.
1328260	1332760	What we can see is the monkey started on the Monkey Island,
1333280	1337380	moved to this server called tunneling-9.
1337380	1341740	This is the first tunneling endpoint.
1341740	1346620	This server connects two network segments.
1346620	1351780	You can think of it like some sort of jump box that the organization is using.
1352560	1360540	This server connects the 10.2.2 subnet to the 10.2.1 subnet.
1360540	1364920	It has two network interfaces, one in each segment.
1365520	1371060	Now the monkey hopped onto this machine and was able to propagate to this machine.
1371060	1373160	For instance, using SSH.
1374140	1377120	Now, what is this blue line?
1377120	1384600	This blue line tells us that the monkey on tunneling-10 needed to send information back to the island.
1384600	1389100	It needed to report back to the command and control server what it has found.
1389520	1393400	However, that's easier said than done.
1396820	1406120	If there was a path between the machine tunneling-10 and the island, the monkey could just send the information back, no problem.
1406120	1408680	However, these two machines are not connected.
1408680	1410620	They are not in the same network segments.
1410620	1414400	They don't have any direct communication in between them.
1414400	1423380	In this case, the monkey on tunneling-9 turned itself into a tunneling server.
1423380	1432540	And enabled tunneling-10 to report back to the monkey island over tunneling communication.
1432540	1445400	In that exact same fashion, this happened twice again with tunneling-11 and tunneling-12 with a different subnetwork, 10.2.0.
1445400	1452160	So what we really had here is two hops between the monkey and the island.
1452160	1459420	And the monkeys helped themselves tunnel the communication back completely automatically.
1459480	1464220	So what we're seeing here is sort of a very deep network test.
1464220	1474620	And the monkey sort of bridging networks and showing how you can hop between different subnetworks in this test instance.
1475280	1481100	Now we can hop on to the security reports section of the monkey.
1482160	1484800	We have three different reports.
1484800	1487620	The first report is the security report.
1488180	1493760	As you can see here, the report starts with an overview.
1494060	1496560	This is sort of the summary of what happened.
1496560	1501340	First of all, it let us know that critical security issues were detected.
1501340	1510460	Which is obviously the case when the monkey was able to run rampant in a network like this, do tunneling, use a ton of exploits and propagate to a ton of different servers.
1512420	1516480	The monkey started propagating on this machine.
1517500	1522500	And it tells us which machine it started on. In this case, it's the island Windows machine.
1523000	1527000	It tells us the configuration we used, which we went over already.
1527000	1531080	Which usernames and passwords were used for brute forcing.
1531160	1533400	Which exploiters were selected.
1533480	1535580	Which IPs were selected to scan.
1535580	1539660	And it notes that the monkeys were configured to avoid scanning local network.
1539660	1544400	This is a really useful feature to limit the spread of monkey.
1544400	1549480	If you want to run it in a network and you're afraid the monkey will just spread all over your network.
1549480	1552220	This is a pretty good way to avoid that scenario.
1553280	1555280	And what did the monkey find?
1555340	1559200	During the simulated attack, the monkey uncovered four threats.
1559280	1562340	Stolen credentials that were used to exploit other machines.
1562340	1565800	Machines that were vulnerable to shell shock.
1565800	1573140	Machines that are accessible using the passwords we provided for brute forcing.
1573780	1577140	And the struts2 vulnerability as well.
1577420	1580240	So we have two wormable CVEs in our network.
1580240	1585140	And we have two credentials-based attack vectors in our network.
1585140	1589220	And we also found segmentation.
1589220	1593200	Potential weak segmentation and actual segmentation issues.
1593200	1597060	Communication from this segment to this segment.
1597060	1600940	Which we defined as two different segments in the configuration.
1600940	1603640	And from this segment to this segment.
1604320	1606560	Jumping back to the map.
1607140	1609520	This is these lines.
1610760	1616140	From the 10.2.2 segment to the 10.2.1 segment.
1616140	1618060	And these four lines.
1618060	1623180	From the 10.2.1 segment to the 10.2.0 segment.
1624000	1630220	Obviously, if you have your segmentation on lockdown, these communications just won't happen.
1632080	1638460	And on every issue here, you can read more and get more specific details.
1638460	1640500	Which services were used.
1640680	1644800	To which IP was able to communicate, etc.
1645780	1649300	Taking a look at machine-related recommendations.
1649300	1653700	You can see which recommendations we have for each machine.
1653700	1658840	So if we want to fix the critical app, the crown jewel, we can find it here.
1658840	1661100	Let's say it's Tunneling11.
1661100	1668080	And we see that we need to change the user monkey password to a complex one-use password.
1668080	1671160	Because it's shared with other computers on the network.
1671160	1672940	And again, you can read more.
1673140	1675660	Specifically, this is vulnerable to SSH.
1676620	1684080	And you need to do micro-segmentation policies to disable communications that aren't required.
1684280	1686760	Because a tunnel was set up.
1686860	1690360	Which obviously means that the machines aren't locked down.
1690360	1695600	Because they can create communication paths that we didn't want them to create.
1697420	1699840	Some different recommendations.
1699840	1701800	The struts24 machine.
1701800	1703880	Struts2-24 machine.
1704610	1707780	You need to upgrade the struts version.
1707780	1715820	Because the struts server at this machine, which is this IP, is vulnerable to a remote code execution attack.
1716500	1719000	You can get even more details here.
1719000	1723560	The attack was made possible because the server is using an old version of Jakarta.
1723560	1727680	That does the multi-part parser thing.
1727680	1730000	And there is more information.
1730000	1734540	You can click on it and obviously see the CVE public information.
1734600	1739980	And there are a ton of machine-related recommendations here.
1739980	1746020	For example, the machine that was vulnerable to shell shock tells you that you need to update your bash version.
1746820	1754220	And you need to segment your network to make sure that there is no communication between machines from different segments.
1754220	1757760	The next section of the report shows us the network from the monkey's eyes.
1757760	1760840	This is the part of the attacker's visibility.
1761380	1764960	From the attacker's point of view, this is how the network looked like.
1766340	1767980	Basically, Swiss cheese.
1768500	1773420	It tells us that the monkey discovered 10 machines, successfully breached 9 of them.
1773440	1776960	What's the last 10%? Well, it's just the machine we started on.
1776960	1779400	Every single machine in this test was breached.
1779400	1783440	Obviously, this is a test network and we set up this as an example.
1783440	1788920	But this is not very different to the results we've seen when running with customers.
1789140	1794860	Now, we can see a summary of which services and on which machines the monkey has found.
1794860	1798500	This sort of maps your attack surface.
1798500	1804580	This shows which ports can be knocked and see who's answering.
1804580	1819840	For example, the tunneling machine, which has both of these IP addresses, as we've said, 2.2 and 2.1, is accessible from all of these machines using SSH.
1820660	1826320	And the struts24 machine listens on 8080 as well.
1826580	1831360	You can also see which exploits were used on each machine.
1831360	1836400	So if you want a sort of vulnerability assessment summary, you can see that here.
1836400	1840220	This machine was exploited using SMB.
1841220	1844600	Specifically, credentials were stolen using Mimikatz.
1846680	1850640	And you can see the post-breach actions that the monkey has performed.
1850640	1855620	It performed 243 post-breach actions on 7 machines.
1855620	1858540	Which actions? Well, we're going to see in a second.
1858540	1863420	But if you want the whole list, you can see here.
1864340	1871820	And you can see which credentials were stolen from machines in order to propagate further.
1871820	1877000	So this is sort of a credential analysis part of the report.
1877380	1879700	This is the security report.
1879700	1883280	But we also have two other reports.
1883280	1893420	The first one is the Zero Trust report, which is the first Zero Trust assessment report available.
1893920	1900980	As you can see, we've mapped what the monkey does to the seven pillars of the Zero Trust Extended Framework.
1901240	1908020	And we've got a lot of red in this report card because we failed a lot of the tests.
1908020	1916920	The monkey tests for violation of principles defined in the Zero Trust security model.
1917160	1921380	And maps it to each of the seven pillars.
1921420	1929380	Networks, devices, people, workloads, data, visibility and analytics, and automation and orchestration.
1930220	1933980	Now, the gray just means that this wasn't executed.
1933980	1940360	In this test, in this simulation, there wasn't anything relevant for workloads, automation or orchestration.
1940520	1945240	Red means that something related to this component failed.
1945240	1948140	Something related to data failed.
1948420	1949740	Well, what was it?
1949740	1953380	We can take a look at the test results and see exactly what happened.
1953380	1955760	So let's take a look at data, for example.
1955760	1964220	We can see that other than everything else that the monkey has done in propagating, stealing credentials, running exploiters and giving us all this data back,
1964220	1967620	it also scanned for unencrypted access to data.
1967620	1974840	Because one of the Zero Trust principles in relation to data is that you need to secure data at transit by encrypting it.
1974840	1984800	However, while the monkey wasn't able to find Elasticsearch instances, it was able to find unencrypted HTTP server.
1984800	1988920	Someone is not using HTTPS and that's a problem.
1989240	1993280	Now let's say we want to know even more data about this specific problem.
1993280	1996980	Which servers? When did this happen? What's up with that?
1996980	2002540	We can scroll down to the finding list and see that the monkey was able to access HTTP servers.
2002540	2010460	And if we look at the specific events, we can see exactly which monkey tried to perform the network scan and when.
2010460	2022140	We can see which services it found. It found TCP80 and then it mapped an HTTP service that was recognized as an open data endpoint.
2022140	2026900	Specifically, it's an Apache server on Ubuntu. And this is the version.
2027740	2032120	So, as you can see the details, it is a pretty detailed report.
2032120	2041400	You can also export all the events to JSON. So you can run scripts on it, match it up with other APIs, etc.
2042780	2047420	Let's take a look at a different test. Let's take a look at networks, for example.
2047420	2054540	Obviously, with the monkey being a breach and attack simulation tool and GuardiCore being a network company,
2054540	2060400	which sort of mainly maintains this tool, this is the part we invested the most into.
2060400	2062800	And we do have quite a lot of tests here.
2063280	2067620	Now it's time to circle back to all the segmentation problems we saw.
2067740	2076020	The monkey tried to scan and find machines that it can communicate and do cross-segment communication.
2076020	2083240	And it was able to, so this test failed because Zero Trust Networks tells us that the most important thing we need to do
2083240	2088620	is to apply segmentation and micro-segmentation inside our network to lock that down.
2088620	2094740	Again, if we go back to the findings, we can see that the monkey performed cross-segment communications
2094740	2098620	and we can see exactly which violations occurred.
2098640	2106940	In this instance, Tunneling 10 managed to talk to 10.2.10.11 in this segment.
2106940	2113380	So you get a pretty detailed report on which segmentation violations occurred.
2113380	2120680	If you have a firewall solution or a micro-segmentation solution, every single event here should be an alert.
2120680	2127820	So you can export all these results and try to match them up with the alerts from your whatever security solution.
2130060	2136460	You can see also that we failed the Network Policy Should Be As Restrictive As Possible test.
2136460	2140040	This is because the monkey was able to tunnel traffic using other monkeys.
2140040	2145300	We also failed this test, which appears in the people pillar as well.
2145300	2147460	So let's take a look at that. What does people mean?
2147460	2151720	Well, it talks about users. People means Zero Trust users.
2151720	2160700	In this case, the monkey tested whether users' permissions to this network and to the resources inside the network is MAC only,
2160700	2164040	mandatory access control, whether it's a need-to-know basis,
2164040	2171400	whether only known users can access the small subset of resources that they should be able to.
2172360	2175340	The way the monkey tests for this is pretty creative.
2175340	2182180	It creates a new user, a new local user on the machine and tries to communicate online,
2182180	2185800	tries to just go out to the internet with an unknown new user.
2185800	2189560	This is a completely unknown user because it's a random username.
2189560	2193120	There's no chance that it existed before.
2193120	2197080	And as you can see, it was able to do that two times.
2197140	2202940	It created a new user and reached out to infectionmonkey.com,
2202940	2207800	so not even a super well-known domain, even though we do get quite a lot of traffic,
2207800	2211780	with some new user and a bunch of random characters.
2212000	2217620	And the process succeeded. It managed to create this communication with a new user.
2217620	2226740	That means that our network, this sample network, doesn't block unknown users from communicating online.
2227300	2232220	And as you can see, some tests can be mapped to quite a lot of different pillars,
2232220	2236740	because this is about people, this is about networks, and this is about visibility.
2236740	2238680	You should be able to see this stuff.
2240700	2248280	The monkey also obviously maps every single device that was exploited as a problem,
2248280	2258640	because you need to do some traditional endpoint security to stop the monkey from propagating across the network.
2259400	2264580	And as you can see, the monkey was able to exploit those endpoints,
2264580	2267920	and you need to check the logs to see if you can recognize this activity.
2267920	2271540	Specifically here, we can see all the exploit attempts.
2271540	2278480	Now, even failed exploit attempts should be logged, but successful attempts obviously should have been blocked.
2279040	2286100	And again, you can export all these results to a JSON file that you can then match up and script to other stuff.
2287620	2290560	The monkey also mapped whatever passed.
2290720	2295500	So, in six different instances, the monkey wasn't able to create a new user,
2295500	2302860	because of endpoint protection or maybe firewalls blocking the communication.
2303100	2307960	So, even if some tests are failing, the monkey lists everything for you.
2307960	2312060	So, you can see what you do have on lockdown and what you don't have on lockdown.
2314840	2320220	The verify part of the report tells you the stuff that you need to verify manually.
2320220	2326560	This is basically a list of everything bad that the monkey has done in this simulation,
2326560	2335940	that you need to test and see whether you can find all the malicious activity in logs and alerts.
2335940	2341440	This is sort of the, let's check how the organization will respond part of the report.
2341680	2348860	And again, once you're done fixing all the holes, going over all the reports, pushing out all the information,
2348860	2354740	you can start over, run again, and within a few minutes, you'll get this report anew.
2354740	2360540	So, you can see if you actually closed all the issues, or maybe you did it incorrectly this time.
2361220	2364840	Lastly, the monkey has the MITRE ATT&CK report.
2364840	2370540	This shows information about the MITRE ATT&CK techniques that were used by InfectionMonkey.
2372120	2378920	This enables you to see which techniques were successfully used by the monkey,
2378920	2382520	which techniques the monkey tried to use, but it failed,
2382520	2384880	which techniques just weren't attempted,
2384880	2388060	and which techniques are disabled and you need to enable in order to run.
2388060	2393480	In this case, we don't have anything disabled because we had monkey running full throttle.
2394200	2400280	And if we want to get more information about some of the ways that the monkey utilized techniques,
2400280	2408080	we can click on any of these techniques and see what the monkey exactly did when it tried to use this technique.
2408080	2411200	Let's take a look at multi-hop proxy, for example.
2411200	2419640	Let's say we want to completely lock down our network and disallow attackers from doing command and control.
2419640	2423100	We want them to be completely lost, even if they manage to breach.
2423400	2425760	So, what did the monkey do?
2425760	2431080	Well, the monkey used multi-hop proxy, and we can see exactly which tunnels it created.
2431080	2437160	It created tunnel from tunneling 11 to tunneling 9 with two hops.
2437160	2440380	We saw that on the map before.
2440660	2443020	This is these lines.
2443040	2447580	Yes, this communication path is a multi-hop proxy.
2448280	2450960	Now, let's say you are using the MITRE ATT&CK framework,
2450960	2454840	but you don't exactly remember what's the multi-hop proxy technique.
2454840	2458420	Well, you can just click on this question mark here,
2458420	2464940	and we immediately show you the relevant page in the MITRE ATT&CK framework.
2465020	2471520	The MITRE ATT&CK being an open source project as well, greatly beneficial to the security community.
2472700	2479820	We also pull the mitigations, because the moment you find that a technique was successfully used,
2479820	2481860	you want to know how to mitigate it.
2481860	2488980	So we just list the mitigations from the MITRE ATT&CK database.
2489280	2491940	Let's say uncommonly used port.
2492060	2494700	Well, the monkey, you get, again, more details.
2494700	2498340	The monkey used this port to communicate to the command and control server.
2498340	2500200	And you also get mitigations.
2500200	2503520	Obviously, popping up again is network segmentation.
2504620	2511040	Some other stuff, you can see that the monkey did some persistence testing.
2511040	2513400	It's important to note that this is only testing.
2513400	2515940	The monkey doesn't persist on machines.
2515940	2518340	It only tests if it can persist.
2518780	2521220	For example, it used the create account technique.
2521220	2525640	As we saw before, it was able to create a new user on the network system.
2525920	2530280	And we can see the results for each attempt, even if it failed.
2530780	2533740	And you can see different mitigations.
2533920	2536820	Again, you should use multi-factor authentication.
2536820	2542580	You need to configure your operating system so that malware can create new users, etc.
2542640	2550160	As an accessibility feature, we also list all the techniques in a list instead of the matrix.
2550240	2552100	So it's easier to navigate.
2552180	2557100	And also, if you have problems seeing the colors of the report, you can see the icons.
2557340	2564300	However, we found out that even our regular users love this display.
2564300	2569340	So just all users like the display as a list as well.
2569340	2575860	And again, you can open up the techniques and see that, for example, in the collection tactic,
2575860	2582140	the monkey used the data from local system and gathered sensitive data, like SSH keys.
2583860	2587140	These are the three reports.
2587360	2589880	Deploying the monkey is super easy.
2589880	2596860	You have the different deployment options, and you can see them or ask some questions.
2596860	2602080	Let's say you're not sure what's the MSSQL exploiter or how does it work.
2602080	2610100	Well, in this version, which comes out for DEF CON in a few days from when I'm recording this,
2610100	2617260	we also brought up a new documentation site, which guides you towards setup guides, getting started guides,
2617260	2625080	frequently asked questions, references for all the exploiters we're using and all the operating systems the monkey runs on,
2625080	2631160	which operating system it supports, some scenarios that you can run.
2633100	2639840	This is the test scenarios we talked about, like a breach from internet-facing servers, phishing.
2639840	2645920	You want to test segmentation or you want to verify security solutions and the procedures and the teams.
2645920	2659680	This is sort of the purple team, you know, magic option, a deep dive into all the reports and seeing how to integrate monkey into other stuff.
2659800	2675900	At the time of this recording, we're supporting integration, deep integration with AWS, both the security hub,
2675900	2687160	and automatically on your EC2 instances. And the guides are pretty deep about every single option that we provide.
2687160	2693780	Let's say the Windows installer, well, it's supposed to be very user-friendly with troubleshooting,
2693780	2698760	and it's open source like the rest of the project. So if you find something that you want added,
2698760	2703980	you can just edit it or open an issue for us, and we'll take care of that.
2706580	2715040	Now what? So we're done with the demo. We took a look at how does the monkey work and what can it offer for you.
2715340	2723900	So first of all, from us to you, we're releasing a new version, version 1.9.0 with more attack techniques,
2723900	2729780	as you've seen in the report, the monkey runs faster and completes the simulation a lot quicker.
2729780	2735880	The server itself has great performance improvements as well, so you can run it on large-scale networks,
2735880	2742760	and the UI is improved. Compared to old versions, maybe you can pull up old versions of the tool
2742760	2749780	and see that the UI has been vastly improved. It's also a lot more secure.
2749780	2758660	We've integrated with Snyk IO, a service that checks the dependencies of a project for vulnerabilities.
2758820	2769120	So we've vetted the product from having vulnerabilities in its bag, and we've run a lot of tests.
2769120	2778920	This really coincides with the fact that we do have big enterprises running us in production networks that actually matter.
2778920	2787020	So we had to step up there. And the monkey is secured by default. For this demo, I turned this feature off,
2787020	2794320	but every single InfectionMonkey instance that you will deploy has password protected by default.
2794320	2798640	You have to set up a user and password combination in order to access the monkey.
2798640	2804400	So even if you set up the InfectionMonkey in a network and somehow lose access to the server,
2804400	2810700	or maybe open up access to attackers to that server, that doesn't mean that they are going to take control of the monkey,
2810700	2813820	because they will need the password combination as well.
2814380	2820600	So you can download this version for free from InfectionMonkey.com, our homepage.
2821020	2826340	You can also access articles and the documentation site from InfectionMonkey.com.
2826700	2833700	And I'm inviting you, first of all, I'm inviting you to use the monkey. Use the InfectionMonkey.
2833700	2838600	If you're doing red teaming, purple teaming, blue teaming, this is a great tool for you.
2838600	2843740	It's automatic, it's free, covers a lot of ground, covers a lot of frameworks.
2843740	2847880	If you're doing penetration testing, for me, the monkey is a no-brainer.
2847880	2854560	It takes out all the skidding part of penetration testing, does it for you, gives you a pretty nice map,
2854560	2859160	and from the results the monkey gives you, you can do much smarter stuff.
2859160	2865960	You can focus on the harder parts of penetration testing, on the manual parts, maybe the human parts.
2865960	2874320	I don't know if we're still doing physical examinations in COVID times, but if you're hacking a site physically,
2874320	2882040	opening doors with credit cards and whatever, let the monkey take care of scanning ports and using the vulnerabilities
2882040	2887560	and stealing credentials and remembering them. You don't need to do that manually anymore.
2887560	2895840	If you want to do network analysis or even IT and security analysis, let's say you purchase a new security solution
2895840	2901920	for your network, you want to test that stuff and you don't want to test it manually.
2901920	2906520	Run the monkey after you install it and make sure you configured it correctly, make sure it actually works.
2907600	2912000	So the main invitation for me to you is to use the monkey.
2912780	2917920	Secondly, you can join us. You can join the monkey trainers community. You can contribute.
2917920	2923920	User feedback is the number one priority setter for us on the roadmap.
2923980	2931320	If a user has a question or a problem or discovers a bug, it jumps to the top of the backlog.
2931320	2934760	So your feedback could really impact the project.
2935260	2940740	Now with our new documentation site, you can also very easily contribute documentation.
2940740	2949440	If you have new scenarios in mind, maybe you want to add more information about specific exploiters or share your screenshots,
2949440	2955540	something you can add to the troubleshooting section, a whole new part of the documentation you think about,
2955540	2959480	you can easily contribute documentation directly from the web.
2959900	2968180	And obviously, if you're a developer, if you're a security developer, if you want to contribute new exploits, new scanners,
2968180	2971860	new MITRE ATT&CK techniques to increase the coverage.
2971860	2976660	If you're into Zero Trust and you want to add more Zero Trust tests, you can contribute code.
2976660	2980360	The project is completely open source and completely free.
2980360	2983600	There is no freemium version. There is no pro version.
2983600	2986640	This is a 100% community project.
2986920	2990300	And lastly, I invite you to spread the word.
2990920	2999860	The monkey is completely dependent on the users and the community to do good in the world.
2999860	3004460	And if you want to help it, you just need to tell other people about it.
3004760	3009820	Since this is a recording, I can't take questions in the recording.
3009940	3016140	But in DEF CON safe mode, I should be online on Discord right now to answer your questions.
3016140	3022600	However, if you're watching this recording after the event happened, don't worry.
3022600	3030820	You can reach out to the entire InfectionMonkey community by going to infectionmonkey.com and clicking on the community button.
3030820	3034660	You will be able to access our public Slack.
3034660	3045400	We have a public Slack workspace where all the developers and all the users hang out, answer troubleshooting questions, talk about features, and discuss security in general.
3045400	3050300	You can also access it from the documentation site right here in our Slack.
3050300	3056000	You can also reach us by support at infectionmonkey.com if you're having any issues.
3056000	3060120	Take a look at the code at github.com slash Gartic or slash InfectionMonkey.
3060120	3063900	And just take a look at our homepage, take a look at the articles.
3064740	3069380	Thank you very much and enjoy the rest of DEF CON safely.
3069380	3075500	Wash your hands, keep your mask on, but since we're at home, we can ignore these for now.
3075760	3077480	Thank you very much.