Upload File

let’s play the game.2015.zeronights.org/assets/files/31-ermakov.pdf · let’s play the game. yet...

  • Home
  • Documents
  • Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience
21
Let’s play the game. Yet another way to perform penetra/on test. Russian “red team exercise” experience from QIWI. Kirill ‘isox’ Ermakov

Upload: others

Post on 05-Jun-2020

2 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Let’splaythegame.Yetanotherwaytoperformpenetra/ontest.Russian“redteamexercise”experiencefromQIWI.

Kirill ‘isox’ Ermakov

Page 2: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

#:whoami?

•  Knownas‘isox’•  Webpenetra/ontester•  QIWICTO/CISO•  Memberof“hall-of-fames”(Yandex,Mail.ru,Apple,andsoon)

•   JBFCpar/cipant^___^

Page 3: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Captainobvious

•  Penetra/ontes/ng•   Justawaytocheckyoursecuritycontrols•   “Fastanddirtyassessment”•  Performedbyqualifiedspecialists•  PartofPCIDSScer/fica/onasexample•   Independentsecurityreview•  Need2doforsecurity-awarecompanies

Page 4: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Tradi=onalapproach

•   Singleteam(2-5members)•   External,Internalandsocial-technology•  Restrictedvectorsandscenario•  A]ackerswhitelist•  Noprivateinforma/onaboutatarget•   Sociala]acksareo^enprohibited•   Limiteda]acksday/me

Page 5: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Pentesterpointofview

•   Target-independentworkscenario•   1/3/meforwellknownvectors•   1/3/mefornewresearch•   1/3/meforautomatedscanners•  Nophysicalsecuritybypass•   Limitedsociala]acks•   Samestoryevery/me

Page 6: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Redteamexercise

•   Theycallit“Red-team”:•   Securityteamisnotno/fied•   Tryingtosimulate“real”a]ack•   S/llalotofrestric/onsandlimits•   Oneteam•   Noinforma/onabouttheinternals

Page 7: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Anywaycoverisnotenough

•  Blindzones•   Timelimits•  Doesnotuseallavailablevectors•   Toomuchaccurateandethic•  Doesnotreallylookslikerealhackersa]ack•  Pentestteaminsufficientresources

Page 8: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Hackmeplz!

•   Letsmakeabig(dream?)team•   Letthemworkontheirown!•  Nomore“secretpentesttechnique”•   Forget“don’ta]ackthat”and“don’tbruteforceusa^er6PM”

•   Scope=everything•   Notkidding.Reallyeverything.

•  Noprepara/onsfromsecurityteam

Page 9: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Norestric=ons

•   Sociala]acks•  Malware•   Accountbruteforce•   0days•   Night/weekenda]acks•   Physicalpenetra/on•   DOS•   Drop-devices•   Personaldeviceshijack•   Employeebribe

Page 10: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Let’stherebeinsider

•   Sharingprivateinforma/on•  Networkmap•  Cri/calassets•   Securityspecialistasinsider•  Hintsandadvises

Page 11: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Deeppenetra=on

•  Physicalsecuritybypass•  Drop-devices:

•  Wi-FiandLANbackconnects•   Cablemanipula/ons•   USBFlashwithmalware

•   Livesocialengineering•   Stealinglaptops/pads/phones

Page 12: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Securityreac=ons

•   Securityteamawarenesscheck•  Realincidentinves/ga/on•  Bansandaccountlockouts•   Livesystemtuning•  Coopera/onwithphysicalsecurity•   Logs,cameras,eventsandalotoffun!

Page 13: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Challengeandgoals

•   Forpenetra/onteam:•   Applica/onorSYSaccountforDB•   ADenterpriseadministratoraccount•   *nixroot/adminaccount•   Accesstoanycri/calsystem

•   Forsecurityteam:•   Defendyourhome

Andthereisonlyonerule:norules

Page 14: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

QIWIRedTeamExercise

•  A]ackers:#ONSEC&#DSEC•  Defenders:#QIWIsecurityteam•   Insider:CISO(me)•   Timeline:2.5month•  A]ackGoal:

•   SYSDBA,root,EnterpriseAdministrator

•   Securityteamgoal:•   No/ceatleast90%a]acksandintrusions•   Defend

Page 15: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Weeksofpain

•   7sociala]acksin2weeks•   Few/mesof“emergency”•   Systemcrashes•  Ordinaryusersbu]hurt:

•   Lockedaccounts•   Spam/phishingemails•   Viruses

•  Malwareinves/ga/ons

Page 16: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Reallycoolvectors

•   Successfulofficebuildingintrusion•  Wi-Fi’edandLAN’edlaptopsgateways•  MacOSXdomainissues•   SmartHousehacking•  PowerSupplytakeover•  CompilingdsniffforDVR

…evenmorein@d0znpppresenta/ons

Page 17: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Somememos

Page 18: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Andwelostthisgame

•   Systemaccountswerecompromised•   Socialengineeringasabesta]ackvector•   SSHaccesstosecurityteammember’sMacbook•  Downloadeddumpsofnetworkdeviceswithpasswordhashes

•   Tonsofsuccessfulbrutes

Page 19: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Successfulvector

•  Gainedcreden/alsusingsocialengineering•   Lossofisola/oninguestWi-Finetwork•   Laptops,connectedbothtocablenetworksandWi-Fi•  BadMacOSac/vedirectoryconfigura/on,allowinganyADaccounttoconnectusingSSH

•  Keepingsensi/vedataplaintextin~/•   Insufficientmonitoringoftheofficetraffic

Page 20: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Results

•  Be]erthanone-teamclassics•   Simulatenearrealhackera]acks•   Excellentscopefulfill•   Tes/ngsecurityasitis,notasitwantstobe•   Youwillbedisappointedinyoursecuritytoys•   ‘Li]le’bitexpensive•   Systemswillcrashsome/mes

Page 21: Let’s play the game.2015.zeronights.org/assets/files/31-Ermakov.pdf · Let’s play the game. Yet another way to perform penetraon test. Russian “red team exercise” experience

Seeya!

•   Thanksto@vidensforagoodtriptotheTroopers•   Thanksto#DSECand#ONSECforagreatjob•   Excusestomysecurityteamforthistwoandahalfmonthsofhell

•  Anyques/ons?•  Contact:[email protected]


Let’s play snooker

Let’s Play

Let’s Play Hangman!

Let’s Play Jeopardy!!

Let’s play soccer. play tennis play volleyball read play ... · B: Let’s play soccer. What are we doing today? Let’s play soccer. play tennis play volleyball read play baseball

Let’s play…

Let’s Play………

Let’s Play…

LET’S PLAY JEOPARDY!!

Let’s Play Jeopardy

Let’s Play Hangman

Let’s Play Ball!

Let’s Play Clue!

English Meadows Play Group Let’s Play!

Let’s Play!

LET’S PLAY MATH

LET’S PLAY JEOPARDY!