every how's it going hopefully your sink
Khan's going good morning keynotes and
lunch and if you're still just in this
room for meat lunch feel free to stay my
name is James Pope everybody just calls
me Pope because they find that easier to
say and it's not because I'm really into
Catholicism or anything but she was born
that I have been asked that question
many a times and today I'm presenting a
security 101 track on think like a
hacker it's still just a little hot
thank you this is you know generally you
don't put in shady URLs but a lot of
people keep asking me to give them the
slide deck later it's not a lot of use
for you but there's a link to the slide
deck if you wanted to follow along in
your phone or later if you you chose to
and I can come back to that later if you
want it so who my little intro here I'm
a partner my own company is called Polk
tech real original right we just put
tech at the end of our name and then do
lots of things technology and security
so so I worked there and I actually
still hold a job doing stuff for it's a
theater chain based out of Los Angeles
I've been in movie theaters since like
the year 2000 so I've done a lot of
stuff in the theater world
I've a member of DC 801 and we're trying
to start like a DC 4 3 5 I moved up to
Logan so I'm working on that
also I'm one of the committee members
here at st. Kahne I also helped run
b-sides and I like a team lead at
blackhat knock every year and I sit on
some associations for theaters
cybersecurity stuff as well I do have
some degrees inserts but that's not
really fun to talk about
so you're here to think like a hacker
how to learn to be a hacker well you
know you know what motivates them how do
you get in that mindset and you know
some of that is kind of simplistic and
some of it's also very complicated so
we're gonna touch on a few of them and
the the way I know how to relate to this
that is to tell you a story about how I
came to think like a hacker and a lot of
the stuff I do
when I was young we got computers came
to us from other family members their
older computers and we had a screen that
was very similar to this this one's a
point of sale I couldn't find one
exactly one of my uncle's he would
provide it was an administrator to K
through 12 and would lock him down so we
saw these das menus that were completely
locked down to what you could do like
word processor and a few other stuff so
we were all stuck in this of like what
the ideal parent wants their kid to do
right just sit there and like I don't
write articles or something so what we
did instead is we figured out how to
make boot disks right and dot's boot
disk and put them in before they boot up
and get command prompt and we could do
every one right we can load you know
Commander Keen right so one of my
biggest drivers in life was Commander
Keen we would do that and monster bash
over here that you just sit there and
play these four hours parents leave play
fact we only have accessed a word
processor so that's what we do right
until they leave reboot the Machine get
admin on it essentially but the whole
drive was to play video games and this
is like aged 10 ish something in there
and they came two more controls right so
the computer suddenly had this like
tumbler key lock on the thing and we
couldn't turn it on right somehow we got
ratted out found out that we're just
sitting there playing Commander Keen all
the time right so we have this physical
walk and that did stop us for a bit
we were just beating our head okay kind
of play computer can't turn it on like
how do you do anything here until one
day I took it apart and jumped it right
I remember staring at that switch for
like two minutes like it's just two
wires right like what does this thing
actually do so we jumped it computer
boots up hey put it back together play
video games right this is the drive get
it back together video games so jetpack
I don't even play that was a big big
favorite as well so just the whole drive
was just sit there to play these video
games we had him on discs labeled what
they were we're copying on parents are
breaking I'm destroying hiding him up in
ceiling tiles right like the whole drive
was it was not too
anyway or just said like hey you should
think like a hacker you should be a
hacker you should as a cyber security or
security controls or circumvent these
things it was just a drive to play video
games at the time right so really think
like a hacker the primary motive there
is just to think different about it it's
it's just to come out something that
you're not used to right depending what
that is it could be completely different
your mindset could already be geared for
this it could also be geared of like I
only do PCI compliance or I only do this
framework and that's the only way
somebody's gonna come at me is through
that and what I'm asking you to do we're
gonna go down a rabbit hole today of
thinking like a hacker think just a
little different about a situation so I
did what anybody would do I want to
become a hacker right so I go to wiki
how like a like how do you become a
hacker right and this is the article how
to think like a big hacker so that's
actually my bad that my presentation
wasn't as cool as their topic they got
big in there and they had these bullet
points which is great and some of these
are pretty interesting I just I thought
I was did she I just want to share it
identify possible exploits and their
domain names gathering as much
information as you can and create a
footprint analysis really great but pay
attention step to that step one there's
only five steps you can in wikiHow you
can become a big hacker five easy steps
so by the time we're done here you guys
are all gonna be you know sitting here
like this this is you guys right you
ready these five steps okay
all right so step one step two pay
attention to backdoor entry points so
there you go
just pay attention of those as step 2
this tip 3 go ahead and just connect to
all their ports their UDP and TCP ports
and see what's running on this is
actually not bad
step 4 think about how you will gain
access to the target once you've learned
that information so you got these ports
you know they got some ftp server on
there and how you gonna gain access to
that so we're really close now you're
about ready to come a hacker you ready
step 5
take that username and password that you
got Trojan it okay so here we go we all
got our we got our hoods on and we're
all hackers now right we passed wikiHow
I saw this one it came on Twitter last
night
of a police agency you think it's in
Australia that just posted this
yesterday I'm not gonna read all this
because it's really long but they
essentially 14 steps to spot a hacker
this is like last night on Twitter and
and the the InfoSec world was pretty
much just like killing this thing right
but some of these are pretty funny and I
think would probably classify everybody
in this room probably has seven of these
I would actually you know we could
probably take a poll and I've got seven
people you'd have seven of these traits
almost every single person in this room
right like spend more of your time on a
computer than you do with people yeah I
probably do that right use terms like
DDoS and pwned yeah okay do you have
multiple email addresses hacker right
you're a hacker you cannot do that
multiple social media profiles on one
platform mmm
you probably enumerated somebody on
LinkedIn there right things like tor red
flag can't do that selling computer
games online cheats online you're a
hacker your internet connection goes
slow Yap hacker it's not Comcast hacker
and it's long there's a bunch in there
it's not worth right now but I was like
you know I think if you do these 14
things you're also hoodie on ready to go
right and the interesting thing is you
kind of are right like I was thinking
like a hackers a little kid a little bit
but that wasn't really the drive and
that's probably not somebody you're
trying to protect against now granite
physical access is important and there
are some controls and things that should
be put in place but that maybe is not
what you're against and it may be it's a
little different so I did so I do a
bunch of work and on those we do
engagements and some of those have been
straight at pen test and I did some for
the state of Utah I worked at Union on
helping going around a lot of K through
12 but I also did dump some G's did some
plenty of those afterwards and we do a
lot of consulting and a lot of it's
compliance driven and I like to break it
down to like here's kind of the reality
right you have things and security
frameworks are great and I'm actually a
big proponent of security frameworks
when they're used for the right reasons
when they're used to improve your
security posture and not used for
compliance over security and if you're
doing compliance
security I've legitimately done and
Bennett orgs that have completely passed
a PCI or whatever the compliance is and
have completely failed at security right
like do we have a IPS yes we do well
it's not even on any applied correct so
it's not in any of the zones that you
actually have traffic on yeah but it
asked if we had one
it didn't say we implemented it
correctly right and so that's where I
have a hard time with and I actually
always talked to customers our front
like listen if you're trying to improve
your posture
I'll help work with you if you're
literally just want to check box you
should go somewhere else and there's
plenty people who will do that
unfortunately but there and in PC I had
another racket right you Larry just
hired another person if you get like a
bad one I don't like that let me just
hire another one right but so this is
what I'm seeing like orgs generally
getting taken down from and when we do
engagements how easily take it down and
so phishing is the top one and I kind of
lump fishing together with some other
social engineering but generally just
phishing users and I don't want to beat
up users but it's a reality in your work
users and I have a big advocate of
putting controls in to also mitigate
some stuff that users do but phishing
walking through the front door right
we'll get to that show Ted I'm gonna put
it in stone because I use it a lot and
it's pretty amazing if you're doing a
single target now that is amazing if
you're just swath in the internet for
things showdown is amazing and we'll
touch on that for a second
leveraging what you have once you get
any type of foothold we'll go over that
for a second and then of course you're
just gonna ransomware it because why
wouldn't you lease we're gonna talk
about is missing patches that's not
really fun to talk about but it's
definitely legitimate it's out there and
showdown does use some s will touch on
it just for a bit
so for fishing unfortunately in the
world if you just take all the things
you're trying to go after it is almost
this easy in some scenarios like
legitimately like you just have to try
like a tool or a thing and here they go
right like can you go get an open-source
fishing program go fish or something and
implement it and then tweak it on
yourself until you eventually get it to
pass their filters it is almost as easy
it's just I don't need to throw down a
rod and do one at a time I can just
start picking up a bunch fishing a lot
of times they're generally after a few
portal's is a login page that they want
you to put in some information when you
do a pen test engagement it's generally
the way they go a lot of people don't
like you to drop payloads sometimes
they're in scope and you can drop
payloads but otherwise it's a link
google authenticate authenticate here
what I actually found that works the
best if I were to say there's one
fishing portal it works the best is a
website that I own called like vote for
site comm and it just legitimately lets
you vote for a website like your company
has a brand new website coming out pick
out of these templates what do you want
to pick and every loves to choose the
direction of the look and feel of some
CSS right there like that one and it
actually tells them like thanks for
information and and submits it it
doesn't go to an air page and redirects
them back to their home page and people
just love to do that including like sis
admins and domain admins which is nuts
right but these portals they work
because people don't stop and pay
attention pay loads is generally
something that they want to execute in
your system this can absolutely be
mitigated a lot of scenarios by IT you
guys can run a lot of things to mitigate
payloads however there are still things
like beef and hooking browsers but
payloads
and do they have atom what can you
leverage of their admin credential once
you're on a system so we'll touch on
those we've seen this basic one however
I do want to touch on some of these so
some of these if they're way under where
you're at apologies but this is a one on
one track so we're gonna touch on some
of the basic stuff these are the basic
validating where it comes from this is
you know our things were dry are they
looking weird are these URLs going to
the wrong places and some of these are
getting much and much harder as much as
we know some of these like yeah let's
hover over link and see that tell me how
you do that on your cell phone well you
can hold down on it for a while and then
it pops up and maybe gives you some
options on what you can do
so things as we know more things are
getting harder some of these URLs that
off you skate where you go they
intentionally make them long to go off
of your cell phone right on a desktop it
would like that look shady but on your
mobile I don't know so some things are
getting a little more complicated with
some of that stuff and we've seen these
generally with phishing away I advocate
people is
to validate at the source timing is
always on your side you can always go
validate at the source right you don't
need to act on what they act if I show
up with a Comcast shirt on and say hey
is your internet running slow your
answer is generally yes right and I'm
here to fix it I need in your data
center right the answer is generally yes
but you should be able to validate that
from the source and that source is not
the business card I hand you with
somebody sitting in a truck outside
right that source is you go call Comcast
you called some you call the vendor
directly you validate at the source if
you get and we always want to act on a
position of something there you can get
to much smarter people that will tell
you the positions of fear and Clow and
all these other reasons why your
emotional triggers get you to act on
some of this stuff but it's generally
like they want you to do something now
and timing is on your side it is in your
best interest to not act on that email
to think about it to go over to validate
at the source right so things like this
like hey your email counts gonna get
shut down that actually could happen if
somebody didn't pay a bill and that's
scary and I got emails and you can't
take away my emails or take my emails I
can't work right or slack depending
which work you're in but you can't take
that away and this is a legit scenario
you might be concerned about but you
contact your IT team you contact your
provider Microsoft Google you contact
them you don't click this link and
validate that right if chase says your
credit card is expired or it's been
declined or in this scenario like this
right this is this would be interesting
right email security later hey you just
logged in from Russia well I'm a
security person I'm shutting that down
now right well that's actually what they
want you to click here put in your
password portal harvest credentials or
payload drop a payload right so this
one's just a position of like you've
already been compromised like whoa right
chase sends you an email out hey you've
already been compromised click here to
you know freeze your card or get a new
one
you might be freaking out about that
validate at the source office validate
at the source timing is on your side so
these are getting better and better less
is the language weird and there's still
plenty of those that are out there but
most of those are just
Brayan and some people still do it but
they're getting better and better this
is a well-crafted email this is a
well-crafted email there might be some a
few things in there you can think about
but overall these could happen which is
why other triggers right somebody could
log in your email account from Russia
your provider might give you an alert
for that that would be concerning unless
you're in Russia maybe not so concerned
but here in Utah
that'd be red flag for me validate at
that source right this one I've used
this in a few presentations I've done
and and let me let me be clear in a
bunch these examples I don't pull these
off the internet these are from things
that worked this worked right somebody
was like I got a download this doc file
or yeah this was a docx file send them
to a doc file
I got download this doc file and enable
that macro right in this scenario what
would you do to validate this I mean
those who can't read in the back I know
it's I try to make them big but it is a
long room this is a divorce letter right
from an attorney who's coming from
something shady like Co dot slash
divorce right if your attorneys there
they shouldn't have that attorney but
let alone and this could be a real thing
I hope it's not in your life I hope your
spouse hopefully you've had some
conversations before would read
something like this however even if it
wasn't it shouldn't be immediate like
screw them I'm gonna preemptive you know
and click on these things like you
should call your spouse probably right
you're gonna have two other conversation
at some point but it shouldn't be good
either because this might be malicious
right all right this this one is huge I
don't know why this still works I'm just
amazed how many people have not
implemented or Microsoft directly has
not just disabled this by default like
GPIO or group policies haven't just
pushed like no macros Mac I'm not saying
macros aren't a thing in some Excel
documents I definitely see them still
being a thing and they shouldn't be but
I've never seen a legitimate word macro
I don't know they probably have a
purpose but not anymore like I've never
seen legitimate word macro you can
absolutely create a policy that just
says like that can't run in my org and
you can do it on an individual computer
or you can do it through group policy
that should not read you should not run
macros out of a Word document it makes
no sense like the way to break it down
to people what a macro is you're
essentially saying I would like this
script to run on my machine right so
let's put into actually English I would
like this malicious filed may be
malicious maybe not I want this file to
run on my machine not just view and
invoice let alone an invoice shouldn't
really be coming in a word file anyway
let alone have a macro and the brand-new
version of this that I just got like a
week ago this one so this one's pretty
hot right now and they're already
starting to skin them with the office
365 brand new ones or the 2019 version
that just came out the same colors same
fill they're gonna say things like these
compatibility mode and essentially what
they say is two things an able editing a
naval content take me out of my sandbox
run a script take me on a sandbox run a
script if you don't want that docx file
to run a script on a machine an able
content should be viewed the same as
like let's run this Exe well that makes
your hair stick I don't want our exe but
I do want to see the invoice that guy
said that's delinquent right yeah I'm
not as customer but I'm really curious
again these are all shown because they
work this works this is probably one
rampant right now there's probably
people doing it right now
hopefully nobody in this room but this
works you have these amazing things like
hey check your password and see if it's
a good password that's a terrible idea
by the way because especially on this
site right I don't know why the site
saying
however definitely had a user got
reported to me how to deal with this
this is a site they went to put in their
password I just want to see if it was
secure it might have been it's not
anymore
that passwords gone you gotta get rid of
that and then these things still work
this was a this was actually few months
bags probably april-ish these things
work you go to a site they have some
shady ad and the ad renders this thing
it takes over your whole screen right
and people are like I don't know I'm
just gonna click the blue things there
what was that talk this morning I you
know where to put you I and make you do
the right choices I don't know this one
I think by giving you two options both
terrible we're more likely to pick one
of them probably you really I guess
install flash flash is a good thing
insecurity world right let's put flash
in there and then these ones this I had
a helper friend with this he was an
elderly gentleman and he gave them money
right his screen got taken over and this
one's really hard to see but it's like
hey malicious pornographic spyware slash
risk where detected let's just cover all
the things it's either pornography or
spyware or risk where like you know
between that combination you'd in it
right and you need a cost immediately do
not do not ignore this and on mobile
phones on someone they will take over
the whole screen and people freaked out
like reboot it shut it down like you can
hit the back button right just hit the
back button and sometimes depending how
they coded it that back button will just
load it again it again but you just open
the app drawer and close it but people
will just like stop and worse call them
right Microsoft doesn't ever call you
they don't they don't call you like hey
I know you need support today right I've
not seen that I've got hey we got an
audit I've got that for Microsoft but I
don't get a call hey let's help you with
support today right but yet people pay
him this stuff works
any questions went on the fishing this
came around Facebook a while there's
been years ago but this was around like
this is so and so and I tweaked it and
was like quit sharing all this crap on
Facebook anyway who knew they'd be
sharing with everybody in the world
right all right we can I can chat with
anybody after is there any questions or
at the end of the talk to let's talk
about creds passwords so I put in there
just walk through the front door so a
lot of times on the engagement whatever
the client is I just take their domain
name and just check that domain name for
already known creds out there what are
the chances they've changed them
actually it's not bad most are changing
I'm I probably say 60 70 percent
probably changed it but it's something
like spring 2017 something
oh let's try summer fall write the note
so there there are you can absolutely go
get dumps of these breaches be care oh
where do you get probably how I've been
part I should know better I do a V I'm
supposed to repeat his question he asked
where can he check to know that if his
domain has been compromised right if
there's known creds out there probably
Troy hunts have I been poned is probably
your safest place to do that you just
put in your email address it validates
you own it and it will send it to you
the part I don't like about that is I
wish he would tell me what he has I said
he just says yes it was in there and it
was a part of this breach and but it
doesn't say they had your password and
had this and this is your password and
if you see this anywhere else you're
still screwed right you didn't go change
that I wish they would once you
validated you own that domain I wish it
would actually give you that data but
what he's doing is a great service
already and that dad is already out
there if you're more into more advanced
stuff you can absolutely go in get these
dumps the problem is is sometimes they
are other malicious files so you needed
to have really good sandboxing and a lot
of times getting on tour and get
validated on some form and you can get
access to a lot of this stuff it's
probably it's over 101 that's not 101
101 go - have I been poned comm putting
your email address and see if you've
been poned right
in fact this stack came from Troy hunts
site 500 million creds different creds
and of that I think he said 80% are
terrible right so these are creds so the
first thing you do is just go look at
that and see if we must log in right
hey you'll hope that username go check
LinkedIn all that guy's an IT guy
perfect
he's got privileged access right so the
password guidelines are kind of changing
I put this in here because people are
still pushing for this hard the every
rotated every 90 days and that
absolutely has purposes for like IT and
escalated people on people having
persistent access and if you're using
vault managers it can still work the
reality is most people just make even
worse passwords they use spring they use
fall they use summer they use quarter
one quarter two
corta 3 they use some variation they
just keep adding a 1 an exclamation
point you know to some extent until they
get past whatever role don't care one
exclamation point right so what they've
come out with NIST and all the other
guidelines are sensor saying of all the
studies of us telling people to rotate
their passwords it's actually been
counter it's been making passwords worse
and so they just changed it to this is
the new standard it's still being pushed
out through different things but most
have adopted it most compliant
frameworks and compliance are on this
but not in a dictionary so that's what
we just talked about it cannot be on a
known breach password if that your
password is already compromised
somewhere you put in a Russian portal
it's gone you can't use it again that
password is gone just assume it's gone
that's a token that tokens expired you
need a new token ok don't reuse them
services system your business shouldn't
take down your personal life your
personal life shouldn't take down your
business there are things and and some
people take this to the the umpteenth
degree and I would say just classify
your life right if you have a Yelp
account and you don't really care about
your Yelp account who cares about your
password to some extent right that can
be something that you maybe share with
something else however if you're like a
buddy of mine who is an avid Yelp person
who spends all their time there and has
like hundreds if not thousands of things
it's really important to him well maybe
you want a segment segment that write
your Netflix well they take over from it
they might increase your account they
might change something depending on your
effort how much you care about that
maybe that's a lower classification to
you and you don't care as much but my
banking my work email my personal email
the things that I reset passwords to
those are different they have to be
different there's no way one should take
down the other one you have to assume
that website like this is the best
example when I started in the
information security or way actually
before that I got I got this website was
breached I was restoring this old truck
called a it was for truck enthusiasts
calm I think it still exists
I was restored in this old truck and I
was posting photos to the world of how
amazing my truck was right and it got
breeze and I like took out my email took
out my binky and it took out and I was
it's like what right I didn't know any
better but for truck enthusiasts of your
life should not take down your banking
shouldn't take down your email shouldn't
take down your org though should be
broken out by service if you have
something critical some database
administrator password separate that
make you something unique vault manager
your friend will touch touch on that
length is the preferred it's harder for
cracking rigs right they don't say that
in the compliance thing but length is
prefer the longer your password the
harder it is for computation to crack it
in a hat to factor is your friend but
don't just rely on two-factor right the
company I own we also have developers
around deaf shops I we we take over a
lot of bad code and two factors not
always implemented properly if you're
like I can use whatever crappy password
I want like p @ s-- word one exclamation
point because i have to factor on I
think you should elevate that a little
bit right
you should Security's always layers it
shouldn't be assuming there's one thing
that stops everything right multiple
things to factor is your friend I
absolutely been on engagements where
we've got their complete credentials
through a portal through whatever other
means we log in and it sends them an
alert hey we're logging in and when a
valid a this is you and they're like new
right you get shut down and they know
you're doing it
two-factor is your friend put it on all
the important things in your life your
email your banking course switches
routers firewalls put on the things that
are important to factor is is actually
one of those like I'm not gonna say
silver bullet but it helps a lot of
things it really mitigates a lot of
things it's that extra layer of control
behind a user making a terrible decision
if you don't know a two-factor is
googling and multi-factor doesn't count
a lot of people like us to factor I put
a username password in and then another
password might you need something
separate that if you only have a key
logger on machine a you will also have
both of those things right vault
managers are your friends depending on
your level paranoia you can have
anything from an online one that sinks
everything for you to a local version
that if your hard drive crashes you lose
everything right somewhere in there is
probably safe regardless it's still
probably better than what you're doing
without you can get into some errant
toppings and stuff with password cards
and stuff and and get really crazy and
that guy's amazing it's all math and
entropy and wizards
but password vault managed your friend I
people always ask me what do you
recommend envelop managers the answer is
whoever looks at a security
vulnerability and mitigates it you can
never say a code will be perfect from
vulnerabilities but whoever's looking at
and mitigating it there's probably two
primary ones out there that you know of
the small ones that nobody looks at the
code it's like a wordpress plug and
that's just been hanging out there for
ten years
treat it skeptical okay moving on yeah
any questions on that yeah this just
happened like yesterday Cisco just
announced another hard cred password in
their program that's like the sixth one
this year I'd pretty sure which is just
crazy okay show Dan I bring this up and
I'm actually gonna tell the story
through somebody else there's this guy
his name is vist on Twitter he's great
he does a lot of things in show Dan I've
done a lot of things that showed in but
his stuff is like extra but this story
tells a perfectly new egg got breached
this whole magic art thing price of
their own and he essentially was telling
the story about how this is probably
worse than you think right so he posts
up there
Oh new egg got compromised let's have a
look oh yeah $5 says it's worse than you
think
and the reason I share that is because
the four screenshots he attaches is
better than any way I could teach how to
you shown it essentially he posts the
terminal output a showdown that just
says here's the ports that are open from
new egg right then in there there's a
prettier graphic interface that says
here's the ports that are open and
here's the services that have been
enumerated on said ports now he is not
ran a vulnerability scan against them he
is not even touched them he's literally
just logging in to show it in and showed
in if you don't know is essentially a
search engine for all the vulnerable
things on the Internet it's probably the
best way to describe it but in there
you're seeing some things and if more
security people might start seeing red
flags like RDP is open on their server
weird right to the world this is to the
world is not behind a VPN is to the
world okay so we already have a terminal
output of ports you already have a
graphical interface reports some
enumeration already so you know that
that wikiHow a little right but you
don't even you have to go through that
effort anymore no I just go to show Han
I look at that looks wide open
next it even will take screenshots of
the things shown and will try to hit a
service like RDP and take a screenshot
of it and just leave it in their portal
so you don't even have to hit their
server to know hey look we got a banner
here that says IT this is an IT
department server oh cool
that might be useful right invite you to
tell you exactly what server Edition
they're running and this is newer on
showdown which is pretty cool but it
actually will dump you the CVE for the
vulnerabilities that it was able to
numerate off that server so some of this
is pretty interesting kind of scary you
can check it yourself it's always good
to check yourself for that but if you're
getting hit just a client first thing
you do is just hit that a client on
boards wants to look at their security I
go put them in the show tin well what
does the rest of world already know
about you it's this you got some work to
do right alright let's briefly touch on
ransomware I mean I spent a ton of time
on it but yeah it's definitely been
aided by crypto coin it's definitely
made it a lot of it was these developers
are creating malware and that malware
would then have to get sold to somebody
to go implement or sometimes they would
do that piece direct and a lot of this
was around credit cards credit card
fraud was going nuts right you write the
shady malware
somebody would buy it or you would do it
you would find a way of vulnerability
put it on a system then you would
collect all the cards you'd have to send
it to Carter's Carter's would duplicate
it then people out there would buy them
and use them right it's this operation
go through a lot of steps and when
cryptic coin came out the same
vulnerabilities that they're putting
malware on a machine they're just like
spirit may not even care about your
credit cards anymore I'm just gonna put
ransomware on all your point-of-sale
systems and you're gonna pay me to get
it back and it cut out all the middlemen
Carter's are out all the other people
out developers getting paid direct it's
a win-win right crypto coin directly to
me hey everybody else is out and it's
just amazing that things like this you
know wanna cry are still wrecking
companies like do is aren't like two
days ago just took down somebody this is
just a known patch that hasn't been
patched and let alone like SMB v1 go
turn that off that shouldn't be in your
org no need for that pretty much ever
and if there is you need mitigation
control but
it's just amazing like these things are
just coming around wrecking orgs in some
of these one of these companies some
shipping carrier like estimated hundreds
and hundreds of millions of dollars to
recover from it that's wild that's wild
for something not patched or some
mitigation between it right and one you
know who's paid ransomware who hasn't
paid ransomware right Atlanta make some
news ransomware
Idaho makes news ransomware I think I
don't actually pay it as what I read
that was exciting and I'm not gonna sit
here and tell you to you you to never
pay around somewhere because like if you
got your grandma's pictures encrypted
and you had nothing else and that was
super important to you that might make
sense I would just advocate to put
something in place where you wouldn't
have to make that choice and what they
encrypt is everything we've had people
with their box accounts and Dropbox
accounts and Google drive's accounts
some of those have other mitigation
controls reversion history roll backs
more enterprise of things you pay the
more options you have but they
definitely will try to encrypt
everything you can write to there's a
reason you should reduce access to just
their jobs not because you don't trust
them it's because they can just encrypt
everything right just check in time here
crypto jacking yeah so this is
interesting so they're the rise of
crypto coin ballooning last year around
December going nuts ever made a lot of
money right everybody cashed out and
December hopefully most people didn't
most people last a lot of money right
but since then this is just this year
alone and what this graph shows you from
the back is the top 10 crypto currency
hacks of 2018 and of that 854 million
dollars which is astounding we're gonna
hit a billion dollars this year guys
installing crypto coin and what this is
to me I'm just gonna simplify it and
there's probably some crypto crypto coin
person who's just gonna go nuts on me
normally ever to just calls us crypto
but in the InfoSec world you gotta say
crypto coins people get mad but what
this says is this is another software
application or applications that exist
that keep getting forked of each other
with libraries
that are vulnerable to something and
these companies are suddenly worth
billions of dollars right either
exchanges or directly themselves the
icos
they're suddenly worth billions of
dollars and they don't have security
people or people who are looking at this
stuff and so criminals hackers are just
like this is literally like compromising
all this ransomware but I can just go
still in crypto coin and they can't even
track it so cryptic coins going nuts
people exploiting people I suspect we
will continue to hear in the news of
more i CEOs more wallets more blockchain
vulnerabilities that will come out why
because there's incentive to do so
it's not that there any more vulnerable
a lot of them moved faster than they
could structure for that didn't help but
yeah we're almost hitting a billion
dollars already by the end us here I
think we're hit a billion dollars we can
maybe have a cake party right billion
dollars because we're all hackers we
think with a hacker mindset billion ours
is a lot of money so if you ever touch
in the crypto world assume that stuff is
vulnerable to some extent such as every
other software application that exists
any questions off the cusp on any
cryptocurrency and that I wanted to
touch on that just cuz it is booming it
was like credit card wave ransomware for
a while and now we're in the crypto
currency just because it's easy it's
lower hanging fruit I don't think we
even go in and encrypt your system I can
just take your money just take your
money I don't have to do anything put in
mono flip it to Apple gift cards go on
ksl sell bunch of a MacBook Pros for
three grand right I do if we have to I
think we got a little bit of time I I've
shared this before but I think to make
you think like a hacker and teach you
I'm gonna walk through an actual
engagement right and the goal here is
we've now fished this person and got
them their creds we've got some access
of their box of whatever access they had
and that's relatively easier than it
sounds in a lot of scenarios and so you
have some goal set out you want to get
local admin on that machine and we'll
talk wide a second and then you want to
get system access on that machine and
some of these will vary depending on how
hardened or kind of posture they have
and obviously if it's a this is a
Windows environment but I'd say this is
a typical environment right
and a lot of cases the user that you get
access to is a local admin which is like
amazing for a criminal or somebody doing
something malicious on your machine so
with that local admin they can do
whatever they want in that box right and
local admin means if somebody sends like
hey go go download this file and you
download it and you can install that
file 99 percent of time your local admin
google chrome has some weird tricks it
doesn't temporary profile but for the
most part local admin is that you can
install something and you can defeat and
turn off pretty much every other control
that is put into place
by anybody else but with local admin you
want system and the reason you want
system is because with system you can
read in memory so in a typical place a
typical environment if you have local
admin on machine how hard is it to go
from local admin to the system access
any thoughts very easy very hard
complicated it depends we've had things
that have blocked this but it is if you
run this wonderful tool you know if
anybody's ever used Metasploit in here
it's worth downloading and playing with
probably get a VM of that getting Cali
but it is type git system type get
system hit enter escalate the system and
with system you can type things like and
it will show your password in like clear
text here you go there's your clear text
you can read memory with memory your
password is sitting there and clear text
so with that you have one machine and
you want to take down more of that organ
machine one access and if that was your
target goal you're done but a lot of
cases you want to go further you want to
get domain access you want the IT staff
you want to escalate that to people who
have more privileged than a reception
desk or a kiosk or something that's
sitting there right and so you just
started numerating that domain i've been
playing a lot with bloodhound females is
playing with it they just keep adding
more and more tools bloodhound is just
an enumeration tool you whatever box you
have access to you give it those access
and it just goes through and crawls
through the art and essentially will say
like hey you're one hop away from a
computer that
highly privileged users log into so
instead of trying to attack everything
in the organization you can go after a
very specific machine to know well if
the privileged persons on that machine
that means their creds are sitting in
memory on that machine right as we just
went through so you know a host you know
to get them in this scenario what we did
is we just took the credentials
this was like a PS attack tool you
essentially said with the credentials I
already have so I already have access to
one machine right with those credentials
what other machines in the org can I log
into already doing nothing else but just
my credentials they have and this is
again from a legitimate engagement but
it is sometimes surprisingly a lot that
same person who or kiosk or service out
there for some device that was installed
a lot of times can login to almost every
other machine in the organization well
if that's the case and it's really easy
right you just go get that computer that
bloodhound shows you that the privileged
person is on login to it with the creds
you already have dump the hash see their
passwords you have full domain access on
that system so in some scenarios oh yeah
yeah so once you grab that I do want to
show that one but yeah this is a clear
text password of once you run that this
is me me cats another hacking tool but
it will actually just dump your password
straight out password 99 exclamation
point three times per this one that I
was doing to show you that it can be
done and this is not to say it's always
that easy cuz sometimes it's definitely
not sometimes it's a pain and really
hard and takes a lot of effort but
sometimes it's actually even easier
there's some really oh this is a picture
of like a firewall I actually like
compromised right like I penetrated that
firewall that happened but sometimes it
is it is easy but sometimes sometimes
it's hard but sometimes it's even easier
there's a couple cool tools that are
just coming out or getting better I
guess I've been out for a little bit
they're getting better to the place
where they're pretty much automating
what I just walked you through and the
tool I know about I playing with they're
kind of cool angry puppy and desktop
and of course they have cool names right
that's ironing your puppy but
essentially you put in what you have and
they will go and automate enumerate jump
box-to-box get you the creds bring them
back here you go you've compromised this
whole domain right and sometimes it's
even easier right depending what
mitigation or lack of mitigations are in
place sometimes it's even worse security
is no longer about just protecting your
perimeter it is about defending it in
layers right it used to be we just put
up a perimeter
we don't care is on the inside we just
cares on the outside and that can work
but pretty much won't for most
businesses because we like things like
email and web browsing and we
intentionally want those to circumvent
our perimeter right if it wasn't for
those you could run a pretty secure
network for the most part you have
insider threat you some other things to
worry about but for the most part that
would be a pretty good network just a
good firewall firewalls are pretty legit
just put up a PF sense box put up
anything but if that Cisco box maybe not
that one but one like it put those up
and your perimeters good you have a good
perimeter but suddenly you let people
through you let users through we want
that through and security can no longer
just be perimeter it has to be layers
there has to be some group policies it
has to be mitigation some will touch on
that I got more it has to be these kind
of things right is getting rid of local
admin on users is not hard
I am I personally my laptop's I never
run his local admin on him why cuz
that's scary that is like root access in
that box I will create a separate
account run it as a limited user and
that's what I use I know the password I
will use it when I need it but if I go
to a page and it pops up and like hey
putting your ministry your passwords
that's a big problem but if you're
already an admin sometimes those just
run right so getting rid of local admin
is a big deal it's kind of hard to do in
some works it is achievable I've
absolutely been through orgs that have
achieved it it can work and it can work
really well but there is some pain there
to go through if you haven't done it yet
so get rid of local admin reduce the
access write ransomware if if Karl from
accounting only has access to a Karl
from accounting needs to do his job well
suddenly accounting doesn't take down
marketing doesn't take down
operations right Carl should only take
down what he can take down those files
that get ransomware it shouldn't be like
we had to pay out the ransomware
for the entire organization a hundreds
of millions of dollars it should be like
well Carl's counts are gone do we pay to
get Carl's counts back or can we restore
that somehow right reducing access is
important a lot of people are always
like they get offended when you take
away stuff oh I've been here for 20
years you can't take this away and it's
not that you're worried about them you
obviously trust them you hire them you
keep them there it's that what can their
computer do there on their behalf what's
happening on that computer when they're
not there right backups are very
important it's not a sexy topic but you
know do backups on-site off-site
revision control is your friend things
you can encrypt and shove up in the
cloud yourself also your friend to keep
other people from getting access to
those you can come to tinfoil hat talks
talk about that a different time
patching also not really sexing topic
but absolutely orgs get completely
wrecked by patching we just went through
walkthrough on Newegg I don't know if
that's been remediate or not it's out
there on the internet though showdown go
look at it go see what the world already
knows about your IP addresses sometimes
it's scary but patching fix a lot of
that stuff patching if you have a good
patch box even in a dirty Network you're
pretty good
that means they gotta like burn an O'Day
on you I'm not saying there's nobody in
this room that they would do that for
but most of people in this room nobody
would do that for right nobody's using a
vulnerability that nobody knows about
generally on you right patch your
systems mitigating controls there's a
bunch of other stuff in your anti
exploit kids things that are actually
kind of cool you know it's just simple
stuff right you hit an organ it's like
they have no SPF record installed on
their their domain which means that you
can fish from their domain as them and
they're none the wiser that's a simple
thing legitimately takes five minutes to
implement depending some words you get
really long like their ticketing comes
from this and this comes from this but
you can figure that out and implement
some like dkm signing there's some easy
stuff to do go get rid of crappy go get
rid of crappy apps flash Java do you
need them maybe you do if you do keep
them patched
if you don't well they're free they're
easy
just delete it see if you actually do
need it that is actually a method I've
done going to Nord just remove all a
Java off to all the systems you start
getting the calls hey can't log into the
HVAC system
hey I can't hit this okay I know that
computer needs it for this purpose
documented make sure that keeps patched
that one needs it for this document and
make sure it's patched right but we took
it off 900 machines and three needed it
I'd say that's worth it things like that
depending on your risk tolerance of boss
is yelling yet yet maybe implement that
slow or aggressive tough to you but
there's some simple ones a user training
is key I do think if you have controlled
user interfaces some of those talked
said this morning is important to like
give them alerts at the right times I
think during shutdown patching is a
great idea I love that idea
why isn't more things do that you and
I'm gonna close Excel it should patch me
then right not to start that makes a lot
of sense but most of us don't have
control for those things right we don't
we generally off control for that but we
do have control of some of our users and
I can absolutely tell you when you have
an engaging security awareness training
more people adhere to it more and more
people will come to you and be like hey
I saw that URL and I didn't like it
something something didn't feel right
because it was a resume but I'm not
hiring you're like yeah now you're
thinking right now you're thinking why
would somebody Sameer somehow I'm not
hiring right attachments backups and to
exploit when I first started doing
security awareness training I use this
one in every single one so if you ever
sat through my stuff you'll see this
again but I started doing this thing
called breach Plaza so this will tell
you kind of the time period when this
was happening and I did update it for
Home Depot I wasn't in the first one or
a target I had to go add those because
they were just big enough but it was
breach Plaza and I kept saying like hey
just keep your organization's how to
breach Plaza like what can you do and
grant it you will never be unhackable
you'll never be compromised but it
should be like a user email account got
compromised it shouldn't be your whole
domain is down and you got to pay
somebody money to get it back it
shouldn't be that kind of scenario some
mitigation in place the unfortunate
thing breach Plaza filled up really fast
like really fast when I first started it
was like I need another one I need
another one and then it was like gone
right and then I started feeling about
breach mom then breach mom was like gone
like it's just too much I can't maintain
this but that said breach mala is ever
expanding we really just want to keep
your or gotta breed
small right to a large extent you can
have a compromise of some some scenario
but it should be contained right you're
never gonna be perfect
sad but true as a hacker maybe that's to
your advantage right things like this
should be red flags as hackers right or
is walking in these are these is like
old-school wiretap that I found in a
building is just like straight up they
stripped the wires and legitimately
tapped into it right you would think the
world is on fire
great the more you sorry this thing
keeps slipping down the world would seem
like it's on fire
there seems like there's so much
negative so much bad out there and what
I would tell you is relax breathe air
ISM there is some sting there you will
feel some sting there is pain out there
in the world there are malicious people
who want to do you and your organization
harm that's truth it will be there
somebody will try to compromise you but
relax try to take some basic steps if
you walk out of here and your password
is password and you just want to update
that that's a win that's a win for
everybody right take a logical step you
might not suddenly be to a one password
card using a ball on your machine with
this proprietary rsync pushing it up to
some cloud service that you're
encrypting you might not get there
really fast maybe you'll never get there
but what you should do is take a logical
step to improve your posture maybe it's
just at the end of the day you shut down
all your emails and you patch your
machine that might be a win right maybe
it is you do take the time to reduce
your account to not be local admin I
think that'd be a big win
take a logical step I do want to share
this with you here's a legitimate 70
sites that you can go to and hack
against them validate that the list
still current but it is but you want to
get your hacking skills as a hacker of
all the things you just learned go run
some angry puppy and Deathstar in their
organization those are a little you want
to do is in a windows box somewhere but
this is legit as a backroom sec and you
can go and hit against this there's a
lot of really cool CTFs here at saint
con as well and you can do some of those
well there's some computers downstairs
in the village I have some hacking
competitions that are pretty entry level
go work on those and I'd say even if
you're just like I don't want to be
hacker I don't want to do any of those
things
it's still advantageous for you to do
that how do they do this why do they do
this what is the mindset behind it what
is this you know you get an executive to
go in like pop a windows box and
suddenly they're coming back and like we
gotta patch things and you're like yeah
you gotta patch things so there is some
advantage of sending people to do these
things to just understand that like
these things are possible right and but
be careful when you do hacking stuff you
get things like this like dry you know
digitalocean send you emails like you
know you go you go login and it's like
uh we don't really like you we're gonna
send you an email to tell you if we like
you right
and sometimes that emails like yeah
we're done taking your money right so
just be careful when you do some of your
hacking stuff that you know dude on
things you own do things that are legal
and you still might piss off your VPS
thank you
[Applause]
you