Marcus Lynn

← All posts

Post 12

BSidesNoVA Conference 2022 Recap

This weekend I attended my first cyber conference, BSidesNoVA 2022. Had a great time, learned way too much for 16 hours (over two days) and walked away wanting more. Here’s a recap of the workshop/talks I went to with some highlights and thoughts from each.

Personal Schedule:

  • Friday Workshop
    • Cyber Threat Intelligence 101 Workshop, Andy Piazza & John Stoner. 8 hr.
  • Saturday Conference
    • No More Shots in the Dark: How a global crisis should change how we think about data and operations, Jessie Jamieson. 30 min.
    • Honeypot Boo Boo: Better Breach Detection With Deception Inception, Justin Varner. 1 hr.
    • Preparing For a Breach in a SaaS Environment, Christian Galvan.1 hr.
    • If overly-permissive IAM is the norm, let’s not escalate it, Jay Chen. 30 min.
    • Into the Breach: An Analysis of State Political Party Account Exposure, Andrew Schoka. 30 min.

Cyber Threat Intelligence (CTI) 101 Workshop

Prior to this workshop I had never heard of CTI and yet after 8 hours I walked out with enough research points to keep me busy for the next month. Andy is that fucking good of a speaker. I’m disappointed I didn’t go to his Threat Hunting talk on Saturday, but I wanted to hear from others for my first conference. In no particular order here are some take away notes:

  • What is Cyber Threat Intel: Data which is collected and analyzed to give business units actionable information (or context) useful for their operations. Threat actor motives, techniques, targets, etc.
    • I got the impression only very mature cyber programs would even have a threat intel team, very DoD oriented but more and more private sector companies are finding value in it.
  • Foundational reading, further resources that I need to check out.
    • Mandiant APT1 report.
    • Psychology of Intelligence Analysis by Richards J. Heuer.
    • The Art of Cyberwarfare: An Investigator’s Guide to Espionage, Ransomware, And Organized Cybercrime by Jon DiMaggio.
    • Incident Response & Computer Forensics by Jason T. Luttgens, Matthew Pepe, and Kevin Mandia
    • Rob Joyce Defcon talks.
    • SANS CTI course.
    • + more :)
  • Threat Intelligence Lifecycle. -> CTI workflow in a nutshell.
    • Planning & Direction. -> What does the business need information on, what matters to us?
      • Strategizing, engaging with other cyber teams.
    • Collection & Visibility.
      • See: Collection Management Framework (CMF).
      • Use internal datasets! You are the only one in a position to use that inside feed for your business.
    • Process & Exploitation. -> SIEM, correlation, clean the data, etc.
    • Analysis & Production. -> Making sense of the data. Data =/= (actionable) Intel.
      • Enrich the information with outside sources.
    • Dissemination. ->Deliver the intel to stakeholders.
      • Just as data is useless by itself, intel is useless unless you present it in digestible way.
      • KISS. 5x5x5 rule!
      • Daily threat reports, flash reports, etc -> Stay on top of the executive minds. Put them at ease, provide value.
  • Structured Analytical Techniques. -> Honestly I didn’t really get this too much, techniques used during the analysis process?
  • Traffic Light Protocol. TLDR: Be trustworthy when people tell you confidential stuff, this is just a way to classify that so its clear to the reader.
  • Defanging IoCs -> There is an unofficial industry standard. Keep in mind of pre-caching so always do this.
    • 192[.]168[.]1[.]1
    • Hxxp / hxxps
    • klrgrz[@]gmail[.]com
    • www[.]badguy[.]net/shouldntdownloadthis[.]exe
  • Pyramid of Pain. -> Model of how much effort it takes for attackers to obfuscate/combat detection & analysis techniques. Actually makes a ton of sense when you see the model.
    • At the same time how easy it is for Defenders to use each level. The higher you go the more complex.
  • Terminology when estimating chances (risk of something happening). Very useful when communicating to executives. Each value is +/- some % of course. Its not exact lol.
    • Certainly - 100%
    • Almost Certain - 93%
    • Probably - 75%
    • Chances about even - 50%
    • Probably not 30%
    • Almost certainly not 7%
  • Confidence Assessments. Same deal as above, plain language when discussing with execs.
    • High level of confidence -> Almost certainly fact/will occur/we have evidence of XYZ.
    • Medium level of confidence -> Maybe some sources, real chance of happening/impacting.
    • Low level of confidence -> More speculation, not many sources.
  • Watch for logical fallacies when performing analysis. Bias is a bitch.
  • Attribution is a meme. Especially for private sector. Companies shouldn’t care exactly who’s hacking them… just that it’s happening. Don’t waste time and resources chasing something you have no control to do anything about.
  • Dark Web intel -> Just hire a vendor to do this. You aren’t big enough to do it.
  • DNS monitoring -> yes.
  • Domain spoof monitoring -> meh.
  • Email security -> should already have it in 2022. 365 sucks lol.
  • Threat box Modeling -> Threat actor assessment methodology.
    • Fantastic way to map out what threats your execs should worry about.
  • Writing reports. -> This is super important to get right.
    • Flash reports vs Analysis reports.
    • The perfect analysis report:
      • 5 pages or less. KNOW THE AUDIENCE.
      • Executive summary … short and to the point.
      • Why was the analysis performed. Use cases.
      • What methodology was used. Is it valid? Defend it.
    • Briefing stakeholders:
      • 5x5x5 rule. -> I love this.
        • 5 slides
        • 5 lines per slide.
        • 5 words per line.
      • Know the audience, know the material. Be clear on what you know and don’t know.
      • BLUFF statement.
  • Intrusion Analysis Modeling.
    • Kill Chain -> Great for discussing aspects of attacks with non-technical/leadership.
    • MITRE ATT&CK -> Very technical, use when communicating with other technical resources.
    • Diamond Model -> Apparently complex but can be useful.
      • Check out threatconnect “Luke in the sky with diamonds.” example
      • Cycle of the cyber threat intelligence SANS webcast.
  • Neat tools.
    • VirusTotal -> Hash checking between tons of AV engines. Enrichment details.
    • URLScan -> Website scanner for suspicious and malicious URLs.
    • RiskIQ & Shodan -> IP Lookup/Domain history stuff.
    • Domain Tools -> WHOIS info on what domain is what/who.
    • Censys.io -> Certificate inspection

Honestly I could write so much more. I have a short list of things to bring back to my org but thanks again to Andy for such an amazing course. CTI is pretty interesting and something I’ll keep my eye on to try out further.

Saturday Conference Talks

  • No More Shots in the Dark: How a global crisis should change how we think about data and operations.
    • This was an introduction to using data to drive decision making using Covid responses as an example.
    • Takeaways:
      • Garbage in garbage out holds true. Prior to performing an analysis make sure you have clean data.
      • Don’t train AI/ML models on junk and try to sell it.
  • Honeypot Boo Boo: Better Breach Detection With Deception Inception
    • I was curious to learn more about Thinkst Canary after hearing a few mentions about them on some cybersecurity podcasts I’ve listened to. The talk included reviewing Thinkst’s capabilities… Canaries & Tokens seem cool! Overall pretty good talk, I would have loved to hear more about real world breaches that got detected though!
    • Takeaways:
      • Thinkst has a straightforward pricing model.
      • Canaries can be deployed quickly, impersonate real infrastructure, and alert when an actor interacts with it unknowingly.
      • Tokens are a free alarming tool that you can deploy which alerts when interacted with. An example is a PDF stored on a file server which alerts when somebody opens it. Mini-honeypots that are flexible… and free for anyone!
  • Preparing For a Breach in a SaaS Environment
    • This talk was aimed at Cloud Native companies and addressing some of the fundamentals that should be done first.
    • Takeaways:
      • Assume SaaS/3rd parties will be breached at some point. Plan for this from the start.
      • Compliance =/= Security.
      • Know your assets, document document document. Know the attack surface.
      • Practice cloud IR
      • Communicate with stakeholders effectively, avoid technical jargon.
      • Focus specifically on the attack trends in your industry (CTI anyone?).
      • For AWS specifically check out CloudTrail & Security Hub.
  • If overly-permissive IAM is the norm, let’s not escalate it
    • Man I don’t even know where to start… Jay is super smart haha. In such a short window he very clearly conveyed his research, what his point was, and gave one solution to it. I do think that this could have been 45 minutes to an hour with a Q&A.
    • Jay’s main point was that too many permissions are delegated for what users actually need.
      • The cloud is setup in such a way so that customers can quickly roll out resources. A side effect of this is that the cloud providers have wide reaching cloud operator role templates that get applied to user accounts.
      • Often these templates have ~90% more permissions than needed. There are a total of 13 thousand total IAM permissions in AWS…. nobody can be an expert on them all.
      • He gave the exact numbers of his research, and introduced the Palo Alto tool IAM-Deescalate which attempts to combat this & prevents privilege escalation as a result of these over-privileged templates.
    • Takeaways:
      • Follow least privilege.
      • Be careful with CSP templates.
  • Into the Breach: An Analysis of State Political Party Account Exposure
    • This was a pretty fun talk, Andrew had a very straight forward premise which he presented clearly. He created a tool (github.com/andrew-vii/hookshot) which scrapes email addresses and checks those addresses against the HaveIBeenPwned API. While this isn’t a novel thing from a technical perspective the way he used it might be. He ran his tool against 50 Republican and 50 Democrat party websites at the state level and found that the entire industry below the Federal level seems to use (and advertise publicly) personal email addresses. Because these are personal email addresses he used his tool to check HaveIBeenPwded to see if those addresses were compromised. He then provided data surrounding credential reuse, the statistical uniformity of compromised accounts regardless of political party, and other interesting tidbits. Approximately 60% of personal email addresses listed on those party websites (in the form of contact information lists, phone numbers, etc) were classified as compromised (and at risk for abuse by a threat actor). This was my main challenge to his methodology, how he was classifying what constituted a compromised account. In short he labeled accounts compromised if there was a breach in the last 5 years with a password tag in the HaveIBeenPwded API. In my opinion this isn’t a very precise method of identifying at risk political addresses, but I admit it’s a good start. We had a great discussion on that and really enjoyed it.
    • Takeaways:
      • Political parties need to stop using personal email addresses (which many have reused credentials with other services) for work.
      • This is is not a party specific issue, everyone does it.
      • His study was only at the state level, further research could be done at the local level but given the trends already emergent it would be even worse given the lack of IT funding and expertise.
      • There isn’t an easy solution.

← All posts