Slide 1: How we breach network infrastructures and how to protect them
How we breach network infrastructures and how to protect them Bernardo Damele, NCC Group
Slide 2: About NCC Group
About NCC Group Eighth successive year of double digit growth We protect 15,000 clients worldwide We monitor over 16 million web pages every week World’s largest penetration testing team May 7, 2014 @ Daisy Wired? © NCC Group 2
Slide 3: Agenda
Agenda • What is security? • How we assess and breach networks • Common mistakes • Overlooked areas • Network design mistakes • Defective assumptions • Weakest entry points of a network perimeter • Leverage access to the network and why • How to protect networks May 7, 2014 @ Daisy Wired? © NCC Grou
Slide 4: What is security?
What is security? “Security is a degree of resistance to, or protection from a threat.” Security provides “A form of protection where a separation is created between the assets and the threat." May 7, 2014 @ Daisy Wired? © NCC Group 4
Slide 5: Key facets of successful security
Key facets of successful security • Processes and procedures • What is expected within the business • People • Who are trained • Who have a sense of risk ownership • Who don’t feel afraid to report • Technology • Helps people • Technology on its own cannot solve cyber security May 7, 2014 @ Daisy Wi
Slide 6: Who are their targets and why?
Who are their targets and why? • Casual • Target: Anything • Criminals / Employees • Target: SME On-Line Banking • Target: Extortion (e.g. CryptoLocker) • State Sponsored • Very targeted attack • Target: IP • Target: System (disruption) May 7, 2014 @ Daisy Wired? © NCC Group 6
Slide 7: How we assess networks
How we assess networks Lifecycle of an infrastructure security assessment • Discovery – scan the network to establish live hosts, their open ports and services exposed • Vulnerability assessment – establish where security issues exist from an unauthenticated standpoint and investigate potential entr
Slide 8: Exploitation and post exploitation
Exploitation and post exploitation Why is it important to exploit vulnerabilities? To evaluate their risk and impact in the context of the network under assessment and produce a high-value report to the client May 7, 2014 @ Daisy Wired? © NCC Group 8
Slide 9: External versus internal assessment
External versus internal assessment External infrastructure assessment is carried out beyond the network perimeter of the client • Focused on services exposed to the Internet across an IP range defined by the client Internal infrastructure assessment is carried out at the client’s site, with a direc
Slide 10: How we breach networks
How we breach networks • Lack of security patches • Default credentials • Excessive network footprint • Lack or weak network segregation • Exceptions • White-listing preferred over black-listing • More May 7, 2014 @ Daisy Wired? © NCC Group 10
Slide 11: How we breach networks
How we breach networks • Lack of security patches • Default credentials • Excessive network footprint • Lack or weak network segregation • Exceptions • White-listing preferred over black-listing • More May 7, 2014 @ Daisy Wired? © NCC Group 11
Slide 12: Lack of security patches
Lack of security patches • Missing patches are easy entry points for attackers • For a large number of critical publicly known vulnerabilities there are reliable exploits • In a typical Windows network changes are high that one workstation will not be patched • Till • Smart card reader • Camera • Em
Slide 13: Lack of security patches – scenario
Lack of security patches – scenario • Office-based network • Windows powered • No centralized solution (e.g. WSUS) to deploy Microsoft patched onto the workstations • Different patching levels • Largely outdated machines – vulnerable to reliable exploits • Local System is an easy win • Leverage foot
Slide 14: How we breach networks
How we breach networks • Lack of security patches • Default credentials • Excessive network footprint • Lack or weak network segregation • Exceptions • White-listing preferred over black-listing • More May 7, 2014 @ Daisy Wired? © NCC Group 14
Slide 15: Default credentials
Default credentials • It is a fact that device under test are kept with default credentials • Application servers and management interfaces too • Wordlists of default credentials for all these are easily available • Tools to carry on login brute-force attacks exist • When they do not, they are easy
Slide 16: Default credentials – scenario
Default credentials – scenario • DMZ environment • UNIX / Linux powered • Exploitation of memory corruption vulnerabilities is not an option • DoS condition avoidance is mandated • Apache Tomcat runs with default credentials admin / tomcat • Used to deploy a custom WAR to achieve command execution •
Slide 17: How we breach networks
How we breach networks • Lack of security patches • Default credentials • Excessive network footprint • Lack or weak network segregation • Exceptions • White-listing preferred over black-listing • More May 7, 2014 @ Daisy Wired? © NCC Group 17
Slide 18: Excessive network footprint
Excessive network footprint • Unnecessary services are often exposed internally to the network perimeter • Effort to maintain large heterogeneous networks leave room for oversight in network footprint • Services that run on localhost may prove helpful to compromise further the network – post exploit
Slide 19: Excessive network footprint – scenario
Excessive network footprint – scenario • Despite SSH in use, R*Services are still used for management purposes • Easy to brute-force ACL for R*Services remotely • Or… NIS used to manage users centrally on a UNIX / Linux network • Can be queried anonymously to retrieve users’ password hashes • Cracke
Slide 20: How we breach networks
How we breach networks • Lack of security patches • Default credentials • Excessive network footprint • Lack or weak network segregation • Exceptions • White-listing preferred over black-listing • More May 7, 2014 @ Daisy Wired? © NCC Group 20
Slide 21: Lack or weak network segregation
Lack or weak network segregation • Network segregation by mere DHCP netmask restriction is ineffective • Segregating at the application layer is defective • Leaves room to exfiltration / tunnelling attacks • MAC filtering is ineffective • NAC solutions do not always guarantee network segregation / a
Slide 22: Lack or weak network segregation – scenario
Lack or weak network segregation – scenario • Two distinct Windows domains: CORP and GUEST • Not part of the same Windows forest • No direct access between the two networks • They’re physically hosted in two separate buildings, different physical devices, no apparent interconnections • Users of the
Slide 23: How we breach networks
How we breach networks • Lack of security patches • Default credentials • Excessive network footprint • Lack or weak network segregation • Exceptions • White-listing preferred over black-listing • More May 7, 2014 @ Daisy Wired? © NCC Group 23
Slide 24: Exceptions
Exceptions • Temporary firewall rules turn permanent • Network configurations are usually complex, undocumented and hard to maintain, hence exceptions are added and rules overwrite / duplicate one another • Exceptions and defective regular expressions may lead to more harm than good May 7, 2014 @ Da
Slide 25: Exceptions – scenario
Exceptions – scenario • Web management interface • Backed by JBoss Application Server • Configured manually to prompt user for credentials at any unauthenticated GET and POST request • HTTP Verb Tampering • Intercept the login request and replace POST with HEAD • Get a valid session ID tied to a hig
Slide 26: How we breach networks
How we breach networks • Lack of security patches • Default credentials • Excessive network footprint • Lack or weak network segregation • Exceptions • White-listing preferred over black-listing • More May 7, 2014 @ Daisy Wired? © NCC Group 26
Slide 27: White-listing over black-listing
White-listing over black-listing • Black-list (“reject known bad”) • Reject data matching a list of known attack strings or patterns • Accept everything else • Can hinder simple attacks and automated attack tools • Highly vulnerable to bypasses using encoding and other techniques • White-list (“acce
Slide 28: Prioritise avenues of attack
Prioritise avenues of attack • Abuse of intended functionality • Example: download of files from an anonymous FTP server • Extended use of functionality • Example: using xp_cmdshell extended stored procedure on a Microsoft SQL Server • Mature, public exploit • Example: exploit for MS08-067 vulnerabi
Slide 29: Move sideways
Move sideways • Once a foothold onto the target network is gained, next step is to retain access • Create an admin user, deploy a backdoor, etc. • Leverage access to inspect the file system, query the DC, sniff traffic • Move sideways • Password reuse for local OS users is a very bad practice • Once
Slide 30: Controls
Controls “Security controls are safeguards or countermeasures to avoid, counteract or minimize security risks relating to personal property, or any company property.” May 7, 2014 @ Daisy Wired? © NCC Group 30
Slide 31: Controls
Controls Preventative • Attempt to stop an event from occurring Detective • Identify and alert when the event occurs Corrective • Remediate after the event has occurred May 7, 2014 @ Daisy Wired? © NCC Group 31
Slide 32: Controls
Controls Physical • Fences, locks Procedural • Policies, standards and processes Technical • Firewalls, anti-virus, encryption Legal and Regulatory • Jurisdictional law, PCI-DSS May 7, 2014 @ Daisy Wired? © NCC Group 32
Slide 33: Controls
Controls Cyber Streetwise • www.cyberstreetwise.com CPNI Top 20 Controls – based on SANS • www.cpni.gov.uk/advice/cyber/Critical-controls/ • http://www.cpni.gov.uk/documents/publications/2014/2014-04-11-critical- security-controls.pdf May 7, 2014 @ Daisy Wired? © NCC Group 33
Slide 34: Top 20 Controls
Top 20 Controls • Critical Control 5: Malware Defenses • Microsoft Security Essentials • Commercial solutions • Critical Control 6: Application Software Security • OWASP Top 10 – www.owasp.org • SANS Top 25 Most Dangerous Programming Errors – www.sans.org • Security Development Life Cycle (SDLC) • O
Slide 35: Top 20 Controls
Top 20 Controls • Critical Control 7: Wireless Device Control • Ensure you are using WPA2-CCMP or better 802.1x EAP-TLS • Disable WEP • Disable WPS • Critical Control 8: Data Recovery Capability • Test your restore functionality • Critical Control 9: Security Skills Assessment and Appropriate Traini
Slide 36: Top 20 Controls
Top 20 Controls • Critical Control 11: Limitation and Control of Network Ports, Protocols, and Services • Disable unused services • Limit access to services • Web proxy • Network traffic filtering • Critical Control 13: Boundary Defense • Ingress filtering • Egress filtering May 7, 2014 @ Daisy Wire
Slide 37: Top 20 Controls
Top 20 Controls • Critical Control 12: Controlled Use of Administrative Privileges • Limit service account privileges • Limit admin users • Admin users use separate account • Critical Control 19: Secure Network Engineering • Segmentation • Segregation • Critical Control 20: Penetration Tests and Red
Slide 38: If you do 7 things right…
If you do 7 things right… 1. Transparent security principle 2. Teach staff about phishing 3. Force strong password policy 4. Get rid of Windows XP, Office 2000-2007 and Internet Explorer 6-8 5. Update third-party software (Adobe, Java if needed, Firefox) 6. Use up-to-date anti-virus 7. Test your dis
Slide 39: Longer term strategies
Longer term strategies • Perform risk assessments • Implement a level of the 20 CSC • Harden devices • Segregate your network • Limit and control administrative privileges • Limit and control network services • Encrypt your USB sticks / laptops • Create an IR plan May 7, 2014 @ Daisy Wired? © NCC Gr
Slide 40: Always remember
Always remember • Don’t buy product vendor hype • Cyber security is not about products • Cyber security doesn’t have to be costly • An incident will likely happen so have a plan May 7, 2014 @ Daisy Wired? © NCC Group 40
Slide 41: Resources
Resources • www.nccgroup.com • www.cpni.gov.uk • www.cyberstreetwise.com • www.sans.org • www.cisecurity.org • www.owasp.org May 7, 2014 @ Daisy Wired? © NCC Group 41
Slide 42: Thank you! Questions?
Thank you! Questions? UK Offices North American Offices Australian Offices Manchester - Head Office San Francisco Sydney Cheltenham New York Edinburgh Seattle Leatherhead Chicago London Austin Milton Keynes Atlanta European Offices Contact us Amsterdam – Netherlands Copenhagen – Denmark training@nccg