Pleaseviewmylinked-inpage(underSeemore)togetacopyofthispresenta<on.Ican’tpostthenamescompaniesIworkdoconsul<ngformuchofthe<me;becausetheyaretryingtoshoreuptheirsystemsbeforebadthingshappen.Ifyouhaveanyques<ons,pleasecontactmeviaemail.Thanks,Ty

1SCALE15x(c)2017TyShipman

EverybodyshouldbeaPENtester

Pleaseholdques<onstotheend.ThisaLIGHTINGtalkwithlotsofinfo.Slideswillbepostedbytheconferenceteam,orlookonmylinked-inprofile(under“Seemore…”)foralinktodownload.Doyouknowhowwellyouareprotec<ngyoursystems,canyouproveit? Canyouthinklikeahacker?ThistalkisaresultofalessonIlearnedaXertakingaPENtesttrainingclassoneweekend.MoretrainingandworkaXerthatwasrequiredtobecomeamoderatelysuccessfulPENtester.Idon’tdoPENtes<ngforalivingyet;IjustusemyinadequateskillstoscaremyclientsintohiringgreatPENtestersandadop<ngsomeofthesolu<onsIsuggestaXerIauditthem.1)  IcontendthatifyoudonoknowthebasicsofPENtes<ng(a[ack),youcannot

adequatelyprotect(defend)yourenvironment.Nordoyouunderstandwhyyouaredoingsomeofthetasksyouaredoingtodaytotrytoprotectyourenvironment.

2)  MostpeopleinthisroomorreadingtheseslideseitherITorDevOpsprofessionals.Youarewearingmanyhats;youroverworked,andmaybeevenbeunderpaid.ButifyoucannotPENtestyourhostsandapplica<onsatabasiclevel;thusaler<ngyourteamoryourselftothevulnerabili<esthatascriptkiddymayfindyouarenotdoinganadequatejob.

3)  Mypresenta<onwilllayoutanargumentthatIhopewillcauseyoutogoandseekaweekendsworth(ormore)ofPENtesteduca<on.Why,youareaprofessionalandneedtokeepyouskillscurrent,soaddanewbolttoyourquiverandmaybeevengetaraise.WhoknowsyoumightevenjumptoPENtes<ngasyournextcareer.

2SCALE15x(c)2017TyShipman

EverybodyshouldbeaPENtester

TheplanbothhackersandPENtestersisroughlythesame.Bothwanttogetinandreachtheirdesiredgoal.ThePENtester’sgoalistoprovetheywereonyoursystem(screendumpofroot/Adminlogin);hackerswant…–youmaketheguess.Iwillsaythis--ifadedicatedhackerteam(organizedcrime,na<onstate)wantsin,theywillfindaway.Youwanttomakeithardersoyoudon’tendupavic<mofasmashandgrabhack;e.g.addbartothewindowsanddoors,outsidelights,aroamingsecurityguard,dogs,aminefield,….•Reconnaissanceoftarget

nmap,studyAPI,applica<ons,VULScanOldOS/soXware,vulnerableconfigura<ononswitchesandsoXware--findweakness

•Exploita<onofvulnerability

Applyoneoftheknownexploits(Metasploitmodule),ordevelopanewone•Escalate

Gettoroot/adminaccountsotheyownmachine•MoveLaterally(expandaccess)

Godeeperintoenvironment•Repeatun<l…Desiredgoalreach

3SCALE15x(c)2017TyShipman

EverybodyshouldbeaPENtester

Iamgoingtomakealotofassump<onshere,notallofthemwillbecorrect,butsomewillbe.Ifanyoneoftheseistrue,thenyoulikelyhavevulnerabili<esinyourenvironmentthatcanbeexploited.Youdon’tworkfora250+personcompanyandlikelydon’thaveadedicatedsecurityperson/teamtohelpyouprotectyourenvironment.YouhaveneverhadaPENtestercomeinandtrytobreakintoyoursystems.LikemostIT/Network/DevOpspeopleyouhavetolearnnewskillsallthe<meandmostsolu<onsaretakingsnippetsofcode/configura<on/knowledgefromGoogleresultsandapplyingthem–soyoumightnothaveafullpictureoftheissuesathandwhenitcomestosecurity.Youdon’tconfigureyoursystems,applica<onstacksusinganystandards.Didyouknowtherearegoodsecurity/hardeningstandardsforWindowsServers,Apache,andLinux/Unixavailable?LookupCIShardeningstandards.Youoryourmanagementthinkyourfirewallwillkeepthebadguysout.YouneedtoaddIDS,AVSsystembasedonbehavior,FIMandlogmanagement,monitoringandaler<ngsystems.YouoryourmanagementthinkyourIDSwillhelpyoustophackers–itonlyalertyoumostofthe<me.Youdon’taggressivelypatchyoursystemsandapplica<onstacks.

Whenwasthelast+meyourestartedallyourLinux2.xor3.xkernelsystems?AreyouonLinuxKernel4.0orhavealivepatchinginstalled?

4SCALE15x(c)2017TyShipman

EverybodyshouldbeaPENtester

1).Oldsystemscanbeownedbybadactorsinminutes,youlearnhowtoownahostintheAMpartofabasicPENtes<ngclass.Anyonehaveanoldcardkeymanagementsystemaround?Howaboutthefrontdesksecurityguardsta<onhost?2).Failuretoinstallcri<calsecuritypatchesislikeleavingawindowopenwhenyouhavebarsonthefrontdoor.Onceavulnerabilityisannounced,thereisusuallyanexploitavailablewithin2-3weeksontheDarkWeb.Theearlyversionscostseveralhundreddollars,latertheygodowntothe10s.Ihaveheardsta<csthatsayyoucanrentaBotnetsfor$1000-2000thatyoucanscantheInternetinlessthan24hoursforasinglevulnerability.3).BruteforcingpasswordsonhostsandVPNarenowanorm.DoyoulockoutaXer6a[empts?4).NMAPALLyourexternalIPaddress,findoutwhatisopen.RunningonAWS,GoogleorAsure–reviewsecurityrules.5/6).SCALE15XsitereceivedanA,mymedicalhistorysitereceivedaCbeforeIreportedissue,nowA-.7/8)..DTP–DynamicTruckingProtocol–abadactorcanskiparoundyourVLANSifnotlockeddown.Seeh[ps://digi.ninja/blog/abusing_dtp.phpformoreinfo.

Lastly,ifyoucandoit,setswitchestoacceptonly1MACaddress(Lookup‘S+ckyMAC’or‘port-securitymac-address’)–becarefulhere.

5SCALE15x(c)2017TyShipman

EverybodyshouldbeaPENtester

BothKaliandMetasploithavecommunityversionsthatarefreetouse,theyaremaintainedbysecuritycompaniesthatspecializeinoffensivePENtes<ng.ncènetcatMetasploitisagreatpackage.Ithassomanyofthebasicexploits(exploitsarehowtoabuseavulnerability,theyinclude0-day,remotea[acks,shellcodehacks).YouneedtodoPENtes<ngthatitisusedbymanyscriptkiddiestobreakintosystemallovertheplace.Learningthebasicstakesafewhours,toreallygetagoodgrasponthesystemyouneedabout30hours.

Vendor VUL

MicrosoX 4700+Oracle 4100+Apple 3600+PHP 550+Google 2300+

6SCALE15x(c)2017TyShipman

EverybodyshouldbeaPENtester

NowthatIhavescared,letmetellyouwhereyoucangetsomeskillstobecomeaPENtestertohelpyouplugtheleaksinyourenvironment.IfyouarenotintheSouthernCaliforniaarea,IsuggestyoulookonlinefortrainingbylocalOWASP,IEEE,ISSAandACMchapters.BeyondthelinkslistedaboveyoushouldsubscribetotheNVDlistthatsendoutweeklyandzerodayalerts:h[ps://nvd.nist.gov/

7SCALE15x(c)2017TyShipman

EverybodyshouldbeaPENtester