Upload File

iot: exploring the threat surfaceintro the big idea securing the edge ... » elasticsearch. threat...

  • Home
  • Documents
  • IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting
39
IOT: EXPLORING THE THREAT SURFACE Jason Ortiz Sr. Integration Engineer

Upload: others

Post on 26-Jun-2020

9 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

IOT: EXPLORING THE THREAT SURFACE

Jason Ortiz

Sr. Integration Engineer

Page 2: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

CONTENTSINTRO

THE BIG IDEA SECURING THE EDGE SECURING THE REST

SECURING THE DATA

Page 3: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

01 | INTRODUCTION

Page 4: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

02 | THE BIG IDEA

Page 5: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

EVERYTHING I KNOW ABOUT IOT

THE BIG IDEA

Page 6: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

EVERYTHING I KNOW ABOUT IOT SECURITY

THE BIG IDEA

Page 7: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

QUESTIONS? THANK YOU.

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

Page 8: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

EVERYTHING I THINK SORT OF MAKES SENSE…

THE BIG IDEA

» IoT Ecosystem

» The Edge

» The Fog/Mist

» The Cloud

Page 9: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

WHAT IS THE BIG IDEA?

THE BIG IDEA

» Data

» Data

» Data

» Simple

https://carbuzz.com/news/general-motors-watches-you-listen-to-the-radio
https://www.pressherald.com/2018/10/02/alphabets-smart-city-idea-sparks-concerns-over-data-use-sharing-of-profits/
Page 10: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

03 | SECURING THE EDGE

Page 11: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

HARDWARE

THE EDGE

» Physical Ports

» uArt

» JTAG

Page 12: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

FIRMWARE

THE EDGE

» Vulnerabilities

» Conventional

» Stored keys?

» Memory dump keys?

» Updates … or NOT

Page 13: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

AUTHENTICATION

THE EDGE

» Sooooo many things!

» Based mostly in HTTP

Page 14: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

AUTHENTICATION

THE EDGE

» Elliptic Curve Crypto?

» Blockchain?

0

450

900

1350

1800

Bitcoin Ethereum PayPal VISA

Transactions / Second

https://blockchaindemo.io/
Page 15: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

PAYLOADS

THE EDGE

https://threatpost.com/threatlist-malware-samples-targeting-iot-more-than-double-in-2018/137528/
Page 16: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

04 | SECURING THE MIST, OR FOG, OR WHATEVER

Page 17: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

OK BUT REALLY

THE … WHATEVER

» The Edge

» The Fog

» The Mist

» The Cloud

https://medium.com/@YogeshMalik/fog-computing-edge-computing-mist-computing-cloud-computing-fluid-computing-ed965617d8f3
Page 18: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

COMPONENTS

THE … WHATEVER

» Networking

» Messaging

» Ecosystems

» Data

Page 19: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

NETWORKING

THE … WHATEVER

» Which part?

» User -> Stand Alone Device?

» User -> Cloud Connected Device?

» User -> Hub?

» Device -> Hub?

» Hub -> Cloud?

» User -> Cloud?

» Device -> Device?

» Device -> Cloud?

Page 20: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

DNS REBINDING

THE … WHATEVER

» Same Origin Policy

» bad.js

» CVEs? You bet

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11315)
http://rebind.network/safe/index.html
Page 21: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

DNS REBINDING

THE … WHATEVER

» Vulns Everywhere!

https://www.armis.com/dns-rebinding-exposes-half-a-billion-iot-devices-in-the-enterprise/
Page 22: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

SECURE NETWORKING?

THE … WHATEVER

» Heavy Use of HTTPS

» Authentication?

» FIDO Alliance

Page 23: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

QUEUES

THE … WHATEVER

» RabbitMQ

» Complex setup

» Basic security

» nats.io

» Auth

» TLS

https://www.rabbitmq.com/ssl.html
http://nats.io
Page 24: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

MQTT

THE … WHATEVER

Page 25: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

MQTT

THE … WHATEVER

» Anything interesting on a public broker?

» SHODAN

» C2 through MQTT

Page 26: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

SECURING MQTT

THE … WHATEVER

» Enterprise Solution (HiveMQ)

» 3rd party broker

Page 27: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

NODERED

THE … WHATEVER

Page 28: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

NODERED

THE … WHATEVER

» Security?

» Anything live?

» API!

https://nodered.org/docs/api/admin/methods/
Page 29: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

SECURING NODERED

THE … WHATEVER

» Authentication

» Secure Comms

Page 30: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

WEB INTERFACES

THE … WHATEVER

» Basic Vulnerabilities

» Custom HTTP servers … but why?

Page 31: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

Databases

THE … WHATEVER

» Mongo

» Postgres

pg_hba.conf

https://docs.mongodb.com/manual/administration/security-checklist/
Page 32: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

INDICES

THE … WHATEVER

» ElasticSearch

https://www.elastic.co/products/stack/security
Page 33: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

05 | SECURING THE DATA

Page 34: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

SECURING THE DATA

THE DATA

» Make No Mistake … I mean PRIVACY

» Is perimeter security dead?

Page 35: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

SECURING THE DATA

THE DATA

» CamerasUnited States

Japan

Italy

France

UK

0 1500 3000 4500 6000

Page 36: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

SECURING THE DATA

THE DATA

» Cars and Cities?

https://carbuzz.com/news/general-motors-watches-you-listen-to-the-radio
https://www.pressherald.com/2018/10/02/alphabets-smart-city-idea-sparks-concerns-over-data-use-sharing-of-profits/
Page 37: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

SECURING THE DATA

THE DATA

» Wearable Medical Devices

“Frankly, I don’t give a damn if someone wants to change their heart rate data.”

Page 38: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING

SECURING THE DATA

THE DATA

» ?

https://www.soccer.com/guide/soccer-com-dissects-the-adidas-smart-ball
Page 39: IOT: EXPLORING THE THREAT SURFACEintro the big idea securing the edge ... » elasticsearch. threat hunting and response | security consulting 05 | securing the data. threat hunting

QUESTIONS? THANK YOU.

THREAT HUNTING AND RESPONSE | SECURITY CONSULTING


Threat hunting as SOC process

Your Practical Guide to 1 – Setting up your threat hunting program Hunt Evil: Your Practical Guide to Threat Hunting 5 3 Common Myths About Hunting Hunting is not a reactive activity

Endgame SANS - Threat Hunting Before the Incident

2020 THREAT HUNTING REPORT - ExtraHop

Workshop threat-hunting

THREAT HUNTING- IOCs VS TTPs- Happiest Minds

Threat Hunting in Windows – Are You Hunting or Being Hunted?

The Elastic Guide to Threat Hunting - copyright

Threat Hunting - csirt.jabarprov.go.id

ACKNOWLEDGING THE THREAT: SECURING UNITED STATES PIPELINE ... · ACKNOWLEDGING THE THREAT: SECURING UNITED STATES PIPELINE SCADA SYSTEMS Synopsis: The threat of large-scale cyber

Towards a Threat Hunting Automation Maturity Model

Building a Successful Threat Hunting Program

Threat hunting with MITRE ATT&CK

TTPs for Threat Hunting in Refineries · TTPs for Threat Hunting in Refineries Dan Gunter | Twitter: @dan_gunter Principal Threat Analyst @ Dragos October 2018. ... •Not Red Teaming

SACON - Threat hunting (Chandra Prakash)

Threat Hunting with Splunk

(CMC THREAT HUNTING SERVICE)

Examples and Goals of Threat Hunting - USALearning · Examples and Goals of Threat Hunting. ... //. ... and they need to answer questions

Industrial Control System Cyber Threat Hunting

Threat Hunting workshop

“Threat Hunting in Active Directory Environment”

Cyber Threat Hunting with Phirelight

Threat Hunting with Qualys€¦ · Threat Hunting with Qualys: Going Beyond Your EDR Solutions. Adversary Threat Tactics are Changing Early 2010s Zero ... Rapidly weaponizing newly-disclosed

DEMYSTIFYING THREAT HUNTING · 2021. 1. 26. · We wanted to clear up the confusion. Demystifying Threat Hunting will explain: • What threat hunting is – and what it isn’t

Threat Hunting

Threat Hunting with ELK training - Intellectual Point

ATT&CKing The Command Line & Hunting For More...Threat Hunting Automation Motivation Current Reality Threat hunting used to detect activity we are currently missing. As defenders,

Proactive Threat Hunting Combining the use of …Proactive Threat Hunting Combining the use of threat intelligence, analytics and automated security tools with human smarts Benefits

GUIDE TO CYBER THREAT HUNTING - Tyler Technologies

Total Threat Protection Securing All Your Threat Vectors Hartford Tech Summit

Enabling Efficient Cyber Threat Hunting with Cyber Threat

Threat Hunting with Splunk Hands-on

2019 THREAT HUNTING REPORT - DomainTools · threats (58%), improving speed and accuracy of threat response (53%) and reducing the number of breaches (52%). THREAT HUNTING GOALS What

Threat Hunting Report can be viewed here - News · THREAT HUNTING REPORT 3. THRET HNTING REPORT 4 KEY SURVEY FINDINGS ... Among the respondents to the threat hunting survey, six in

Enabling a Threat Hunting Capability in AWS