puppetconf 2016: how you actually get hacked – ben hughes, etsy

How You Actually Get Hacked

1 — @benjammingh for PuppetConf 2016

https://www.twitter.com/benjammingh

https://puppetconf.com/

AKA Do you want ants?Because that's how you get ants!




Who's this clown? 2

→ Infrastructure security at Etsy.→ Puppet Labs Operations alumni.

→ First used Puppet on the 0.26 branch.→ Has only been in big trouble with the phone

company once.

2 https://twitter.com/skullmandible/status/4112818511315230723 — @benjammingh for PuppetConf 2016

https://www.etsy.com/

https://puppetlabs.com/

https://twitter.com/skullmandible/status/411281851131523072



What this talk is about?→ Risk and threat modelling.

→ Reality, and infosec's aversion to it.→ What to actually focus on, to be more secure, but

less hipster.→ Security myopia and the best being the enemy of

the good.




What this talk is not about?→ Mad 0day. Go to Infiltrate

→ Vendor Sponsorship. (Note however, it is Black Friday soon www.etsy.com)

→ Me reading out breach reports.→ Nessus.


http://infiltratecon.com/




Mild audience participation

warning!6 — @benjammingh for PuppetConf 2016



Google Syndrome Disclaimer!If you are Google/Facebook/BAE Systems/Raytheon/

Any part of Five Eyes/OPM, this hopefully and somewhat obviously does not apply to you.

Also stop listening to funny haired people who work at yarn websites for your security advice!

Smash the 1%, eat the rich!




Threat modelling

The who now?




H1B fashion model visa.




Working out who might attack you and how




Evaluating risks and reality

(and impact)




Are humans good at evaluating risk?




Have you ever said:"Have a safe flight!"




Has anyone ever said:"Have a safe drive to the

airport!"14 — @benjammingh for PuppetConf 2016



Flying:→ An entire spare pilot.→ Computer controlled.→ A spare engine!

→ 100s of hours training/qualifications.→ regular safety checks.




Taxis→ ....

→ have the strange smelling pine tree thing?




Every statistic says flying is 100x safer




Securitywhat is it?




"The state or condition of being or feeling secure."-- The Oxford English Dictionary (as HRH Queen

Elizabeth the Second decrees)




"Being or feeling secure"




Secure [from whom?]




Who are you defending against?→ Scripts (mass own wordpress, nmap/zmap looking

for mongodb/mssql/etc)→ Script kiddies (the above, but with a tutorial)

→ Bug Bounties (hand wave 80% of attacks on your website?)

→ Red Teams/Pen tests (every... 6 months? maybe?)




Other attackers?→ China!!!111 (though now Russia is in vogue)

→ Hackers in it for the lols (needs no explaination)→ Hacktivists (I remain unconvinced these are real

→ Hacking for profit (not for fun. See China)


https://www.youtube.com/watch?v=oLmYbaRg1Ag



The main ones, ZOMG.→ NSA.

→ now and then the FBI→ everyone forgets about CSE (and all of Five Eyes)

→ GCHQ (who seem to have fewer morals..)




"How to NSA-Proof your Apple iCloud account. – Underground Network"

"Blackphone 2: 'NSA Proof' Android Phone For Privacy Seekers Now Available For Preorder"

"NSA-proof your e-mail in 2 hours""How NSA-Proof Are VPN Service Providers?"


https://underground.net/how-to-nsa-proof-your-apple-icloud-account/

https://underground.net/how-to-nsa-proof-your-apple-icloud-account/

http://www.ibtimes.com/blackphone-2-nsa-proof-android-phone-privacy-seekers-now-available-preorder-2060768

http://www.ibtimes.com/blackphone-2-nsa-proof-android-phone-privacy-seekers-now-available-preorder-2060768

http://sealedabstract.com/code/nsa-proof-your-e-mail-in-2-hours/

https://torrentfreak.com/how-nsa-proof-are-vpn-providers-131023/



"An NSA-proof operating system. Yes, for real.""NSA-proof passwords"

"NSA-proof SSH""Physicists are building an NSA-proof internet"


http://www.dailykos.com/story/2013/07/13/1222957/-An-NSA-proof-operating-system-Yes-for-real

http://boingboing.net/2015/03/27/nsa-proof-passwords.html

http://kacper.blog.redpill-linpro.com/archives/702

http://www.pri.org/stories/2014-04-02/physicists-are-building-nsa-proof-internet



The NSA should probablynot be in your threat model.




Whaaa?But shouldn't we defend against everyone?




Once you can defend against everyone up to

the NSA,then try to defend

against the NSA.31 — @benjammingh for PuppetConf 2016



*cough*(please infosec, stop this NSA fetishism &

security nihilism)*cough*




Which is also again sayingLearn to threat model in reality.




Impact!What is the business

impact of this breach.34 — @benjammingh for PuppetConf 2016



Defacement vs. DDoS

→ If you're a real time trading house large DNS provider, DDoS is a really expensive thing,

defacement is not as big.→ A political party website, DDoS is just annoying,

defacement could be huge.




Mail doxing/spooling→ If you're a hacker in the 90s, having your mail

shared with a 'zine is annoying.→ If you're a presidential candidate, your mail being

public could endanger an election.




In just your company→ Credit card processing done by you or someone

else (hi Stripe)→ PII or other user data.

→ Laptop being stolen (please tell me they're encrypted and passworded...)

→ Annoying people from Lizard Squad on IRC, and suffering a large DDoS.


https://www.stripe.com/

http://krebsonsecurity.com/tag/lizard-squad/



Breaches38 — @benjammingh for PuppetConf 2016



How do systems get(0wned|compromised|

breached)40 — @benjammingh for PuppetConf 2016



Well here's how it happened in the 90s.

l33t$ cc -o humpdee humpdee.cl33t$ ./humpdee 203.0.113.76Humpdee c0ded by Tekneeq Crew!

Local address: 198.51.100.12Return position: 678Return address: 0x01423908Got shell# iduid=0(root) gid=0(root)




Big thanks to our teal 90s sponsor . . . .s$ '$&ty . . .s$$$sss..yssss. $$$' ,&ft,ysp ,sss. ,saaas. ,saaas. .ssuiis ss $$$' d$$',`$$b $$$ .$$f",`$$$P"Y$$b d$V" `$$b d$$' "$$b d$$" `$$$" $$$ $$$sss$$$ $$$$$K. $$$ ;$$$ $$$sss$$& $$$sss$$$ $$$ ,$$$ $$$ .,$$$, .ss $$$ `$$bs. $$$, $$$ $$$' .ss $$$' ,ss.$$$ .,;$$$ "Y$$" `Y$$sd$P",$$$, Y$$B.$$$i. $$$L`Y$bsd$P' `T$bsd$$P `V$baod$$$ `"" `"""""' '"""' """"'"""" """' `""""" `""""' `"""""Y$$ .$$$. . . . . . . . .y$$$b. . 'Y$P' . Y" .'

http://www.attrition.org/hosted/tekneeq/42 — @benjammingh for PuppetConf 2016

http://web.archive.org/web/20000819082232/http://www.attrition.org/hosted/tekneeq/



(I'm trying to be invited back next year)

$shellcode = @("shellcodez"/L) \x31\xdb\xb0\x1b\xcd\x80\x31\xc0\xb0\x02\xcd\x80\x85\xc0\ \x75\x32\x31\xdb\x89\xd9\xb1\x01\x31\xc0\xb0\x3f\xcd\x80\ \x31\xdb\x89\xd9\xb1\x02\x31\xc0\xb0\x3f\xcd\x80\xeb\x1f\ \x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\ \x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\ \x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh |-shellcodez

madexploit { "humpdee": ensure => shell, targer => '203.0.113.76', shellcode => $shellcode, require => Date['90s'], }




Timewarp to now!→ 99% of servers don't have real routable IPs.

→ TEH CLOUD, NAT, Load balancers, &c.→ A few people bought firewalls.

→ DEP, SEP, Stack cookies, ASLR, GENTOO!!!11→ Hopefully you've patched this vuln from 1997?




iOS(not IOS, that is somewhat less secure)




Things we know→ FBI bought an "exploit" for $1M.

→ Zerodium had a $1M bounty for full remote end to end compromise.

→ Apple's own bug bounty for certain things in in the $100,000s range.

→ Maybe someone in your company has one of these iPhone devices?




ZOMG!an attacker could get a foothold in your

network for a cool $1m dollars!




Reality→ So for the quick simple payment of $1m dollars

you're totally getting owned.→ if your attacker has $1m spare to spend on just an

exploit.→ and owning you is worth >$1m.

→ oh yeah, and there's no cheaper way to do it.




Reality 2→ Attackers have budgets.

→ Majority of attacks have financial motives.→ Defense is about raising those costs.

→ (whilst still allowing your company to continue to make money)




Zero day is notyour biggest worry.




So how do we fix this?

with threat modelling51 — @benjammingh for PuppetConf 2016



Say you have N months allocated to a security project.

Which of these will give a better return on your overall security?




Rolling out the awesome Grsecurity on all your

linux servers.


https://grsecurity.net/



Rolling out a password manager to everyone in

your organisation.


https://1password.com/

https://www.dashlane.com/



One of these is awesome cool tech, which stops

mad 0day.(and I really love the work of GRSec)




The other involves talking to people in the

company and helping them with a password

manager.56 — @benjammingh for PuppetConf 2016



Arbitrary pie chart 3D DOUGHNUT CHART!




"The use of stolen, weak or default credentials in breaches is not new, is not bleeding edge, is not

glamorous, but boy howdy it works"- Verizon 2016 Data Breach Investigations Report


http://www.verizonenterprise.com/resources/reports/rp_DBIR_2016_Report_en_xg.pdf

https://threatbutt.com/press/Threatbutt-DZIR-2016.pdf



Passwords59 — @benjammingh for PuppetConf 2016



Passwords == keys




More question time!If you care about lock security, do you:

→ buy cheap crappy keys but replace your locks in your whole house every month?

or→ buy decent (cough European) locks and not worry

about it.61 — @benjammingh for PuppetConf 2016



No one does the former right?

(not that many people do the latter either, but anyway)




(also no ones house gets broken in to with lockpicks either, but stop poking holes in

my analogy)




Which of these is better?→ "Password1234oct"

or→ "ainwobchiFatodFeb0WrorckyishroocsyacIsAfby"




Which will be better next month?→ "Password1234nov"

or→ "ainwobchiFatodFeb0WrorckyishroocsyacIsAfby"




You're wrong Ben because reasons→ Guessing the first one, you can guess the others.→ It'll be written down as it changes all the time.→ Has much less entropy so they can remember it.→ Second one is hashcat proof, the first one is not.


https://hashcat.net/



If you want more than just passwords!

Spend money on Duo and buy Yubikeys


https://www.duo.com/

http://yubico.com/



Duo→ gives you secure second factor over iPhone/

Android push notifications.→ backup of SMS or phone call.

→ backup codes too.→ more secure than TOTP 2FA.




Yubikeys == <3→ Tiny USB cryptographic tokens that can tie in to

Duo to be a second factor.→ no more having to find your phone (I know, life is

hard...)→ Can also generate & store SSH/GPG RSA keys.

→ Now have U2F/FIDO for, well, Dropbox, GitHub, and Google


https://blogs.dropbox.com/dropbox/2015/08/u2f-security-keys/

https://github.com/blog/2071-github-supports-universal-2nd-factor-authentication

https://support.google.com/accounts/answer/6103523?hl=en



But most importantly...




STOP MAKING YOUR COLLEAGUES HATE YOU!




Be nicer? MadnessAt Etsy, we try, really hard, to make the security team

approachable and friendly!

(In spite of hiring me)




Why do this?(Other than working for a hugging

company)




PhishingThis is pretty new, has anyone heard of it?




Solving phishing!→ Can't be done, despite what Barracuda may want

to sell you.→ 99% of people entering details vs. 9% of people

entering details isn't all that helpful.→ (But still try to reduce it)




Solving phishing IRHaving people tell the security team when a phishy email comes in, even if they've clicked on everything

and shared their passwords, is great.




Not solving phishing IRHaving a holier than thou, mad leet security team

who talk down to people when they report a phishing email.

That will be the last time they bother to report anything to you.




Love always finds a way.→ If security block everything, people will just do it

anyway.→ "Shadow" teams spin up, and just avoid all your

safeguards.→ you block all outbound traffic bar the proxy,

someone will run corkscrew.


https://daniel.haxx.se/docs/sshproxy.html



Security people, be

nicer ❤81 — @benjammingh for PuppetConf 2016



And now the second half




Conclusions→ Start from securing from least skilled attacker up,

not most skilled down.→ Be realistic about your threat model.

→ Whilst its cool to defend against people with bigger budgets. Actually defending is better than

trying and failing.




Conclusions deux→ Pick the boring definite wins, not the exciting

maybe wins.→ Yes, you won't get a BlackHat talk out of them, but

you will be more secure.→ Attackers want to win, Defenders can definitely

win if they pick the right fight.




Thank you→ Twidder: @benjammingh

→ LinkedIn: lnkdin.me/p/benyeah→ SpeakerDeck: speakerdeck.com/barnbarn

→ JitHub: github.com/barn→ Etsy: Careers --- CodeAsCraft <--- our blog

→ Fax: pending.85 — @benjammingh for PuppetConf 2016


https://www.linkedin.com/in/benyeah

https://speakerdeck.com/barnbarn

https://github.com/barn


https://www.etsy.com/careers/

https://codeascraft.com



Wham!




puppetconf 2016: how you actually get hacked – ben hughes, etsy

Technology