Downloaded 21 times
More Related Content
OFFENSIVE IDS
- 1. OFFENSIVE IDS OVERVIEW VERSION: 1.4a DATE:27/02/2019 AUTHOR: SYLVAIN MARTINEZ REFERENCE: ESC14-MUSCL CLASSIFICATION: PUBLIC {elysiumsecurity} cyber protection & response
- 2. 2 CONTENTS PUBLIC {elysiumsecurity} cyber protection &response • IDS Introduction; • Topology Example; • IDS Benefits; • Offensive IDS Overview; • Topology Revisited; • Benefits Revisited; • Capturing traffic; • Core Components; • Tweaking; • Finding the needle; • Free credentials; • IDS Dashboard example; BEYONDUSE CASESSETUPCONCEPTCONTEXT • Not just defence; • Resources.
- 3. 3PUBLIC {elysiumsecurity} cyber protection &response IDS INTRODUCTION ANALYSIS OPTIONS SIGNATURES PATTERNS & BEHAVIOURS ACTIVE PASSIVE CONFIGURATION OPTIONS NIDS HIDS IDS IPS IDS HIGH LEVEL CONCEPT TRAFFIC & EVENTS ANALYSIS ALERTS & ACTIONS Icons from the Noun Project unless specified otherwise BEYONDUSE CASESSETUPCONCEPTCONTEXT
- 4. 4PUBLIC {elysiumsecurity} cyber protection &response TOPOLOGY EXAMPLE GUEST WIFI USERS SERVERS DMZ DUPLICATED TRAFFIC EXTERNAL DUPLICATED TRAFFIC INTERNAL INTERNET TRAFFIC ANALYSIS SIGNATURES PATTERNS / BEHAVIOURS SECURITY ALERTS Icons from VMWARE IDS BEYONDUSE CASESSETUPCONCEPTCONTEXT
- 5. 5PUBLIC {elysiumsecurity} cyber protection &response IDS MAIN BENEFITS CYBER SECURITY ATTACKS ALERTS (PORT SCANS, C2C, BRUTE FORCE, ETC) CYBER SECURITY ISSUES ALERTS (CLEAR TEXT PASSWORD, OUTDATED APP, ETC) VULNERABLE HOSTS ALERTS (CVE, EXPLOITS, ETC.) VULNERABLE APPLICATIONS ALERTS (CVE, EXPLOITS, ETC.) NETWORK ACTIVITY VIEW (IP SOURCE & DESTINATION, PORTS, PROTOCOLS) NETWORK DATA FLOW VIEW (NETWORK ENTITY RELATIONSHIPS) NETWORK ANOMALIES VIEW (SUSPICIOUS TIMELINE, ACTIVITY SPIKES & VOLUME) NETWORK CONTENT VIEW (HTTP, FTP, SMB, ETC.) ALERTS INVESTIGATION BEYONDUSE CASESSETUPCONCEPTCONTEXT
- 6. 6PUBLIC {elysiumsecurity} cyber protection &response OFFENSIVE IDS OVERVIEW TO USE THE POWER OF IDS TO HELP FIND INTERESTING TIMELINE, VULNERABILITIES AND SENSITIVE DATA GOAL TO HELP GOING THROUGH LARGE VOLUME OF CAPTURED DATA AND RE-PURPOSE THE BENEFITS OF IDS WHY CAPTURING TRAFFIC AND EVENTS IN A PCAP FILE AND REPLAY IT INTO A STANDALONE IDS IN A VM HOW BEYONDUSE CASESSETUPCONCEPTCONTEXT
- 7. 7PUBLIC {elysiumsecurity} cyber protection &response NETWORK TOPOLOGY - REVISITED GUEST WIFI USERS SERVERS DMZ INTERNET DUPLICATED TRAFFIC PCAP FILES DUPLICATED TRAFFIC PCAP FILES TRAFFIC ANALYSIS SIGNATURES PATTERNS / BEHAVIOURS SECURITY ALERTS, FILES, PASSWORDS, ETC. FILES EXTRACTION PCAP FILES IDS BEYONDUSE CASESSETUPCONCEPTCONTEXT
- 8. 8PUBLIC {elysiumsecurity} cyber protection &response IDS MAIN BENEFITS - REVISITED CYBER SECURITY ATTACKS ALERTS (PORT SCANS, C2C, BRUTE FORCE, ETC) CYBER SECURITY ISSUES ALERTS (CLEAR TEXT PASSWORD, OUTDATED APP, ETC) VULNERABLE HOSTS ALERTS (CVE, EXPLOITS, ETC.) VULNERABLE APPLICATIONS ALERTS (CVE, EXPLOITS, ETC.) NETWORK ACTIVITY VIEW (IP SOURCE & DESTINATION, PORTS, PROTOCOLS) NETWORK DATA FLOW VIEW (NETWORK ENTITY RELATIONSHIPS) NETWORK ANOMALIES VIEW (SUSPICIOUS TIMELINE, ACTIVITY SPIKES & VOLUME) NETWORK CONTENT VIEW (HTTP, FTP, SMB, ETC.) SPEED UP NETWORK TRAFFIC ANALYSIS IDENTIFY INTERESTING TIMELINES IDENTIFY VULNERABILITIES TO EXPLOIT IDENTIFY TARGETS OF INTEREST EXTRACT SENSITIVE INFORMATION PROFILE USERS AND APPLICATIONS BEYONDUSE CASESSETUPCONCEPTCONTEXT
- 9. 9PUBLIC {elysiumsecurity} cyber protection &response CAPTURING TRAFFIC NO OPERATIONAL IMPACT PHYSICAL ACCESS REQUIRED IN MOST CASES TAP TRAFFIC AGAINST KEY TARGETS POWERED/UNPOWERED SOLUTIONS DUMMY CAPTURE DEVICES: - SMALL ROUTER; - THROWING STAR LAN; INTELLIGENT CAPTURE DEVICES: - RASPBERRY PI; - HAK5 PACKET SQUIRREL. BEYONDUSE CASESSETUPCONCEPTCONTEXT
- 10. 10PUBLIC {elysiumsecurity} cyber protection &response CORE COMPONENTS BEYONDUSE CASESSETUPCONCEPTCONTEXT USE TCPREPLAY YOU CAN ACCELERATE IF YOU DON’T MIND ABOUT TIMELINE. REPLAY TRAFFIC DECIDE WHICH ENGINE TO USE: SURICATA OR SNORT IDS ENGINE USE A FREE IDS DISTRIBUTION SUCH AS SECURITY ONION OR SELKS SET IT UP AS A STANDALONE VM VIRTUAL MACHINE
- 11. 11PUBLIC {elysiumsecurity} cyber protection &response TWEAKING BEYONDUSE CASESSETUPCONCEPTCONTEXT LOOPBACK NIC DOES NOT WORK WITH TCPREPLAY ON A VM USE A DUMMY NIC INSTEAD CONFIGURE YOUR IDS TO MONITOR THAT NIC
- 12. 12PUBLIC {elysiumsecurity} cyber protection &response FINDING THE NEEDLE BEYONDUSE CASESSETUPCONCEPTCONTEXT • FIND THE SECRET CONTRACT XYZ • YOU ARE ONLY GIVEN 3 EMPLOYEES NAME SCENARIO • 50GB OF INTERCEPTED TRAFFIC OVER A WEEK PERIOD • YOU DON’T KNOW WHERE TO LOOK • WIRESHARK DOESN’T LIKE THAT FILE SIZE SO MUCH…CHALLENGES • REPLAYED THE 50GB OF DATA TO A STANDALONE IDS • ABLE TO PINPOINT DAYS AND TIME OF PEAK ACTIVITY AND TYPE OF ACTIVITY (FILE TRANSFER) • GO BACK TO WIRESHARK WITHIN A MUCH SMALLER TIMEFRAME AND FIND THE DOCUMENT! IDS TO THE RESCUE
- 13. 13PUBLIC {elysiumsecurity} cyber protection &response FREE CREDENTIALS BEYONDUSE CASESSETUPCONCEPTCONTEXT • ACCESS THE ACCOUNT OF A TOP EXECUTIVE SCENARIO • THE EXECUTIVE IS PARANOID AND DID NOT FALL FOR PHISHING • THE EXECUTIVE IS VERY CAREFUL WITH HER SOCIAL MEDIA PRESENCE • HER LAPTOP IS FULLY PATCHED • NETWORK TRAFFIC INTERCEPTED IS TOO BIG TO BE USEFULCHALLENGES • REPLAYED NETWORK TRAFFIC TO A STANDALONE IDS • ALERT FOR A PASSWORD SENT IN CLEAR TEXT • THE EXECUTIVE IS UPDATING A CHARITY BLOG USING AN ALIAS • SHE USES THE SAME PASSWORD ON HER CORPORATE ACCOUNTIDS TO THE RESCUE
- 14. 14PUBLIC {elysiumsecurity} cyber protection &response IDS DASHBOARD EXAMPLE BEYONDUSE CASESSETUPCONCEPTCONTEXT
- 15. 15PUBLIC {elysiumsecurity} cyber protection &response NOT JUST DEFENSE BEYONDUSE CASESSETUPCONCEPTCONTEXT DETECT ATTACKINVESTIGATE ALERT IDS ENVIRONMENT, LIKE MOST SECURITY DEFENSE TOOLS ENVIRONMENT, CONTAINS SENSITIVE DATA AND MUST BE PROTECTED SO THEIR INFORMATION IS NOT USED AGAINST YOU!
- 16. 16PUBLIC {elysiumsecurity} cyber protection &response RESOURCES BEYONDUSE CASESSETUPCONCEPTCONTEXT SNORT BASED ENGINE: HTTPS://WWW.SNORT.ORG/ SURICATA BASED ENGINE: HTTPS://SURICATA-IDS.ORG/ IDS VIRTUAL MACHINE DISTRIBUTION - SECURITY ONION (SO): HTTPS://SECURITYONION.NET/ - SELKS: HTTPS://WWW.STAMUS-NETWORKS.COM/OPEN-SOURCE/ GREAT COMMUNITY IS HERE TO HELP; SO AND SELKS AUTHORS ARE VERY ACTIVE; PROFESSIONAL SUPPORT AVAILABLE FROM THEM TOO; VARIOUS INSTALL GUIDE AVAILABLE: HTTPS://WWW.ELYSIUMSECURITY.COM/BLOG/GUIDES/POST7.HTML
- 17. {elysiumsecurity} cyber protection &response © 2015-2019 ELYSIUMSECURITY LTD ALL RIGHTS RESERVED HTTPS://WWW.ELYSIUMSECURITY.COM ABOUT ELYSIUMSECURITY LTD. ELYSIUMSECURITY PROVIDES PRACTICAL EXPERTISE TO IDENTIFY VULNERABILITIES, ASSESS THEIR RISKS AND IMPACT, REMEDIATE THOSE RISKS, PREPARE AND RESPOND TO INCIDENTS AS WELL AS RAISE SECURITY AWARENESS THROUGH AN ORGANIZATION. ELYSIUMSECURITY PROVIDES HIGH LEVEL EXPERTISE GATHERED THROUGH YEARS OF BEST PRACTICES EXPERIENCE IN LARGE INTERNATIONAL COMPANIES ALLOWING US TO PROVIDE ADVICE BEST SUITED TO YOUR BUSINESS OPERATIONAL MODEL AND PRIORITIES. ELYSIUMSECURITY PROVIDES A PORTFOLIO OF STRATEGIC AND TACTICAL SERVICES TO HELP COMPANIES PROTECT AND RESPOND AGAINST CYBER SECURITY THREATS. WE DIFFERENTIATE OURSELVES BY OFFERING DISCREET, TAILORED AND SPECIALIZED ENGAGEMENTS. ELYSIUMSECURITY OPERATES IN MAURITIUS AND IN EUROPE, A BOUTIQUE STYLE APPROACH MEANS WE CAN EASILY ADAPT TO YOUR BUSINESS OPERATIONAL MODEL AND REQUIREMENTS TO PROVIDE A PERSONALIZED SERVICE THAT FITS YOUR WORKING ENVIRONMENT.