Hi guys.
I'm Chris.
And welcome back to my course on Enterprise Security fundamentals.
In this lesson we are going to discuss about the red team's kill Gene.
Let's have an overview of the kill chain.
So kill genes are an idea regionally taken from the military strategy which described the structure
of an attack against an objective.
The company Lockheed Martin applied this idea to information security and it is now used as an industry
standard framework for describing the progression of attacks against information systems.
As you can see the various phases of the kill chain are the reconnaissance the weaponization the delivery
exploitation installation commanding control and actions on objective.
Now in the next slides I am going to go through this phases with some examples that have occurred in
real life.
So let's talk about the first phase of the red team's kill chain and that is the reconnaissance well.
So what would be some examples of the way that reconnaissance works now.
One clever one is using social media platforms like LinkedIn for example you can use LinkedIn and other
social media platforms of course to determine a lot of information about an organization's
security personnel for example who works in the companies I.T. department.
And when you look at who works in the company's I.T. department you have a look at their profile right.
And you can learn more about the systems and the applications that they work with.
Well obviously someone who is a Windows server expert and doesn't have any experience let's see with
Linux or Unix and you're looking at the I.T. department of this organization and they all seem to have
windows certifications.
Well then you can start to make some assumptions about the type of systems that are running that organization.
You can also let's see that they've got a Twitter account
but they don't have a look at who they follow.
What are they interested in with regard to their job for example.
Are they following people that talk about Office 365.
Are they following people that talk about another type of mail product.
Who are they following and what are their technologies interest.
And through that you can start to build up a profile of the profile and indirectly a profile of the
organizations information system.
Figure out what you can figure out by looking at an external I.T. presence for example.
Do I have a VPN gateway.
Where is a mail system hosted.
Is it up in Office 365.
Or are they hosting The Mail on premises hallways their DNS external DNS infrastructure configured.
Try and figure out as much as you can just by looking at those things that are public about the organization.
And basically this is what the reconnaissance is about now.
One of the other things you can do is if you know where to look you can find out organizational credentials
that have been exposed in password data breaches for example if you remember a couple of years ago there
was a breach of an infidelity Web site.
One of the very interesting things that came out of that was that a lot of people on that infidelity
Web site a site where you would assume people were looking for a degree of anonymity was that they were
actually using their business e-mail addresses or their government email addresses or even their military
e-mail addresses.
So what we know or what we can gather from this.
The people are generally people Jodi are not that good when it comes to the sanitation and care of their
work e-mail credentials.
The other thing we know is that people tend to reuse passwords.
So it's not unreasonable to think that someone who used a specific password for an infidelity website
might actually use that same password for their VPN credentials or their domain admin account or their
e-mail account for that count.
OK.
So the next stage of the Red Team kill Jane would be weaponization.
Okay.
So let's see the different aspects of weaponization now weaponization is where we choose the tool for
the attack and the reality is the boring reality is that when most attackers are looking to attack they're
not sitting there and writing custom attack tools to do it.
What they're probably doing and 95 percent of the time is using stuff that's off the shelf in terms
of how off the shelf stuff and these attack tools are.
That is someone else has built them they're using tools that already exist.
They're not going out and creating special tools and weaponization is about determining the most appropriate
tool for what can be determined about an infrastructure in the reconnaissance phase about the infrastructure
that's being attack.
For example if you know that they run a particular distribution of Linux then you are going to tailor
your tool when you're talking that particular distribution of Linux if you know that your organization
is using Asia.
Then you're going to be looking at tools that are helping you compromise what they're running in Asia
right.
Now in terms of the delivery phase let's put out the bullets here and
in terms of the delivery phase of the red team's kill chain.
Well it really does depend a lot on the target on the target.
One technique that's common when a red team has access to to the to the premises that is I know where
the location of the business or the organization they're attacking.
And this is to basically just go out and one technique is to basically just go out there and scatter
you as bikies in places where let's see the smokers of the organization congregate to make it look like
someone has gone out for a cigarette and they might have dropped their use be key.
And of course what you do is that you then put malware on the U.S. key because what you're hoping is
that someone's trying to figure out who's you be key it is.
And they're just going to plug it in and then the malware just runs or the delivery occurs.
Yes.
You know how I was talking about before about exposed credentials and breaches.
Well think about what's going on now with office sixty three six five.
Let's say that someone leaves their office 365 credential as their sign up for the infidelity Web site
or because people apparently do that.
Well you might be able to do that right.
Take the username and password from the exposed breach and then just sign into office 365 and that might
just give you access for example to the organizational sharepoint site which you could then use to plan
malware know watering hole attack and a watering hole attack is basically is going to be a site where
people visit or regularly.
And of course people regularly visit SharePoint sites.
Now there are ways that you can protect against this if you're on Office 365 administrator but it does
involve you to actually lighting up those security features.
And one of the very interesting things about Office 365 security is how much of it actually isn't implemented
by most organization.
And that's the sad truth unfortunately.
OK.
Let's go to the next phase and this would be the exploitation phase all key so the exploitation phase
in the red team's kill.
That's getting the code to run well how do you do that.
Well it was certainly a lot easier with U.S. bee attacks where in years bee auto run has been enabled.
Right there's other ways.
You basically go and hide the exploit code you know document that you want someone to open and it again
depends on the people that you're attacking.
Attackers have a lot of ways of getting people to execute code.
What they're trying to avoid is having that trigger and time malware defenses within the organization.
So the next step in the red team's skill chain is the installation
and the step is where the code has been executed.
And that means that the code runs and then goes and does a whole lot of other things.
Mostly what an attacker what the attacker is trying to do is trying to get persistence at this stage
they're trying to get more software down on the compromised machine so that they can properly compromise
this machine to run malware isn't going to do anything.
What you want to do so what you want to do is get them to run malware and then the malware goes and
installs let's say a remote Texas backdoor to that person systems and you then you can remote into that
system and then you can start to move around the organization.
So often this initial code extends itself.
The initial code is small and then it will pull down the tools from a location on the Internet.
And this happens in most cases.
So the compromise and the bank then comes down all the tools that the attacker is going to reuse and
start moving laterally throughout the network.
So once the installation has occurred once persistence has been achieved once the attacker has remote
access to the network we move on to the next phase which is of course command and control
key
the command and control phase that's where the attacker has got persistence and they're going out and
they're trying to head for domain dominance so to give you an example of this I've talked about and
we've discussed in order there are lessons about a particular retailer attack that occurred several
years ago.
And if you know your history you'll be able to figure out which retailer it is anyway.
The attacker in that case did something very very interesting.
They've got persistence through getting some air conditioning vendor credentials.
So that's how they initially got onto the internal network.
Then they did their reconnaissance of the network and they found out basically how that organization's
I.T. infrastructure worked.
And they did a lot of clever things.
For example
they worked and you know what control software was being used for.
Yeah.
What monitoring tools were being used but perhaps what I thought was the most clever thing about this
attack was what they did they compromised the image deployment servers used to this organization.
So to give you a very high level overview of the way this worked there's a way of maintaining security.
And what this organization did was very was very right.
It was basically what the operating system deployed on each cash register and drop a fresh image there.
So the idea being of course that if one cash register is that it out the retail outlet had had become
compromised in a way.
Right.
So it didn't matter because every 24 hours that kept cash registered would be white and the fresh the
seemingly secure operating system image would be dropped on the cash register.
This was a scheduled task running on the deployment servers that did exactly this every 24 hours.
It dropped the fresh image on all the cash registers what the attackers did was very very clever.
They basically modified the image that was being dropped on the cash register and baked malware in it.
So in their command and control what they were able to do was basically ensure that every cash register
in the nation every 24 hours ended up with malware on there that would be able to intercept credit card
transactions that pass through the cash register.
So that also moves in to the next objective on the kill chain and that is the action on objective are
the action on objective.
Basically is the last the last step on the on the kill chain
and that's what the attack is there to do basically.
So in our case in our example they put the malware into the image.
They dropped it onto the cash register or made it so that the image was dropped onto the cash register
every 24 hours and then they had all that credit card data gathered and then they would gather this
data back onto a location on the internal network.
That was a file server and something like that every 24 hours they would accumulate credit card data
from all the cash register around the nation and then a scheduled task or task was to for this entire
day that be uploaded to a server in the Central Europe.
The final part of the story is that they weren't actually properly found out until the Secret Service
start noticing similarities in credit card numbers and where they have been used.
Now the other thing that was interesting was that the attackers had their malware detected but the detection
was not made through signature through a signature based detection because the malware was modified
that in the way that it would look like on legitimate software and it was always all the alerts were
put away as false positives.
Okay so now that we have discussed some examples in regards to the various phases of the Red Team skill
chain let's actually go through and talk about each.
Each phase individually so reconnaissance This is the first phase and the red teams kill Gene sophisticated
attackers don't randomly attack organizations sophisticated attackers spent a significant amount of
time researching their target an attacker will use the reconnaissance phase to determine where whether
a target is worth attacking the objectives of an attack and the characteristics of the target.
For example an attacker might spend time examining the link then to determine which stuff hold specific
roles within the organization before they've taken any overt action against the target organization.
A sophisticated attacker may have detailed understanding of the structure of an organization's information
systems and security teams using tools like linked in.
As we've earlier mentioned in the previous slides not only could an attacker determine who the senior
information systems staff are but they'd also be able to deduce the likely nature of those systems based
on the experience of the stuff in question.
So when organizations an organization who who's a I.T. department is staffed by professionals that hold
an extensive variety of let's say Microsoft certifications are likely uses Microsoft products right.
An organization whose database administrators for example who all have extensive prior experience working
with a specific database product such as my sequel are likely using that product to host their production
databases during the reconnaissance phase attackers examine external services such as web applications
provided to customers or Web sites as well as email and DNS to determine the characteristics of those
services.
For example does an organization hosted its email infrastructure in office 365.
Or is it using on premises solutions.
The answers to these questions will determine the attackers strategy as they progressed throughout the
kill chain an internal red team is at an advantage because they already know which information systems
are in use at the organization.
An exercise that's an internal red team might engage in is trying to assert and from external sources
such as LinkedIn as well as other public information such as DNS registration records and passive monitoring
so they would be trying to ascertain exactly how much information about the nature of the organization's
information system could be determined by a diligent investigator who only had access to external sources
of data
the next.
The next one is weaponization weaponization involves creating or selecting existing remote Texas malware.
This malware when deployed will allow the attacker to gain a foothold or a beachhead in the target organization.
The selection of malware will be determined by information gained during the reconnaissance phase and
basically will target vulnerabilities that are likely to exist within the target organization's information
systems infrastructure.
For example the malware selected for attacking Web site will be substantially different if the organization's
Web site is hosted on ice with a sequel server background where compared to a Web site hosted on a pash.
With my sequel back for example the better tailored the malware or exploit is to the target organization
the more likely the attack is to succeed.
I'm going to talk about next about the delivery phase and I have prepared a separate slide for this
because there are several topics that I want to discuss in this delivery phase
okay.
So the delivery phase the delivery phase involves having the targets of the attack execute malware on
the target organization's information system infrastructure some attacks that require user intervention
for the remote code to execute other attack types can be performed remotely so there are a variety of
delivery methods that may be leveraged to meet these objectives of delivery.
And we will go through some of them.
But bear in mind these are some some type of delivery methods but are not limited to silk.
First one on the list phishing attacks phishing attack.
He uses his specially crafted email sent to users in the hope that they will open the email depending
on the sophistication of the attack.
The user may have to click on a link to trigger the next stage of the attack.
There are several varieties of phishing attack that required differing levels of user interaction.
Simply opening the email means some scenarios trigger the remote code execution.
Clicking on the link in the email may download remote code that executes directly on the target system
or may take the user to a Web site which would trigger the remote code execution.
Another form of another common form of phishing attacks involves phishing of credentials.
In this type of attack the target user is sent an email that looks very legitimate asking them to navigate
to a site where they need to sign in with their organizational credentials to perform a task.
For example an email reminding the user that they must change their email account password that directs
them to a site that has been configured to look like to look the same as their normal web mail site.
Unless the user is paying attention it is possible that they may enter their credentials which end up
being harvested for later use by the attack.
Another method would be crafted file attacks in this type of attack especially crafted file is emailed
to the target user.
This file when opened executes malicious code that installs the attacker software on the recipient's
computer if the file is crafted well enough or the configuration of the user's computer allow untrusted
code to run.
It's highly possible that simply opening the document will trigger the execution of the attackers code
the next method is remote code execution.
Well this type of attack involves sending specially crafted data to an information system such as an
application or service running one of server for example sending specifically crafted traffic to computers
running.
Let's see the apps lead to SMB Wan storage protocol can allow attackers to execute code on those computers.
Other types of remote code execution vulnerabilities allow attackers to inject code into a remote systems
memory and have that system execute that code next one is the watering hole attack.
This is an attack where malware is planted on an insecure site that people at the target organization
are known to frequently visit.
For example people at a specific organization may be patrons of a specific let's say a golf club by
compromising and planting malware on the golf clubs website.
It's possible that the malware hosted on the Web site might be downloaded and installed on work computers
when people within the organization visit the Web site during office hours.
It's just as simple as that the next one is the you as has bee sting attack.
As we've discussed in the previous slides this one is pretty straightforward.
In this type of attack U.S. stocks are dropped casually on the ground outside the front entrance of
the building or in areas outside the building where employees are known to frequent the gather such
as.
For example the area used for cigarette breaks.
Some of the employees will plug this year's bee sticks into their computer which allows the malware
to be installed on that computer giving the attacker internal network access
and the last one on our list as exposed VPN credentials or credential breach Web sites such as Troy
haunts.
Have I been porn.
Dot com provide users with the notifications when websites where they're they've created account suffered
data breaches which indicate that the credential of those accounts have been compromised.
Those that have investigated the properties of these data breaches has found that many users of third
party websites sign up to those Web sites using work rather than private email accounts.
As many users that have poor information security practices are likely to use the same password for
their work account as they do for third party websites.
Attackers that get access to breach data potentially have access to the work credentials of the user
that signed up for the breached site's of the work credentials that are exposed when sites account databases
are breached.
It is not unreasonable to assume some will work with organizational VPN systems.
Right.
So it is possible that some attackers will gain access to an organization through a VPN because a person
within an organization signed up to an external Web site using their organizational email address and
password and those credentials were later exposed
going on to the next phase on our list.
And that is the exploitation phase in this phase.
The attackers the malware code successfully triggers leveraging the targeted vulnerability depending
on how well the attacker was able to assert and the properties of the target information systems.
This may occur quickly or may take several tries before the code successfully runs going on to the next
phase which is the installation phase in the installation phase.
The original malware code is leveraged to deploy an access point also known as a backdoor through which
the attacker can access the compromised beachhead system this usually occurs through the original malware
code downloading and running exploit tools remotely which eventually provide the attacker with a remote
access point into the target organization's network.
The next one on our list is the command and control phase and again I've I've reserved.
Let's see a separate slide for this one because there are some aspects that we need to talk about.
So in the command and control fees the attacker has achieved persistent access to the target organization
systems information in reaching this phase.
The attacker will likely have leveraged one of the following
concepts or strategies or attack types whatever you want to call them lateral movement.
So it is highly likely that the first system that an attacker compromises isn't the one that allows
the attacker to achieve their objective lateral movement is where an attacker begins to compromise other
systems on the network.
Increasing the number of compromised systems as they move laterally towards accomplishing their goal.
An example of lateral movement might be where a member of the accounting team.
Let's see a response to a phishing email.
And has small reinstalled on their computer.
This malware can extract the cache credentials of the of the member of the organizations.
Let's say a first level of support team as well as to provide the attacker with the remote access to
the target organization's network because it's not unlikely that a member of the first line of support
the helpdesk team connected remotely to the accounting team member machine and the credentials were
cached the attacker then would be able to use the credentials of the first level of support team to
gain access to other systems.
In doing so the attackers eventually can capture the credentials of a member of the domain administration
team and they are able to leverage this credentials to gain domain dominance.
Another way the attacker would achieve leverage commanding control is privilege escalation privilege
escalation is the process of an attacker leveraging a compromised unprivileged account such as that
of a standard user or service into control over an account that is able to perform actions beyond those
original privileges in the previous example.
The attacker was able to start with access to the computer of a user with no administrative privileges
by running specifically crafted software.
They were able to capture the credentials of a user that had a greater network privileges.
Was they had access to these privileges the then they were able to eventually escalate until they had
full administrative permissions on the domain.
And that introduces us to the next to the next bullet here on our list which is domain dominance or
administrative privilege.
A common goal of the command and control phase is to get administrative privileges also termed as root
privileges on the target organization's information systems.
Of course.
For example control of an organization's domain controllers provides domain dominance once an attacker
has control of an organization's domain controllers.
They most likely can perform any action that they desire on the network.
There are exceptions to this rule but they require separation of administrative privileges and the deployment
of technologies such as just in time administration or just enough administration technologies which
we will discuss and talk about in a more level of detail in the next section and lectures going on to
the last phase on our list.
And that is actions on objective.
This is pretty straight forward in this phase.
The attacker or red team in the exercise care result.
Its objective.
As mentioned earlier this could be to steal data deploy around somewhere.
You play Queen mining software extort the organization or just destroy the systems.
The actions on objective fees is the attackers and gain and that's the end of it.
I will see you in the next lesson.
I hope this has been informative for you.
And thank you for watching.