Tag Archive for: Blackhat USA 2013 Summary – Part 2 of 3

You are here: / Blackhat USA 2013 Summary - Part 2 of 3

Posts

Blackhat USA 2013 Summary – Part 3 of 3

An interesting note from this presentation was the percentage of already compromised mobile devices identified during the study. Out of the 608 compromised phones identified the majority were Apple IOS phones. Not Android as I would have expected. The main take away from the briefing was that BYOD is a new market and the security solutions are not fully developed. Encrypting data at rest can’t be the beginning and end of the solution. The entire phone needs to be secure and the devices need to be the monitored to the same extent we would monitor any other device on the network.

The second day’s keynote was given by Brian Murihead from NASA and was titled, “Take Risk but Don’t Fail”. Let’s be honest here. Giving a keynote on the second day of Blackhat after the director of the NSA is a tough job. Brian’s keynote was more traditional Blackhat keynote. It was uplifting material about overcoming obstacles, taking risk and innovation. However, for me it was pretty boring and I almost fell asleep half way through. That being said it was interesting to hear the amount of ingenuity that went into the development of the Mars rovers. I was piqued by the skycrane. The reentry vehicle uses jets to hover over the landing spot and lowers the rover to the ground using a crane. Once the rover is lowered the reentry vehicle jets off to a safe distance and crashes leaving the rover safely on the ground. That’s pretty innovative by itself but when you think it happened automatically on planet 225 million kilometers away, that’s pretty cool.

I also caught a presentation from a former coworker Alva “Skip” Duckwall, “Pass the Hash II”. Yes, I am biased towards speakers who are friends or former co-workers. The talk centered on how pass the hash was still a viable attack method. The presentation hammered home the fact that pass the hash simply utilized the Microsoft authentication process as intended. As is traditional, many pot shots were lobbed at Microsoft who actually had a representative sheepishly in attendance.

Beyond the traditional Microsoft bashing, Skip pointed out flaws in Microsoft’s Group Policy Preferences (GPP). GPP allows admins to set passwords across the domain easily. It’s a great tool for administrators and an even better tool for hackers. Because all of the passwords are set the same they have the same has h and that means you only need to get one and pass it gleefully along to access all the others. He also pointed out a similar issue with Smart Cards. When enabled, the accounts create hashes that never change. They don’t expire either. Ever. He did end on a positive note offering scripts for changes the hashes and configuration tips to avoid these problems.

The last presentation I will mention was a very high level discussion of security incidents by Jason Healey, titled “Above My Pay grade: Cyber Response at the National Level”. Jason made the very interesting point that at a certain level a cyber incident stops being cyber and simply becomes a national incident. At that point it is treated like any other disaster or crisis and the decision makers may make some surprising decisions. In one insightful example, Jason described an exercise where his team proposed the ability to hack into the financial markets and destroy a week’s worth of data. When presented with this information, the decision makers responded that they would simply restore from the previous weeks data. There would be financial winners and losers but the market would survive. Jason noted that these are the same people who have to make snap decisions on recessions, natural disasters and other crisis. For them the cyber aspect starts to fade at a certain level and they are left with a crisis that needs an answer.

Jason provided a very detailed flow of how an incident can go from your SOC all the way up to the president. It was definitely not a ones and zeros presentation but it was a pretty insightful journey into how national incidents are handled.

Lastly, I’ll talk about the overall setup of the conference this year. Each attendee was issued a RFID card with their name on it. This card was used to provide vendors information and also to sign up to provide feedback on speakers. In each presentation room there was a RFID reader setup. If you badged in you were emailed a feedback form for that presentation. Blackhat seemed very interested in getting feedback on the presentations from attendees. The vendor area was moved to a larger space and was very slick. There were a lot of huge LCD displays, presentations and even a full out racing simulation complete with cars and steering wheels. The swag was plentiful and creative. I saw everything being given away from tiny RC helicopters all the way up to Iphone controlled AR Parrot 2.0 quadcopters. Even more noteworthy, were the many help wanted signs vendors were displaying. I’ve never seen that at Blackhat.

I learned a lot, got see some old friends and met some new ones. If you’ve never been, I highly recommend the experience. If you have been I want to repeat some advice I’ve seen several times online. Given the chance to see a briefing or have a cup of coffee with an experienced Infosec professional, take the cup of coffee!!

Read Part 1 of 3 or Read part 2 of 3

Blackhat USA 2013 Summary – Part 2 of 3

Quite frankly the keynote alone was worth the price of admission. However, I did see some other presentations. As I mentioned earlier, being more of a manager these days I focused less on some of the splashier briefings and drifted towards those on a more managerial track. The first I caught was by Patrick Reidy, formerly the CISO of the FBI. I was partial to this speech because I had worked with Patrick before and I was really curious what he had to say.

Patrick’s presentation centered on lessons learned at the FBI concerning how to combat and detect insider threats. Patrick homed in on some interesting points. He noted that you can’t use traditional IDS to track or detect an insider. He also noted that simple base lining and assigning equal value to all actions would fail to identify insider based anomalies. His solution was to analyze the history of insider breaches at the bureau and other organizations. He used that information to create a different baseline. Interestingly, he was very candid about the initial failures of the monitoring system the bureau initially setup. He stated that only when they clearly defined what insider threat was and the actions that an insider would take did they stand a chance of detecting them.

Even more interesting was his ultimate conclusion that detection was not the most effective approach. After a few years, Patrick finally settled on what he called “positive social engineering”. This basically consisted of a combination of training users and reinforcing positive behavior. The Data Loss Prevention (DLP) software installed on user’s computers was used to provide warning to users who were moving sensitive data. He noted a significant drop in incidents once the staff was forced to acknowledge the transfer of sensitive data through the DLP notification system.

One other interesting piece of information he provided was an Insider Threat Kill Chain. This model differs from the traditional model Lockheed Martin created. It covers Recruitment, Search & Recon, Acquisition and Exfiltration. Creation of this insider threat kill chain was necessary in the development of detection strategies. The most impressive part of the presentation was the admission of failure, rethinking of strategy and research that went into developing a successful insider threat program. On a side note there was an awesome moment of levity when Patrick showed a slide that said a kitten dies every time someone mentions BYOD. I’m not a fan of BYOD either.

I also sat in on “Practical Attacks against Mobile Device Management Solutions”. Like I said, I’m not a fan of BYOD. However, like just about every other security professional I have to deal with it a work. This talk identified some serious flaws with the majority of major device management solutions used for BYOD. If you use Airwatch or Good yes, they were talking about you. The vulnerability centers on the fact that despite having encrypted partitions, at some point the data needs to be decrypted and presented. At that point the data can be intercepted and extracted. Given the fact that just about every major smart phone platform has at least one vulnerability that can be exploited for root access. It’s not farfetched. The talk noted that after a phone had been rooted it was trivial to either extract the data from memory or from storage after it had been decrypted.

Read Part 3 of 3 or Read Part 1 of 3