Invisible attacks visible in your network. How to see and follow the tracks?

Transcription

1 Invisible attacks visible in your network. How to see and follow the tracks? Jochen Belke - Regional Technical Director at Lancope, CISSP Mariusz Sawczuk - Manager of Technical Sales Support Team at Sevenet

2 Agenda Part 1 Invisible threat Part 2 Network as a source of information Part 3 Detection and telemetry Part 4 Live Demo

3 Part 1 Invisible threat

4 Invisible threat: Anatomy of APT attack Compromised Web server Callback Server 0 Reconnaissance Scanning Social engineering; Facebook, LinkedIn, etc. Dummy attacks, DDoS DC Servers 1 1 Exploitation day vulnerability Obfuscated JavaScript code Weaponized pdf file DMZ DC Servers 2 FW 2 Dropper xor or Packer 3 Comand and control IPS Blogs, well known web pages Data Loss Using outbound port 443 (SSL) 5 Malware propagation

5 Invisible threat: Phase1 - Exploit Web browser execute obfuscated JavaScript hidden in RAW html. Exploit uses vulnerability in the web browser.

6 Invisible threat: Phase1 - Exploit The exploit has performed a heap-spray attack and exploits vulnerability in web browser. It has manipulating the memoryspace reserved for the application and the files that it opens. The exploit code now tells the system to download a new file.

7 Invisible threat: Phase 2 - Dropper Decoded (xor) binary file. The decode key is contained within the shellcode of the exploit. Legacy Security Never Saw It Coming. When the xor decode key is applied, the random looking binary now becomes a exectuable file and since the host is compromised, it is easy to get this file to run.

8 Invisible threat: Invisible Techniques Exploit - Obfuscated JavaScrpit code - Heap spray - Weaponized pdf file - Code injection - Process migration Dropper (binary/executable) - xor or Packer CallBacks - Blogs, well known web pages Data Loss - Using outbound port 443 (SSL)

9 How to see invisible threats and follow the tracks?

10 Part 2 Network as a source of information

11 Network: The source of information 3560-X San Jose New York Atlanta NetFlow NetFlow WAN NetFlow 3925 ISR NetFlow NetFlow Cat6k ASR-1000 NetFlow ASA Internet NetFlow DMZ NetFlow Cat6k NetFlow NetFlow NetFlow NetFlow Datacenter Cat4k Access NetFlow NetFlow UCS with Nexus 1000v NetFlow NetFlow 3850 Stack(s)

12 Network: NetFlow

13 NetFlow v fields to choose from, including IPv6 and payload sections Network: NetFlow

14 Network: NetFlow NetFlow has many versions Version Major Advantage Limits/Weaknesses V5 Defines 18 exported fields Simple and compact format Most commonly used format IPv4 only Fixed fields, fixed length fields only Single flow cache V9 Flexible NetFlow (FNF) IP Flow Information Export (IPFIX) AKA NetFlow V10 NSEL (ASA only) Template-based IPv6 flows transported in IPv4 packets MPLS and BGP nexthop supported Defines 104 fields, including L2 fields Reports flow direction Template-based flow format (built on V9 protocol) Supports flow monitors (discrete caches) Supports selectable key fields and IPv6 Supports NBAR data fields Standardized RFC 5101, 5102, 6313 Supports variable length fields, NBAR2 Can export flows via IPv4 and IPv6 packets Built on NetFlow v9 protocol State-based flow logging (context) Pre and Post NAT reporting IPv6 flows transported in IPv4 packets Fixed length fields only Uses more memory Slower performance Single flow cache Less common Requires more sophisticated platform to produce Requires more sophisticated system to consume Even less common Only supported on a few Cisco platforms Missing many standard fields Limited support by collectors

15 Network: Configuring Flexible NetFlow 1. Configure the Exporter Router(config)# flow exporter my-exporter Router(config-flow-exporter)# destination Configure the Flow Record Router(config)# flow record my-record Router(config-flow-record)# match ipv4 destination address Router(config-flow-record)# match ipv4 source address Router(config-flow-record)# collect counter bytes 3. Configure the Flow Monitor Router(config)# flow monitor my-monitor Router(config-flow-monitor)# exporter my-exporter Router(config-flow-monitor)# record my-record 4. Apply to an Interface Router(config)# interface s3/0 Router(config-if)# ip flow monitor my-monitor input

16 Network: Switch Flow Record configuration! flow record CYBER_3KX_FLOW_RECORD match datalink mac source-address match datalink mac destination-address match datalink mac source-vlan-id match ipv4 tos match ipv4 ttl match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port collect interface input snmp collect interface output snmp collect counter bytes collect counter packets collect timestamp sys-uptime first collect timestamp sys-uptime last!

17 ! flow record CYBER_ISR_RECORD match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface input collect routing next-hop address ipv4 collect ipv4 dscp collect ipv4 ttl minimum collect ipv4 ttl maximum collect transport tcp flags collect interface output collect counter bytes collect counter packets collect timestamp sys-uptime first collect timestamp sys-uptime last collect application name! Network: Router Flow Record configuration

18 Network: Firewall (ASA) NSEL configuration! flow record CYBER_3KX_FLOW_RECORD match datalink mac source-address match datalink mac destination-address match datalink mac source-vlan-id match ipv4 tos match ipv4 ttl match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port collect interface input snmp collect interface output snmp collect counter bytes collect counter packets collect timestamp sys-uptime first collect timestamp sys-uptime last!

19 Part 3 Detection and telemetry

20 Detection: The evolution of Cyber Threats Viruses (1990s) Defence: Anti-Virus, Firewalls Worms (2000s) Defence: Intrusion Detection & Prevention Botnets (late 2000s to current) Defence: Reputation, DLP, App.-aware Firewalls Directed Attacks (APTs) (today) Strategy: Visibility and Context ILOVEYOU Melissa Anna Kournikova Nimda SQL Slammer Conficker Tedroo Rustock Conficker Aurora Shady Rat Duqu

21 Polar Bear Detection: Hiding in plain sight

22 Detection: Concept OODA Loop Unfolding circumstances Implicit guidance Outside information Unfolding interaction with environment Cultural Traditions Genetic Heritage Analysis & Synthesis New information Previous Experiences Observe Orient Decide Act Feedback Feedback Unfolding interaction with environment

23 Detection: Know the Attacker Who? What? When? Where? Why? How? Nation-state? Competitor? Individual? What is the target? Is there a time when the attacker is most active? Where is the attacker? Where are they successful? Why are they attacking what is their goal? How are they attacking Zeroday? Known-passwords? Insider?

24 Detection: Flow Based Anomaly using NetFlow

25 Detection: Behaviour Based Analysis

26 Detection: Components StealthWatch Management Console Reputation Feed (Optional) Other tools/collectors StealthWatch Labs Information Center StealthWatch FlowReplicator StealthWatch FlowCollector Cisco ISE NetFlow NetFlow StealthWatch FlowSensor NBAR NSEL Cisco Network StealthWatch FlowSensor VE Users/Devices

27 Detection: Where to launch NetFlow? Each network layer offers unique NetFlow capabilities Access Distributi on & Core Edge Catalyst 3560/3750-X Catalyst 4500 ISR Catalyst 4500 Catalyst 6500 ASA ASR

28 Detection: Providing Scalable Visibility Drilling into a Single Flow Yields a Wealth of Information 29

29 Detection: Identifying Reconnaissance Activity Long and slow activity to discover resources and vulnerabilities What to analyse: High number of flows High client byte ratio One-way or unanswered flows Flows within the subnet/host group Flows to non-existent IP s Flow patterns Abnormal behaviour StealthWatch Method of Detection: Concern Index High Traffic High Connections Trapped Hosts

30 Detection: Command and Control Periodic phone home activity What to analyse: Countries Applications Uploads/Downloads ratio Time of day Repeated connections Beaconing - Repeated dead connections Long lived flows Known C&C servers StealthWatch Method of Detection: Host Lock Violation Suspect Long Flow Beaconing Host SLIC Reputation Feed

31 Detection: Data Loss Intermediary resource used to obfuscate theft Data is exported off resource What to analyse: Historical data transfer behaviour Applications Time of day Countries Amount of data single and in aggregate Time frames Asymmetric traffic patterns Traffic between Host Groups StealthWatch Method of Detection: Suspect Data Loss Alarm

32 Detection: Identifying Malware Propagation Discovered host answers and vulnerability exploited What to analyse: High number of flows High client byte ratio Connections within the subnet/host group Flow patterns Abnormal behaviour StealthWatch Method of Detection: Concern Index, Target Index Scanning Alarms Touched Host Worm Propagation Alarm Worm Tracker

33 Part 4 Live Demo

34 Thank you!