Episode 8: HACKERS: How we GET IN and how to STOP US

Introduction

The hosts introduce themselves and the topic of discussion, which is how hackers get into organizations and how to stop them.

Topic Introduction

• The podcast is about how hackers get into organizations and how to stop them.

• The hosts are Spencer and Brad from the Offensive Security Group at Secure IT360.

Importance of Feedback

The hosts encourage listeners to provide feedback on the podcast.

Feedback Requested

• Listeners are encouraged to rate, share, like, and subscribe to the podcast.

• Feedback helps improve the quality of the podcast.

Initial Access Techniques

Brad introduces three initial access techniques that are consistently successful in penetrating organizations.

Most Successful Initial Access Techniques

• Credential attacks (80% success rate)

• Credential stuffing: using compromised credentials obtained from data breaches to attempt login on other sites.

• Password spraying: attempting a few commonly used passwords across many accounts.

• Phishing attacks (10% success rate)

• Spear phishing: targeted phishing emails with personalized content.

• Whaling: spear phishing targeting high-level executives or individuals with access to sensitive information.

• Public-facing vulnerabilities (5% success rate)

• Exploiting known vulnerabilities in public-facing systems such as web servers or VPNs.

Credential Stuffing Attack

Brad explains what a credential attack is and describes credential stuffing as one of two specific types of credential attacks that are highly successful.

What is a Credential Attack?

• A credential attack involves logging into something using stolen credentials.

• Two types of credential attacks:

1. Credential stuffing: using compromised credentials obtained from data breaches to attempt login on other sites.

• Users often reuse passwords across multiple sites.

2. Password spraying: attempting a few commonly used passwords across many accounts.

Credential Stuffing Attack

• Credential stuffing involves using compromised credentials obtained from data breaches to attempt login on other sites.

• Users often reuse passwords across multiple sites, making this technique highly successful.

• Offensive Security Group crawls the dark web to obtain compromised credentials.

Reusing Passwords

The hosts discuss the prevalence of password reuse and its implications for credential attacks.

Password Reuse

• Many users use the same password or a similar password across multiple sites.

• This makes it easier for hackers to gain access to multiple accounts if one set of credentials is compromised.

Conclusion

The hosts conclude the podcast by summarizing the three most successful initial access techniques and emphasizing the importance of strong security measures.

Key Takeaways

• Credential attacks (credential stuffing and password spraying), phishing attacks (spear phishing and whaling), and public-facing vulnerabilities are the three most successful initial access techniques.

• Strong security measures such as multi-factor authentication can help prevent these types of attacks.

Importance of Fresh Credentials

The speaker discusses the importance of using fresh credentials and monitoring email accounts associated with an organization.

Using Fresh Credentials

• Stale credentials are worthless.

• Look for fresh credentials, generally within six months.

• Use these credentials not just for logging into email but also for other entry points.

Commonly Used Platforms

• Email is the most commonly used platform.

• Other commonly used platforms include Office 365 and G Suite.

• Remote access credentials are often found to match.

Reusing Passwords

• Bet on users reusing passwords across different platforms.

• Attackers may log into a user's Facebook or Google Meet account if they suspect password reuse.

• Many platforms lack password reset requirements and do not adhere to corporate password policies.

Best Practices for Security

The speaker provides best practices for improving security in an organization.

Enable MFA on Everything

• Enable MFA on everything, including public-facing resources.

• SSO and lateral movement between systems is easy, so secure everything.

Get Rid of Unnecessary Logins

• Reduce attack surface by getting rid of unnecessary logins to apps.

• Use SSO and MFA where possible.

Asset Management and Change Management

• Asset management and change management are often neglected but have a significant impact on security.

• Technical debt can lead to unpatched systems or systems that are no longer needed.

User Education and Credential Attacks

This section discusses the importance of user education in preventing credential attacks, specifically password stuffing and password spraying.

User Education

• Educate users not to reuse work passwords on other sites or use company email on third-party sites.

Password Stuffing vs. Password Spraying

• Password stuffing is using stolen credentials to gain unauthorized access to accounts.

• Password spraying is guessing passwords by leveraging human behavior in creating predictable passwords.

Password Spraying Techniques

• Use API forwarders from different locations to bypass lockout policies and defensive mechanisms.

• Use demographic or geographic information from websites to create word lists for potential passwords.

Importance of User Education

• Educate users on what constitutes a strong password and how to construct them safely.

• Provide tools like corporate-managed lockboxes for passwords such as LastPass or KeePass.

Using Randomly Generated Passwords

This section discusses the benefits of using randomly generated passwords.

Benefits of Randomly Generated Passwords

• Taking the human element out of credential management reduces the risk of successful credential attacks.

• Tools like LastPass can generate 25-character randomly generated passwords that are impossible for humans to remember but secure against attacks.

Password Managers and Credential Attacks

The speaker discusses the importance of using password managers to create strong passwords and mitigate credential attacks.

Password Managers are Great

• Password managers are a great way to streamline the process of creating and managing strong passwords.

• They make it user-friendly to have big passwords, even if you had a passphrase before.

• They allow for impossible passwords that bad guys are never going to get.

Importance of Strong Passwords

• It's better to have a 99 character password that you can never log into than having your bank account hacked into and losing all your money.

• Using password managers is encouraged from a corporate setting perspective as they help in creating strong passwords.

Web Application Exploits

The speaker talks about web application exploits being the second most frequent method of attack, especially on small vendor applications or homegrown applications.

Input Validation Issues on Small Vendor Applications

• Small vendor applications or homegrown applications tend not to do as much input validation as they should, making them vulnerable to web application exploits.

• Microsoft has unlimited resources, so we don't find input validation issues as much on things like SharePoint or Exchange Admin on O365.

SQL Injection Attack

• SQL injection is an example of web application exploit that can lead us down into the database right which we could then interact with directly leading us to take over the server.

• There are many resources available such as plugins for burp for fuzzing parameters in fields and everything, making it easy for attackers to craft successful ways of interacting with SQL.

Importance of Cross-Site Scripting Vulnerabilities

In this section, the speaker discusses the importance of cross-site scripting vulnerabilities and how they can be used for initial access.

Cross-Site Scripting Vulnerabilities

• Cross-site scripting vulnerabilities are commonly found in web applications.

• These vulnerabilities can be used for initial access to an application.

• Stored cross-site scripting is especially dangerous as it allows attackers to execute code on a victim's browser even after they have left the website.

• Credential attacks and injection points are sought after by ransomware groups and other threat actors.

How to Address Web Application Vulnerabilities

In this section, the speaker discusses ways to address web application vulnerabilities.

Addressing Web Application Vulnerabilities

• Use vulnerability scanners like OWASP ZAP or Vericode for static and dynamic scanning.

• Burp Academy offers free training on web penetration testing using Burp Suite Pro.

• Bloodhound can be used to find attack paths for free.

• Research and learn about these tools to find low-hanging fruit.

Finding Low-Hanging Fruit in Web Application Security

The speaker discusses the importance of finding easy vulnerabilities in web application security and recommends using free tools like OASP to improve app security.

Using Free Tools for Easy Vulnerabilities

• With a little bit of research and some free tools, it's possible to find easy low-hanging fruit vulnerabilities.

• OASP is a great resource for those interested in web application security. It offers free resources to help people improve their app security.

The Importance of OASP in App Security

The speaker emphasizes the importance of OASP as a resource for improving app security.

Working with OASP

• The speaker has been working with OASP as a volunteer for 20 years.

• Everything that OASP does is free, which is its mission statement: to put out awesome free stuff to make people better at app security.

Phishing: A High Success Rate Tactic

The speaker explains why phishing belongs on the list despite being rarely used in offensive operations due to its high success rate compared to other tactics.

Why Phishing Has a High Success Rate

• Phishing involves sending out links and emails, making it similar to fishing.

• Its success rate is higher per capita than other tactics because there is very rarely a question of success or failure when it comes to red team fishing.

• If email defense isn't completely mature or if attackers have enough money and time, they can bypass email filtering by buying an expired top-level domain with good reputation and spinning it over to G Suite.

• By creating a valid entity coming from Gmail with a reputable domain, attackers can bypass all filtering at that point unless filters look for changes in domain registration.

Bypassing Email Security with Legitimate Sites

The speaker explains how attackers can bypass email security by using legitimate sites that offer website builder or code writing services.

Using Legitimate Sites to Host Fake Login Pages

• Attackers can use legitimate sites like Glitch to host fake login pages.

• These pages are hosted on the actual site and have a legitimate certificate, which can bypass URL filtering done by email security products.

• With a little bit of sophistication, time, and resources, attackers can bypass some email security measures.

Reviewing Tech Stack for Email Security

The speaker recommends reviewing tech stack for email security instead of paying someone to build out infrastructure for phishing attacks.

Reviewing Tech Stack for Email Security

• It's more cost-effective to review tech stack for email security than paying someone to build out infrastructure for phishing attacks.

• By looking at the tech stack, it's possible to tell if it's easy to get around or not.

• Larger corporations tend to be targeted constantly and may already have mature email defense.

Phishing and Email Defense

In this section, the speakers discuss phishing and email defense. They talk about how phishing is multifaceted and expensive to do against mature organizations. They also provide tips on how to improve email filtering.

Phishing Engagement

• Phishing engagement serves to answer multiple questions such as whether a payload can be bypassed, if the user will click on it, and if it will call out to myc2.

• It is expensive to do phishing against mature organizations.

• Once you get through the hurdles of doing phishing, something will execute and run.

Understanding Goals

• Understanding goals is important when considering phishing.

• Customers are usually worried about their tech stack for email defense or endpoint security.

• Endpoint assessment should be done as part of an internal pin test.

Tips for Improving Email Filtering

• Find an email filtering vendor or tool that sandboxes and explodes attachments and URLs.

• Use virus total checks as part of email filtering evaluation.

• Test your email filters by sending emails with specific attachments, documents, links, etc., through your filter.

Free Tools for Security Testing

In this section, the speakers discuss free tools that can be used for security testing. They mention various tools that can be used for password policies, scanning with Burp or Zap, testing email filters, etc.

Free Tools for Security Testing

• There are many free tools available for security testing such as Azure password policies, Burp community free version, Zap from OWASP (free), etc.

• Testing users' passwords is a good starting point.

• Setting up tools that you already have with Azure password policies is another good starting point.

• Scanning with Burp or Zap can help identify vulnerabilities in web applications.

• Testing your email filters by sending emails with specific attachments, documents, links, etc., through your filter can help identify weaknesses.