Lecture 03

[Music] so today we are continuing with the locked Martin cyber kill chain that we started yesterday and uh we only could go through two of the uh seven stages uh the reconnaissance and weaponization and we'll talk about the uh the next uh five stages hopefully today but before that again we uh want go to mente.com and try this okay so you have the code today 2131 2349 so this question is uh rank in order of importance for an IT system security what is more important confidential integrity and availability so again you can push on your screen to give importance okay okay so what we seeing the trend is that uh confidentiality that is data privacy is given more importance data Integrity that no unauthorized modification of data has happened is given the kind of second Rank and availability that is if it is a system that is providing a service it should be available as the users need so which means that if it is a web service it should not be down more than so often if it is a service that uh you are using internally for example uh your uh email system it should not be down uh more than so often so that's the availability now the reason why I put this question here is last night I was reviewing a draft regulation for a power system in the country and in that the objectives of the regulation was written as confidential it integrity and availability and the non-repudiation that is if somebody has done some modification or done some access they should not be able to say that it was not me right so that's non-repudiation so when I looked at that I said well we are talking about power system operators we are talking about generation company that generates electricity either through thermal energy or through other kinds of uh energy or solar or maybe nuclear or uh Hydro or there are transmission companies which carries power in this you know very high voltage transmission lines from the generation location to the distribution locations or there are distribution companies like kesco in kpur or upcl in lakau ETC who are actually uh getting power from generation companies through transmission companies and then uh you know put giving that power to your houses or local factories and so on now these companies if you say that the goal of cyber security uh measures in these companies is confidentiality Integrity availability and non- repudiation doesn't make mean anything right so so the goal of uh a power system company is actually provide something uh to their customers for example a generation company their goal is to provide uh generated electricity to the customers in this case the customers are actually the uh uh the distribution companies and distribution companies uh the transmission companies are uh delivering that electricity as and when needed to the distribution companies and distribution companies are delivering electricity to the customers and customers and uh they have a certain service level agreement which is based on uh some of them are based on actually regulation like you have to in India you cannot give uh 50 HZ uh Power uh you have to give uh uh 60 HZ right so in India no India is 50 HZ I think uh us is 60 HZ so you have to have a certain frequency you have to have certain voltage level you have to have a certain quality of power so you cannot have voltage dropping all the time right there in rural places sometimes there are distribution companies where the power distribution actually is pretty bad quality like you know you you have the bulbs flickering and all kind of low voltage so this kind of stuff but that is not what the customers expect so if you ask me what is the goals of a cyber security rules or regulations for such companies I would not say confidentiality Integrity availability non repudiation I'll say that that I should be able ble to withstand cyber attacks and still provide the services as promised to my customers right so whatever is the level service level agreement or whatever is the regulation like you know what is the frequency level frequency cannot like exactly frequency may not be exactly 50 HZ but it cannot go more than few you know uh uh z uh few uh 0304 Hertz the Excursion cannot be too long because that will basically disturb the entire grid right and then I should also make sure that whatever disturbance happens due to Cyber attack on me should not Cascade to my customers or the other interconnected components so that should be the objective now to fulfill this objectives I may have to make sure that I maintain the Integrity of the uh information that flows through my control systems I should have my control system available that is the control uh like uh generator control or whatever control is uh being used to make sure that the electricity is generated at the right frequency right voltage the the voltage is maintained through the transmission system the uh there is no loss power loss through the transmission system all that control has to be protected from cyber attackers to change the information that flows from sensors to the controllers and controllers to the actuators right so so this putting this confidentiality Integrity availability as my goal of cyber security rules and regulations make no sense right so it should be always based on what is my business so if I say what is the why why should I do a cyber security of I kpur right so if I say because I want to maintain confidentiality Integrity availability then the question will come of what right not everything has to be confidential there are a lot of information that is not confidential not everything uh Integrity change will affect us not not necessarily that everything has to be available 100% of the time so I have to say what is my business and what is my service and what quality of service I have promised to my customers and my goal would be to maintain that functionality and quality performance at the uh when Cyber attack happens and to do that I may have to do something about uh protecting certain databases protecting certain Services protecting some data in the uh that that moves through the network from servers to clients or server to server network devices access to servers Etc and I should have the availability based on what I have promised to my customers if I have promised that 99.9999% of the time this service should be on then I have to do that irrespective of how I do it like whether it's an availability part of the system or it's the confidentiality or the Integrity part of the system so I I think that this is very important to understand because many times when you ask somebody what is cyber security they say that cyber security is the ability to maintain confidentiality Integrity uh availability and non-repudiation that's a common uh definition of cyber security but when it comes to practical cyber security it's not by saying these things make uh you know very little sense uh without knowing what services are you offering and what performance of that service have you promised and how to maintain that promise without uh being affected by Cyber attack so so all your efforts uh using firewalls using antivirus using endpoint uh security using network monitoring uh using uh strong authentication everything will be in service to what you have promised as service quality and Service uh availability to others right so that's what uh um I that's why I put this question just to see now the second question is how do you know that your internet facing systems like your web server maybe your email server FTP server or any web application uh that you are running how do you know that your uh internet facing systems are being scanned by sending packets to it and looking at the response to those packets and you know making inference from the [Music] responses okay so remember that not every internet facing system is web service right you may have an SSH service running which is internet facing your your VPN might be running you may have a uh FTP running you may have uh many other services that may be running web service is one of them so web server logs will only give you things that happen to the uh web servers or attempts to connect to the web server or attempt to send HTTP messages to the web servers that's what you will get from the web server logs so if somebody is sending PC P sin packets or somebody's sending sending ping you w't get that in the web server right so uh that will only be visible if you have a network monitoring so if your network monitoring will give you that kind of information okay so next one what would you check to find if someone visiting your website someone is visiting your website from suspicious IP addresses okay so how do you know whether somebody is visiting your website TCP connection to well they will certainly make TCP connection to uh Port 0 or Port 443 right but you do not have to necessarily do Network level uh information in your web server log you will get get request right HTTP get request so from the HTTP get request you can get that information right so you do not necessarily you can get the information from network monitoring as well but uh you do not necessarily have to go that far so depending on what you are looking for you have different logs and the certain uh see network monitoring is actually of course uh we should have network monitoring for every infrastructure but if you cannot afford network monitoring because network monitoring means that you have to actually have a pretty fast uh you know packet capture because network monitoring basically mirrors the port through which the network traffic comes and then sends that data to a system where you actually process the packets and get intelligence out of it like where the packet is coming from you may sometimes have to qual certain number of packets to actually see what it is it may be a file it may be a malware and things like that which is rather expensive so if you cannot afford uh network monitoring for this particular problem statement that I want to see who all are connecting to my uh website web server lock should should suffice right but Network monitoring will also give you that information and more information yes we Define suspicious so well that depends so for example there is an abuse DV database uh that you can always check an IP against if see see whether that IP is already listed as uh malicious uh there could be other uh uh threa analysts can actually collect their own set of uh IP addresses which they have seen in the past doing certain activities you could also see whether the country like if the IP is not VPN based or tour based then it could also show you the country uh by going to kuiz database or IP location database so you can find whether it's coming from a country where you are not expecting traffic from so suspicious is actually a relative term right what is suspicious to me may not be suspicious to you right so but every company has their own threat intelligence to figure out what they will count as suspicious and what they will ignore right but by ignoring they might make a mistake but uh there is only so much information they have right so that that is the way it is okay so so you don't want to be doxed right you know the term doxed so when somebody uh somebody is upset with you they put up your home address your personal mobile number maybe your personal email etc etc uh your location in the on the social media or Internet so that other people can go and bother you right so that is called doxing right now most of the time by going to social media we docs ourselves right if you go to my LinkedIn or Facebook page and if you really are want to know a lot of things about my whereabouts and where I'm going and all that stuff you can figure a lot right so the question is now as as yesterday we said that the reconnaissance one way of doing reconnaissance is to find an an employee or user inside the organization and use you know some kind of this fishing email or fishing message on their WhatsApp Etc to actually hook them and then uh you do uh get into the foothold into the system so if you don't want that to happen if you have this uh uh issue that uh uh what how do you avoid this now I have three choices provide your contact details uh you should not provide your contact details on social media uh or uh should not have social media presence and the third is be aware and do not click on links or download pictures at Etc from unknown uh senders now so in cyber security is always about a trade-off trade-off between usability and security right sometimes when we make things very secure for example two Factor authentication we actually make it very difficult for many users some users are okay with two Factor very easy for them some for some uh people it may be difficult so usability versus security so you have to figure out the risk versus benefit right so if you keep the uh two Factor authentication off then you are taking a lot of risk now if your system that that that you are trying to protect by having two- Factor authentication does not have too much impact on you even if it gets compromised then you you can uh get rid of two Factor authentication and take the risk so every organization or every individual has a acceptable risk so risk is never zero so anything we do on the on the digital uh realm has risk the question is how much risk can you tolerate so if you can tolerate a risk like suppose you have a second phone uh and you that phone you do not do banking or any such things then you can take a lot of risk on that phone but the phone on which you are doing your internet banking UPI Etc you cannot you will always have a screen lock and all that stuff because you want to have in the in the uh as a trade-off between usability and security you will have a security on that one because the risk is higher there the other phone that you only use for video games or something you may actually take more risk right so risk and securities uh risk of uh being compromised versus uh uh versus the usability is always a trade-off so so in this case for example uh most people would like to be on social media have uh connections either in LinkedIn kind of connections or uh the uh social uh Facebook Instagram kind of connections whatever most people would like that so so their best option there is that uh be extremely careful because be prepared to be doxed on those platforms and then you will get lot of uh uh spam uh and lot of fishing emails or fishing messages so you have to be extremely careful so this is what is called uh you know risk mitigation by putting in controls so we cannot always get rid of the risk so we mitigate the risk by putting in controls and controls don't do often people think that controls means firewalls and and endpoint security Etc controls could be also a method of methodical uh Habit or process a process that everybody has to go through so this is a control so the the one that you have 27 of you have chosen this is actually a risk mitigation by exerting a control so uh the by not being on social media you are that is another type of control but there maybe your benefit is too low the in the tradeoff is too much right if you are not at all on social media then your chances of getting docked reduces drastically so that's a good control but that control may not be uh uh good enough for as a trade-off so as a tradeoff it is better to have a control that more or less will give you the uh chance of uh avoiding any kind of U compromise but for that you have to do some kind of a control uh of your own behavior right so the all these things will come later that when we talk about risks and then how to mitigate risk with controls some of the controls are technical controls and some of the controls are process level controls so this is an example of a process level control do not trust any email without doing due validation now the last question I have for today is uh why is it easy to uh weaponize these days if you find a vulnerability anybody any person in not with not even having any education in uh cyber security or computer science can do weaponization okay so so those who are choosing that people are more cyber security educated and easily write malware I wouldn't say that right because uh writing malware is like after don't think that after finishing this class you will be writing malware you won't be able to write malware by doing this class or even doing the other classes in cyber security so so we are not teaching malware design in this institute but it is easy to learn if you want to learn uh there are a lot of material on the web so uh that's not the issue but that's not the overwhelming reason maybe some of the cases people are writing their own malware but in most cases they're purchasing the exploits and malware in the dark web and the third one which got very little support is also a case right so ransomware service is very common so you actually go and uh tell a ransomware service uh platform that here is here are the uh IP address and uh here I want the ransomware to be used there to exploit and the money is kind of divided right so whatever money uh the attackers get some part of part goes to the platform vendor right so so that is also common so weaponization has become easy now what is the implication of that to us we are we are the good people right we are the Defenders right and we are talking about attackers so the since it's easier for attackers the job for us gets harder right and also the risk goes up right so risk as we'll see later the risk is based on threats uh and vulnerabilities and the impact so threat here is increasing right so the threats are easy to uh come up with and threats are easy and vulnerabilities are often not ped so together uh it's a deadly combination for us and therefore we have to work harder for security okay so now going back to the uh main lecture so reconnaissance we already talked about that is how they find how to get into your system and if you are Defender you always have to uh make sure you continue to watch the logs watch the network and so on to see efforts of reconnaissance and that will keep you you know raise your posture your cyber security posture when you see a lot of reconnaissance activity then you know that it's time to up the game for defense so so weaponization we talked about that they figure out how to what malware to use or whether to use fishing or whether to directly exploit an internet facing service and so on and for as a Defender if an weaponization happens and you get affected you have to have an ability to uh do forensic afterwards so that you are prepared for next time right so what is written on the defender side is after actually the weapon that was created has been detonated on you and you're trying to learn from it by doing cyber forensics for the next time you just you don't necessarily say well this did not affect me too much only two unimportant machines got affected so I I I just cleaned them up with uh you know uh rebuild the system or whatever and then I am happy right no you have to do very detailed forensics to figure out how this happened so you have to also do a forensic analysis of root cause what path was taken by the attacker whether it was by exploiting a service uh a ability at in an internet facing service or is it through fishing or some kind of social engineering or somebody brought in a some kind of USB stick and plugged it in by not knowing or knowingly into this and launched a malware into the system all this stuff has to be analyzed and used as some kind of reparation for bettering your cyber security posture okay so and also uh this malware's metadata and analysis can tell a lot about it you can also tell uh who might be behind it by looking at the time of the day when the actual uh launch launch of the attack happened because that will tell you which geographical region the attack might be from right so so this kind of information has to be collected uh if you are affected so the third stage is uh delivery so you have figured out how to get in you have figured out what payload to deliver but you have to now deliver the payload either by exploiting one of the vulnerable services or by uh doing some kind of uh social engineering like fishing email or uh fishing messages and so on there are also other kind of tricks like Watering Hole attacks so what you do is that you create some kind of a buz in the social media or in some other Forum there are also uh telegram channels or Whatsapp channels uh chat rooms where you say that oh this is a very good website you are getting big discount there so a lot of people goes there right and everybody gets affected so this is called a watering hole attack right so you might have seen many of you might have seen that sometimes you will see on social media uh some kind of a post that kind of says that uh mukes Amani doesn't want to want you to know how he is going to make money and then uh picture and stuff gives a Bitcoin or something right so many people will think that really mukes am said something or amitab ban or some somebody and then you go in there and you think that this is a new site it will tell you how to make money and all that stuff and then you get affected right so this kind of Watering Hole is very common so uh so you have to uh once that happens as a Defender uh you have to figure out what was the delivery medium how it was delivered uh the uh and then uh you also have to see who were uh targeted for example the the Ukraine power grid attack that happened in 2015 they actually did fishing of high Executives and the high level Executives one of the high level Executives of the the company Distribution Company Ukraine's uh Distribution Company in cave uh clicked on the link and then got affected by malware then the malware actually you know did a lateral movement into other machines and found a bunch of VPN credentials these VPN credentials it sent back to its command and control servers and using that VPN they got into the actual power system operations Network and then they actually not only change power system operational Network at the same time they actually disabled the UPS so and then turned off all the computers so even UPS not being there it was actually you know you could not have any power it was turned off right away and that's how the operation happened so who is targeted is important like is it Target like random targeting or is it very uh specific targeting is it a spear fishing or regular fishing right so that you have to know then uh from these things you have to understand the intent of the adversary why is the intent of the adversary very important because if it is a script Kitty who is just playing around it's less of a problem if it is an activist then it's a little bigger problem problem but it may not be as big a problem if it was a nation state you know advanced persistent thread group they have deep resources they have deep knowledge and they that means that you are at a big big problem right so figuring out the intent of the adversary and who the adversary is by looking at the day uh time of the day Etc is very relevant and important and then you collect information from the for forensics now if you look at this paper I I already posted the paper also if you look at this paper they are not talking about proactive defense they're talking about after the incident happened what I should do as Defender to prepare for the next time right so of course uh you can also learn from other organizations which got attacked not not you and you can get all this information on how that happened and then accordingly also raise your cyber security posture so it does not necessarily have to happen to you to learn how to defend so in the US they have this things called information sharing and Analysis centers Isaacs so for every sector they have an ISAC like for example they have an Isaac for finance Finance uh bfsi sector Banking and finance sector they have an ISAC for uh ICS industrial Control Systems they have an Isaac for you know oil and gas sector and so on so Isaac is information sharing so all the organizations who are member of the ISAC if an attack happens on them they they shared that information about root cause uh forensic information and so on so that all the other organizations that are part of that Isaac also learned from there right unfortunately in India there the isacs are not active there are some isacs but the they're not very active because organizations are very very uh uh you know uh what should I say very uh reticent about uh not sharing information in fact in India the the main uh problem is that when an attack happens to a company they hide it and by hiding that they uh are not helping the similar similar like other Banks if a bank gets attacked the other Banks should know what happened how it was happen how it happened uh and so on but uh very little information comes out but this sharing is very important in order for us to actually learn from other uh adjacent uh organizations so now we are in the third stage right so reconnaissance weaponization now delivery so the attacker has now delivered the first payload through fishing or whatever so now the uh delivery of the payload does not necessarily mean that uh the attack will take place because somebody has to click on the link or somebody has to turn on the uh you know malware but or launch the malware by double clicking on it or something right unfortunately this is not fully true anymore because there are also something called zero click attacks so I don't know if you have heard of Pegasus Pegasus was a malware very Infamous malware from an Israel Israeli company Ino so they figure out they put a lot of money in researching figuring out exploits in especially in Mobile systems mobile like iOS or uh Android or some of the applications that come with this Android or or iOS and try to find out a vulnerability that nobody else has found yet so these are called zero day vulnerabilities because a white hat hacker or a responsible a hacker will do a responsible disclosure as soon as they figure out there is an exploit they will go to the company and say that look here is an exploit here is a vulnerability you have and it can be exploited this way please fix it the companies usually especially companies which has large user base like WhatsApp or iOS or Android Etc they take this very seriously they immediately test for it and then try to fix it and when they fix it they dispatch an update so you always get an update from iOS or Android Etc now if the hackers do not even tell the company and the company also continue to do research finding vulnerabilities but maybe some vulnerability they also missed so in that case this becomes a zero day vulnerability zero day vulnerabilities are then divid divided into two one is that if I deliver an exploit of that vulnerability to your machine you may have to double click or something user may have to take an action before it can be launched and the other division is what we call zero click vulnerability that is user do not have to necessarily do anything as soon as the exploit comes in it will execute so this zero day Zero click vulnerabilities are the uh way the NSO the Pegasus system works they don't rely on user to be fooled now these are most virulent type of attacks because the user has no clue right so you may be very careful about fishing not clicking on unknown links not clicking on unknown the you know files and so on but zero day Zero click you know all bets are off so that's what Pegasus used for for example in the uh uh uh uh initially in 2009 19 they found a zero day Zero click bug in the video call feature of WhatsApp and uh the latest one that was very famous in 2021 that was in the uh uh the FaceTime uh in the iOS uh exploit right now there is a Marketplace for these vulnerabilities so this uh uh so if there are web websites where you can go and get even up to $1 million for uh uh you know giving a vulnerability report that nobody knows about yet it's a zero day vulnerability and if it is a zero click you get up to million dollars right so there is a there is also a black market of that in the dark web so so there is a book by a New York time uh uh cyber security uh journalist uh called the this is how the world will end and she predicts that uh if we do not control this zero day uh Marketplace black Marketplace then countries will basically destroy each other's uh nuclear facilities and other things and and eventually it will go out of control right so once a nuclear thing starts others will retaliate and and there that's a little bit of a uh pessimistic book but it's a very good book about if you want to know more about this uh dark Market of uh zero day vulnerabilities so so if it is not a zero day vulnerability then you expect the uh somehow you have to lure the uh the victim to actually click on the links or it may be a vulnerability that can be uh a a remote code execution vulnerability or something through which you can actually make things uh uh you know start running on the system so in this case case so so Del after delivery we are now in the exploitation stage this is stage four so how do I stop exploitation so let's assume that reconnaissance was done and and somebody was targeted and the targeted person actually was fooled into clicking on something and then the the actual the weaponization and delivery happened now I have to figure out how to stop the exploitation right so to stop the exploitation uh of of course if it is not a zero click vulnerability then user awareness goes a long way right the user knowing what to do and what not to do is a very important one and that's why we often do this uh fishing drills and and other things to make sure that the users are used to uh being cautious uh we also can do like most of these payloads will only uh do something if there is a vulnerability in the in some system like it may be an application it could be the operating system it could be the network stack it could be the web server and all that so secure coding Etc are important to make sure that vulnerabilities are avoided as much as possible we have to do regular vulnerability scan and patching so that we can patch these vulnerabilities there is also endpoint hardening that is you know so we when we go into to MIT defend discussions we'll see what hardening is all about but when we basically take a system and uh make a lot of configuration changes make sure all the operating system and applications are up to date uh we make sure that all the unnecessary ports are closed we make sure that there is regular users and not administrative users only there is very responsible uh way of using the administrators account these are called hardening it's about making the system hardened against any kind of attacks doesn't mean that you will avoid all attacks but many attacks can be avoided by hardening your system so so hardening is another important thing to do and then continuously monitor the end points that is having a visibility into what's running on the system whether new processes are being spawned whether some file system is being changed whether a u suspicious IP is being contacted by the machine all this information can be found by putting an agent on on the device and have that agent report to the security Operation Center what is happening at the end point so so all these things have to be done in order to avoid the exploitation so remember that uh the claim of locked Martin is that uh I am I am telling you that these are the seven steps that all attackers has has to take if you can stop it in the stage one good if you cannot stop it in stage one try to stop in stage two if not then try to stop in the stage three that is at the delivery phase if if you cannot stop in the delivery phase try to stop in the exploitation phase so this is the way they think that I have to cut the chain at some point to reduce the possibility of full-fledged damage right so that's the idea so so the next one is installation so uh uh see the the problem is that if you just have a payload that executes once and then uh the user logs out or user shuts down the machine and and everything goes away then that's not good for you right as an attacker so the attacker tries to do what is called a persistence so they are calling installation here so they remain persistent in the machine so they can actually write themselves their binaries into startup folder in a windows so that next time Windows start the process will start or they will try to inject themselves into a important service right so the code will execute when that service turns on uh so they can also put a webshell so they can actually go to your web application and find uh the write down the uh address of the web shell and they can actually get a shell into your machine uh and then start doing their manual exploitation so various kinds of things they can do for uh creating persistence so the persistence or being installed into the system is one of their important objectives right to stay persistent remain in the system so that they can provide a back door they might be opening a port and the far attacker from the far will use that as a service to connect to your system right so they can do various things or you can get a webshell and that web shell would actually allow you to have a shell access to this and and if the person is running the web application as root which many people by mistake uh do then you will get a root shell which means you will have full administrative control on that machine so here the defender has to actually continue to do the what they're calling hips host intution prevention system nowadays people call it endpoint detection or endpoint protection system and then you have to understand if the malware requires administrative privileges or only the user depending on the what the malware wants to do but in most cases they try to gain the administrative privilege and that is what is called a privilege escalation so we have to keep auditing and and monitoring the end points if there are signed executables we have to figure out the certificates and you have to understand when the malware was uh created and so on now this certificate thing so nowadays nobody ex uh no uh operating system wants to execute a binary which has not been certified uh with a digital certificate that is you take the hash of the binary and do a encryption using the private key of the uh company like for example mic Micosoft right so no Microsoft binary comes without a certificate and the Microsoft operating system automatically knows the I mean it it already knows the public key of Microsoft uh signing uh public key so it will check whether the the binary has been signed and that gives them a confidence that this is actually a patch from Microsoft and I can execute it safely but things are not that simple anymore because the certificates get stolen right so in the case of stocks net certificates of legitimate vendors were used so therefore this process doesn't necessarily always work if the certificate is stolen okay so it's time so we'll uh we'll come at this installation stage tomorrow and then uh two more stages uh uh will command and control and uh the uh uh the actions on objectives that is the main impact and then we'll hopefully by by tomorrow we'll finish locked Mar uh this uh CKC cyber kill chain okay [Music] [Music] [Music]