2010JohnStrandKeynote pdf

What is Cloud Computing?

 I had to look it up

 I hear about it a lot, but I don’t have a clear concept of what it is

 Straight to the Wiki!

 “Cloud computing is Internet-based computing, whereby shared resources, software and information are provided to computers and other devices on-demand, like a public

utility.”

 I get it… It is like a Bot-Net!

But What is it?

 “It is a paradigm shift..” Oh oh… This is going to be good.

 It is a paradigm shift following the mainframe and client-server shifts that preceded it.

Details are abstracted from the users who no longer have need of,

expertise in, or control over the technology infrastructure "in the cloud" that supports them.[1]Cloud computing describes a new supplement, consumption

and delivery model for IT services based on the Internet, and it typically involves the provision of dynamically scalable and often virtualized resources as a service over the

Internet.[2][3]It is a byproduct and consequence of the ease-of-access to

remote computing sites provided by the Internet.[4]

 The term cloud is used as a metaphor for the Internet, based on the cloud drawing used in the past to represent the telephone network [5]_{, and later to depict the Internet in computer}

network diagrams as an abstraction of the underlying infrastructure it represents.[6]_{Typical cloud}

I Am Letting Wikipedia Write All

of My Presentations!

 Security could improve due to centralization of data[35]_,

increased security-focused resources, etc., but concerns can persist about loss of control over certain sensitive data, and the lack of security for stored kernels[36]_.

Security is often as good as or better than under

traditional systems, in part because providers are able to devote resources to solving security issues that many

customers cannot afford.[37] _{Providers typically log}

But Wait!!!

Did they say “Internet”

 “The term cloud is used as a metaphor for the Internet.”

 But the Internet is Evil!!

Lets set the stage..

 We have to know who it is we are working with

 Who are the people we are defending?

 Who is attacking?

 What are their capabilities?

 What are their means?

 What are the tools we have to defend ourselves?

Your Users

 They are trying to go places they shouldn’t

 Security is not a major concern

 They never get into trouble

 “It was just a pop-up!”

 They “think” they know what it would look like if they were attacked.

 No skull and crossbones? Good to go!

 You “think” they are “stupid”

Granny Max

 Loves to gamble

 Likes Polka Dots

 Likes anything with “Polka” in it

 Thinks the CD tray is a coaster

 Collects Gnomes

Phil… From Accounting

 Works with numbers…

 ... and Terabytes of Porn!

 Has a “slight” problem

 Does not get along with Granny Max

 Hates cats

The “Average” Users

 Does not gamble…

 … at work

 Does not surf porn…

 ….at work

 Likes: Facebook, YouTube,

Politics, eBay, Googling, Fantasy football, Fark, Drudge Report, the Huffington Post, CNN, Amazon

 Dislikes: Web filters

The Bad Guys

 Motivated

 Can you imagine their HR department?

 Wicked skilled (more on this later)

 They either own or infect many of the sites your more “interesting” users are going to

The Cloud

 The Internet is big…

 … really big

 You just won't believe how vastly hugely

mindboggingly big it is...

 Most of it is worthless.. and Evil!

 Many of your users will

Back to the Ninjas…

 Those “defenses” you have?

 Yea, about those

 Antivirus

 Can be bypassed easily

 SSL can be use against you

 and can be stripped off

 IDS/IPS can be bypassed

Ninja Evil #1: AV

 Last time I was out we bypassed AV with Metasploit

 One of you ratted me out

 Either that, or I could blame my father..

 Lets blame my father

 Now 6 out of about 40 AV Vendors consistently catch Metasploit Virus payloads

 In .exe form… They still don’t catch the word docs, Java, Javascript, C, Raw, or “other” encodings

 Uppercase

 In-fact… They don’t “catch” the malware… They catch the .exe template



Polypack is a Ninjas friend



Polypack will automagicly pack your executable

with 10 packers and check them against 10 major

AV vendors



You can then download the one that bypasses the

AV of your choice!!!



The angry calls to AV vendors will continue!!

Ninja Evil #2: SSLStrip

 Another great tool from Moxie Marlinspike

 This tool strips away SSL from the end user

 Hence the name

 The HTTPS will become HTTP

 No negative feedback to the user

 The vast number of users will not notice

 Even the very paranoid ones

SSLStrip Walkthrough

SSLStrip: Got one!

SSLStrip: Checking the logs

SSL Strip: /hackme

“But if the attacker is not on my

network….?”

 Stop. Right. There.

 They don’t have to be

 Starbucks

 Hotels

 Airports

 Remember Phil and Gran Max?

 They were using TOR proxies…

 SSL Strip works great in TOR proxies

 How much you want to bet they have the synchronized passwords?

 BGP Prefix attacks

BGP Prefix attack

 Announce someone else's Autonomous System Number

 Just be more specific

 Pakistan Vs. Youtube

 Pakistan 1, YouTube 0

 http://news.cnet.com/8301-10784_3-9878655-7.html

But if we fire Phil and Gran Max

we are cool… Right?

 Not so fast…

 In 2009 77% of sites that were hosting Malware were “legitimate” sites

Some offenders

 Newsweek

 MLB.com

 Facebook

 MySpace

 CNN

 Every blog site you can think of

The Point…

 If anything touches the Internet assume that it is going to be compromised eventually

 We covered just a few Ninja tricks, but there are many more

 Obfuscated Javascript and Flash attacks are scary

 If we start with this concept in mind we can adequately model the threats we are facing

 You cannot be too paranoid

 Cloud Computing does not help

Step #1

 Filter and monitor outgoing traffic

 I know I ripped on this earlier… But stay with me

 Restrict outbound ports

 Do your users need SSH, FTP, RDP, Telnet?

 Implement Web filters

 They are at least a start

 Look into Highly Predictive Blacklists

 For Traffic in and Traffic out

Step #2: Your Users Systems

 If they have a firewall…. Turn it on

 But we are behind our corporate firewall?

 You are protecting your users from each other

 If one system gets compromised it does not necessarily mean all of your systems get compromised

 Have a different Local Admin Account password for every workstation

 Sounds hard?

 It is not so bad

Step #3: Dealing with the Cloud

is what it is.

 Some things are great!

 Email, Ping Power Pipe hosting, DNS

 Some things are “less-great”

 Database processing, Document Management, HR

 Look at the contract

Your Administrators

 Should never, ever go to the Internet with Admin Privileges

 Need to be trained in systems/applications base-lining and hardening and incident identification

 SANS 564 Security for Systems Administrators

 This means the security team too!!

 Start talking about what a Internet white-list approach would look like

Conclusions

 The Internet is evil

 You will get compromised

Upcoming SANS Classes

 SANS Security for Systems Administrators

 http://www.sans.org/security-training/security-architecture-systems-administrators-1312-mid

 PaulDotCom

FIN

 http://pauldotcom.com

 [email protected]

 Twitter: strandjs

 Youtube Videos: strandjsgmail and pauldotcom