280 likes | 308 Views
Drawing blood from a Stone. haroon meer | marco slaviero SensePost. Agenda. Introduction What this talk is about Complete control with: Outbound TCP Connections IPS in the way ? Outbound DNS Requests Outbound *nothing* Lessons Learned Questions ?. Introduction. Who we are SensePost
E N D
Drawing blood from a Stone.. haroon meer | marco slaviero SensePost
Agenda.. • Introduction • What this talk is about • Complete control with: • Outbound TCP Connections • IPS in the way ? • Outbound DNS Requests • Outbound *nothing* • Lessons Learned • Questions ?
Introduction • Who we are • SensePost • {haroon|marco} @ sensepost.com • (with extra case studies from {nick|bradleyj} @ sensepost.com)
What this talk is about? • Breaking into stuff! What this talk is not about? • Canned demos of Metasploit vs. 2001 Why ? • For a small reality check.. • To determine if we need to “sweat the small stuff” • Because its fun! How ? • Case studies…
Arbitrary Outbound TCP is bad.. • Least privilege is hardly a new concept.. • Limiting outbound TCP connections is a no brainer • Why? • Because attackers need to call home.. • Because we need our tools.. • Because we want to be comfortable.. • Because its your job to make sure we cant..
Why your IPS isn’t a Panacea • IPS appears to be interfering with our recon. • All we want to do is an innocent little port-scan.. • > 10 ports on one target -> shun source • > 10 targets in X seconds -> shun source • Vertical and Horizontal Scans -> shun source • Who does this stop ?
I’m ok! I only allow outbound DNS • Outbound UDP 53 is common on Firewall Configs. • *shrug* we don’t know why! • If I get to run commands on your server.. Then outbound DNS is my friend.. • SQL Injection + DNS tunnels circa 2002.. • SQL Injection + DNS tunnels circa today..
Ok.. What if I.. • Hardened my Web-server • Apache running with limited privileges • No outbound TCP • No outbound UDP • Teeny-Tiny reg-ex problem in my application.. (can you spot it?)
Lessons Learned… • Know your enemy? (who are you up against?) • Know the limits of your defenses.. • Detection is an important piece of the puzzle. • Basics are still necessary! • There is no unbeatable security measure..
Thank You Questions?