Speaker: Chris Ayers

See live blog table of contents for more posts

---

Slides/github: https://github.com/codebytes/mitre-attack-for-devs

Security has changed in last 5 years

• Patch Tuesday has about a thousand patches. That is about as many as all of last year!
• MS authenticator – have to type a number vs just clicking approve
• Growing attack surface – ex: cloud
• Sophisticated adversaries – nation-states, organized crime, insider threats. Water treatment plans
• Complex attack chains – multiple techniques chained togehter
• Traditional defenses – focus on single points of failure
• Goal today is to protected identity, session and data access

OWASP

• renamed from Open Web Application Security Project to Open Worldwide Application Security Project
• community driven security standards
• top 10
• vulnerability classification, remediation guidance, prevention focus
• Focuses on vulnerabilities from point of view of what breaks. Looks at application layer
• Should use both OWSP and ATT&CK

MITRE ATT&CK

• MITRE came out of the military.
• Not community driven
• Knowledge base
• 14 tactics, 200+ techniques, 400_ sub techniques
• Derived from actual cyber attacks and threat intelligence
• MITRE also does CVEs, ATLAS (ML threats)
• Focuses on adversary behavior from point of view of what attackers do. Looks at adversary-informed defense across entire attack lifecycle
• More specific

ATT*CK

https://attack.mitre.org

• Tactics – focus on the “why” of the attack
• Techniques – how the attack happens (ex: spear phishing)
• Sub-techniques – ex: spear phishing over email
• Procedures – real world examples

Real world

• Kill chain is not linear
• Loop backs, paralel activities
• “crooked line”

Solar winds

• Backdoor into signed update
• DDL executes
• SAML credential threat
• Command and control via DNS blending
• Data exit over C2

Initial Access and Credential Attacks

• Make access decisions explicit
• SQL Injection vs parameterized queries
  • Detect credential stuffing – too many request too quckly from same IP

Execution and Command injection

• Command injection vs command whitelisting
• Unsafe deserialization

Persistence & Session Hijacking

• Vulnerable session management – that last forever
• Web shell detection – looking for extension isn’t enough. if do prevew can run JavaScript

Credential Access & Secrets

• Try to use managed identity instead
• Rotate secrets; better to use short lived tokens
• Use key vault
• Don’t put api keys/tokens in source code
• GitHub alerts if check in a key to public repo. Can auto expire the checked in token. Even cleaning history not enough because people can subscribe to commits. Need to protected with pre-commit hook on your machine

Defense Evasion & Log Tampering

• Correlate logs from different sources
• Log injection
• Tamper evident logging

Supply chain compromise

• Malicous packages,
• event-stream, solarwinds, log4shell, xz utils, sai hulud, notepad+, axios, etc
• 2021 – Log4Shell was a dependency trust failure. It waa bug. People didn’t know if using because used other things that included. Also needed SBOM for own software.
• 2024 – XZ Utils – 2 year long con.- “Jian Tan” submitted first patch in 2021. Sock pullets pressure maintainer so Jia becomes co-maintainer. Backdoor in tarballs only in 2024. Found March 29th by accident because SSH was 500ms slower from a Microsoft researcher looking at PostGres performance. Goal was to get this into Fedora so in next major release of Red Hat Linux.
• 2025 – NotePad++ update hijack – We hosting infrastructure compromised. Web host trojanied the update.exe by adding a side loaded (loading malicious file) DLL.
• 2026 – Axios NPM Compromise – March 31 for 3 hours there was an extra dependency with a remote access trojan. The post install script downloaded software to allow remote access. It was just a patch release so not looked at closely.

Patching is more than deploying

• Patch the dependency -> inventory affected services
• Restart the service -> Verify the critical workflows
• Close the ticket -> check for prior compromise

Collection & Exfiltration

• 2015 – anthem – slowly stole data over http request
• 2022 – LastPass – stole tokens targetting developer’s home PC
• Helpful to have baseline statistic on how much data usually have so know when unusual
• API rate limiting with exfil detection

MITRE website

• Multiple matrixes
• Can read about details of attacks such as detection/mitigations.

My take

THere were lots of examples including technique names/numbers. I feel like I got a good feel for ATT&CK. I also poked at https://attack.mitre.org as well to get a feel for what it looks like. A lot of different items shown as well both as code and as mapping to ATT&CK. And the recent events examples.