Speaker: Chris Ayers
See live blog table of contents for more posts
Slides/github: https://github.com/codebytes/mitre-attack-for-devs
Security has changed in last 5 years
- Patch Tuesday has about a thousand patches. That is about as many as all of last year!
- MS authenticator – have to type a number vs just clicking approve
- Growing attack surface – ex: cloud
- Sophisticated adversaries – nation-states, organized crime, insider threats. Water treatment plans
- Complex attack chains – multiple techniques chained togehter
- Traditional defenses – focus on single points of failure
- Goal today is to protected identity, session and data access
OWASP
- renamed from Open Web Application Security Project to Open Worldwide Application Security Project
- community driven security standards
- top 10
- vulnerability classification, remediation guidance, prevention focus
- Focuses on vulnerabilities from point of view of what breaks. Looks at application layer
- Should use both OWSP and ATT&CK
MITRE ATT&CK
- MITRE came out of the military.
- Not community driven
- Knowledge base
- 14 tactics, 200+ techniques, 400_ sub techniques
- Derived from actual cyber attacks and threat intelligence
- MITRE also does CVEs, ATLAS (ML threats)
- Focuses on adversary behavior from point of view of what attackers do. Looks at adversary-informed defense across entire attack lifecycle
- More specific
ATT*CK
- Tactics – focus on the “why” of the attack
- Techniques – how the attack happens (ex: spear phishing)
- Sub-techniques – ex: spear phishing over email
- Procedures – real world examples
Real world
- Kill chain is not linear
- Loop backs, paralel activities
- “crooked line”
Solar winds
- Backdoor into signed update
- DDL executes
- SAML credential threat
- Command and control via DNS blending
- Data exit over C2
Initial Access and Credential Attacks
- Make access decisions explicit
- SQL Injection vs parameterized queries
- Detect credential stuffing – too many request too quckly from same IP
Execution and Command injection
- Command injection vs command whitelisting
- Unsafe deserialization
Persistence & Session Hijacking
- Vulnerable session management – that last forever
- Web shell detection – looking for extension isn’t enough. if do prevew can run JavaScript
Credential Access & Secrets
- Try to use managed identity instead
- Rotate secrets; better to use short lived tokens
- Use key vault
- Don’t put api keys/tokens in source code
- GitHub alerts if check in a key to public repo. Can auto expire the checked in token. Even cleaning history not enough because people can subscribe to commits. Need to protected with pre-commit hook on your machine
Defense Evasion & Log Tampering
- Correlate logs from different sources
- Log injection
- Tamper evident logging
Supply chain compromise
- Malicous packages,
- event-stream, solarwinds, log4shell, xz utils, sai hulud, notepad+, axios, etc
- 2021 – Log4Shell was a dependency trust failure. It waa bug. People didn’t know if using because used other things that included. Also needed SBOM for own software.
- 2024 – XZ Utils – 2 year long con.- “Jian Tan” submitted first patch in 2021. Sock pullets pressure maintainer so Jia becomes co-maintainer. Backdoor in tarballs only in 2024. Found March 29th by accident because SSH was 500ms slower from a Microsoft researcher looking at PostGres performance. Goal was to get this into Fedora so in next major release of Red Hat Linux.
- 2025 – NotePad++ update hijack – We hosting infrastructure compromised. Web host trojanied the update.exe by adding a side loaded (loading malicious file) DLL.
- 2026 – Axios NPM Compromise – March 31 for 3 hours there was an extra dependency with a remote access trojan. The post install script downloaded software to allow remote access. It was just a patch release so not looked at closely.
Patching is more than deploying
- Patch the dependency -> inventory affected services
- Restart the service -> Verify the critical workflows
- Close the ticket -> check for prior compromise
Collection & Exfiltration
- 2015 – anthem – slowly stole data over http request
- 2022 – LastPass – stole tokens targetting developer’s home PC
- Helpful to have baseline statistic on how much data usually have so know when unusual
- API rate limiting with exfil detection
MITRE website
- Multiple matrixes
- Can read about details of attacks such as detection/mitigations.
My take
THere were lots of examples including technique names/numbers. I feel like I got a good feel for ATT&CK. I also poked at https://attack.mitre.org as well to get a feel for what it looks like. A lot of different items shown as well both as code and as mapping to ATT&CK. And the recent events examples.