This presentation was by Chris Nickerson, founder of Lares Consulting, and the goal was to talk about the use of layered attacks.<\/p>\n
General types of threats includes social engineering\/human (corporate\/personal manipulation, bogus e-mails, physical intrusion, media dropping, phone calls, conversation, role playing), electronic (application and business logic attacks, software vulnerability exploitation, …), physical (break-in, theft, physical access, physical manipulation, violence), and malfunction\/inherent (business logic flaws, software glitches, software coding holes\/exploits, process breakdown, act of god\/war\/terrorism disruption, intended backdoors) and a red team test should cover them all.<\/p>\n
Why red teaming?<\/p>\n
How do you know you can put up a fight if you have never taken a punch?<\/p><\/blockquote>\n
Red teaming process: Information Gathering -> Vulnerability Analysis -> Target Selection -> Planning -> Executing the Attack -> Back to step 1<\/p>\n
Process of Attack<\/strong><\/span><\/p>\n
\n
- Information Gathering:<\/strong> Research methods and useful information (spend most time here)<\/li>\n
- Vulnerability Analysis:<\/strong> Internal\/external\/hired\/personal<\/li>\n
- Target Selection:<\/strong> Internal\/external\/hired\/personal<\/li>\n
- Planning:<\/strong> Plan a, b, e, d, pie<\/li>\n
- Executing the Attack:<\/strong> Getting what you need and getting out.\u00a0 Not getting greedy.\u00a0 Getting out cleanly.<\/li>\n<\/ul>\n
Corporate Attack Approach<\/strong><\/span><\/p>\n
\n
- External Direct:<\/strong> server\/app attack<\/li>\n
- External Indirect:<\/strong> client side\/phishing\/phone calls<\/li>\n
- Internal Indirect:<\/strong> key\/cd drops\/propaganda\/creating a spy<\/li>\n
- Internal Direct:<\/strong> social\/electronic\/physical\/blended<\/li>\n
- Exotic Attacks<\/strong>: environment manipulation (pulling the fire alarm, etc to move people)<\/li>\n<\/ul>\n
Information Gathering Tools<\/strong><\/span><\/p>\n
\n
- Maltego: The best attacks from the best intel (gives a graphical view of how all of the information interacts)<\/li>\n
- Metagoofil: Yer Dox on the net have Infos (Extracts information from internet documents)<\/li>\n
- Clez.net (External Profiling)<\/li>\n
- CentralOps.net (Network Profiling)<\/li>\n
- Robtex (Server Profiling)<\/li>\n
- Touchgraph (Show business relationships and links)<\/li>\n
- ServerSniff (Get tons of webserver specific info and verification)<\/li>\n
- Netcraft (usage info)<\/li>\n
- DomainTools (Domain info)<\/li>\n
- MySpace\/Friendster\/Twitter (know ya enemy)<\/li>\n<\/ul>\n
Onsite Tools<\/strong><\/span><\/p>\n
\n
- BootRoot\/SysReQ<\/li>\n
- Ophcrack Live<\/li>\n
- Helix\/Backtrack<\/li>\n
- Core Impact<\/li>\n
- FireWire PCMCIA Card + Winlockpwn = Unlock<\/li>\n
- Switchblade + Hacksaw + U3 drive<\/li>\n
- Elite Keylogger<\/li>\n
- WRT + Metasploit = Cheap leave behind<\/li>\n<\/ul>\n
Other Fun Toys Onsite<\/strong><\/span><\/p>\n
\n
- FlexiSpy (installs image on cell phone to read SMS, listen to phone calls, etc)<\/li>\n
- Pen cams<\/li>\n
- USB cams<\/li>\n
- Cell phone jammers<\/li>\n<\/ul>\n
All of these different methods to test front\/back\/side doors don’t rule out the low tech attacks.\u00a0 You could spend a million dollars to prevent someone from hacking the server and they could just walk in the front door and take it.\u00a0 A really good talk by a guy who really knows his stuff and the only talk I’ve seen so far at the conference that wasn’t specifically about technical vulnerabilities.<\/p>\n","protected":false},"excerpt":{"rendered":"
This presentation was by Chris Nickerson, founder of Lares Consulting, and the goal was to talk about the use of layered attacks. General types of threats includes social engineering\/human (corporate\/personal manipulation, bogus e-mails, physical intrusion, media dropping, phone calls, conversation, role playing), electronic (application and business logic attacks, software vulnerability exploitation, …), physical (break-in, theft, […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[127,4],"tags":[76,128,12,167,622,166,165],"class_list":["post-110","post","type-post","status-publish","format-standard","hentry","category-owasp-appsec-nyc-2008","category-web-app-sec","tag-application","tag-appsec","tag-owasp","tag-projects","tag-security","tag-team","tag-tiger"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t