Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a...

60
Attack Trees Red Teaming

Transcript of Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a...

Page 1: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

Attack TreesRed Teaming

Page 2: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

▪ Matteo Beccaro | Twitter: @_bughardy_

▪ Chief Technology Officer at @_opposingforce.

▪ Conference speaker & trainer.

▪ Messing around with networks and protocols.

▪ Often flying around the globe.

▪ Founder & CTO at Opposing Force

▪ The first Italian firm specialize in offensive physical security

who am i

Page 3: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

▪ at Opposing Force

▪ We dedicate big % of our time in internal RESEARCH on HARDWARE, SOFTWARE and METHODOLOGY

▪ We assess the HUMAN, CYBER and PHYSICAL security of Corporations and Governments.

▪ We perform ATTACK SIMULATIONS with extended scope (often no limitations at all).

what do we do

Page 4: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

▪ in 2018 we started working on ATTACK TREE theory, trying to apply it to our engagement.

▪ We quickly found that it could help to speed up the information gathering and crafting of attack scenarios phases.

▪ To meet our purposes we had to adapt it to the OFFENSIVE side.

▪ We also need rules to quickly adapt our strategy to a fast changing scenario where information and events can be unpredictable.

what do we do

Page 5: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

…so, what is an attack tree? how can I apply it?

what do we do

Page 6: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

what is an attack tree

agenda

red teaming

v/s

cyber pentestbenefit of attack tree simulation

crafting an effective attack tree

case studies

Page 7: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

what is an attack tree

agenda

red teaming

v/s

cyber pentestbenefit of attack tree simulation

crafting an effective attack tree

case studies

Page 8: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

“Attack trees provide a formal, methodical way of describing the security of systems, based on varying attacks. Basically, you

represent attacks against a system in a tree structure, with the goal as the root node and different ways of achieving that goal

as leaf nodes.” - Bruce Schneier

what is an attack tree

Page 9: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

Citing again Bruce Schneier, Attack Trees are:

▪ A way of thinking and describing security systems and subsystems.

▪ A way of building an automatic database that describes the security ofa system.

▪ A way of capturing expertise, and reusing it.

▪ A way of making decisions about how to improve security, or the effects of a new attack on security.

what is an attack tree

Page 10: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

An Attack Tree, in its standard definition, is a formal way to perform threat and risk analysis of a defined system.

what is an attack tree

Page 11: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

An attack tree is composed by two (2) main elements: leaf nodes and root node(s).

▪ A root node is the goal of the overall attack

▪ A leaf node is a specific attack

what is an attack tree

Page 12: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

what is an attack treeleaf nodesroot node

Page 13: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

An attack tree is composed by two (2) main elements: leaf nodes and root node(s).

▪ A root node is the goal of the overall attack.

▪ A leaf node is a specific attack (or subgoal).

▪ And / Or node represent different way to achieve the attack:

▪ An and node means all sub-attacks must be achieved.

▪ An or node means at least one attack must be achieved.

what is an attack tree

Page 14: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

what is an attack treeleaf nodesroot nodeand/or nodes

Page 15: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

We shall define a value for each leaf node in order to understand the attack scenarios against the asset, root node, we want to defend.

This value can be:

▪ Boolean: doable, not doable.

▪ Continuous: cost, risk, etc to attack or defend.

In our example we will use the cost needed for the attack to succeed.

what is an attack tree

Page 16: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

what is an attack tree

leaf nodesroot nodeand/or nodesX = cost

Page 17: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

In complex scenarios we could have multiple goals, or assets, to protect.

More complex attack tree can be messy to represent graphically.

From a defensive point of view, the goal of an attack tree is toidentify possible attacks and increase their costs/risk, or reduce their probability applying appropriate countermeasure.

what is an attack tree

Page 18: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

what is an attack tree

agenda

red teaming

v/s

cyber pentestbenefit of attack tree simulation

crafting an effective attack tree

case studies

Page 19: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

red teaming v/s cyber pentest

https://blog.rapid7.com/2016/06/23/penetration-testing-vs-red-teaming-the-age-old-debate-of-pirates-vs-ninja-continues/

Page 20: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

“penetration testing is validating a configuration when you believe it to be secure.”

Daniel Miessler (https://danielmiessler.com/study/security-assessment-types)

red teaming v/s cyber pentest

Page 21: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

red teaming v/s cyber pentest

Page 22: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

“red team” is: an independent group that challenges an organization to improve its effectiveness.

Daniel Miessler (https://danielmiessler.com/study/security-assessment-types)

During a red teaming engagement we must identify possiblethreat agents and goals for a specific organization. Then executeattack scenarios that are likely caried out by such threat agents.

red teaming v/s cyber pentest

Page 23: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

red teaming v/s cyber pentest

Page 24: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

what is an attack tree

agenda

red teaming

v/s

cyber pentestbenefit of attack tree simulation

crafting an effective attack tree

case studies

Page 25: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

As we saw, in red teaming activities we must first identify the possible attack scenarios.

Attack trees allows us to investigate possible attack scenarios,understanding the risks and benefits, before executing them.

benefit of attack tree simulation

Page 26: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

We use two different type of attack trees:

First one: to understand which attacks we can perform, howrisky they are, what benefits we can get from a successful attackand how much we need to invest, in terms of time and money,

to execute it.

benefit of attack tree simulation

Page 27: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

leaf nodesroot nodeand/or nodesR(X) = 1..100

benefit of attack tree simulation

Page 28: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

leaf nodesroot nodeand/or nodesC(X) = 1..100

benefit of attack tree simulation

Page 29: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

leaf nodesroot nodeand/or nodesP(X) = 1..100

benefit of attack tree simulation

Page 30: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

With this information we can calculate the feasibility of eachattack.

We can use multiple formulas, for our examples we will calculatethe effort using:

benefit of attack tree simulation

Page 31: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

With this information we can analyse which attack scenariosexecute, or in which order.

More knowledge we can gather from our target, more precise our tree will become.

benefit of attack tree simulation

Page 32: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

benefit of attack tree simulation

Page 33: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

benefit of attack tree simulation

Page 34: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

Graphical representation gets messy with complex scenarios.

benefit of attack tree simulation

Page 35: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

benefit of attack tree simulation

Page 36: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

To simplify complex attack scenarios we can use a second type of tree graph instead of incrementing the complexity of a attack tree graph.

This graph is also useful before going in the field. We want to furtherexplore the chosen path. We need to craft a what-if graph.

Let’s suppose we want to execute the phishing attack. We want to understand what issues we can encounter during the attack, and what to

do in such cases.

benefit of attack tree simulation

Page 37: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

benefit of attack tree simulation

Page 38: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

If we fail, we get back to our tree attack graph to perform a second path.

benefit of attack tree simulation

Page 39: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

benefit of attack tree simulation

Page 40: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

what is an attack tree

agenda

red teaming

v/s

cyber pentestbenefit of attack tree simulation

crafting an effective attack tree

case studies

Page 41: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

How can we build an attack tree from scratch?

crafting an effective attack tree

Page 42: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

▪ Identify goal(s). If there are multiple goal, each is a separate attack tree.

▪ Identify possible scenarios (attacks) to execute to reach the goal.

▪ Identify possible and impossible scenarios.

▪ Evaluate the feasibility of each scenario

▪ Identify information required to execute the scenarios.

▪ What if we don’t get that information?

crafting an effective attack tree

Page 43: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

what is an attack tree

agenda

red teaming

v/s

cyber securitybenefit of attack tree simulation

crafting an effective attack tree

case study

Page 44: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

▪ Identify goal(s). If there are multiple goal, each is a separate attack tree.

▪ Identify possible scenarios (attacks) to execute to reach the goal.

▪ Identify possible and impossible scenarios.

▪ Evaluate the feasibility of each scenario

▪ Identify information required to execute the scenarios.

▪ What if we don’t get that information?

case study

Page 45: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

case study

Page 46: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

▪ Identify goal(s). If there are multiple goal, each is a separate attack tree.

▪ Identify possible scenarios (attacks) to execute to reach the goal.

▪ Identify possible and impossible scenarios.

▪ Evaluate the feasibility of each scenario

▪ Identify information required to execute the scenarios.

▪ What if we don’t get that information?

case study

Page 47: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

case study

Page 48: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

▪ Identify goal(s). If there are multiple goal, each is a separate attack tree.

▪ Identify possible scenarios (attacks) to execute to reach the goal.

▪ Identify possible and impossible scenarios.

▪ Evaluate the feasibility of each scenario

▪ Identify information required to execute the scenarios.

▪ What if we don’t get that information?

case study

Page 49: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

case study

Bribing/Collusion

Page 50: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

▪ Identify goal(s). If there are multiple goal, each is a separate attack tree.

▪ Identify possible scenarios (attacks) to execute to reach the goal.

▪ Identify possible and impossible scenarios.

▪ Evaluate the feasibility of each scenario

▪ Identify information required to execute the scenarios.

▪ What if we don’t get that information?

case study

Page 51: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

case study

Bribing/Collusion

Page 52: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

case study

Bribing/Collusion

Page 53: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

case study

Bribing/Collusion

Page 54: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

case study

Page 55: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

case study

Bribing/Collusion

Page 56: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

▪ Identify goal(s). If there are multiple goal, each is a separate attack tree.

▪ Identify possible scenarios (attacks) to execute to reach the goal.

▪ Identify possible and impossible scenarios.

▪ Evaluate the feasibility of each scenario

▪ Identify information required to execute the scenario.

▪ What if we don’t get that information?

case study

Page 57: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

case study

Page 58: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

repeat for all possible scenarios

case study

Page 59: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

Any question?Don’t be shy..

Page 60: Attack Trees Red Teaming - Hack In The Box …...graph instead of incrementing the complexity of a attack tree graph. This graph is also useful before going in the field. We want to

Thank you

[email protected] | www.opposingoforce.it | @_opposingforce


Single Node Injection Attack against Graph Neural Networks

Single Node Injection Attack against Graph Neural Networks

LNCS 4237 - Attack Graph Based Evaluation of Network Security...Attack Graph Based Evaluation of Network Security Igor Kotenko and Mikhail Stepashkin SPIIRAS, 39, 14 Liniya, St.-Petersburg,

LNCS 4237 - Attack Graph Based Evaluation of Network Security...Attack Graph Based Evaluation of Network Security Igor Kotenko and Mikhail Stepashkin SPIIRAS, 39, 14 Liniya, St.-Petersburg,

Deployment Optimization of IoT Devices through Attack ... · Deployment Optimization of IoT Devices through Attack Graph Analysis WiSec ’19, May 15–17, 2019, Miami, FL, USA Following

Deployment Optimization of IoT Devices through Attack ... · Deployment Optimization of IoT Devices through Attack Graph Analysis WiSec ’19, May 15–17, 2019, Miami, FL, USA Following

Region Incrementing Visual Cryptography

Region Incrementing Visual Cryptography

Understanding the Attack Surface and Attack Resilience … · Understanding the Attack Surface and Attack Resilience of ... (internals, audit, fuzzing, ... Understanding the Attack

Understanding the Attack Surface and Attack Resilience … · Understanding the Attack Surface and Attack Resilience of ... (internals, audit, fuzzing, ... Understanding the Attack

Topology Attack and Defense for Graph Neural Networks: An ...

Topology Attack and Defense for Graph Neural Networks: An ...

Attack on graph

Attack on graph

Advances in Automated Attack Planning · –Tools for generating and analyzing Attack Graphs Steven Noel and Sushil Jajodia (2004) –Managing Attack Graph complexity through visual

Advances in Automated Attack Planning · –Tools for generating and analyzing Attack Graphs Steven Noel and Sushil Jajodia (2004) –Managing Attack Graph complexity through visual

Popular Protocol attack Smurf Attack Introduction: … Protocol attack!Smurf Attack!SYN attack!UDP Attack, ICMP Attack!CGI request attack!Authentication server attack!Attack using

Popular Protocol attack Smurf Attack Introduction: … Protocol attack!Smurf Attack!SYN attack!UDP Attack, ICMP Attack!CGI request attack!Authentication server attack!Attack using

Lesson 7 McManus COP1006 1. Flowchart Symbols The Loop Logic Structure Incrementing/ Decrementing Accumulating While/WhileEnd Repeat/Until.

Lesson 7 McManus COP1006 1. Flowchart Symbols The Loop Logic Structure Incrementing/ Decrementing Accumulating While/WhileEnd Repeat/Until.

Graph Theory,Graph Terminologies,Planar Graph & Graph Colouring

Graph Theory,Graph Terminologies,Planar Graph & Graph Colouring

ATTACK, ATTACK, ATTACK

ATTACK, ATTACK, ATTACK

Adversarial Attacks on Node Embeddings via Graph Poisoning · Adversarial Attacks on Node Embeddings via Graph Poisoning lem associated with the poisoning attack. We assume an attacker

Adversarial Attacks on Node Embeddings via Graph Poisoning · Adversarial Attacks on Node Embeddings via Graph Poisoning lem associated with the poisoning attack. We assume an attacker

A test of attack graph-based evaluation of IT-securityumu.diva-portal.org/smash/get/diva2:696145/FULLTEXT01.pdf · A test of attack graph-based evaluation of IT-security Fredrik Johan

A test of attack graph-based evaluation of IT-securityumu.diva-portal.org/smash/get/diva2:696145/FULLTEXT01.pdf · A test of attack graph-based evaluation of IT-security Fredrik Johan

A Graph Patrol Problem with Random Attack Times

A Graph Patrol Problem with Random Attack Times

Adversarial Examples for Graph Data: Deep Insights into ... · Adversarial Examples for Graph Data: Deep Insights into Attack and Defense Huijun Wu1;2, Chen Wang2, Yuriy Tyshetskiy

Adversarial Examples for Graph Data: Deep Insights into ... · Adversarial Examples for Graph Data: Deep Insights into Attack and Defense Huijun Wu1;2, Chen Wang2, Yuriy Tyshetskiy

Graph-Based Metrics for Insider Attack Detection in …IEEETRANSACTIONS ON VEHICULAR TECHNOLOGY, VOL.62,NO.4,MAY2013 1505 Graph-Based Metrics for Insider Attack Detection in VANET

Graph-Based Metrics for Insider Attack Detection in …IEEETRANSACTIONS ON VEHICULAR TECHNOLOGY, VOL.62,NO.4,MAY2013 1505 Graph-Based Metrics for Insider Attack Detection in VANET

Graph. Undirected Graph Directed Graph Simple Graph.

Graph. Undirected Graph Directed Graph Simple Graph.

Remediating Logical Attack Paths Using Information System ... · Keywords: logical attack paths, remediation candidates, MulVAL at-tack graph, simulated topology, remediation costs,

Remediating Logical Attack Paths Using Information System ... · Keywords: logical attack paths, remediation candidates, MulVAL at-tack graph, simulated topology, remediation costs,

Cyber security and attack analysis : how Cisco uses graph analytics

Cyber security and attack analysis : how Cisco uses graph analytics