Now exploring New Zealand's internet IP space with @ss2342 and @haquaman
#Press 🕵️ #CHCon2020 @CHCon_nz
#Press 🕵️ #CHCon2020 @CHCon_nz
What inspired them to do this?
Using a botnet to scan the whole internet. Illegal botnets for good?
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
Using a botnet to scan the whole internet. Illegal botnets for good?
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
Also apparently @Metlstorm inspires people. Who knew? 🤷♂️
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
Demo!
Screens of pages available from NZ IP addresses.
Lots of draytek modems...
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
Screens of pages available from NZ IP addresses.
Lots of draytek modems...
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
What's the architecture?
"I'm still not sure Mongo wasn't a mistake" 😂
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
"I'm still not sure Mongo wasn't a mistake" 😂
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
As every corporation knows, the solutions to a problem is to add more technology
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
Plugins they've made
Nmap, screenshotter, SMB shares scanner (disabled due to *crimes*), vuln scanning
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
Nmap, screenshotter, SMB shares scanner (disabled due to *crimes*), vuln scanning
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
Problems:
Nmap crashing "all the damn time"
Weird 2Degrees firewalls... 🤔
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
Nmap crashing "all the damn time"
Weird 2Degrees firewalls... 🤔
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
The data is so unstructured that you don't have a good way to store it and query it
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
The state of New Zealand... 😬
Lots of vulnerable routers, HP iLO, printers, tank gauges?
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
Lots of vulnerable routers, HP iLO, printers, tank gauges?
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
Truck stop tank data?
Why is this on the internet?
Why is this on the internet?
Supermarket stuff on the internet. Lots of fridges and controls.
They're all awful, ask me how I know... 😬
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
They're all awful, ask me how I know... 😬
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
Sooo many webcams on the internet.
But maybe best to leave those alone. Don't do crimes.
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
But maybe best to leave those alone. Don't do crimes.
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
Lots of unpatched citrix vulns in the NZ IP space. Not gonna tweet the photos for... Reasons.
Somehow seeing this IN NEW ZEALAND is more impactful
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
Somehow seeing this IN NEW ZEALAND is more impactful
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
Some good stats on where common vulnerabilities are in NZ
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
@ss2342 @haquaman #Press 🕵️ #CHCon2020 @CHCon_nz
What is blamelessness?
Its a cultural change. It's balancing safety and accountability. It's about not punishing people who make mistakes.
Its about not pointing fingers at anyone, but recognising its the system.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
Its a cultural change. It's balancing safety and accountability. It's about not punishing people who make mistakes.
Its about not pointing fingers at anyone, but recognising its the system.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
Blamelessness means people can feel safe to come forward with problems so that they can actually get fixed.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
With a blameless culture it changes the narrative.
It stops being "why did that person make the mistake" and becomes "how did the system allow them to make s mistake"?
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
It stops being "why did that person make the mistake" and becomes "how did the system allow them to make s mistake"?
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
Second stories are the stories behind the incident.
Incidents aren't human accidents, they're process problems.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
Incidents aren't human accidents, they're process problems.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
We had daily updates with transparency in a clear and calm way.
We put our experts and leaders out in front.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
We put our experts and leaders out in front.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
Blamelessness is about treating people with empathy.
If you don't treat people with empathy, you end up with silos and it becomes us vs them.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
If you don't treat people with empathy, you end up with silos and it becomes us vs them.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
Be Kind to each other.
When everyone starts to care and look after each other we all become much more effective.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
When everyone starts to care and look after each other we all become much more effective.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
Don't focus on root cause.
In distributed systems you can't blame one thing. The point is to fix the issue.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
In distributed systems you can't blame one thing. The point is to fix the issue.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
We focused on containment. Stopping the virus rather than blaming the people who caught it.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
We removed the stigma. Mistakes happen. People have to feel comfortable coming forward.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
Blamelessness doesn't mean there is no accountability. It's about looking at the actions taken, not the people
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
We didn't start with mask wearing, but we took new information and started to push to normalise it.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
We also increased our testing and our leaders led the charge.
We removed the stigma from having COVID which made it more likely that people would be tested
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
We removed the stigma from having COVID which made it more likely that people would be tested
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
Think about when we went into lockdown.
It was really hard for many of us.
Think about how hard it must be for people in managed isolation. Be empathetic.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
It was really hard for many of us.
Think about how hard it must be for people in managed isolation. Be empathetic.
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
How do we do this?
Take that empathy muscle and practice.
Sera practices blamelessness at home now!
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
Take that empathy muscle and practice.
Sera practices blamelessness at home now!
@tsdubz #Press 🕵️ #CHCon2020 @CHCon_nz
What is Rekognition?
Amazon's image recognition tool.
Can detect if you're using a face mask properly!
Famously sold to law enforcement at a discount... 😬
@waptor75 #Press 🕵️ #CHCon2020 @CHCon_nz
Amazon's image recognition tool.
Can detect if you're using a face mask properly!
Famously sold to law enforcement at a discount... 😬
@waptor75 #Press 🕵️ #CHCon2020 @CHCon_nz
Some assumptions:
- that analysis is using Rekognition
- that you're photographed from multiple angles
@waptor75 #Press 🕵️ #CHCon2020 @CHCon_nz
- that analysis is using Rekognition
- that you're photographed from multiple angles
@waptor75 #Press 🕵️ #CHCon2020 @CHCon_nz
Some warnings:
Make sure you know local mask laws.
Also, face paint can be problematic for several reasons.
@waptor75 #Press 🕵️ #CHCon2020 @CHCon_nz
Make sure you know local mask laws.
Also, face paint can be problematic for several reasons.
@waptor75 #Press 🕵️ #CHCon2020 @CHCon_nz
Privacy film and face shield also works - as long as you get enough glare
@waptor75 #Press 🕵️ #CHCon2020 @CHCon_nz
@waptor75 #Press 🕵️ #CHCon2020 @CHCon_nz
Anyone can do this themselves by creating an AWS account and playing with the facial recognition
@waptor75 #Press 🕵️ #CHCon2020 @CHCon_nz
@waptor75 #Press 🕵️ #CHCon2020 @CHCon_nz
Plaintext password storage.
It means anyone who gets in the kitchen can see all users passwords. 😬
@nickmalcolm #Press 🕵️ #CHCon2020 @CHCon_nz
It means anyone who gets in the kitchen can see all users passwords. 😬
@nickmalcolm #Press 🕵️ #CHCon2020 @CHCon_nz
How does hashing work?
Good... But the same password will make the same hash.
@nickmalcolm #Press 🕵️ #CHCon2020 @CHCon_nz
Good... But the same password will make the same hash.
@nickmalcolm #Press 🕵️ #CHCon2020 @CHCon_nz
Can be tough to change.
But make sure to get rid of those old hashes.
@nickmalcolm #Press 🕵️ #CHCon2020 @CHCon_nz
But make sure to get rid of those old hashes.
@nickmalcolm #Press 🕵️ #CHCon2020 @CHCon_nz
But good storage is really only buying users time if the hashes get out.
@nickmalcolm #Press 🕵️ #CHCon2020 @CHCon_nz
@nickmalcolm #Press 🕵️ #CHCon2020 @CHCon_nz
Or payment cards!
Visa and Mastercard don't like to play with others, tho.
@kaezone #Press 🕵️ #CHCon2020 @CHCon_nz
Visa and Mastercard don't like to play with others, tho.
@kaezone #Press 🕵️ #CHCon2020 @CHCon_nz
Badge challenge - try to collect them all!
Find all 9 stickers and show the crew. First 10 (I think) will win a prize!
#Press 🕵️ #CHCon2020 @CHCon_nz
Find all 9 stickers and show the crew. First 10 (I think) will win a prize!
#Press 🕵️ #CHCon2020 @CHCon_nz
Topics for the panel discussion tonight.
Will not be broadcast or tweeted so be in the room!
#Press 🕵️ #CHCon2020 @CHCon_nz
Will not be broadcast or tweeted so be in the room!
#Press 🕵️ #CHCon2020 @CHCon_nz
A #press selfie while we're waiting to kick off the afternoon session
#Press 🕵️ #CHCon2020 @CHCon_nz
#Press 🕵️ #CHCon2020 @CHCon_nz
These are generally nationstate actors - quite big organisations.
They're more than just hackers.
This is potentially a well practiced organisation.
#Press 🕵️ #CHCon2020 @CHCon_nz
They're more than just hackers.
This is potentially a well practiced organisation.
#Press 🕵️ #CHCon2020 @CHCon_nz
The great thing about tech conferences is that there are never any issues. 😉
#Press 🕵️ #CHCon2020 @CHCon_nz
#Press 🕵️ #CHCon2020 @CHCon_nz
And we're back!
We can put a wrench in that with threat intelligence, right?
#Press 🕵️ #CHCon2020 @CHCon_nz
We can put a wrench in that with threat intelligence, right?
#Press 🕵️ #CHCon2020 @CHCon_nz
Looking at Named But Hardly Shamed:
Generally disclosures didn't really stop APT operations.
#Press 🕵️ #CHCon2020 @CHCon_nz
Generally disclosures didn't really stop APT operations.
#Press 🕵️ #CHCon2020 @CHCon_nz
Let's try and collate some of this same intelligence via open source
Timeline:
#Press 🕵️ #CHCon2020 @CHCon_nz
Timeline:
#Press 🕵️ #CHCon2020 @CHCon_nz
More spear phishing.
Despite getting burned repeatedly they just keep going.
#Press 🕵️ #CHCon2020 @CHCon_nz
Despite getting burned repeatedly they just keep going.
#Press 🕵️ #CHCon2020 @CHCon_nz
So burning tools doesn't work.
They just switch to different tools that they've developed in parallel.
#Press 🕵️ #CHCon2020 @CHCon_nz
They just switch to different tools that they've developed in parallel.
#Press 🕵️ #CHCon2020 @CHCon_nz
If releasing papers doesn't work, what do we do?
Make yourself a harder target.
#Press 🕵️ #CHCon2020 @CHCon_nz
Make yourself a harder target.
#Press 🕵️ #CHCon2020 @CHCon_nz
Shortcomings of the research:
Relying on attribution from others.
Reports reflect Kade's biases.
#Press 🕵️ #CHCon2020 @CHCon_nz
Relying on attribution from others.
Reports reflect Kade's biases.
#Press 🕵️ #CHCon2020 @CHCon_nz
Strengths of the research:
You can start to see connections over time.
#Press 🕵️ #CHCon2020 @CHCon_nz
You can start to see connections over time.
#Press 🕵️ #CHCon2020 @CHCon_nz
Persistence via event triggered execution.
Basically to mitigate you have to monitor.
#Press 🕵️ #CHCon2020 @CHCon_nz
Basically to mitigate you have to monitor.
#Press 🕵️ #CHCon2020 @CHCon_nz
Vendors, please report on all of the things the APT is doing, not just what you can sell tools to mitigate.
#Press 🕵️ #CHCon2020 @CHCon_nz
#Press 🕵️ #CHCon2020 @CHCon_nz
Now its @jsstott talking about monitoring and debugging in minecraft!
#Press 🕵️ #CHCon2020 @CHCon_nz
#Press 🕵️ #CHCon2020 @CHCon_nz
Hacking and minecraft go well together!
Like Pokemon in minecraft.
Or minecraft in minecraft?
Pack.png
@jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
Like Pokemon in minecraft.
Or minecraft in minecraft?
Pack.png
@jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
Variable integer format can compress big numbers into a small amount of bytes.
@jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
@jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
Just wait everyone! I haven't implemented auth beyond a bucket and a house!
@jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
@jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
Now its @vashta_nerdrada talking about context: the answer is to life, the universe, and everything.
@jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
@jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
Context is what allows us to make informed decisions and think critically
@vashta_nerdrada @jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
@vashta_nerdrada @jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
Black Swan events and context
In the plague times our ability to operate depends on our location - in NZ vs US, etc
@vashta_nerdrada @jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
In the plague times our ability to operate depends on our location - in NZ vs US, etc
@vashta_nerdrada @jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
There may be many layers of mitigations in place making it difficult to exploit vulnerabilities
@vashta_nerdrada @jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
@vashta_nerdrada @jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
Peer review can be super important because you're getting people with different contexts to look at it from a different perspective.
@vashta_nerdrada @jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
@vashta_nerdrada @jsstott #Press 🕵️ #CHCon2020 @CHCon_nz
Design choices are important. You need to consider the context where the solution will be used.
@vashta_nerdrada #Press 🕵️ #CHCon2020 @CHCon_nz
@vashta_nerdrada #Press 🕵️ #CHCon2020 @CHCon_nz
Is your product going to fail in some unexpected way?
@vashta_nerdrada #Press 🕵️ #CHCon2020 @CHCon_nz
@vashta_nerdrada #Press 🕵️ #CHCon2020 @CHCon_nz
Taking the time and making the threat models can save your bacon later.
Bacon being lots and lots of effort.
@vashta_nerdrada #Press 🕵️ #CHCon2020 @CHCon_nz
Bacon being lots and lots of effort.
@vashta_nerdrada #Press 🕵️ #CHCon2020 @CHCon_nz
Everyone needs to challenge their assumptions.
Engineers love resiliency, so pitch threat modeling as a way to increase it and add context.
@vashta_nerdrada #Press 🕵️ #CHCon2020 @CHCon_nz
Engineers love resiliency, so pitch threat modeling as a way to increase it and add context.
@vashta_nerdrada #Press 🕵️ #CHCon2020 @CHCon_nz
Should we be automating the triaging of sensitive information? Will it provide enough context to make decisions?
@vashta_nerdrada #Press 🕵️ #CHCon2020 @CHCon_nz
@vashta_nerdrada #Press 🕵️ #CHCon2020 @CHCon_nz
Alright! This is where the tweeting ends for a while!
Redacted talk up next - you need to be here! 😁
#Press 🕵️ #CHCon2020 @CHCon_nz
Redacted talk up next - you need to be here! 😁
#Press 🕵️ #CHCon2020 @CHCon_nz
Its been amazing to have an actual, in person con this year!
Thanks so much to @CHCon_nz and everyone who makes it happen!
#Press 🕵️ #CHCon2020
Thanks so much to @CHCon_nz and everyone who makes it happen!
#Press 🕵️ #CHCon2020
Thanks to the:
Volunteers!
Speakers and trainers!
Sponsors!
Attendees!
And especially, the amazing @CHCon_nz crew!
#Press 🕵️ #CHCon2020
Volunteers!
Speakers and trainers!
Sponsors!
Attendees!
And especially, the amazing @CHCon_nz crew!
#Press 🕵️ #CHCon2020
Its a very very happy @ChrisObiOne who one the amazing @pepperraccoon original! 😍
#Press 🕵️ #CHCon2020 @CHCon_nz
#Press 🕵️ #CHCon2020 @CHCon_nz
And @tsdubz wins the @AshBloomfield appreciation award for such an amazing Dr Ashley focused talk!
#Press 🕵️ #CHCon2020 @CHCon_nz
#Press 🕵️ #CHCon2020 @CHCon_nz
Some appreciation for @FKeatingGeek!
Apparently the con is on as long as Frank keeps getting whisky!
#Press 🕵️ #CHCon2020 @CHCon_nz
Apparently the con is on as long as Frank keeps getting whisky!
#Press 🕵️ #CHCon2020 @CHCon_nz
Frank has put a phenomenal amount of working into making this happen.
Sooo much love for @FKeatingGeek!
#Press 🕵️ #CHCon2020 @CHCon_nz
Sooo much love for @FKeatingGeek!
#Press 🕵️ #CHCon2020 @CHCon_nz
Lots of amazing prizes given out!
Special shout out to @pepperraccoon!
#Press 🕵️ #CHCon2020 @CHCon_nz
Special shout out to @pepperraccoon!
#Press 🕵️ #CHCon2020 @CHCon_nz
• • •
Missing some Tweet in this thread? You can try to
force a refresh
