You found the backup wrap up your go-to podcast for all things

backup recovery and cyber recovery.

In this episode, we're talking about living off the land attacks.

And it's honestly, I think one of the sneakiest things that bad guys do, they

get into your environment and instead of bringing their own tools, because

you know they might trip your alarm systems, they use your tools against you.

Things like PowerShell or WMI tools that you're likely already using.

My co-author, Dr. Mike Saylor, breaks down how this works.

Why it's so hard to detect and what you can actually do about it, I think, uh,

there's a lot of value in this episode.

By the way, if you don't know who I am, I'm w Curtis Preston, AKA, Mr.

Backup, and I've been passionate about backup and recovery for over, can't

believe it, 30 years ever since I had to tell my boss there were no backups of the

production database that we had just lost.

I don't want that to happen to you, and that's why I do this.

On this podcast, we turn unappreciated admins into Cyber Recovery Heroes.

This is the backup wrap up.

Welcome to the backup wrap up.

I'm your host, w Curtis Preston, AKA, Mr. Backup, and I have with me a

guy who seems to laugh at my errors.

Persona, Molly nios going Persona.

I am good, Curtis.

I nothing like with friends like this who needs enemies.

Exactly.

I just, I, I make, I make, I make mistakes.

And you, well, honestly, I get, I get I like them too.

I, it makes it, making me laugh.

Makes me laugh.

It's just funny that, uh, how long has the, has it, it been called the

backup wrap up at least two years now.

I think about, oh yeah, probably two years.

And I still, my brain wants to say Backup centrals restore it all, which

is the original name of the podcast.

But, um, anyway, I don't know.

Well, welcome to our, uh, pity party, Mike.

Doctor Mike Saylor.

How's it going?

It is going well guys.

Thanks for having me.

My co-author on our lovely book, learning Ransomware Response and

Recovery, which Mike, I understand you, you have some to show us.

You don't have it hung yet, but there he is.

The official.

Framed copy of our book.

Yeah, just hold it just like that.

For the next, for the next half hour.

Yeah.

Very.

Yeah.

O'Reilly does that.

They send you a copy when, uh, um.

You know, when it's ready.

And by the way, I just got a, I just got news from one of my folks

on LinkedIn that the book said it's gonna be there on Tuesday.

So they, you know, they ordered it in, they ordered it in January and uh,

Amazon says it's gonna be there Tuesday.

So, very exciting.

Any,

So for all our listeners, go out, order the book, listen, or then you can actually

read what Curtis and Mike have been doing

yeah.

many, many, many, many months.

Many, many months.

And then give us a review on Amazon, uh, if you, if you like it,

then come back

yeah.

come back to the podcast

And comment.

be going, no, because we'll be going more in depth into many of these topics.

Yes, we will.

Yes, we will.

And today we're talking about something that honestly, I, I had, I had heard

the, I had heard the term, but it wasn't, you know, given that I don't, uh, live

that side of it the way you do, Mike.

Um.

The, um, this term living off land was something new to me.

So, uh, I, why don't you give us a, do you have a story that kind of gives

us an idea of what we're talking about when we talk about living off the land?

Well, there's, there's lots of stories.

Um, but living off the land is, is often part of some bigger,

bigger campaign, bigger attack.

Something you hear about in the news.

You know, somebody got hacked, somebody had ransomware, somebody,

you know, lost a bunch of data.

the living off the land.

Part of that was simply, um.

Something that facilitated that attack to some degree.

So, and, and from, as an auditor, an IT person, cyber person, you know, I

harp on organizations all the time.

Whatever you build, make it focused on whatever it's doing.

so, you know, the other term for that is system hardening.

You know, uh, delete things you, you don't need.

Turn stuff off, you're not gonna use, close the port.

Don't talk to things that you don't need to talk to.

Um, those are all fruits of the land that a bad guy could use,

uh, to facilitate an attack.

Some of those you can't turn off, uh, like Windows Management as an example, or

WMI, uh, the operating system needs that.

Uh, there are other things like PowerShell, uh, whether it's a, a

system that uses it or an admin that uses it for scripting, but story short.

Uh, bad guys will figure out a way to circumvent the security controls you

have that are looking for the deployment or installation of bad guy tools.

they'll get through that, that filter, that gate, uh, by using

tools that are native to the systems that they're attacking, uh, in

order to facilitate their attack.

Um, so.

If

So.

there was a story in the book, you talked about a Seattle logistics firm, it was

hit by a Conti ransomware, uh, variant.

It was saying that it, it infected 60% of the firm servers and it, it was the

same thing where it was, they somehow used the administrators, the, their

administrative tools against them.

Yep.

So windows management and very powerful at, at deploying.

Um.

You know, code or, or malware across an environment, and especially if it's the

admin or a service, running as an admin.

I remember years ago we, we, uh, we responded to an incident where it

was actually the, it was the security tool that was running, uh, a service

with administrative privileges that was compromised by a bad guy.

And they used the security tools itself, service that was running to, uh, to spread

the, the malware across the environment.

So Mike, just a clarification.

you say living off the land, is it specifically just taking whatever

tools are in an environment and using that in order to propagate your

attack or to, uh, execute your attack?

Or is it also, for instance, um.

resources a as an example, someone might have had some virtual machines sitting

around that they sort of forgot about from an inventory perspective or other

things that might be deployed in a company that they're not, no longer tracking,

doesn't get the latest security patches.

Those sort of things that they then start to think about when you talk about land.

It, it would definitely escalate to that if, if they have the

time to identify those, but.

Traditionally living off the land is, is services or applications,

uh, resident on the machines they're attacking or using to attack.

Now, as a bad guy, they, they find this, this, uh, this target

host with all these goodies on it.

but then they realize, well, this is the admin's computer, so if I do stuff from

this computer, they may note, they may notice some latency or resource drain.

so maybe they do some recon first, or they figure out a way to stand up a

virtual machine in that environment.

Uh, ideally using a dormant one instead of, you know, setting off some

potential bells about creating a new one, but then migrate those tools or

figure out if there's a way to, to, uh, uh, employ those tools on that

virtual machine that's not being used.

that's a, that would be a pretty good tactic.

Yeah, I, it comes from, you know, the, the term, you know, for those

of us that have been, uh, lived in either a suburb or urban environment

or entire life, the concept of living off the land is that you're going.

To literally live off of what is available.

You know, that this term is, is an old term.

It doesn't have anything to do or that originally didn't have anything to

do with, uh, the world of computers.

The idea is you're gonna live somewhere and you're going to

use what is available on that.

You know, that property in order to, uh, survive.

And so I, I think, I think that's a perfect term.

Uh, you know, think of like an episode of Survivor, uh, basically right?

You're only allowed to use what's a avail, what's there, right?

And so that's why, you know, they call this a living off the land because you're

going to use, you know, you, meaning the, the attacker is going to use whatever

tools are available to them and, and why.

What, what's the purpose of that?

Uh, Mike, meaning that, you know, why don't I want to, let's say I've got this

great tool that does this amazing thing.

Why wouldn't I, if I've got access to the environment, why wouldn't I just

install this, this great tool that I have that does this cool thing?

Why would I do this living off land?

So there's a couple of layers of, uh, hopefully a couple of layers

that organizations have in place.

Uh, one of those is monitoring incoming payloads.

Uh, so a file type.

Well, and I guess that's the other part.

How, how would you get that payload into the environment?

Is that a, an attachment to a phishing email?

Is it compromised credentials?

Uh, in either case?

Uh, payloads usually have a, a, you know, a good amount of baggage with them.

It's not a, you know, it's not kilobytes.

It's usually megabytes and sometimes, uh, multiple mega, you know, a hundred,

400 megabytes of, of size, depending.

Um.

So the, the, the first layer is, or the first hurdle is how do

I get it into the environment?

The second one is, how do I get past all the filters, whether that's

antivirus and malware, spam filter, et cetera, that's not gonna strip

that attachment or that, that payload out of the, the communication.

And then the last part of that is a lot of times, uh, ideally we would limit.

Uh, a user's ability to install something on an endpoint, uh, to,

uh, you know, a privileged account.

Uh, so if, if, if you compromise the, you know, the receptionist, she shouldn't be

a local admin, uh, so she shouldn't be able to, that account shouldn't be able

to install stuff locally, that payload.

So if you can craft your, your attack utilizing tools that are resident.

You're simply connecting to the machine and running that stuff that's already

installed and you're running it locally.

The other benefit of running it locally, uh, is that a lot of times

those services are already installed and using administrative privileges.

Is it also true though, Mike, that I know you talked about how do you get the

malware in or whatever the package is into the environment, like from an attacker's

perspective, once they've sort of, like you mentioned PowerShell earlier, right?

Once they sort of have a methodology to propagate the attack, to actually

live off the land, that's something they can then replicate in other

companies, organizations, and not just limit it to like one company, correct.

Right.

Yeah.

So fundamentally windows and environments work the same.

You know, there, there are some of the older ones have a few services and, and.

Methods for communicating that are probably still enabled versus

today's, um, I think there's a lot more network segmentation and

some other things that, that are common today than there used to be.

Uh, but for sure, if you can build a, an attack strategy in a Windows

environment, um, you should be able to replicate that to some degree just

about any, in any Windows network.

When you were talking about the, the hurdles.

W would another hurdle be even, even if you've got, you, you

managed to download the file, you managed to get past the filters.

Would there be additional filters required to actually execute this, uh, tool?

If, if you're talking about some, yeah.

Yeah.

Um.

a lot of environments would require administrative

privileges in order to execute.

So as an example, a normal user might not be able to run registry editor or

even a command prompt or even change their desktop, you know, wallpaper.

Um, and so, yeah, after, after you install it, you, you've also

gotta figure out, you know, what privileges do you need to run it.

Now I remember what I, now I remember what I forgot.

You, you, you brought up a topic a couple of times and it's, it's outside

of the scope of what I wanted to talk about today, but I thought we'd

just talk a, talk about it, a little about it, and that is this concept

of not allowing, uh, regular users to have admin on their own machines.

I know that as best practice.

The question is, is it common practice?

Uh, whi which way that they do have admin practice.

they do not have, that I, I know that it's best practice not to give Joe Schmo.

You know that that shouldn't have admin, admin even on his local

machine, even though that is.

You know, inconvenient to him.

Uh, we often talk about that security is, is inconvenient.

Right?

Right.

So even though that's inconvenient, it's also inconvenient to the IT

people because now that anytime Joe Schmo needs a new tool, we have

to be the one to go install it.

Which sounds amazing in terms of security, but it also sounds

like a giant pain in the butt.

What, uh, what, how common is it that people actually do this?

Uh, that's, that's a, how common it is is difficult.

But I can tell you in in regulated organizations, you know, those that

have to be compliant with something.

Uh, there is a, a control check for making sure that local, you

know, users don't have, you know, um, more privileges than they need.

Well, then organizations get around that by justifying the need for a user to

have, uh, you know, admin privileges.

And, and I see that even, um, and, and well, you know, mature.

Uh, and secure environments.

An engineer has local admin because he needs to run, you know, some kind

of CAD software with, you know, the ability to manipulate memory and, you

know, graphics and all this other stuff.

Um, thinking, well, it's justified.

Well, bad guys realize this too.

So those are the users they're gonna target.

They're not gonna target the receptionist, uh, you know, for, for the most part.

Um.

So it depends, uh, in, in smaller organizations where, you know, the,

the, it, uh, you know, support doesn't want to have to answer the call to

help someone install, you know, widget.

Uh, they would much rather just give them the ability to do that and, and

not have to take so many phone calls.

Um, but in larger organizations that leads to what we call shadow it.

You know, the, the ability to download and do stuff and make changes and build

things without it being involved, well, that lends itself to more issues down the

road with patch management and conflict and vulnerabilities and other things that

it doesn't know about because they weren't involved with helping you do those things.

And so, you know, restricting access and privilege is, is necessary in a large,

um, user environment for a lot of reasons.

Persona, do you?

Go ahead.

Security is one of those.

Persona.

You, you remember the, uh, the episode, the wifi is down

Yep,

one of our OG episodes, and they, that particular person said that they had,

what was it, 450 SaaS applications.

applications.

Yeah.

That just blew me away when they said that.

Um.

So Mike, this is all, um, like amazing, just learning about off the land attacks.

How come it isn't talked about more often?

Like it seems that this would be very common for a lot of the attack vectors and

what guys are doing, but like Curtis, like you mentioned at the start of this, right?

It's things, something you had really heard about.

So it, it, it is, it's not the, it's not the sexy part of the attack.

Right.

So when you're telling a story, that's the part where people

start to Yeah, absolutely.

You know, that's the part of the, that's the part of the story where

people's eyes kind of gloss over 'cause it gets pretty technical and

it's not as exciting as, you know.

They, they, they broke in and they, and then they, they made off with all the

goods, uh, all that stuff in the middle.

People just kind of get blurry about because it's, it's not the, it's not

the, it's not the cause of the effect.

It's the, it's the creamy feeling.

that excites me sometimes, but, uh,

I, if I, if I can make an analogy, there was recently this, uh, huge.

Uh, uh, heist at the Louvre, right?

Where, where the guys, and like I'm drawing an analogy where like the living

off the land was like the yellow vests.

Like they just pretended to be part of the crew.

Uh, and so people just, they did, you know, it wasn't the

sexy part that attacked that.

They managed to just sort of look like they belong there and just sort of

get in and out in the middle of broad daylight and steal the crown jewels.

Um, yeah.

many, are so many ties to, to the kinetic world with cyber,

you know, all those analogies.

Uh, I can, I've, I've done social engineering and, and red teaming and

breaking into buildings for years and.

All of that stuff is very similar.

You know, as soon as I make it in a door a building, the first

thing I target is the break room.

And I get a cup of coffee.

'cause somebody that's walking around with coffee less suspicious than someone

that's wandering around aimlessly.

Uh, and then, you know, if you've got a clipboard or a name badge or a

notepad or whatever, I can tell you I started, I started breaking into

buildings upon request, not, not

Yeah,

uh.

understand.

Man, 2004.

So 22 years.

Uh, and not once, never once has anybody stopped and asked me if I needed help

or are you, who are you here to see?

Or who are you or nothing?

22 years.

I, I, maybe I, people don't wanna talk to me, that's fine.

But, but that's helped me be successful at social engineering.

By the way, I love, I love your, I love it when you use fancy

words like the kinetic world.

I, I've never heard anyone call it the kinetic world before.

You mean like the real world as opposed to the cyber world.

and you can touch stuff.

Okay.

I've never, I've literally never heard the term kinetic.

I, I know the term kinetic.

Like,

fall then?

what's that?

That's

Where

the,

fall

that's the virtual world.

there's the kinetic, there's the kinetic, uh, matrix of, of things

that supports the, the, the cyber.

Uh, you know, and I guess you could, you could do analog

and digital too, but, yeah,

All right.

I just, I just, I had to call that out.

is, is in the kinetic world.

What's that?

The Nebuchadnezzar, the ship in

Oh, right, right.

It's in the kinetic world.

Exactly.

Exactly.

Nice, nice, uh, deep reference there.

So we, so this is about, we're, we're, we're in the environment, right?

But basically we wanna spread around.

We want to do stuff without being attacked, and the best, I'm

sorry, without being detected.

And so the best way to do that is to use tools that.

Again, aren't being monitored because they're just part of the

normal, uh, way of doing business.

Does that sound about right?

then.

And, and you're right.

And, and those tools can facilitate the different phases of an attack.

So sometimes, uh, you know, those tools are used to do reconnaissance and,

you know, the, the, the slow, the low and slow stuff, the stealthy stuff.

'cause you don't want to get caught before you're able to, to really,

you know, kick up your attack.

So you do the, the reconnaissance stuff really quietly and then you use

those tools to pull down, you know.

The other parts of your attack.

So maybe you've got payloads or, additional software like Mimi

Cats as an example for credential harvesting and that kind of stuff.

So you would, you would go slow and, and methodical first, and then once

you figured out how you, what you need to do next or what your, you know,

the, the, the environment looks like.

you, you start to do more.

You, you're more active and, and you take more risk.

Uh, and that's where you would, you know, evolve your attack

into, into different tools.

Mike, how, what role does the, you know, like the level

of credentials play in this?

Um, you know, if you're doing a living off of the land attack,

what role does, like the level of credentials that you're using play.

Man, what do I always say?

It depends, right?

Um, so.

You know what?

I'm just gonna cut every time you ever say It depends.

I'm gonna make a super cut and it'll be a four hour long video, but go ahead, Mike.

Somebody did a meme, uh, where, where they took all the ums.

Oh, it was, it was our intern program.

So the interns were, were doing a presentation and we, we, we give

them constructive feedback and they were using the filler words, the ums

and the, and so somebody, somebody on one of the other interns did

a compilation of all the ums and

Wow.

And so it was just a consistent, um, uh, uh.

So your answer is, it depends.

so it does depend, uh, and what I mean by that is it depends on the

capabilities in the environment to monitor for weird stuff.

So it would be weird for the receptionist to run PowerShell in an environment

she's also a, you know, a computer science student or something like that.

It would not be weird for an admin to be running these

administratively related tools.

Or scripts or uh, uh, activities.

So in the cyber world, we have tools that do what are called

user and behavioral user behavior.

I'll get it right in a second.

User and event behavior analytics or UEBA.

a user, it creates a baseline, so type of user, type of device.

And it, it tries to delineate between what's normal on these anomalies.

So if you've got a. Even an admin account that doesn't use PowerShell

very often if a bad guy compromises that environment and that admin

account, now he's running PowerShell in some weird way that should, that

could be flagged or should be flagged.

But it depends on, depends on the capabilities in that environment.

Now Windows inherently you, you can set up logging and alerting,

but a lot of organizations don't.

They don't, they don't wanna spend the time it's noisy.

'cause Windows environments talk a lot.

Uh, and then.

Even if there is an alert that one or two or a few, it people are busy putting

out fires and it's gonna be a day or a week before they go, Hey, there was this

alert thing, that I need to look into.

So it's a mess.

Uh, but yeah, uh, there, there are ways of there identifying weird

stuff based on the type of user, uh, that's conducting that activity.

So, I know you talked about monitoring, alerting, Mike.

there other things that.

can do because with these living off the land attacks, it's already

there, like all the tools are there that this person needs.

so basically saying you're screwed if you're trying to protect these things

and prevent these sort of attacks from using the tools that already exist.

You are not, and.

And, and it, it, it's just how much overhead do you wanna put

on securing your environment?

One of the things, just taking you back to another example of a resource

that's available 24 7 that shouldn't be.

And, and I'm, so I'm alluding to, you know, some of these administrative

tools being available all the time, even if the administrator doesn't

need it, remote access into your network from supporting vendors.

Why is that available 24 hours a day if I don't currently need your help?

It's because someone's too lazy to go turn off the modem and yeah, I said modem,

or disable that VPN access or suspend that user account because it, it's,

it creates overhead very similarly.

can suspend services running on in our environment.

We can turn off, uh, administrative services that aren't being used when

they're not necessary, don't do that.

And then ideally, um, because we don't do that, uh, you would wanna

monitor for the use of those things.

And a lot of organizations still think that we don't need that, or it's too

expensive, or, you know, we don't have the skillset, you know, whatever the case is.

There's always, there's excuses after excuses, but.

Yeah, I think, I think this, we, we've talked about this, uh, and

we're gonna give, we're gonna give a couple action items here.

Uh, we've talked about, like, one of the things that comes up a lot is RDP, right?

And that RDP is very, very useful.

But RDP open all the time, and RDP, especially RDP, accessible via.

The internet, right.

Directly accessible via the internet is just, you're just, it's just,

there's like asking for trouble.

Right?

Um, and so there are ways to turn it off and turn it on when you need it.

Uh, and there's also, and, and, and you know, again,

you, you, you, you alluded to.

You alluded to, there's, there's a, there's a budget,

uh, aspect of this, right?

So there are remote access tools that are much more secure

than RDP that you could enact.

Uh, it, it's just, it's going to increase your costs, but perhaps

increase your costs a little bit with a much higher level of security.

I, I think it's a matter of like finding, finding that sweet spot, right?

Where, where's the, some things I think we can do.

Where it's, it's a, there's a little bit of hassle and I, I, I'll give another

perfect example of something that you suggested back on a previous podcast

that I enacted in my personal life.

And that was using, um, you know, you, the idea was that don't have, uh, you

know, when you, when you go into your bank, like don't have a bunch of other

tabs open and all that kind of stuff.

And, and the way I, and the way I. Decided to implement that was, if

I do anything that's that level of security, I do it in a different browser.

Right.

Meaning a different brand of browser.

Right.

And, and then I, um, and since I use Chrome as like my main browser,

I implemented a, uh, I, there's a tool that allows me to blacklist.

Certain sites, right?

Like Citibank, right?

I can say if I ever, 'cause, 'cause I, I don't know if you

know this, Mike, I forget stuff.

I got CRS like a lot and I forget that I, that I told myself, I'm

not gonna log into Citibank on my.

Chrome browser.

And so I do it.

I'll type in, I'll type in citi.com, and Chrome will say, you know, you

told us not to let you do that.

And I'm like, oh yeah.

And then I go over to Firefox minor level of inconvenience for

a significant change in security.

And I think it's a matter of finding those things for these

living off the land, uh, attacks.

Does that sound about right?

It does.

And if I could continue your bank analogy a little further.

So your browser would be the living off the land part, especially

if you save your password.

Yeah.

Uh, so that guy just has to compromise your machine and identify

the browsers you use and then.

Yeah, trial and error.

Chrome doesn't work.

Oh, Firefox does work.

Oh, and you saved your password.

So now I'm, I'm in your bank because I've used the resources

available to me on your machine.

Well, then the, the evolution of that activity would generate,

you know, some kind of log, or event triggers in the bank, right?

So somebody logged in at 2:00 AM from a different IP address than, you know, your.

Recent IP addresses.

Right.

a, an email or a text message potentially related to that.

if they buy stuff or change stuff, you should hopefully have

alerting or events related to that.

And if there's any transactions over a certain threshold, you should have

alerting related to those things.

Right.

are the, those are the things.

And just going back to the living off the land part.

know, bad guys are gonna do reconnaissance first and be quiet, but then when

they're ready to, to execute their, plan, they're not necessarily as up, uh, as

concerned with how loud they're gonna be.

'cause it's gonna happen very quickly.

Hmm.

Nice.

So let's talk.

Go ahead, prana.

we, so Mike, I know you said that people will act fast.

How far or how much time is taken usually in that first step of kind of scoping

things out, using, uh, living off the land versus, okay, now I'm actually

gonna execute and sort of run with it.

And like you said, they don't care how loud it is.

They're gonna make a bunch of noise, break a bunch of things, but

they're trying to go as quickly as possible before they're detected.

If I could write, it depends backwards so that it would show up the right

way, I would, uh, but it depends.

But like is it like 90% of the time is typically spent in the first phase

and less time is spent in the second?

Is that a fair assumption?

and there, there are some good statistics around that.

But yeah.

As an example, a, an attack that could last four hours had probably 30 to 90

days worth of reconnaissance ahead of it.

Hmm.

So, yeah, that's interesting.

Um.

So, uh, all right, well, let's talk about, we, PowerShell has come up a lot.

What, what can we do with PowerShell and, you know, is there anything that's like

the easy idea that I talked about earlier?

Is there a way to easily disable and re-enable PowerShell when we need it?

So of all the environments that I've, I've worked with or in.

Very few of them use PowerShell very much.

There's usually that one, that one admin, that one person that knows how to use it

and that uses it because they're, they get it and then man, it makes life easy.

Everybody else doesn't need it.

And in a lot of cases, PowerShell is not necessarily required or

needed across an entire environment.

Hmm.

You might just need it between your admin machine and Office 365 or

those, or, or your server cluster, take it off of everything else.

And, and that just, that goes back to hardening.

So how do I harden my network?

Well, you've first gotta understand your network, right?

Know yourself.

What, what do I, what am I responsible for?

How do all these things work?

What is their primary role?

Hopefully you've got one machine for one role.

We, we would call that a bastion host, like your web server's, just

your web server, that's not also your financial server or your backup server.

Uh, and then for, for those roles and that purpose of that machine, what's needed,

what's necessary to, to support it.

Like you don't need Bluetooth active on a production server.

It doesn't need to be a web server unless it's a web server.

You don't need.

Uh, it doesn't need print server services running.

so those are just examples of the services running.

Well, now let's, let's look at all the, the, the overhead from a, a file and

help, uh, you know, software perspective.

Your server doesn't need Microsoft Solitaire and games.

It doesn't need all the help.

It doesn't need all the help files, it doesn't need templates.

And, and all of the, the pre-installed.

You know, garbage that the, the vendor, whether it's Dell or whoever, uh, so much

that can be done to, to make a machine run more effectively and securely.

If you can really understand what it's gonna do, and then

take everything else off, turn it

But Mike, that takes, but that takes work.

it, it takes work.

So again, it depends.

So if, if I've got all these machines.

And I spend the time to develop what I would call a, a golden image, right?

So, um, I, I take one machine and I say, this is exactly how I want this done.

Well create an image of that and apply it on the other, however many.

And then for each one of those golden images, I can add back on top of

that base golden image, the things that are particular to that server.

So your, so your golden image is, is, is, uh, like in this case, uh,

PowerShell is disabled everywhere.

But then for that one person who needs PowerShell, you can turn it on.

Correct.

Yeah.

And that's, that's great too because if you have an issue with that

machine, re-apply the image, right?

Uh,

Hmm.

Yeah.

from scratch without having to figure out what broke and how to fix it.

Is there, is there a way for us to figure out the tools, esp if we're,

if we're, if we're trying to secure things for, you know, against a living

off the land attack, is there a way to figure out the tools like PowerShell

that are in use in our environment?

By, by the use of, by looking at like the ports that they're using, for example.

There are, um, and.

And, and there's free tools.

One's called Nmap, uh, another one's called Wireshark.

Uh, so those are network protocol analyzers, so you can run

that across your environment.

It'll tell you by IP address.

Here's the ports that are open and based on the, the

default service for a given port, it'll, it'll give you a description of what it

thinks might be running on that port.

But bad guys are also pretty good, uh, at, at changing what ports are being

used so that you're not suspicious of, uh, um, of network activity.

Like we had an incident call on on Friday where a school district

said, I think I'm getting hacked.

I just shut my network down.

right, well, let's look into that.

Well, it was, uh.

Um, expired certificates for a website, and then on the back

end, the logs showed that,

data was going out.

Uh, iic ICMP data was going out to this, uh, AWS IP address.

Well, ICMP by itself, not a bad thing, but to a, uh, an IP address that

maybe doesn't have a good reputation.

That could be a bad guy just sending, like intentionally changing what

port they're sending data out so that it looks like ICMP, but maybe

it's just low throttle, you know, throttled down data exfiltration, uh,

turned out to be a false positive.

It was actually their web filter for the school district.

but, uh, we helped them learn something new that day.

but bad guys do that.

Uh, our, our engineers will exfil credentials over the DNS port

because you can't block DNS.

hardly anybody's, you know, monitoring that port.

Right.

you just do it slow and methodically, then you could, you could exfil quite a

bit of data, uh, over a period of time.

Yeah, I think we talked about that with when we had, um, uh, what's his name?

Uh, Dwayne Persona.

The Red Teamer.

Yeah.

When we had the red teamer on there, he talked a lot about, about the use of DNS.

Um, you know, you gave me a memory back when my daughter was young and I was a

little concerned about some of the traffic that I was seeing, uh, coming into.

Um, the computer she was using and I went and I bought a SonicWall firewall, right.

That had content filtering.

And she came in the front, she came in the front, it was literally

just sit, there was a box, a SonicWall box sitting on the couch.

She walked in, she goes, SonicWall, what's that doing here?

And I said, well, yeah, it's for this.

She's like, they use that at the school.

It won't let you do anything.

And I'm like, yes.

I was like.

I bought the right one.

Um, anyway, so the other, uh, so something you talked about with, um, this idea of

that it was going to a place that maybe that isn't quite trusted, that brings

up another concept of this idea, either either application, white listing or IP

address, white listing in terms of is that another way that we can And, and, and it's

another tool where it's, when you start, it's probably gonna be a giant pain.

Right.

If you say no applications are allowed to be used except for those

that have been blessed by it, it's gonna really suck for a while.

But is that, again, this goes back to the turning off, um, admin, is

this a common practice as well?

I.

It is.

And if you put the work in upfront, it's gonna be a little less headache.

And what I mean by that is if, if you want to implement.

You know, kind of white listing, black listing policies start

with getting to know everybody.

Like go sit with the engineers, go sit with the accounting and executives

and find out what they're using, or do some of your own homework.

You know, there's logs out there.

Uh, but go, go talk to them about what you want to do and, and the, the purpose,

like we're, we're doing this to, to make things, uh, safer, but it also helps us

reduce risk and problems with computers and, you know, all that good stuff.

So help me understand.

What you need to do your job, and then I'm gonna use that to, to develop a

plan to, to make us all safe and, and, you know, better, better, you know,

better running and, uh, environment and computers with fewer problems.

So you really have to do that research upfront where you're looking at

the, the things that are being used.

And again, you can do, you can use the network monitoring tool to do that.

These are the things that are happening.

What's that?

I've got another, another example of that and, and.

Yeah, how you, how you do this.

Uh, and, and by this I mean this exercise of, of understanding what

your business needs or what the, your employees need to do their job.

a lot of times it just, no, nobody spends time on an exercise like that

until there's smoke or fire, right?

And then, and then we're like, well, what caused it?

Why did this happen?

How did you let this get this bad?

You know, that kind of thing.

And, and really, if you, if you.

understand security and whether that's physical security or cyber, it's gotta

start with understanding what you're protecting and how this whole place works.

A good example of that would be a school district.

Schools in Texas primarily don't care to have network connections to

China unless you've got like some sister school and there's a program

over there and this kind of thing.

the most part, we don't communicate with China.

Uh, a a a public school in Texas.

So why are we allowing traffic from China to even reach our network?

Right?

So there's that.

Alright, well then, uh, uh, a bigger kind of, more interesting story is I

had a friend that worked for match.com as their IT security person, and they

didn't do any geo IP blocking at the firewall and they were getting hit

millions of times a day from overseas.

And a lot of those, the intent was to create fake female profiles in the

application, uh, for the only purpose of phishing, um, personal email addresses

out of the male members of match.com that they could then spam those male

me, those male uh, members', personal emails with, uh, pornography links.

And those bad guys were making millions of dollars a day through phished pornography

link clicks because of bots on the dating site that were coming from overseas.

And the moment, I'll tell you how bad this was, the moment that they

implemented geo IP blocking@max.com,

The traffic to 10%.

well, uh, from an organized crime perspective, this is how bad it was.

Uh, you know, they were just kind of a, uh, an introverted kind of nobody.

They just did their job and went home and played Xbox, you know, that kind of thing.

And one day they went home after having implemented geo ip blocking.

It did, it had such an impact on the organized crime ring

that was running this thing.

they had actually shipped a wooden casket and it was propped up on their front porch

that told them to undo the GOIP blocking.

Oh

That doesn't sound good.

That's the dark side, you know.

Um, so, uh, all right.

Well, I, we could, we could talk about this all day, but I, I, I, I

think we get, you know, identify.

Things that you need to, you know, that your organization needs to get the job

done, places that your organization needs to communicate with to get the job done.

Investigate all that stuff and then start investigating, locking things down, right?

Turning off applications that aren't being used, turning off regions that are, that,

that we have no reason communicating with.

And, um, and, and consider application white listing, uh, you

know, and, and no administrative privileges on machines, right?

Unless, unless that.

Person needs and I'll, I'll tell one final story about this.

Going back a hundred years when I was consulting at a certain

communication company and um.

I, we had determined, or I had figured out that, that all their

engineering team had, um, admin route on their Unix workstations.

And I talked to the boss.

I was like, there is no reason that they need route on

their, on their workstations.

And so I went around and I. I changed the root password.

The, uh, each of them had a use, like, let's say the user ID was Curtis.

There was a user ID called Curtis Zero that had a UID of zero, which was

basically root and they had that password.

And I went around and I removed that entry and I rebooted the machine, right?

And, um, one of the guys was really, really angry and, um.

He was like, well, you know when you reboot the machine, like the

license manager doesn't come back up.

And I go, well, if the license manager needs to come back up when you reboot the

machine, why don't you just put it in the startup file so that it reboots or so it

restarts when they reboot the machine.

He says, I don't know how to do that.

And that's her is why you don't have root.

And I actually like your, your story about the, the Unix environment

because, um, you could, you can take away people's and, and I and I, and I

will also promote this, even if you're an admin, run your machine as admin,

Right,

machine as a normal user and then elect to run applications as admin.

You just have to put your credentials in every time,

right.

save you.

So similar to the Unix environment, you know, you, you, you run as a normal user

and then you pseudo to, to route when you need to use, and that also creates a

log, uh, an audit log of If everybody's using Curtis Zero, then no one, there's

no accountability for who did what.

It just says Curtis zero.

That was actually my nickname in high school.

Curtis Hero.

Anyway.

All right.

Well, thank you very much, Mike.

Uh, and everyone thank you persona again.

No, this was good.

Yeah.

All right.

That is a wrap.