Black Hat Europe 2022 NOC: The SOC Inside the NOC

0
160
Black Hat Europe 2022 NOC: The SOC Inside the NOC


Our core mission within the NOC is community resilience. We additionally present built-in safety, visibility and automation, a SOC contained in the NOC.

In half one, we coated:

  • Designing the Black Hat Network, by Evan Basta
  • AP Placement Planning, by Sandro Fasser
  • Wi-Fi Air Marshal, by Jérémy Couture, Head of SOC, Paris 2024 Olympic Games
  • Meraki Dashboards, by Rossi Rosario Burgos
  • Meraki Systems Manager, by Paul Fidler
  • A Better Way to Design Training SSIDs/VLANs, by Paul Fidler

In half two, we’re going deep with safety:

  • Integrating Security
  • First Time at Black Hat, by Jérémy Couture, Head of SOC, Paris 2024 Olympic Games
  • Trojan on an Attendee Laptop, by Ryan MacLennan
  • Automated Account Provisioning, by Adi Sankar
  • Integrating Meraki Scanning Data with Umbrella Security Events, by Christian Clasen
  • Domain Name Service Statistics, by Adi Sankar

Integrating Security

As the wants of Black Hat advanced, so did the Cisco Secure Technologies within the NOC:

The SecureX dashboard made it simple to see the standing of every of the related Cisco Secure applied sciences.

Since becoming a member of the Black Hat NOC in 2016, my aim stays integration and automation. As a NOC group comprised of many applied sciences and corporations, we’re happy that this Black Hat NOC was essentially the most built-in so far, to offer an general SOC cybersecurity structure answer.

We have concepts for much more integrations for Black Hat Asia and Black Hat USA 2023. Thank you, Piotr Jarzynka, for designing the combination diagram.

Below are the SecureX risk response integrations for Black Hat Europe, empowering analysts to analyze Indicators of Compromise in a short time, with one search.

The unique Black Hat NOC integration for Cisco was WebWitness sending suspicious recordsdata to Threat Grid (know Secure Malware Analytics). We expanded that in 2022 with Palo Alto Networks Cortex XSOAR and used it in London, for investigation of malicious payload assault.

WebWitness noticed a focused assault towards the Black Hat community. The assault was meant to compromise the community.

WebWitness extracted the payload and despatched it to Secure Malware Analytics for detonation.

Reviewing the evaluation report, we have been in a position to rapidly decide it was the MyDoom worm, which might have been very damaging.

The assault was blocked on the perimeter and the analysts have been in a position to observe and enrich the incident in XSOAR.

First Time at Black Hat, by Jérémy Couture, Head of SOC, Paris 2024 Olympic Games

My first time at Black Hat turned out to be an unbelievable journey!

Thanks to the cybersecurity partnership between Paris 2024 and Cisco, I used to be in a position to combine into the Cisco Crew, to function the NOC/SOC as a Threat Hunter on essentially the most harmful community on the planet for this European Edition of Black Hat.

My first day, I helped with deploying the community by putting in the wi-fi Meraki APs on the venue, understanding how they have been configured and the way they might assist analysts to determine and find any shopper related to the community that would have a foul conduct throughout the occasion, the concept being to guard the attendees if an assault was to spray on the community.

Following this “physical” deployment, I’ve been in a position to entry the entire Cisco Secure surroundings together with Meraki, Secure Malware Analytics, Umbrella, SecureX and the opposite Black Hat NOC companions software program instruments.

SecureX was positively the product on which I needed to step up. By having so improbable professionals round me, we have been in a position to dig within the product, figuring out potential use instances to deploy within the orchestration module and anticipated integrations for Paris 2024.

Time was flying and so have been the attendees to the convention, a community with out person is enjoyable however could be fairly boring as nothing occurs, having so many cybersecurity skilled on the similar place testing completely different safety malwares, assaults and so forth led us to very attention-grabbing investigations. A paradox on the Black Hat, we don’t need to block malicious content material because it could possibly be a part of workout routines or coaching courses, fairly a unique mindset as what we, safety defenders, are used to! Using the completely different elements, we have been capable of finding some observables/IOCs that we examine by means of SecureX, SecureX being related to all the opposite elements helped us to complement the observables (IPs, urls, domains…), understanding the criticality of what we recognized (resembling malware payloads) and even led us to poke the parents within the coaching courses to allow them to know that one thing actually flawed was taking place on their gadgets.

Being a part of the Black Hat NOC was an unbelievable expertise, I used to be in a position to meet improbable professionals, absolutely dedicated on making the occasion a hit for all attendees and exhibitors. It additionally helped me to raised perceive how merchandise, that we use or will use inside Paris 2024, could possibly be leveraged to our wants and which indicators could possibly be added to our numerous Dashboards, serving to us to determine, instantaneously, that one thing is going on. 

Trojan on an Attendee Laptop, by Ryan MacLennan

During the final day of Black Hat Europe, our NOC associate, WebWitness noticed some recordsdata being downloaded on the community. The integration once more robotically carved out the file and submitted the Cisco Secure Malware Analytics (SMA) platform. One of these recordsdata got here again as a trojan, after SMA detonated the file in a sandbox surroundings. The particular hash is the under SHA-256:

938635a0ceed453dc8ff60eab20c5d168a882bdd41792e5c5056cc960ebef575

The screenshot under exhibits a few of the behaviors that influenced the choice:

The results of seeing these behaviors induced SMA to provide it the very best judgement rating obtainable to a detonated file:

After this judgement was made, we related with the Palo Alto Networks group, and so they discovered the IP handle related to the file obtain.

Once we had this info, we went to the Meraki dashboard and did a seek for the IP handle. The search returned just one shopper that has been related to the handle for the complete Black Hat convention.

Knowing that there has solely been one shopper related to the handle made discovering the attendee simpler. We then wanted to know the place they have been and Meraki had this discovered. After opening the shopper’s profile, we noticed what SSID and entry level (AP) they have been related to utilizing the Meraki location map.

We then discovered the attendee and allow them to know to have their IT examine their laptop computer to verify it’s clear.

Apart from the technical challenges of working a brief community for N thousand folks, the Black Hat occasion reminded us that success doesn’t occur with out teamwork; that management isn’t nearly protecting the venture on observe. It can be about taking care of the group and that small particulars in planning, construct up and tear down could be simply as essential, as having all the suitable instruments and beautifully expert Individuals utilizing them throughout the occasion itself.

Automated Account Provisioning, by Adi Sankar

In the Cisco Secure know-how stack, inside the Black Hat NOC, we use SecureX Single Sign-on. This reduces the confusion of managing a number of accounts and passwords. It additionally streamlines the integrations between the Cisco merchandise and our fellow NOC companions. We have an open ecosystem strategy to integrations and entry within the NOC, so we are going to provision Cisco Secure accounts for any employees member of the NOC. Logging into every particular person console and creating an account is time consuming and may typically result in confusion on which instruments to provision and which permission ranges are wanted.

To automate this course of, I developed two workflows: one to create non-admin customers for NOC companions and one to create administrator accounts in all of the instruments for Cisco employees. The workflows create accounts in SecureX, Secure Malware Analytics (Threat Grid), Umbrella DNS and Meraki dashboard, all utilizing SecureX Single Sign-On.

Here is what the workflow appears to be like like for creating non-admin customers.

The workflow requires three inputs: first title, final title, and e-mail. Click Run.

The sequence of API calls is as follows:

  • Generate a SecureX token to entry the SecureX API together with the “admin/invite:write, invite:write” scopes.
  • Invite the User to SecureX utilizing the invite API (https://visibility.amp.cisco.com/iroh/invite/index.html#/). In the physique of this POST the position is about to “user”. In the Administrator workflow this may be set to “admin” permitting full entry to SecureX.
  • If the invite fails on account of a reproduction invite, print an error message in Webex groups.
  • Invite the person to the Meraki dashboard utilizing the “admins” API (https://api.meraki.com/api/v1/organizations/{organizationId}/admins). In the physique of this name, the group entry is about to none, and entry to 2 networks (Wireless community and Systems Manager) are set to “read-only” to make sure the person can’t make any adjustments to have an effect on the community. In the Administrator model org entry continues to be set to none however “full” permissions are offered to the 2 networks, one thing we don’t want all customers to have.
  • Generate a token to the brand new Umbrella API utilizing https://api.umbrella.com/auth/v2/token with the next scopes (learn admin customers, write admin customers, learn admin roles). This single endpoint for producing a token primarily based on scopes has made utilizing the Umbrella API considerably simpler.
  • Then invite the person to Umbrella utilizing the “admins” API at (https://api.umbrella.com/admin/v2/users) and within the physique of this POST the “role ID” is about to 2 to make sure read-only permissions are provisioned for Umbrella.
  • Create a person in Secure Malware analytics utilizing the API at (https://panacea.threatgrid.com/api/v3/organizations/<ORG_ID>/users). The physique of this request merely creates a Malware Analytics login utilizing the customers final title and appending “_blackhat”
  • The final name is to ship a password reset e-mail for the Malware Analytics person. (https://panacea.threatgrid.com/api/v3/users/<LOGIN>/password-email) They can set their password by way of the e-mail, login to the Malware Analytics console after which hyperlink their SecureX sign-on account, which suggests they may now not want to make use of their Malware Analytics credentials.

Once the workflow has accomplished efficiently, the person will obtain 4 emails to create a SecureX Sign-On account and settle for the invites to the assorted merchandise. These workflows actually improved our responsiveness to account provisioning requests and makes it a lot simpler to collaborate with different NOC companions.

Integrating Meraki Scanning Data with Umbrella Security Events, by Christian Clasen

Over the earlier Black Hat occasions, we have now been using Meraki scanning knowledge to get location knowledge for particular person purchasers, as they roamed convention. In the preliminary weblog put up (Black Hat Asia 2022), we created a Docker container to simply accept the information from the Meraki Scanning API and put it aside for future evaluation. At Black Hat USA 2022, we wrote about tips on how to use Python Folium to make use of the flat textual content recordsdata to generate chronological heatmaps that illustrated the density of purchasers all through the convention.

This time round, we’ve stepped it up once more by integrating Umbrella DNS Security occasions and including the flexibility to trace purchasers throughout the heatmap utilizing their native IP handle.

To enhance the portability of our knowledge and the effectivity of our code, we started by transferring from flat JSON recordsdata to a correct database. We selected SQLite this time round, although going ahead we are going to probably use Mongo.

Both could be queried instantly into Python Pandas dataframes which is what is going to give us the optimum efficiency we’re searching for. We have a devoted Docker container (Meraki-Receiver) that can validate the incoming knowledge stream from the Meraki dashboard and insert the values into the database.

The database is saved on a Docker quantity that may be mounted by our second container, the Meraki-Mapper. Though this container’s main objective is constructing the heatmaps, it additionally performs the duty of retrieving and correlating Umbrella DNS safety occasions. That is, any DNS question from the Black Hat community that matches considered one of a number of predefined safety classes. Umbrella’s APIs have been lately improved so as to add OAuth and simplify the URI scheme for every endpoint. After retrieving a token, we will get all safety occasions in the time-frame of the present heatmap with one name.

What we need to do with these occasions is to create Folium Markers. These are static “pins” that can sit on the map to point the place the DNS question originated from. Clicking on a marker will popup extra details about the question and the shopper who despatched it.

Thanks to the Umbrella Virtual Appliances within the Black Hat community, we have now the inner IP handle of the shopper who despatched the DNS question. We even have the inner IP handle within the Meraki scanning knowledge, together with the latitude and longitude. After changing the database question right into a Pandas dataframe, our logic takes the IP handle from the DNS question and finds all cases within the database of location knowledge for that IP inside a 5-minute window (the decision of our heatmap).

What we find yourself with is an inventory of dictionaries representing the markers we need to add to the map. Using Bootstrap, we will format the popup for every occasion to make it look a bit extra polished. Folium’s Popup plugin permits for an iFrame for every marker popup.

The result’s a transferring heatmap overlaying a complete day on a given convention ground, full with markers indicating safety occasions (the crimson pushpin icon).

Clicking on the pushpin exhibits the main points of the question, permitting us within the NOC to see the precise location of the shopper once they despatched it.

To additional enhance this service throughout the subsequent convention, we plan to implement an online web page the place NOC employees can submit an IP handle and instantly get map monitoring that shopper by means of the convention ground. This ought to give us an much more environment friendly approach to discover and notify of us who’re both behaving maliciously or seem like contaminated.

Domain Name Service Statistics, by Adi Sankar

For years we have now been monitoring the DNS stats on the Blackhat conferences. The post-pandemic 2022 numbers seem like we by no means skipped a beat after the dip in DNS queries from 2021, seen within the bar graph under. This yr’s attendance noticed effectively over 11 million complete DNS queries.

The Activity quantity view from Umbrella provides a top-level stage look of exercise by class, which we will drill into for deeper risk looking. On development with the earlier Black Hat Europe occasions, the highest Security classes have been Dynamic DNS and Newly Seen Domains. However, it’s price noting a proportionally bigger improve within the cryptomining and phishing classes from 9 to 17 and 28 to 73, respectively, in comparison with final yr.

These years, Black Hat noticed over 4,100 apps connect with the community, which is almost double of what was seen final yr. However, nonetheless not topping over 6,100 apps seen at Black Hat USA early this yr.

Should the necessity come up, we will block any utility, resembling Mail.ru above.

Black Hat Europe 2022 was one of the best deliberate and executed NOC in my expertise, with essentially the most integrations and visibility. This allowed us the time to take care of issues, which is able to at all times come up.

We are very happy with the collaboration of the group and the NOC companions.

Black Hat Asia shall be in May 2023, on the Marina Bay Sands, Singapore…hope to see you there!

Acknowledgments

Thank you to the Cisco NOC group:

  • Cisco Secure: Ian Redden, Christian Clasen, Aditya Sankar, Ryan MacLennan, Guillaume Buisson, Jerome Schneider, Robert Taylor, Piotr Jarzynka, Tim Wadhwa-Brown and Matthieu Sprunck
  • Threat Hunter / Paris 2024 Olympics SOC: Jérémy Couture
  • Meraki Network: Evan Basta, Sandro Fasser, Rossi Rosario Burgos, Otis Ioannou, Asmae Boutkhil, Jeffry Handal and Aleksandar Dimitrov Vladimirov
  • Meraki Systems Manager: Paul Fidler

Also, to our NOC companions WebWitness (particularly David Glover, Iain Davidson, Alessandro Contini and Alessandro Zatti), Palo Alto Networks (particularly James Holland, Matt Ford, Matt Smith and Mathew Chase), Gigamon, IronNet, and the complete Black Hat / Informa Tech employees (particularly Grifter ‘Neil Wyler’, Bart Stump, Steve Fink, James Pope, Jess Stafford and Steve Oldenbourg).

About Black Hat

For 25 years, Black Hat has offered attendees with the very newest in info safety analysis, growth, and tendencies. These high-profile world occasions and trainings are pushed by the wants of the safety group, striving to deliver collectively one of the best minds within the trade. Black Hat evokes professionals in any respect profession ranges, encouraging progress and collaboration amongst academia, world-class researchers, and leaders in the private and non-private sectors. Black Hat Briefings and Trainings are held yearly within the United States, Europe and USA. More info is accessible at: blackhat.com. Black Hat is delivered to you by Informa Tech.


We’d love to listen to what you suppose. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!

Cisco Secure Social Channels

Instagram
Facebook
Twitter
LinkedIn

Share:



LEAVE A REPLY

Please enter your comment!
Please enter your name here