Cisco is a longtime accomplice of the Black Hat NOC and 2023 was our seventh yr supporting Black Hat Europe. Cisco is the Official Mobile Device Management, Malware Analysis and DNS (Domain Name Service) Provider.
We work with the opposite official suppliers to deliver the {hardware}, software program and engineers to construct and safe the community, for our joint buyer: Black Hat.
- Arista: Wired and Wireless Network Equipment
- Corelight: Network Analytics and Detection
- InternetWitness: Threat Detection & Response, Identity
- Palo Alto Networks: Network Security Platform
The main mission within the NOC is community resilience. The companions additionally present built-in safety, visibility and automation, a SOC contained in the NOC.
Outside the NOC have been accomplice dashboards for the attendees to view the amount and safety of the community visitors.
From Malware to Network Visibility
Cisco was first requested to supply automated malware evaluation, again in 2016. Our contributions to the community and safety operations advanced, with the wants of the client.
The NOC leaders allowed Cisco (and the opposite NOC companions) to usher in further software program to make our inside work extra environment friendly and have better visibility; nevertheless, Cisco isn’t the official supplier for Extended Detection and Response, Network Detection and Response or collaboration.
- Cisco XDR: Threat Hunting / Threat Intelligence Enrichment / Executive dashboards / Automation with Webex
- Cisco XDR Analytics (Formerly Secure Cloud Analytics / Stealthwatch Cloud): community visitors visibility and risk detection
- Cisco Webex: Incident notification and group collaboration
The Cisco XDR Command Center dashboard tiles made it straightforward to see the standing of every of the linked Cisco Secure applied sciences, and the standing of ThousandEyes brokers.
When the companions deploy to every convention, we arrange a world class community and safety operations middle in just a few days. Our objective stays community up time and creating higher built-in visibility and automation. Black Hat has the choose of the safety business instruments and no firm can sponsor/purchase their manner into the NOC. It is invitation solely, with the intention of range in companions, and an expectation of full collaboration. As a NOC group comprised of many applied sciences and firms, we’re constantly innovating and integrating, to supply an general SOC cybersecurity structure answer.
Below are the Cisco XDR integrations for Black Hat Europe, empowering analysts to research Indicators of Compromise (IOC) in a short time, with one search.
We respect alphaMountain.ai, Pulsedive and Recorded Future donating full licenses to Cisco, to be used within the Black Hat Europe 2023 NOC.
A core built-in know-how within the Black Hat NOC for Cisco is InternetWitness sending suspicious recordsdata to Threat Grid (now Secure Malware Analytics). We expanded this in Black Hat Asia 2023 with Corelight additionally submitting samples. Over 4,600 samples have been submitted.
The NOC analysts additionally used Malware Analytics to research suspicious domains, with out the chance of an infection. An instance was an alert for cryptomining on the community by Umbrella, accessed by a pupil in a Black Hat coaching course.
Rather than going to the web site on a company or Black Hat belongings, we have been capable of work together with the web site within the glovebox, together with downloading and putting in the web site payload.
We allowed the payload to make the adjustments on the digital machine, because the person skilled.
For cryptomining, we enable the exercise to happen, however alert the person that their machine is getting used for that goal.
As the payload was not malicious, we didn’t notify the person of an an infection.
XDR Analytics, by Abhishek Sha
XDR Analytics (previously Secure Cloud Analytics, or Stealthwatch Cloud) means that you can achieve the visibility and steady risk detection wanted to safe your public cloud, non-public community and hybrid setting. XDR Analytics can detect early indicators of compromise within the cloud or on-premises, together with insider risk exercise and malware, coverage violations, misconfigured cloud belongings, and person misuse. These NDR (Network Detection and Response) capabilities are native performance inside Cisco XDR. Cisco XDR was accessible beginning July 31st 2023, so we had some expertise below our belt for using its capabilities.
XDR Analytics geared up us with the potential to establish a variety of alerts, considerably enhancing our cybersecurity measures at Black Hat.
Deciphering Cyber Threats: A Black Hat Case Study in XDR Analytics
While scanning web hosts is a typical observe in cybersecurity, it’s necessary to notice that the context and goal of those scans can considerably influence the seriousness of the state of affairs. If these scans have been to shift focus in direction of different convention contributors or, extra critically, in direction of the community infrastructure itself, it might immediate a extra severe response.
This state of affairs underscores the necessity for steady vigilance and a proactive strategy in monitoring and responding to potential cyber threats. This is the essence of efficient cybersecurity administration – a course of that’s consistently examined, improved, and fortified within the face of potential threats.
During our community vigilance at Black Hat, Ivan and I encountered a state of affairs that clearly highlighted the essential function of XDR Analytics. XDR Analytics raised an alert when it detected that a number of inside IP addresses have been speaking with sure exterior IP addresses. Intriguingly, these exterior IP addresses have been on our blocklist for manufacturing safety environments.
Leveraging the netflow telemetry we have been receiving, we employed the Event Viewer characteristic on XDR Analytics to discern the kind of visitors being transmitted to these addresses. On all noticed logs, the one protocol was ICMP.
A full search confirmed that no visitors apart from ICMP linked to the exterior IPs.
By using graphs in XDR Analytics, we gained insights into the amount of visitors despatched to the exterior IP addresses. This proved instrumental in figuring out whether or not any potential ICMP tunneling was happening, based mostly on the dimensions of the general visitors.
We then centered our investigative efforts on these suspicious exterior IP addresses utilizing Cisco XDR. The examination revealed that this IP was flagged on different blocklists as effectively.
Further evaluation on the Cisco XDR graph disclosed a community of different endpoints that had additionally been interacting with these doubtful IP addresses. This revelation uncovered the far-reaching affect of those IPs and enabled us to visualise the varied interconnected actions.
Lastly, we resolved the IP addresses on Umbrella and deduced that these IP addresses have been related to a “Private Internet Access VPN”. It appeared that the endpoint was testing the reachability of all these relays hosted in several areas.
Despite this visitors being innocuous, we capitalized on XDR and XDR Analytics to achieve a greater understanding and context of this incident. This expertise underscores the efficacy of those instruments in enhancing cybersecurity defenses.
Mastering Threat Detection with Attack Chains
XDR Attack Chain is a characteristic that permits us to correlate a number of alerts into a bigger investigation. We use extracted alert meta knowledge to find out what the alerts have in frequent, which we check with as frequent indicators. Common indicators embrace units, IP addresses, host names, and usernames. We then observe the MITRE ATT&CK® framework to additional establish the ways, methods, and procedures (TTPs) to mannequin the sequencing of actions and risk behaviors which may very well be early indications of an assault.
In this occasion, we’re observing an assault chain comprising a number of “Suspected Port Abuse (External)” occasions. Typically, with out an assault chain, every of those occasions would should be investigated individually, a course of that may very well be time-consuming and doubtlessly much less efficient.
However, the fantastic thing about an assault chain lies in its potential to consolidate a number of alerts right into a singular, interconnected occasion. This methodology gives a holistic overview of the varied alerts, the units concerned, and their respective roles, all throughout the framework of a single mixed occasion.
The energy of this strategy is that it eliminates the necessity for an exhaustive investigation of every separate alert. Instead, it presents a complete, contextualized view of the state of affairs, enabling a extra environment friendly and efficient response to potential threats.
With this data, we have been capable of work with the risk hunters of InternetWitness, Palo Alto Networks and Corelight, to find out the chance to the community and attendees. Activities involving malware what could be blocked on a company community have to be allowed, throughout the confines of Black Hat Code of Conduct.
Black Hat Insights: Cisco Telemetry Broker
Cisco Telemetry Broker (CTB) acts as a foundational pillar for the clever telemetry airplane, thereby future-proofing the telemetry structure. It enhances visibility and context into the telemetry that drives the merchandise that depend on it, facilitating telemetry brokering, filtering, and sharing. The Telemetry Broker is the end result of years of administration, troubleshooting, reworking, and sharing telemetry to empower Security and Network Analytics merchandise.
At the Black Hat occasion, we employed the Telemetry Broker to course of a SPAN (Switched Port Analyzer is a devoted port on a swap that takes a mirrored copy of community visitors from throughout the swap to be despatched to a vacation spot) of all community visitors, together with the Netflow generated from Palo Alto Networks firewalls. This was a part of our NOC collaboration and integrations. We then made all this knowledge accessible to the risk hunters in Cisco XDR.
A typical Telemetry Broker deployment necessitates each a dealer node and a supervisor node. To reduce our on-premises footprint, we selected to handle the dealer node by means of XDR Analytics. This performance was activated by the XDR Analytics Engineering group on our Black Hat XDR Analytics portal from the backend, as it’s at the moment in beta. This enabled us to handle the dealer node and evaluation the metrics instantly from the cloud.
We additionally put in a further plugin referred to as the Flow Generator Plugin. This plugin enabled us to generate Netflow telemetry from the ingested SPAN visitors. With the beta code, we have been lucky to have the help of the engineering group to check the newest and most superior know-how Cisco has to supply. A particular shoutout to the engineering group for his or her invaluable help.
Unleashing the Power of Cisco XDR Automate at Black Hat Europe
With the ever-evolving technological panorama, automation stands as a cornerstone in attaining XDR outcomes. It’s certainly a testomony to the prowess of Cisco XDR that it boasts a totally built-in, sturdy automation engine.
Cisco XDR Automation embodies a user-friendly, no-to-low code platform with a drag-and-drop workflow editor. This progressive characteristic empowers your Security Operations Center (SOC) to hurry up its investigative and response capabilities. You can faucet into this potential by importing workflows straight from Cisco or by flexing your artistic muscular tissues and crafting your individual.
Cisco XDR introduces a trailblazing idea referred to as Automation Rules. This recent tackle automation guarantees to revolutionize the way in which you work together with the system. During the Black Hat Europe occasion, we flexed our ingenious muscular tissues and dropped at life an XDR Automate workflow. This workflow was designed to spring into motion every time XDR Analytics posted an incident. The workflow would delve into the guts of the alert, extracting essential particulars such because the alert description, publish time, entity teams, and observations. The parsed outcomes have been then broadcasted on Webex Teams through a message and concurrently posted on Slack. This ensured that different risk hunters might readily eat the data. Furthermore, the workflow will probably be shared on GitHub, encouraging a wider viewers to grasp and respect the automation course of.
The automation output is under. In the realm of cybersecurity, Cisco XDR Automate is pushing the boundaries, redefining how we understand automation and its limitless potentialities.
“Collaboration” and “Continuity” – for profitable risk looking, by Ivan Berlinson
During Black Hat, the NOC opens early earlier than the occasion and closes later after the trainings/briefings full for the day. This implies that each analyst place have to be coated by a bodily, uninterrupted presence for about 11 hours per day. Even with the utmost dedication to your function, typically you want a break, and a brand new potential incident doesn’t wait till you’ve completed the earlier one.
Abhishek and I shared the function of Cisco XDR analyst, with morning and afternoon shifts. We have labored carefully collectively to deal with incidents or alerts from Cisco XDR analytics and to actively hunt threats. It was a terrific collaboration! It was necessary that we didn’t work in silos and that we acted as a group to ensure we maximized all our efforts. To do that, we in fact wanted good communication, however we additionally wanted a platform that may help us and allow us to doc and share data shortly and simply (the incident we’re at the moment engaged on, what we’ve discovered, what we’ve carried out…).
The Cisco XDR incident supervisor and ribbons (with its browser extension) have been a terrific assist and saved us numerous time. Let’s shortly see how we used them in a typical investigation.
While I used to be performing a risk hunt based mostly on a Malware Analytics (Threat Grid) report exhibiting phishing indicators, XDR analytics alerted us about a number of communications to locations on a listing of nations to be monitored and utilizing a non-standard protocol/port mixture.
Cisco XDR – Incident abstract
I took a fast take a look at the incident, and because of XDR assault chain and computerized enrichment, I had an on the spot view of the belongings impacted and the a number of locations concerned.
Cisco XDR – Incident primary view (with auto-enrichment)
Telemetry from the InternetWitness integration enriched the incident and confirmed the visitors, however the built-in risk intelligence sources didn’t present any malicious verdicts or risk indicators associated to those IP addresses. Further investigation was required to substantiate this potential incident.
Investigation with telemetry from InternetWitness
I added a be aware to the incident as a part of the “Confirm Incident” step of the response plan, however as I used to be already on one other exercise, I requested Abhishek to get into the sport.
Cisco XDR – Guided Response
Abhishek was capable of additional examine communication to these IPs within the uncooked community flows collected by XDR analytics and collaborate with the InternetWitness group, who can look deep inside packet. But he doesn’t want to put in writing down the IPs on paper or memorize them, we are able to use the Cisco XDR ribbon built-in in our browser to in one-click extract any observables in an online web page.
Add observables to casebook utilizing Cisco XDR ribbon (browser-plugin)
We can then add them to a casebook shared robotically between us and accessible all over the place.
Casebook accessible for Abhishek within the XDR Analytics console
A couple of minutes later, I had completed with my earlier file and was assured about going to lunch, realizing that Abhishek was on the case and had all the data he wanted.
With the assistance of the Palo Alto analyst, it was confirmed that the visitors was reliable (QUIC – HTTP/3).
Confirmation from Palo Alto
Here are the browser extensions on your personal SOC use:
Network Visibility with ThousandEyes, by Adam Kilgore and Alicia Garcia Sastre
Black Hat Europe 2023 is the third consecutive convention with a ThousandEyes (TE) presence, following a proof of idea in Black Hat Asia 2023 and an preliminary deployment at Black Hat USA 2023. Building upon our first full deployment in Vegas, we have been centered on bettering deployment course of, knowledge baselining, and monitoring procedures.
Hardware and Deployment Process
Some of the {hardware} we dropped at the convention
Just like Black Hat USA 2023, we deployed 10 TE brokers on Raspberry Pi’s. However, since ExCel London is a smaller venue, we had the identical variety of brokers to unfold throughout a smaller space—we nonetheless didn’t really feel like we had a full Thousand Eyes, however undoubtedly extra visibility. We unfold that visibility throughout core switching, Registration, the Business Hall, two- and four-day coaching rooms, and Keynote areas.
We additionally added just a few equipment from classes realized in Vegas. Deploying TE brokers on micro-SDs is a time-consuming course of which requires connecting the micro-SD to a laptop computer utilizing a USB adapter. We invested in two adapters that may join 4 USB adapters without delay for extra streamlined deployment and scaling.
Economies of scale
At BH USA, we additionally developed a technique for deploying TE brokers wirelessly on Raspberry Pi (as coated on this weblog publish), though this performance isn’t technically supported. At BH Europe, our intention was to depend on wired Pi brokers for the majority of the monitoring; nevertheless, the wi-fi entry factors shipped to the convention didn’t have a free ethernet port. Because of this we ended up doing a primarily wi-fi deployment once more, plus two wired brokers linked to switching infrastructure. The new wi-fi deployment revealed some documentation and course of enhancements to roll into the prior weblog publish.
Enabling wi-fi on the ThousandEyes Pi picture additionally makes the Pi extra inclined to overheating. The server room in London ExCel the place we did our preliminary provisioning had a cooling drawback and reached 28 levels Celsius (82 F) at one level. The warmth within the room brought on a really quick failure of the wi-fi adapter, which initially made it seem that the wi-fi was not working in any respect. However, we ultimately untangled the documentation and warmth associated issues and obtained all of the Pi’s deployed, the place they functioned stably all through the convention, with just a few overheating incidents.
Changes in accessible personnel and {hardware} additionally necessitated a change within the Linux platform for configuring the scripts for persistent wi-fi deployment. We went with Ubuntu through VMWare Fusion on Mac laptops, which supplied a easy deployment sequence.
Monitoring, Alerting, and Baselining
The wi-fi community at BH Europe had much less latency variation than BH USA, which required tuning of alert thresholds to cut back noise. At BH USA, we deployed a rule that fired when the latency on any agent exceeded two normal deviations above baseline. However, in BH Europe this alert was firing on latency adjustments that have been statistically important, however very minor in actual world phrases. For instance, the alert under fired when latency elevated 5.4ms+ above a 7.3ms baseline.
To management for smaller variations, we added a minimal threshold of 30ms change above baseline. This resulted in a a lot smaller set of extra helpful alerts, whereas nonetheless sustaining visibility into altering latency circumstances earlier than latency reached noticeably degraded ranges.
Trains, Planes, and Wireless Access Points
On the final day of the convention, NOC morning employees discovered the wi-fi community was inaccessible half-hour earlier than the convention opened for the day. Nothing will get the blood pumping like a community failure proper earlier than enterprise hours. However, an expedited investigation revealed that solely the NOC was affected, and never the broader convention wi-fi infrastructure.
Troubleshooting revealed that the SSID was accessible, however many of the endpoints couldn’t detect it. A fast collaboration with our buddies at Arista revealed that the endpoints making an attempt to hook up with 5 GHz have been having points, whereas the endpoints that have been linked at 6 GHz have been all fantastic—an necessary element.
This was in step with what we noticed within the ThousandEyes portal. There was one engineer with a ThousandEyes endpoint agent operating earlier than the outage occurred. We jumped to agent views to examine Wi-Fi stats.
While we have been investigating, the SSID got here again at 5 GHz.
Reviewing the TE endpoint logs, we discovered that the endpoint was linked to wi-fi channel 116 earlier than the outage.
After restoration the endpoint was linked to channel 124.
During the outage the endpoint was not able to connecting to the Wi-Fi, creating a spot within the logs the place no channel or sign power was accessible. The channel change was indicative of the SSID coming again up and recalculating the most effective channel to promote the SSID.
So why did the wi-fi channel of the SSID change and what was the set off? Here comes the fascinating half: The Black Hat convention is hosted at ExCeL London, lower than 4 km away from the London City airport. Remember the preliminary channel of the SSID? It was 116, which is a Dynamic Frequency Selection (DFS) channel. These channels share the spectrum with climate radar and radar programs.
To share the usage of these channels in Wi-Fi, a mechanism was put in place by regulators to prioritise radar utilization, and that is precisely what DFS does. Wi-Fi units will hear for radar occasions and both cease utilizing the channels or robotically transfer off these channels after they detect radar occasions.
As we’re so near the airport, isn’t uncommon that one DFS occasion occurred. We are simply fortunate it didn’t occur extra typically.
Do you wish to see the entire evaluation for your self? Thanks to a really useful characteristic of ThousandEyes, you’ll be able to. All the data of this mini outage was captured in a net accessible report. Feel free to click on round and discover all of the related data for your self. The outage began at 7.31 am. The most insightful view could be discovered at Scheduled checks -> Network -> Click on the dotted traces to reveal all of the nodes within the path visualization and see metrics extra clearly.
Meraki Systems Manager, by Paul Fidler and Connor Loughlin
Our eighth deployment of Meraki Systems Manager because the official Mobile Devices Management platform went very easily, and we launched a brand new caching operation to replace iOS units on the native community, for pace and effectivity. Going into the occasion, we deliberate for the next variety of units and functions:
- iPhone Lead Scanning Devices: 68
- iPads for Registration: 9
- iPads for Session Scanning: 12
- Number of units deliberate in whole: 89
We registered the units prematurely of the convention. Upon arrival, we turned every machine on.
Then we ensured Location Services enabled, at all times on.
Instead of utilizing a mass deployment know-how, like Apple’s Automated Device Enrollment, the iOS units are “prepared” utilizing Apple Configurator. This contains importing a Wi-Fi profile to the units as a part of that course of. In Las Vegas, this Wi-Fi profile wasn’t set to auto be a part of the Wi-Fi, leading to the necessity to manually change this on 1,000 units. Furthermore, 200 units weren’t reset or ready, so we had these to reimage as effectively.
Black Hat Europe 2023 was completely different. We took the teachings from US and coordinated with the contractor to arrange the units. Now, for those who’ve ever used Apple Configurator, there’s a number of steps wanted to arrange a tool. However, all of those could be actions could be mixed right into a Blueprint.
For Black Hat Europe, this included:
- Wi-Fi profile
- Enrollment, together with supervision
- Whether to permit USB pairing
- Setup Assistant pane skipping
In Meraki Systems Manager, we managed the purposes by the assigned use, designated by Tags. When we got here in on the primary morning of the Briefings, three iPhones wanted to be modified from lead scanning within the Business Hall, to Session Scanning for the Keynote, so the attendees might fill the corridor sooner. Reconfiguring was so simple as updating the Tags on every machine. Moments later, they have been prepared for the brand new mission…which was necessary because the Keynote room crammed to capability and needed to go to an overflow room.
We additionally have been capable of verify the bodily location of every machine, if wiping was required resulting from loss or theft.
Below you’ll be able to see web page certainly one of 4 pages of Restrictions imposed by Meraki Systems Manager.
When it was time for the attendees to register, they simply displayed their QR code from their private cellphone, as acquired in e mail from Black Hat. Their badge was immediately printed, with all private particulars secured.
This goes with out saying, however the iOS units (Registration, Lead Capture and Session Scanning) do have entry to non-public data. To make sure the safety of the information, units are wiped on the finish of the convention, which could be accomplished remotely by means of Meraki Systems Manager.
Content Caching
One of the most important issues affecting the iOS units in BH USA 2023 was the rapid must each replace the iOS machine’s OS resulting from a patch to repair a zero-day vulnerability and to replace the Black Hat iOS app on the units. There have been lots of of units, so this was a problem for every to obtain and set up. So, I took the initiative into trying into Apple’s Content Caching service constructed into macOS.
Now, simply to be clear, this wasn’t caching EVERYTHING… Just Apple App retailer updates and OS updates.
This is turned on withing System Setting and begins working instantly.
I’m not going to get into the weeds of setting this up, as a result of there’s a lot to plan for. But, I’d recommend that you just begin right here. The setting I did change was:
I checked to see that we had one level of egress from Black Hat to the Internet. Apple doesn’t go into an excessive amount of element as to how this all works, however I’m assuming that the caching server registers with Apple and when units examine in for App retailer / OS replace queries, they’re then informed the place to look on the community for the caching server.
Immediately after turning this on, you’ll be able to see the default settings and metrics:
% AssetCacheManagerUtil settings
Content caching settings:
AllowPersonalCaching: true
AllowSharedCaching: true
AllowTetheredCaching: true
CacheRestrict: 150 GB
DataPath: /Library/Application Support/Apple/AssetCache/Data
ListenRangesOnly: false
LocalSubnetsOnly: true
Mother or fatherSelectionCoverage: round-robin
PeerLocalSubnetsOnly: true
And after having this run for a while:
% AssetCacheManagerUtil settings
Content caching standing:
Activated: true
Active: true
PreciseCacheUsed: 528.2 MB
CacheParticulars: (1)
Other: 528.2 MB
CacheFree: 149.47 GB
CacheRestrict: 150 GB
CacheStanding: OK
CacheUsed: 528.2 MB
MaxCachePressureLast1Hour: 0%
Parents: (none)
Peers: (none)
PrivateCacheFree: 150 GB
PrivateCacheRestrict: 150 GB
PrivateCacheUsed: Zero KB
Port: 49180
PrivateAddresses: (1)
x.x.x.x
PublicAddress: 86.28.74.239
RegistrationStanding: 1
RestrictedMedia: false
ServerGUID: xxxxxxxxxxxxxxxxxx
StartupStatus: OK
TetheratorStatus: 1
TotalBytesAreSince: 2023-12-01 13:35:10
TotalBytesDropped: Zero KB
TotalBytesImported: Zero KB
TotalBytesReturnedToPurchasers: 528.2 MB
TotalBytesStoredFromOrigin: 528.2 MB
Now, helpfully, Apple additionally pop this knowledge periodically right into a database positioned at:
Library/Application Support/Apple/AssetCache/Metrics/Metrics.db in a desk referred to as ZMETRICS
Visualising this knowledge: Reading from macOS Metrics.db
Inspired by a weblog I learn (impressed as a result of I couldn’t get the ruby script to work) I set off to try to create a entrance finish to this utilizing Grafana. After putting in a SQLIte plug in into Grafana, I might ultimately see knowledge in Grafana, which was nice, however the Unix date appeared VERY from 1993. I spent two hours making an attempt to wrangle the information into one thing usable and viewable on a graph to no finish, so I gave up.
However, it’s superb the distinction a day makes. I went again to Grafana and the SQLite db, and had some success:
This diagram reveals the cache vs utilization of cache. Bear in thoughts that there was a single OS replace, and solely a handful of purposes on the managed iOS units (in addition to updates for the Mac Mini that caching server is operating on).
I additionally perservered with a historical past of cache utilization:
Try as I would, I couldn’t discover a approach to present the dates throughout the X Axis. I’ll persevere with this for Black Hat Asia 2024.
Visualising this knowledge: Reading from my very own database
Firstly, I reused a number of the easy code to control the information from the AssetCacheManagerUtil settings command. I then created a script that first created a SQLite database, after which, each 900 seconds, put the information into it. The code to do that is right here on GitHub.
After working with the information in right here, it appears incomplete. I’ll endeavor to work on this in order that the information is extra plausible for Singapore. In principal, nevertheless, this seems like a greater approach to retailer the information. Cache Pressure, for instance, doesn’t seem within the database.
Domain Name Service Statistics and Streamlining NOC Threat Hunting by Alex Calaoagan
Since 2017, we’ve been monitoring DNS stats on the Black Hat conferences, and yr over yr (besides over the course of the pandemic), the present has continued to develop. That development is mirrored within the DNS visitors that we seize.
With over 38M DNS requests made, BH Europe 2023 has been, by far, the most important London present on document. The big soar in DNS requests could be attributed not simply to development, but additionally to the visibility developments we made at BH Asia 2023, earlier this yr in Singapore.
*Quick reminder from Singapore: Working with Palo Alto Networks, we compelled attendees, through a firewall redirect initiated by Palo Alto Networks, to make use of our resolvers. Without this alteration, Umbrella wouldn’t see the visitors in any respect, as these machines with hardcoded DNS, whether or not it was 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google), have been capable of bypass our Virtual Appliances.
The Activity quantity view from Umbrella offers a top-level stage look of actions by class, which we are able to drill into for deeper risk looking. On pattern with the earlier BH Europe occasions, the highest Security classes have been Malware and Newly Seen Domains.
In a real-world setting, of the 38M requests that Umbrella noticed, over 6,000 of them would have been blocked by our default safety insurance policies. However, since it is a place for studying, we usually let every thing fly (extra on that later).
App Discovery in Umbrella offers us a fast snapshot of the cloud apps in use on the present. In line with Black Hat’s development through the years, the variety of cloud apps in play has steadily risen. This quantity tends to observe attendance ranges, so no shock right here.
2021: 2,162 apps
2022: 4,159 apps
2023: 4,340 apps
Interested in what apps attendees hit probably the most? Here you go. The solely surprises have been Slack (WhatsApp being the incumbent…we’re in Europe, proper?) and Nine Chronicles (who knew Block Chain MMORPG gaming was a factor? I definitely didn’t).
Umbrella additionally identifies dangerous cloud purposes. Should the necessity come up, we are able to block any software through DNS, comparable to Generative AI apps, Wi-Fi Analyzers, or anything that has suspicious undertones. Again, this isn’t one thing we might usually do on our General Wi-Fi community, however there are exceptions. For instance, every now and then, an attendee will study a cool hack in one of many Black Hat programs or within the Arsenal lounge AND attempt to use stated hack on the convention itself. That is clearly a ‘no-no’ and, in lots of circumstances, very unlawful. If issues go too far, we are going to take the suitable motion.
A helpful Cisco XDR Automate workflow, deployed by Adi Sankar and up to date by Abhishek Sha (as talked about in a publish above), helps streamline our risk looking efforts through a Webex plugin that feeds alerts into our collaboration platform, considerably enhancing risk response occasions. Do you have got a number of product person interfaces and risk intelligence sources to log-in to? Integration and enhancing intelligence supply helps ease the overhead of combing by means of mountains of information.
Applying this plug-in to our NOC risk looking duties, we have been capable of shortly establish a tool that was beaconing out to a number of identified malicious websites.
After additional investigation and looking DNS information for *hamster*, we discovered that one other person was just a little distracted on their machine in the course of the convention. You also can see under how we enable Training rooms to hook up with new (and doubtlessly malicious) domains for academic functions.
Digging into the difficulty of the person repeatedly connecting to a number of identified malicious websites, utilizing one more visibility enhancement we made at Black Hat Singapore 2023, we recognized every community zone the person traversed in the course of the present. Again, if this have been a company setting and an actual risk was recognized, this knowledge may very well be used to zero on particular compromised units, giving the community group a map of reply and doubtlessly quarantine within the occasion a risk has unfold. We may even use this to assist decide “Patient Zero,” or the origin of the compromise itself.
*Quick reminder: We mapped out each Black Hat community zone on the ExCel middle in Umbrella to assist us establish what areas of the present flooring requests originated from.
Going even deeper, utilizing Cisco Secure Cloud Analytics, we discovered the machine to possible be an iPhone. With this new data in hand, it’s a secure assumption that the machine was already compromised earlier than the attendee walked within the constructing. The NOC leaders approved Palo Alto Networks to place up a captive portal to warn the person that the machine was contaminated.
As I discussed above, Umbrella would usually block these identified malicious requests and porn visits (in case your community admin deemed vital) in the true world, proper off the bat. Here at Black Hat nevertheless, as a result of it is a studying setting, we usually enable all requests. To assist educate and serve the convention attendees higher, quite than kicking them off the community, we give them notification through a captive portal. If the attendee disregards our warning (comparable to conducting illegal actions), we are going to once more take the suitable motion.
All in all, we’re very happy with the collaborative efforts made right here at Black Hat Europe by each the Cisco group and all of the collaborating distributors within the NOC. Great work everyone!
Black Hat Asia will probably be in April 2024, on the Marina Bay Sands, Singapore…hope to see you there!
Acknowledgments
Thank you to the Cisco NOC group:
- Cisco Security: Ivan Berlinson, Abhishek Sha, Alejo Calaoagan, Adam Kilgore and Alicia Garcia Sastre
- Meraki Systems Manager: Paul Fidler and Connor Loughlin
- Additional Support and Expertise: Adi Sankar, Ryan Maclennan, Robert Harris, Jordan Chapian, Junsong Zhao, Vadim Ivlev and Ajit Thyagarajan
Also, to our NOC companions InternetWitness (particularly David Glover, Iain Davidson and Alessandro Zatti), Palo Alto Networks (particularly James Holland), Corelight (particularly Dustin Lee), Arista Networks (particularly Jonathan Smith), and the complete Black Hat / Informa Tech employees (particularly Grifter ‘Neil Wyler’, Bart Stump, Steve Fink, James Pope, Michael Spicer, Jess Stafford and Steve Oldenbourg).
About Black Hat
For over 25 years, Black Hat has supplied attendees with the very newest in data safety analysis, growth, and developments. These high-profile world occasions and trainings are pushed by the wants of the safety group, striving to deliver collectively the most effective minds within the business. Black Hat conjures up professionals in any respect profession ranges, encouraging development and collaboration amongst academia, world-class researchers, and leaders in the private and non-private sectors. Black Hat Briefings and Trainings are held yearly within the United States, Europe and USA. More data is on the market at: Black Hat.com. Black Hat is delivered to you by Informa Tech.
We’d love to listen to what you assume. Ask a Question, Comment Below, and Stay Connected with Cisco Security on social!
Cisco Security Social Channels
Instagram
Facebook
Twitter
LinkedIn
Share: