Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… ·...

29
Detecting Blue Team Recon With Ads 0x200b

Transcript of Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… ·...

Page 1: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Detecting Blue Team Recon With Ads

0x200b

Page 2: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

DisclaimersTL;DR plz don’t fire or sue me

● The views expressed herein do not reflect the views of my current or former employers.

● I am not responsible for any misuse of the information provided nor am I condonding any misuse.

Page 3: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

● Cat pretending to be a human or vice versa● Classically trained Blue Teamer

○ I’ve made lot of really stupid mistakes

● Using Blue Team mistakes against them ;)

$whoami?

Page 4: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Caveats● Target will search for the term● Target will use a chosen Ad Network● Ad will register as ‘displayed’ to target

Page 5: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Backstory

Page 6: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Problem● Your Op is your baby● You worked hard● You were clever● Your implant gets discovered

Time to save your baby!

Page 7: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

What IF it gets detected?● What is a early warning worth?● What do we care about?

○ Indirect○ Passive ○ Low effort

● Blue Teams leak tons of info

Page 8: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Virustotal Uploads

● Blue Team uploads unknown file ● Red Team knows file was found

Page 9: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Blue Teams are Burnt Out

Page 10: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

The SOC Analyst

● False Positive● False Positive● False Positive● Something Stupid● False Positive● False Positive● Something interesting● ……...

Page 11: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Investigation Lifecycle1. Magic happens2. Human looks at the Event3. Initial investigation/determination 4. Escalation to specialist

Page 12: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Target The HumanPrior to the escalation basic analysis will happen:

● Internal tools● Vendor products● Public tools

Page 13: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

What if I knew when people searched for things?

Page 14: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Advertising Goals● Show content based on usage

○ Keywords○ Demographic info○ Interests

● Give customers tools to tune Ads

Page 15: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Ad Performance

Page 16: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Yes, but...

Is It Possible?

Page 17: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Advertising limitations● Search volume

○ People need to be searching

● Search results○ There must be something to find

Page 18: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

OPSEC Considerations● Payment Information

○ Credit Card○ Address○ Phone Number○ Email

● Search results○ Must be indexed

Page 19: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Let’s Do It!

Page 20: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

What type of Ad?● Search Keyword Match

○ Broad○ Phrase○ Exact

● Display/Mail/Video Ads● Bid Strategy

Page 21: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Other Keyword Possibilities● Any unique string

○ Author handle○ Email address○ Unique File Name○ Misc. Phrase

Page 22: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Picking your Keyword(s)Don’t

● Use Generic Terms○ Minimize False Positives

● Complex Ideas● Domains or IPs

Do

● Something unique ○ Low Search Volume

● Keep it simple ● Tailor to your target

Page 23: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Example● AdWord for a Google search of a specific Keyword● Traffic and results already generated

○ Maximize clicks○ High bid for Click

Page 24: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

YEY!

Page 25: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Usability ● Slight Delay

○ Google says 3 hours

● AdWords API○ Basic CSV

Page 26: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Practical Considerations● What type of actor are you?● What is the target?● How much effort did you put in?● OPSEC

○ Possible but not easy

Page 27: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Next Steps● Ad Tech keeps changing ● Keywords matching on emails

○ Distribution Lists○ Legacy Ad Tech○ 3rd Party Apps

Page 28: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Why do you care?● Everything we do is tracked ● As Advertising evolves the barrier to entry lowers● Let’s leverage the data for ourselves

Page 29: Detecting Blue Team Recon With Ads - media.defcon.org CON 26/DEF CON 26 presentations/DEF… · Title: DEF CON 26 Hacking Conference Author: DEF CON Speaker Subject: DEF CON 26 Presentation

Thank You


DEF CON 26 Badge Write-up CON 26/DEF CON 26... · pixel-graphic gifs that have calming scenes and simple animations of little cats moving their tails. When we weighed this against

DEF CON 26 Badge Write-up CON 26/DEF CON 26... · pixel-graphic gifs that have calming scenes and simple animations of little cats moving their tails. When we weighed this against

An Attacker Looks At Docker - DEF CON CON 26/DEF CON 26...An Attacker Looks At Docker Approaching Multi-Container Applications Wesley McGrew, Ph.D. Director of Cyber Operations HORNE

An Attacker Looks At Docker - DEF CON CON 26/DEF CON 26...An Attacker Looks At Docker Approaching Multi-Container Applications Wesley McGrew, Ph.D. Director of Cyber Operations HORNE

Project “The Interceptor” - DEF CON CON 26/DEF CON 26... · David Meléndez Cano @TaiksonTexas R&D Embedded Software Engineer in Albalá Ingenieros, S.A. Spain Author of the robots:

Project “The Interceptor” - DEF CON CON 26/DEF CON 26... · David Meléndez Cano @TaiksonTexas R&D Embedded Software Engineer in Albalá Ingenieros, S.A. Spain Author of the robots:

PLAYBACK: A TLS 1.3 STORY - DEF CON CON 26/DEF CON 26... · 2020. 5. 16. · •TLS 1.3 is awesome, but could lead to a vulnerable application if 0-RTT is being used. •Your application

PLAYBACK: A TLS 1.3 STORY - DEF CON CON 26/DEF CON 26... · 2020. 5. 16. · •TLS 1.3 is awesome, but could lead to a vulnerable application if 0-RTT is being used. •Your application

Sneha Rajguru Prajwal Panchmahalkar - DEF CON CON 26/DEF CON 26... · Sneha Rajguru Security Consultant, PayatuTechnologies Pvt Ltd. @sneharajguru Prajwal Panchmahalkar Red Team Lead

Sneha Rajguru Prajwal Panchmahalkar - DEF CON CON 26/DEF CON 26... · Sneha Rajguru Security Consultant, PayatuTechnologies Pvt Ltd. @sneharajguru Prajwal Panchmahalkar Red Team Lead

DEF CON 26 Hacking Conference CON 26/DEF CON 26 presentations/DEFCON-26... · 12:46 PM HACKER TRACKER 2016-06-20 Welcome to Hacker Tracker iOS version DEF If you have any events,

DEF CON 26 Hacking Conference CON 26/DEF CON 26 presentations/DEFCON-26... · 12:46 PM HACKER TRACKER 2016-06-20 Welcome to Hacker Tracker iOS version DEF If you have any events,

Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

Hacking BLE Bicycle Locks for Fun & A Small Profit CON 26/DEF CON 26... · 2020-05-16 · Hacking BLE Bicycle Locks for Fun & A Small Profit Author: DEF CON Speaker Subject: DEF CON

DEF CON 26 資訊安全年會」報 告

DEF CON 26 資訊安全年會」報 告

DEF CON 26 Hacking Conference CON 26/DEF CON 26...Find us on Twitter: @michaelossmann / @dominicgs Title DEF CON 26 Hacking Conference Author DEF CON Speaker Subject DEF CON 26 Presentation

DEF CON 26 Hacking Conference CON 26/DEF CON 26...Find us on Twitter: @michaelossmann / @dominicgs Title DEF CON 26 Hacking Conference Author DEF CON Speaker Subject DEF CON 26 Presentation

Finding Needles in Haystacks - DEF CON CON 26/DEF CON 26 workshops...01 Introduction Agenda 02 Code review 03 Lab 1: A PHP Application 04 Lab 2: A Golang Application Lab 3: A Ruby

Finding Needles in Haystacks - DEF CON CON 26/DEF CON 26 workshops...01 Introduction Agenda 02 Code review 03 Lab 1: A PHP Application 04 Lab 2: A Golang Application Lab 3: A Ruby

You’re Just Complaining Because You’re Guilty CON/DEF CON 26/DEF CON 26...You’re Just Complaining Because You’re Guilty: A DEF CON Guide to Adversarial Testing of Software

You’re Just Complaining Because You’re Guilty CON/DEF CON 26/DEF CON 26...You’re Just Complaining Because You’re Guilty: A DEF CON Guide to Adversarial Testing of Software

DEF CON 26 Hacking Conference CON 26/DEF CON 26 presentations/DEF… · Summary Device external storage is a public area which can be observed/modified by a third-party application

DEF CON 26 Hacking Conference CON 26/DEF CON 26 presentations/DEF… · Summary Device external storage is a public area which can be observed/modified by a third-party application

Whitepaper: Bypassing Port Security In 2018 – … CON 26/DEF CON 26...Page 1 of 37 Whitepaper: Bypassing Port Security In 2018 – Defeating MACsec and 802.1x-2010 DEF CON 26 Pre-Release

Whitepaper: Bypassing Port Security In 2018 – … CON 26/DEF CON 26...Page 1 of 37 Whitepaper: Bypassing Port Security In 2018 – Defeating MACsec and 802.1x-2010 DEF CON 26 Pre-Release

WEAPONIZING THE BBC MICRO:BIT - DEF CON CON 25/DEF CON 25 presentations/DEFCON...WEAPONIZING THE BBC MICRO:BIT ... Python code size is limited, ... DEF CON Conference, DEF CON, DEFCON,

WEAPONIZING THE BBC MICRO:BIT - DEF CON CON 25/DEF CON 25 presentations/DEFCON...WEAPONIZING THE BBC MICRO:BIT ... Python code size is limited, ... DEF CON Conference, DEF CON, DEFCON,

Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file

Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file

DEF CON 24 Hacking Conference - Ruxcon · Title: DEF CON 24 Hacking Conference Author: DEF CON 24 Speaker Keywords

DEF CON 24 Hacking Conference - Ruxcon · Title: DEF CON 24 Hacking Conference Author: DEF CON 24 Speaker Keywords

Andrea Marcelli (@ S0nn1 ) - DEF CON CON 26/DEF CON 26... · Andrea Marcelli (@_S0nn1_) Twitter Email Web PhD Student Security Researcher . The signature generation problem The algorithm

Andrea Marcelli (@ S0nn1 ) - DEF CON CON 26/DEF CON 26... · Andrea Marcelli (@_S0nn1_) Twitter Email Web PhD Student Security Researcher . The signature generation problem The algorithm

DEF CON 26 Voting Village - DEF CON® Hacking Conference CON 26 voting... · 2018-09-27 · DEF CON 26 Voting Village Report on Cyber Vulnerabilities in U.S. Election Equipment, Databases,

DEF CON 26 Voting Village - DEF CON® Hacking Conference CON 26 voting... · 2018-09-27 · DEF CON 26 Voting Village Report on Cyber Vulnerabilities in U.S. Election Equipment, Databases,

Project “The Interceptor” - DEF CON CON 26/DEF CON 26... · Project “The Interceptor” Avoiding counter-drone systems with nanodrones David Melendez Cano R&D Embedded Software

Project “The Interceptor” - DEF CON CON 26/DEF CON 26... · Project “The Interceptor” Avoiding counter-drone systems with nanodrones David Melendez Cano R&D Embedded Software

DEF CON 23 Presentation CON 23/DEF CON 23... · DEF CON 23 Presentation Keywords: DEF CON Conference, DEF CON, DEFCON, Speeches, Hacking, Hackers, Hacker Conference, Computer Security,

DEF CON 23 Presentation CON 23/DEF CON 23... · DEF CON 23 Presentation Keywords: DEF CON Conference, DEF CON, DEFCON, Speeches, Hacking, Hackers, Hacker Conference, Computer Security,