(serene music)
(applause)
- [David] Hey guys, I've given this
talk a couple of times now at different
intelligence communities and stuff like that.
I went to a DHS ATTE conference
which stands for Advanced Threat Technical Exchange.
It wasn't very technical,
so I took out a lot of the technical portions
just to come to a conference
where everything is very technical.
So sorry about that.
We have a lot of cool images and fun things for managers,
which is normally who I brief,
but the majority of this presentation
is better as a conversation.
So we're gonna breeze through this,
and most of what's gonna happen at the end of it,
if you guys have questions, let's push questions.
I kind of have a feeling you're going to,
because of the nature of what we're doing.
Basically, what we work on
is what's called the ECS Program.
The ECS is a sister program of EINSTEIN.
Who's all heard of EINSTEIN that DHS has?
A lot of people.
So I mean, it is actually an exact replica
of the EINSTEIN program.
It's for US-based commercial infrastructure, though.
And so I work on an ISP.
I work for an ISP on this program
where we cover down and we monitor
for foreign intelligence, terrorist organizations,
and highly funded crime syndicate activity
in US-based critical infrastructure.
The way that the program works,
interested parties like ISPs--
I'm sorry, CenturyLink, Verizon, AT&T,
other people are part of the program as well.
They get cleared.
Intel comes from federal intel communities.
DHS collects form intel communities.
And cleared parties identify vehicles
to leverage intel in commercial spaces.
So basically what that means is we set up a spot for them
to go to route their traffic through us.
We monitor for classified intelligence
in commercial organizations.
Obviously you have to take people from previous spaces
like agencies whatnot who have access to that intel.
They can read it, they can identify it.
Whenever there's enriched data that's necessary,
you submit downgrade requests, whatnot.
So that's kind of just a background of the program itself.
I'll give kind of a little bit of an overview
really quickly, again, what it is,
but we're gonna go into what we're doing
with the basics of intel, how we're manipulating data
using unclassified attributes of classified intel
to identified classified intelligence
before it becomes classified.
And then I can push it out to the commercial community.
I forgot I was in charge of this.
So basically what I just went through,
intel communities push to Homeland Security,
which then goes down to CSPs, which then we cover down
for critical infrastructure in the United States.
One of the largest conversations that's happening right now
is how we can play a role in the election platforms.
Of course, that's a buzz in everything as
you may or may not know but ECS is on its schedule 70,
to be able to cover down for that, so that one of
the things that were driving right
now moving forward in that case.
The way that we do that fundamentally is by setting up
IP sub tunnels to organizations having them route their DNS
traffic back and forth to us.
So we cover them on DNS, SMTP, and NetFlow indicators.
Right now were just going to talk about DNS.
So in organizations, not every organization
has people with clearances.
So whenever they see something bad
and we're going to hit them up and say,
Hey we saw this its bad.
Their like, Why is it bad?
Well I can't really share that with you,
you're just going to have to trust me.
Yah I'm not going to trust you.
I don't trust people I'm paying for indicators with
and I come back through and they actually give me intel
I still don't trust the intel.
So I'm not going to trust you by not giving me anything.
So how can we shift that around,
and open above further conversation?
So, basically non-mature organizations
Are going to come through and say,
Well we actually can't identify were the threat's at
we're just dealing with DNS traffic,
how can I identify where its coming from?
Well being able to, basically implement honey pots.
Leveraging of WebRTC on those apache frameworks,
allows us for us to identify source IP addresses
of infected threats, and utilization of Netflow
traffic across wire are all different ways that can
leverage and be used to identify an infected host.
So again, what we're kind of going back through here,
if your somebody that offers IOCs, if your someone
that's collecting IOCs, if your somebody that's doing
anything with IOC's on the front end of it
collect your intel put it in one spot.
Whenever you guys come to a conversation,
exactly what was talking about this morning.
When coming out of that conversation be ready to share.
Be ready to bring stuff to the table, be ready to
actually give it up because DHS is pushing down
classified intelligence to whatever they can
to help cover down on monitoring of intelligence
in a critical infrastructure.
If you guys are aware of things, hey we're also aware
of activity that's going on here.
Its the same exact infrastructure, but these domain names
these IP addresses you guys may not be aware of.
We'll collect it, we'll integrate it, we'll use it
in our statistical analysis.
Again Mitre at the top of the page of course a buzzword
for this conference which is great.
It's a great platform it's what we use for
the aggregation of our intelligence and being able
to sort of group together the attributes of our data.
A bunch of other different pieces where you can get
information on APT's, terrorists organization,
and crime syndicates.
Of course there's tons of different things you can monitor
for, so many downloads something from Metasploit and they
create something that's got a hash on it.
I don't care, we're not coming down on Bob.
We're not looking for Bob or George down the street.
We're looking for the organizations
that I just talked about.
So these are where you'll be able to find them.
Okay so automating the hard work,
again kind of going back to that
you guys can sort of see we're covering down on
23 different actors and you can sort of see the outliers
here which is pretty synonymous with what's going on
and the commercial industry whatever everybody else
has been reporting, hey these are the organizations
with the highest hitting activity.
Of course DHS is not going to let us put,
hey this is APD-28, 29 but you guys do the math.
So this is essentially what we're doing.
We're pulling information in, we're doing active
blocking, inline blocking of known bad indicators.
And then we're actually taking the attributes
of our known bad indicators and then
putting them into different databases.
And when I say attributes, I mean
TTLs of DNS names when it was registered,
everything that Umbrella talked about yesterday
we're essentially doing the exact same thing
but we're doing it with classified intelligence.
Again, anything that I'm going to say up here is
not going to be new we've already talked about all of it,
it's the source of the data that's basically
different in our case.
Again, that conversation if you guys wanted to be
involved in that say, hey we'd love to be able to see
the intel that your producing that your coming up with
after this your share with the rest of the community.
We're happy to do that reach out to me
contact me we're happy to provide that information
back to you guys, hey these are other
indicators we're finding and then going back to the source
to identify what processes are initiating these
to validate that it is actually a threat.
So things we're going to go over.
Really quickly DGA exposure and pattern based algorithm.
Again we talked about a lot of these also,
we're just going to go over really quickly.
Models used for this are the DGA basically training at once.
If you guys want to talk about this a little bit more
I don't want to bore you with this its almost lunch time.
But Exposure Model it actually needs to be trained
multiple times you have to use a lot of different
data you have to train it you have to look at it again
train it again, training with known goods and known bads.
So this essentially what I just said,
allows for us to identify unclassified domains
leveraging classified data.
So in DGA, have you guys know the life cycle.
There's like five or six different ways.
Five or six hundred different ways that a DGA can
produce or domain or hash.
This right here is the model used for using the same
NTP server, so you grab a time stamp you have the same
NTP server the time stamp becomes your hash,
you push your hash through and that way your C2 and
your client know what the domain is supposed to look like.
So as you can see we basically just come up and
showing you guys randomly generated, dictionary based
generated and hybrid generated domains.
Exposure, Exposure again uses the attributes of it.
What we can as it goes across the packet size,
TTL associated, when was it registered,
who was it registered by, email addresses registered,
what geographical location of an IP address was used
to register the domain, every aspect of that.
It's pushed into there, we push it back through.
We have a localized database.
And all of the monitoring of it is all done passively.
Obviously we can't do monitoring of inline traffic
as it goes across because there's
just too much traffic and its too quick.
WhiteListed, obviously TrendMicro, Symantec, and Verizon
they all use DGA in different types of exposure stuff
like in their domain names, you have a lot of
false positives you have to WhiteList different types
of stuff and BlackList anything.
I think Bambeneck was discussed yesterday.
AlienVaults and AIS, AIS is another good source
that DHS pushes out some of them are validated
some them are not validated sort of take it with
a grain of salt, but at least there's
something there for you guys to be able to use.
Exposure Model attributes, again TTL,
registration, IP variations, responses, daily trends,
and cost per query.
So if you guys have any questions on that I'm
happy to discuss it later.
The pattern based algorithm. Pattern based algorithm is
really near and dear to my heart because its one of those
things I helped develop based on my time as an
offensive security operator and
offensive intelligence operator.
So I know lots of the call back intervals are configured
specific ways with randomized variables in there that say
hey instead of call back every two hours use a randomized
variable that says call back every one hour and forty five
minutes to every two hours and fifteen minutes.
Which then makes it nearly impossible to say
hey this is a two hour time interval.
So we pull all the attributes back together, identify a
scope bandwidth, because some pieces of malware are actually
configured to get all of your commands your supposed to run
at one time process all of them and push them back so
you don't need to do another query again for an IP address.
But some of them are designed to call out get the IP
address of your domain that's set to a TTL of one
run a command do it again.
So then you have groupings of call outs that
go over the course and that actually tends to break
your algorithm whenever they're not.
It just doesn't process properly.
So then you have to identify when the pieces of malware
woke up and when it went back to sleep.
And sometimes that can be 15-20 minutes,
if its not actively being used.
So you basically have to group together.
So we use SK-learn and Python to do that
to be able to cluster those for us.
So basic call back interval will be set to
7200 seconds which is two hours.
That's sort of the base, it could be set to two hours,
it could be set to 24 hours, it could be set to anything.
It just depends on how much data your able to collect and
put into your database to process your algorithm through.
This is kind of the processes that it goes through.
Again, it gets extremely technical
it's right before lunch I'm not gonna do that
it's also raining out and I think it
kind of makes people tired.
If anyone has any questions just let me know.
So again kind of when we put the data back together.
We sort of started to be able to see configured intervals.
Obviously you had to take out your outliers
and you see your variations and things
start to become a little more clear.
So again as I said, we're not the only people doing this.
I just took a black cat course in Vegas from Cylance.
They're doing stuff with DGA as well.
They're doing a really great job at it if you guys
have any questions about that Cylance people here but
look up Tom Paste on LinkedIn, he'd be happy to have
a conversation with you about it.
We're going to go back through,
this is sort of the alerting platform methodology
you can use for that, ELK and Splunk.
I mean Splunk is too expensive, if you wanted to do this
in your low cost, use ELK use GrayLog they're both
methodologies you can use that are really inexpensive.
But you can kind of see the way it comes in.
You pull a tap, an optical tap, pass an optical tap
database it, in the database of the attributes we pull
the information out with the algorithm and then
process data, generate alerts, alerts go back out to a human
and then that gets pushed back out to the end user.
Again being able to put the information in and basically
what we're doing is to being able to tag information in ELK.
If you guys aren't familiar with that looking up
tagging information in ELK, its a really easy way
to be able to add filters to it and look at it
that's data that's already in there.
Chances are you're probably aware of it.
Again this is Cylance interface they're doing a really
great job, this is their DGA model that they are using.
Predictions analysis and what not.
So essentially you're able to see kind of different types of
statistical analysis when outliers are processed through
and how they're viewed in maps.
Okey-Doke, Thanks guys.
(applause)
(serene music)