How to Backdoor Invulnerable Code Josh Schwartz, Director of - - PowerPoint PPT Presentation

▶
how to backdoor invulnerable code
SMART_READER_LITE
LIVE PREVIEW

How to Backdoor Invulnerable Code Josh Schwartz, Director of - - PowerPoint PPT Presentation

Feb 05, 2024 178 likes •1.03k views

How to Backdoor Invulnerable Code Josh Schwartz, Director of Offensive Security @Salesforce Bio Offensive Security aka Red Team at Salesforce Realistic Adversary Simulation Security Change Catalyst Im a hacker, rule

slide-1
SLIDE 1

How to Backdoor “Invulnerable Code”

Josh Schwartz, Director of Offensive Security @Salesforce

slide-2
SLIDE 2

Offensive Security aka Red Team at Salesforce “Realistic Adversary Simulation” “Security Change Catalyst” I’m a hacker, rule breaker, general troublemaker.

Bio

slide-3
SLIDE 3

“

“A red team is an independent group that challenges an

  • rganization to improve its effectiveness.”
slide-4
SLIDE 4

Spoiler Alert

No such thing as “invulnerable code”.

slide-5
SLIDE 5

Invulnerable Code

At best you get code that is “secure enough”

slide-6
SLIDE 6

Invulnerable Code

What is secure enough?

slide-7
SLIDE 7

Invulnerable Code

Code without security bugs…?

slide-8
SLIDE 8

“

Code that enforces expected states, rather than allowing users to do things with your system that you did not account for.

slide-9
SLIDE 9

Invulnerable Code

How do you secure code? Obvious!? Don’t write code with bugs! Right?

slide-10
SLIDE 10

Yes, you should do that.

But, there is more...

slide-11
SLIDE 11

Invulnerable Code

Let’s imagine that “invulnerable code” is this nickel, and on

  • ne side is all the lines of code that you write without any

security related bugs

slide-12
SLIDE 12

Invulnerable Code

Now let’s take a look at the other side and flip that nickel

  • ver.
slide-13
SLIDE 13

Invulnerable Code

The other side is every other aspect that goes into writing that code.

slide-14
SLIDE 14

Invulnerable Code

The third party libraries that you didn’t write yourself

slide-15
SLIDE 15

Invulnerable Code

The code repo that stores the code

slide-16
SLIDE 16

Invulnerable Code

The integration systems that put it together and test it

slide-17
SLIDE 17

Invulnerable Code

The build pipeline that moves it around and deploys it

slide-18
SLIDE 18

Invulnerable Code

The humans that create and maintain all of those systems

slide-19
SLIDE 19

Invulnerable Code

The humans that have access to those human’s computers...

slide-20
SLIDE 20

Invulnerable Code

Perhaps some of you realize there is still another side of this coin?

slide-21
SLIDE 21

Invulnerable Code

It’s the side you don’t see.

slide-22
SLIDE 22

Invulnerable Code

The side you can’t see.

slide-23
SLIDE 23

Invulnerable Code

The things we can’t account for.

slide-24
SLIDE 24

The Black Swan Theory

slide-25
SLIDE 25

The best we can do

Accept there is no ubiquitous security perfection

slide-26
SLIDE 26

On the bright side

We can think like an adversary We can challenge where we set the bar

slide-27
SLIDE 27

I’m going to share with you some of my tactics as the attacker

slide-28
SLIDE 28

What is

Social Engineering

slide-29
SLIDE 29

You are probably thinking

Isn’t that just a fancy word for lying?

slide-30
SLIDE 30

“

“Any act that influences a person to take an action that may or may not be in their best interest”

slide-31
SLIDE 31

Influence through emotional response Pretext Manipulation vs Elicitation

Core Concepts

slide-32
SLIDE 32

Social Engineering vs. Phishing

slide-33
SLIDE 33

Phishing Examples

⊡ Classic Credential Capturing ⊡ The Nigerian Prince with a Diamond Mine ⊡ The IRS Call

slide-34
SLIDE 34

Phishing

This type of phishing is weak.

slide-35
SLIDE 35

Phishing

It’s impersonal.

slide-36
SLIDE 36

Spear Phishing

⊡ More targeted ⊡ More personal ⊡ More effort per person ⊡ Less likely to be detected ⊡ More likely to succeed

slide-37
SLIDE 37

Spear Phishing Example

Vibe Manager

I’m volunteering with Surf For Life!

Red Team

slide-38
SLIDE 38

Spear Phishing Example

Red Team

slide-39
SLIDE 39

Spear Phishing Example

slide-40
SLIDE 40

Spear Phishing Example

slide-41
SLIDE 41

Spear Phishing Example

Of course there is no form

slide-42
SLIDE 42

Spear Phishing Example

slide-43
SLIDE 43

How we start a Spear Phish

Step 1: Social Recon

slide-44
SLIDE 44

Social Recon

slide-45
SLIDE 45

Social Recon: LinkedIn

slide-46
SLIDE 46

Social Recon: Employment

slide-47
SLIDE 47

Social Recon: Personal Site

slide-48
SLIDE 48

Social Recon: Twitter

slide-49
SLIDE 49

Social Recon: Facebook

slide-50
SLIDE 50

Social Recon: Google Sites

slide-51
SLIDE 51

Social Recon: Result

slide-52
SLIDE 52

Yeah Sorry

Attackers can stalk you using the internet to get access to the things that you have access to. This is not a new thing.

also it get’s worse.

slide-53
SLIDE 53

Identity Duplication: Orig

slide-54
SLIDE 54

Identity Duplication: Fake

slide-55
SLIDE 55

Identity Duplication: Result

Cloning public profiles allows a social engineer to leverage a targets subliminal familiarity with identity based content to gain instant rapport.

slide-56
SLIDE 56

Identity Duplication: Result

slide-57
SLIDE 57

Gmail Helps Prevent Malware

Blocking malicious file types in emails

slide-58
SLIDE 58

Google Drive Sharing

You can share any type of file through Google Drive

slide-59
SLIDE 59

Google Drive Sharing

Real Example

slide-60
SLIDE 60

Google Drive Sharing

They receive this

slide-61
SLIDE 61

Google Drive Sharing

Google Hosts the file

slide-62
SLIDE 62

Google Drive Sharing

They send back:

slide-63
SLIDE 63

But

What if something so simple doesn't work?

slide-64
SLIDE 64

Example 2

1. Notice our target has nice offices from pictures they post on social media 2. Create our pretext: Freelance journalist for a magazine that features interior design 3. Contact target asking to feature them alongside other big companies 4. Set up “interview”

slide-65
SLIDE 65

Example 2

Our request gets a response and fwd from their PR firm

slide-66
SLIDE 66

Example 2

They are totally stoked and set up the interview

slide-67
SLIDE 67

Example 2

⊡ Interview and tour of offices lasts for about 4 hours ⊡ Take pictures of security systems, whiteboards, post-it notes, etc. ⊡ Spring the trap

slide-68
SLIDE 68

Example 2

slide-69
SLIDE 69

Example 2

slide-70
SLIDE 70

What then?

So what happens after you get that access? Sure would be nice to get that person’s password...

slide-71
SLIDE 71

Local Phishing

  • sascript -e 'tell app "System Events" to display dialog "Software Update requires your password to apply ." & return &

return default answer "" with icon file ":System:Library:CoreServices:Software Update.app:Contents:Resources:SoftwareUpdate.icns" with hidden answer with title "Software Update" buttons {"OK"} default button "OK"'

slide-72
SLIDE 72

Local Phishing $credential = $host.ui.PromptForCredential("Credentials Required", "Please enter your user name and password.", "$env:username", "NetBiosUserName") $credential.Password | ConvertFrom-SecureString $env:username $credential.GetNetworkCredential().password

slide-73
SLIDE 73

Local Phishing DISPLAY=:0 gksudo -p -m "Enter your password to apply changes."

slide-74
SLIDE 74

2FA is Good

We are good at stealing passwords. 2FA will go a long way here. It makes it way harder for us but it isn’t perfect. Here are a few ways we get around it:

slide-75
SLIDE 75

Cookie Stealing

slide-76
SLIDE 76

SSH Multiplexing

Bypassing 2FA

slide-77
SLIDE 77

Continuous Integration

JENKINS!

slide-78
SLIDE 78

Backdooring Code

you understand the company you have access internally you have passwords you can bypass 2FA you have access to internal documents you have access to servers you have access to the code pipeline

slide-79
SLIDE 79

Backdooring Code

Is backdooring your production code really that hard?

slide-80
SLIDE 80

Zero Bugs

slide-81
SLIDE 81

This isn’t everything

slide-82
SLIDE 82

The End

slide-83
SLIDE 83

Questions / Complaints?

slide-84
SLIDE 84

Thank You