WEBVTT

1
00:00.000 --> 00:00.060 align:middle line:84%


2
00:00.060 --> 00:02.700 align:middle line:90%
Here's the thing about hackers
that nobody really talks about.

3
00:02.700 --> 00:04.980 align:middle line:90%
There is an actual
personality trait

4
00:04.980 --> 00:08.147 align:middle line:90%
about hackers that makes them
so effective in taking down

5
00:08.147 --> 00:08.730 align:middle line:84%
organizations.

6
00:08.730 --> 00:10.900 align:middle line:90%
Do you know what that
personality trait is?

7
00:10.900 --> 00:11.940 align:middle line:84%
Patience.

8
00:11.940 --> 00:15.300 align:middle line:90%
They will sit and wait for
a vulnerability to pop up.

9
00:15.300 --> 00:19.160 align:middle line:90%
And one of those vulnerabilities
is plain text protocols.

10
00:19.160 --> 00:21.210 align:middle line:90%
You see, they'll wait for
the perfect opportunity

11
00:21.210 --> 00:24.750 align:middle line:90%
to get into your network,
and then they'll wait again.

12
00:24.750 --> 00:26.910 align:middle line:90%
They'll wait and
listen for traffic

13
00:26.910 --> 00:28.737 align:middle line:90%
as it moves throughout
the environment,

14
00:28.737 --> 00:30.945 align:middle line:90%
and they're going to be
waiting for some traffic that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:28.737 --> 00:30.945 align:middle line:90%
and they're going to be
waiting for some traffic that

15
00:30.945 --> 00:32.110 align:middle line:84%
is unencrypted.

16
00:32.110 --> 00:35.575 align:middle line:90%
These plain text protocols,
like HTTP or Telnet,

17
00:35.575 --> 00:37.200 align:middle line:90%
that's what they're
really looking for.

18
00:37.200 --> 00:39.995 align:middle line:90%
And at some point, somebody
will slip up and use them.

19
00:39.995 --> 00:41.370 align:middle line:90%
And that's when
the attacker will

20
00:41.370 --> 00:44.472 align:middle line:90%
grab the info they need and
take their exploit even further.

21
00:44.472 --> 00:45.930 align:middle line:90%
So in this particular
Nugget, we're

22
00:45.930 --> 00:48.555 align:middle line:90%
going to talk a little bit more
about these plaintext protocols

23
00:48.555 --> 00:50.860 align:middle line:90%
and what we can do to secure
ourselves against them.

24
00:50.860 --> 00:51.970 align:middle line:84%
Let's get going.

25
00:51.970 --> 00:53.940 align:middle line:90%
So the thing about
plain text protocols

26
00:53.940 --> 00:55.560 align:middle line:90%
is they can be the
corporate killer.

27
00:55.560 --> 00:57.780 align:middle line:90%
This is the way they get
in, because we're not

28
00:57.780 --> 00:59.760 align:middle line:84%
encrypting any of our traffic.

29
00:59.760 --> 01:03.540 align:middle line:90%
And as long as the hacker is
patient and waits and listens,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:59.760 --> 01:03.540 align:middle line:90%
And as long as the hacker is
patient and waits and listens,

30
01:03.540 --> 01:05.400 align:middle line:90%
they will end up
grabbing this password.

31
01:05.400 --> 01:07.900 align:middle line:90%
So what we're going to do, I've
got EVE NG, my little EVE NG

32
01:07.900 --> 01:11.250 align:middle line:90%
topology spun up here, and
I'm going to initiate a Telnet

33
01:11.250 --> 01:15.243 align:middle line:90%
session from my local
computer into R5 right here,

34
01:15.243 --> 01:16.410 align:middle line:84%
and I'm going to use Telnet.

35
01:16.410 --> 01:18.180 align:middle line:90%
That way we can
capture the traffic

36
01:18.180 --> 01:20.280 align:middle line:90%
and see where the plaintext
protocol comes up.

37
01:20.280 --> 01:21.780 align:middle line:90%
So what I'm going
to do here, so I'm

38
01:21.780 --> 01:24.530 align:middle line:90%
going to start my Wireshark
capture by clicking on Capture,

39
01:24.530 --> 01:27.580 align:middle line:90%
and I'm going to choose
Capture on my E0/0 interface.

40
01:27.580 --> 01:29.395 align:middle line:90%
So here comes the
Wireshark capture.

41
01:29.395 --> 01:31.020 align:middle line:90%
We'll say this is an
ethernet capture--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:29.395 --> 01:31.020 align:middle line:90%
We'll say this is an
ethernet capture--

42
01:31.020 --> 01:32.937 align:middle line:90%
and I'm just going to
see a lot going on here.

43
01:32.937 --> 01:36.450 align:middle line:90%
So I'm going to let it run while
I bring up my little terminal

44
01:36.450 --> 01:36.990 align:middle line:84%
here.

45
01:36.990 --> 01:39.312 align:middle line:90%
We're going to start a new
session into this device.

46
01:39.312 --> 01:40.770 align:middle line:90%
Now, this is the
device right here.

47
01:40.770 --> 01:42.660 align:middle line:90%
If I give it a show
IP interface brief,

48
01:42.660 --> 01:46.080 align:middle line:90%
you can see the IP
address is 10.10.21.153.

49
01:46.080 --> 01:47.700 align:middle line:90%
So when I Telnet
into this device,

50
01:47.700 --> 01:51.100 align:middle line:90%
my Wireshark capture should
grab all that traffic.

51
01:51.100 --> 01:54.940 align:middle line:90%
And we should be able to see
the actual password that I used.

52
01:54.940 --> 01:56.472 align:middle line:84%
So I'll start a new session.

53
01:56.472 --> 01:57.930 align:middle line:90%
We're going to
choose Telnet, which

54
01:57.930 --> 02:01.470 align:middle line:90%
is an unencrypted, plaintext
protocol used in order
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:57.930 --> 02:01.470 align:middle line:90%
is an unencrypted, plaintext
protocol used in order

55
02:01.470 --> 02:03.310 align:middle line:84%
to access network devices.

56
02:03.310 --> 02:08.160 align:middle line:90%
So I specify my IP address
of the device, 10.10.21.153.

57
02:08.160 --> 02:10.930 align:middle line:90%
This is port 23 that
Telnet operates on.

58
02:10.930 --> 02:11.970 align:middle line:84%
And I'll click Next.

59
02:11.970 --> 02:13.260 align:middle line:84%
And I'll click Finish.

60
02:13.260 --> 02:15.960 align:middle line:90%
So now from within
SecureCRT, all I have to do

61
02:15.960 --> 02:17.460 align:middle line:84%
is double click on the device.

62
02:17.460 --> 02:20.440 align:middle line:90%
It asks me for my user
name, which is Cisco.

63
02:20.440 --> 02:22.247 align:middle line:84%
My password is Cisco.

64
02:22.247 --> 02:22.830 align:middle line:84%
And that's it.

65
02:22.830 --> 02:23.700 align:middle line:84%
We're hosed.

66
02:23.700 --> 02:24.310 align:middle line:84%
That's it.

67
02:24.310 --> 02:25.170 align:middle line:84%
That's all it took.

68
02:25.170 --> 02:28.140 align:middle line:90%
So now if I jump back here,
I'm going to click Stop.

69
02:28.140 --> 02:31.860 align:middle line:90%
And we can now filter out
my traffic based on Telnet.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:28.140 --> 02:31.860 align:middle line:90%
And we can now filter out
my traffic based on Telnet.

70
02:31.860 --> 02:33.790 align:middle line:84%
Here is my Telnet traffic.

71
02:33.790 --> 02:39.150 align:middle line:90%
This is my IP address
right here, 10.10.21.29.

72
02:39.150 --> 02:41.220 align:middle line:90%
And this was my
destination device.

73
02:41.220 --> 02:44.590 align:middle line:90%
This was the device replying
to me as the packets came in.

74
02:44.590 --> 02:45.210 align:middle line:84%
So watch this.

75
02:45.210 --> 02:48.090 align:middle line:90%
From the very top of the very
first packet that I received

76
02:48.090 --> 02:50.310 align:middle line:90%
here, what I can
choose is right click

77
02:50.310 --> 02:52.830 align:middle line:90%
and then follow and
then TCP stream.

78
02:52.830 --> 02:53.520 align:middle line:84%
Look at that.

79
02:53.520 --> 02:54.480 align:middle line:84%
Just like that.

80
02:54.480 --> 02:57.480 align:middle line:90%
This is-- the red
denotes my packets

81
02:57.480 --> 03:00.112 align:middle line:90%
and the blue denotes
the response packets.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
02:57.480 --> 03:00.112 align:middle line:90%
and the blue denotes
the response packets.

82
03:00.112 --> 03:01.320 align:middle line:84%
Do you see what happens here?

83
03:01.320 --> 03:05.640 align:middle line:90%
I type C, it responded with C.
I typed I, it responded with I.

84
03:05.640 --> 03:08.760 align:middle line:90%
And this is my user
name right there, Cisco,

85
03:08.760 --> 03:11.393 align:middle line:90%
and there's the password
that I typed right there.

86
03:11.393 --> 03:12.060 align:middle line:84%
See, this is it.

87
03:12.060 --> 03:13.200 align:middle line:84%
That's all a hacker takes.

88
03:13.200 --> 03:16.110 align:middle line:90%
There's nothing-- there was
no encryption of this traffic

89
03:16.110 --> 03:17.440 align:middle line:84%
going back and forth.

90
03:17.440 --> 03:21.030 align:middle line:90%
So the hacker was able to
simply just capture each packet

91
03:21.030 --> 03:23.070 align:middle line:90%
as it flowed across
the wire, and then

92
03:23.070 --> 03:26.550 align:middle line:90%
using this tool like Wireshark,
reassemble the stream

93
03:26.550 --> 03:28.050 align:middle line:84%
of packets, and there we go.

94
03:28.050 --> 03:31.470 align:middle line:90%
They now see our user name
and they see our password
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:28.050 --> 03:31.470 align:middle line:90%
They now see our user name
and they see our password

95
03:31.470 --> 03:32.280 align:middle line:84%
right there.

96
03:32.280 --> 03:34.560 align:middle line:90%
The exact same thing
could be thought of when

97
03:34.560 --> 03:37.260 align:middle line:84%
using the HTTP protocol.

98
03:37.260 --> 03:39.280 align:middle line:90%
Let's take my very own
website for a second,

99
03:39.280 --> 03:43.020 align:middle line:84%
http://knoxhutchinson.com.

100
03:43.020 --> 03:45.790 align:middle line:90%
I got to move the address
bar down a little bit.

101
03:45.790 --> 03:46.740 align:middle line:84%
You see this here?

102
03:46.740 --> 03:52.860 align:middle line:90%
This is not secure right there,
because I typed in http://.

103
03:52.860 --> 03:53.970 align:middle line:84%
Here's my video running.

104
03:53.970 --> 03:54.750 align:middle line:84%
Let me pause that.

105
03:54.750 --> 03:56.670 align:middle line:90%
And I didn't write
this application.

106
03:56.670 --> 03:59.910 align:middle line:90%
I didn't write this website
to automatically redirect

107
03:59.910 --> 04:03.570 align:middle line:84%
to the secure, encrypted, HTTPS.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
03:59.910 --> 04:03.570 align:middle line:84%
to the secure, encrypted, HTTPS.

108
04:03.570 --> 04:06.450 align:middle line:90%
This is just an
application design failure.

109
04:06.450 --> 04:08.010 align:middle line:90%
The real kicker,
when you find out

110
04:08.010 --> 04:10.680 align:middle line:90%
how simple it is to stop
these types of attacks--

111
04:10.680 --> 04:13.710 align:middle line:90%
this is why it's
almost shameful when

112
04:13.710 --> 04:15.660 align:middle line:90%
you see these types
of things coming up.

113
04:15.660 --> 04:18.660 align:middle line:90%
Because this website is
hosted in the Azure cloud,

114
04:18.660 --> 04:20.820 align:middle line:84%
on Azure's app service product.

115
04:20.820 --> 04:25.770 align:middle line:90%
And redirecting HTTP traffic
to HTTPS is just a checkbox.

116
04:25.770 --> 04:29.460 align:middle line:90%
All I have to do is just tell it
when an HTTP request comes in,

117
04:29.460 --> 04:32.110 align:middle line:90%
just send it to the
HTTPS end point.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

117
04:29.460 --> 04:32.110 align:middle line:90%
just send it to the
HTTPS end point.

118
04:32.110 --> 04:35.700 align:middle line:90%
And for the most part, on
most application developers

119
04:35.700 --> 04:38.400 align:middle line:90%
or web developer
servers, that redirect

120
04:38.400 --> 04:40.020 align:middle line:84%
is nothing more than a checkbox.

121
04:40.020 --> 04:41.760 align:middle line:90%
You just tell it,
I just want traffic

122
04:41.760 --> 04:44.190 align:middle line:84%
to go to secure HTTPS instead.

123
04:44.190 --> 04:47.190 align:middle line:90%
That also removes
your own liability

124
04:47.190 --> 04:49.980 align:middle line:90%
of exposing someone's
content or traffic

125
04:49.980 --> 04:51.990 align:middle line:90%
because you're using
an unencrypted protocol

126
04:51.990 --> 04:53.070 align:middle line:84%
like an HTTP.

127
04:53.070 --> 04:56.400 align:middle line:90%
So again, keeping in
mind that vulnerabilities

128
04:56.400 --> 04:59.730 align:middle line:90%
don't just come in on
network devices or servers.

129
04:59.730 --> 05:02.280 align:middle line:90%
They come in through
application in code, too.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
04:59.730 --> 05:02.280 align:middle line:90%
They come in through
application in code, too.

130
05:02.280 --> 05:04.440 align:middle line:90%
And in this case, we've
explored a vulnerability

131
05:04.440 --> 05:07.410 align:middle line:84%
by using HTTP instead of HTTPS.

132
05:07.410 --> 05:10.110 align:middle line:90%
And the same thing goes back
with these network access

133
05:10.110 --> 05:10.710 align:middle line:84%
protocols.

134
05:10.710 --> 05:13.770 align:middle line:90%
It doesn't just stop
with Telnet, where

135
05:13.770 --> 05:16.260 align:middle line:84%
we should use SSH instead.

136
05:16.260 --> 05:18.780 align:middle line:90%
We should block access
coming in on Telnet.

137
05:18.780 --> 05:23.790 align:middle line:90%
This is also the difference
between SNMP and SNMP V3.

138
05:23.790 --> 05:26.670 align:middle line:90%
Or instead of even using
SNMP V3 in the first place,

139
05:26.670 --> 05:29.430 align:middle line:90%
you could use a network
automation protocol

140
05:29.430 --> 05:32.400 align:middle line:90%
like NETCONF, which
operates over SSH,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

140
05:29.430 --> 05:32.400 align:middle line:90%
like NETCONF, which
operates over SSH,

141
05:32.400 --> 05:36.420 align:middle line:90%
or RESTCONF, which
operates over HTTPS.

142
05:36.420 --> 05:38.580 align:middle line:90%
It's really important
that you analyze

143
05:38.580 --> 05:41.400 align:middle line:90%
all of the protocols that
are actually being operated

144
05:41.400 --> 05:44.160 align:middle line:90%
within your environment
because, again, we go back

145
05:44.160 --> 05:48.210 align:middle line:90%
to not just our network
devices, but also IoT devices

146
05:48.210 --> 05:51.120 align:middle line:90%
or things like our UPS's,
battery backups, that

147
05:51.120 --> 05:54.415 align:middle line:90%
may be operating SNMP
version 1 on those as well.

148
05:54.415 --> 05:56.040 align:middle line:90%
I once worked for an
organization-- one

149
05:56.040 --> 05:57.582 align:middle line:90%
of the largest
organizations I worked

150
05:57.582 --> 06:01.560 align:middle line:90%
for had UPS's all over the
place, and not only were they
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

150
05:57.582 --> 06:01.560 align:middle line:90%
for had UPS's all over the
place, and not only were they

151
06:01.560 --> 06:05.160 align:middle line:90%
operating with just
SNMP V1, but they also

152
06:05.160 --> 06:07.080 align:middle line:90%
had the default
login and password

153
06:07.080 --> 06:11.250 align:middle line:90%
set when you tried to
access them over HTTP.

154
06:11.250 --> 06:12.930 align:middle line:90%
I mean, this is a
triple whammy here.

155
06:12.930 --> 06:15.180 align:middle line:90%
We're using the weakest
version of SNMP,

156
06:15.180 --> 06:17.460 align:middle line:90%
we're not using
encryption on HTTP,

157
06:17.460 --> 06:19.335 align:middle line:90%
and it had the default
username and password.

158
06:19.335 --> 06:20.835 align:middle line:90%
I don't remember
what it is anymore.

159
06:20.835 --> 06:22.380 align:middle line:90%
Let's just say it
was admin admin.

160
06:22.380 --> 06:24.090 align:middle line:84%
It was wildly vulnerable.

161
06:24.090 --> 06:26.490 align:middle line:90%
And we, obviously, as soon
as we took over that client,

162
06:26.490 --> 06:28.770 align:middle line:90%
we took these steps to
address those problems

163
06:28.770 --> 06:30.090 align:middle line:84%
and fix them right up front.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

163
06:28.770 --> 06:30.090 align:middle line:84%
and fix them right up front.

164
06:30.090 --> 06:32.580 align:middle line:90%
So that's been understanding
protocol weaknesses

165
06:32.580 --> 06:35.083 align:middle line:90%
and vulnerabilities and how
you can mitigate those issues.

166
06:35.083 --> 06:36.750 align:middle line:90%
I hope this has been
informative for you

167
06:36.750 --> 06:38.960 align:middle line:84%
and I'd like to thank you for--