WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:02.850 align:middle line:90%
That DNS Nugget actually
set up a lot of information,

3
00:02.850 --> 00:06.060 align:middle line:90%
a lot of understanding the
concepts of exfiltration

4
00:06.060 --> 00:06.700 align:middle line:84%
techniques.

5
00:06.700 --> 00:08.715 align:middle line:90%
In fact, pretty much
the rest of this content

6
00:08.715 --> 00:10.590 align:middle line:90%
throughout the skill is
going to be following

7
00:10.590 --> 00:13.230 align:middle line:90%
a similar type of method
or thought process

8
00:13.230 --> 00:15.030 align:middle line:90%
when it comes to
exfiltrating data.

9
00:15.030 --> 00:17.943 align:middle line:90%
But it uses different protocols
to do it at this point.

10
00:17.943 --> 00:19.860 align:middle line:90%
So what we're going to
be doing in this Nugget

11
00:19.860 --> 00:23.190 align:middle line:90%
is talking about how we can
leverage the HTTP protocol.

12
00:23.190 --> 00:25.440 align:middle line:90%
Now, if you've followed along
throughout this playlist

13
00:25.440 --> 00:28.050 align:middle line:90%
and you've learned about
how REST APIs work,

14
00:28.050 --> 00:29.650 align:middle line:84%
it's kind of the same thing.

15
00:29.650 --> 00:31.860 align:middle line:90%
We're talking about
those HTTP methods
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.650 --> 00:31.860 align:middle line:90%
We're talking about
those HTTP methods

16
00:31.860 --> 00:36.540 align:middle line:90%
and how we can provide payloads
of data within the HTTP request

17
00:36.540 --> 00:37.200 align:middle line:84%
themselves.

18
00:37.200 --> 00:40.200 align:middle line:90%
Let's get going, talking about
how the HTTP protocol works,

19
00:40.200 --> 00:42.150 align:middle line:90%
and how it can be
used against us.

20
00:42.150 --> 00:45.240 align:middle line:90%
So that DNS exfiltration
stuff, that was pretty cool

21
00:45.240 --> 00:48.452 align:middle line:90%
and a pretty creative way
to exfiltrate data, right?

22
00:48.452 --> 00:49.410 align:middle line:84%
Well, here's the thing.

23
00:49.410 --> 00:52.140 align:middle line:90%
The DNS protocol was
really only built

24
00:52.140 --> 00:55.560 align:middle line:90%
to do one thing-- send a
query, get a response back.

25
00:55.560 --> 00:59.130 align:middle line:90%
But when it comes to
the HTTP protocol,

26
00:59.130 --> 01:02.470 align:middle line:90%
that's the protocol that
makes the internet work.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:59.130 --> 01:02.470 align:middle line:90%
that's the protocol that
makes the internet work.

27
01:02.470 --> 01:05.563 align:middle line:90%
It's not just about sending
off a little bit of information

28
01:05.563 --> 01:06.730 align:middle line:84%
and getting a response back.

29
01:06.730 --> 01:09.810 align:middle line:90%
Now we can actually
get and download files.

30
01:09.810 --> 01:10.950 align:middle line:84%
We can upload files.

31
01:10.950 --> 01:13.450 align:middle line:84%
We can create new data.

32
01:13.450 --> 01:16.080 align:middle line:90%
I mean, think about how you do
all of your shopping online.

33
01:16.080 --> 01:18.000 align:middle line:90%
When you place an
order for things,

34
01:18.000 --> 01:20.340 align:middle line:90%
you're sending your
credit card information.

35
01:20.340 --> 01:24.000 align:middle line:90%
You're sending your order
information out to the internet

36
01:24.000 --> 01:26.070 align:middle line:84%
using the HTTP protocol.

37
01:26.070 --> 01:28.410 align:middle line:90%
Using the HTTP
protocol is actually

38
01:28.410 --> 01:32.820 align:middle line:90%
a really easy way for attackers
to exfiltrate your data.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:28.410 --> 01:32.820 align:middle line:90%
a really easy way for attackers
to exfiltrate your data.

39
01:32.820 --> 01:35.010 align:middle line:90%
And it's one of the
most common ways

40
01:35.010 --> 01:36.540 align:middle line:84%
to see that that's happening.

41
01:36.540 --> 01:38.310 align:middle line:90%
It's a great way
to see when you've

42
01:38.310 --> 01:40.050 align:middle line:84%
got indicators of compromise.

43
01:40.050 --> 01:41.790 align:middle line:90%
Again, this is where
you would see things

44
01:41.790 --> 01:43.470 align:middle line:90%
like a cross-site
scripting attack,

45
01:43.470 --> 01:46.038 align:middle line:90%
or where you would see things
like a SQL injection attack.

46
01:46.038 --> 01:48.330 align:middle line:90%
So let's jump on the whiteboard
and talk again a little

47
01:48.330 --> 01:51.390 align:middle line:90%
bit about how the
HTTP protocol works,

48
01:51.390 --> 01:53.310 align:middle line:90%
and how it can be
used against us.

49
01:53.310 --> 01:56.610 align:middle line:90%
So the idea, again, is that
Bob's computer right here

50
01:56.610 --> 01:57.780 align:middle line:84%
has been attacked.

51
01:57.780 --> 02:02.820 align:middle line:90%
It's now been taken over by this
malicious malware, or virus,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:57.780 --> 02:02.820 align:middle line:90%
It's now been taken over by this
malicious malware, or virus,

52
02:02.820 --> 02:06.940 align:middle line:90%
or Trojan, or the bad
stuff that's going on here.

53
02:06.940 --> 02:11.430 align:middle line:90%
And maybe it just so happens
that Bob is a SQL developer.

54
02:11.430 --> 02:14.910 align:middle line:90%
And he has access
to the SQL databases

55
02:14.910 --> 02:17.400 align:middle line:90%
where all of our
corporate data live.

56
02:17.400 --> 02:20.730 align:middle line:90%
So the malware begins
discovering what all resources

57
02:20.730 --> 02:21.810 align:middle line:84%
it has access to.

58
02:21.810 --> 02:24.240 align:middle line:90%
It may be trying to
elevate privileges one more

59
02:24.240 --> 02:26.820 align:middle line:90%
time by trying to run
everything as admin.

60
02:26.820 --> 02:28.950 align:middle line:90%
And at some point
it realizes that it

61
02:28.950 --> 02:31.350 align:middle line:84%
can access this SQL database.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:28.950 --> 02:31.350 align:middle line:84%
can access this SQL database.

62
02:31.350 --> 02:34.110 align:middle line:90%
The attacker here is
now just salivating.

63
02:34.110 --> 02:36.750 align:middle line:90%
They're chomping at the bit,
because they have access

64
02:36.750 --> 02:38.010 align:middle line:84%
to the corporate data.

65
02:38.010 --> 02:40.600 align:middle line:90%
They have access to
maybe medical records.

66
02:40.600 --> 02:42.780 align:middle line:90%
They have access to
maybe government secrets.

67
02:42.780 --> 02:44.730 align:middle line:90%
They have access to
your corporate info,

68
02:44.730 --> 02:47.430 align:middle line:90%
like sales information,
or upcoming products,

69
02:47.430 --> 02:51.060 align:middle line:90%
or intellectual property, like
copyrights, and trademarks,

70
02:51.060 --> 02:52.080 align:middle line:84%
and things like that.

71
02:52.080 --> 02:53.730 align:middle line:84%
It's time for them--

72
02:53.730 --> 02:56.790 align:middle line:90%
before they hold it
encrypted for ransomware,

73
02:56.790 --> 03:00.370 align:middle line:90%
they want to exfiltrate and
steal that data for themselves.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:56.790 --> 03:00.370 align:middle line:90%
they want to exfiltrate and
steal that data for themselves.

74
03:00.370 --> 03:02.370 align:middle line:90%
We talked about one of
the ways they could do it

75
03:02.370 --> 03:06.900 align:middle line:90%
by sending DNS queries with the
data being encoded by base64.

76
03:06.900 --> 03:11.490 align:middle line:90%
But the HTTP protocol is
way more robust and easier

77
03:11.490 --> 03:15.787 align:middle line:90%
to work with, because, again,
it all comes back to APIs.

78
03:15.787 --> 03:17.370 align:middle line:90%
Did you watch the
Nuggets on the APIs?

79
03:17.370 --> 03:18.990 align:middle line:90%
That's pretty
important stuff when

80
03:18.990 --> 03:22.450 align:middle line:90%
it comes to using the HTTP
protocol to exfiltrate data.

81
03:22.450 --> 03:26.550 align:middle line:90%
So now the attacker has a
malicious server sitting out

82
03:26.550 --> 03:28.080 align:middle line:84%
here on the internet.

83
03:28.080 --> 03:31.500 align:middle line:90%
And what it really
is is an API endpoint
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

83
03:28.080 --> 03:31.500 align:middle line:90%
And what it really
is is an API endpoint

84
03:31.500 --> 03:34.470 align:middle line:90%
that is set up to
receive data payload.

85
03:34.470 --> 03:38.220 align:middle line:90%
The malware begins running
queries against the database.

86
03:38.220 --> 03:40.710 align:middle line:90%
It's running these
gigantic SELECT statements.

87
03:40.710 --> 03:44.460 align:middle line:90%
And it's just retrieving as
much data as it possibly can

88
03:44.460 --> 03:47.340 align:middle line:90%
from each one of the tables
that exists in the database.

89
03:47.340 --> 03:50.940 align:middle line:90%
Then from there the malware
can convert the table data

90
03:50.940 --> 03:57.035 align:middle line:90%
that comes back from the SQL
database into JSON or XML.

91
03:57.035 --> 03:58.410 align:middle line:90%
Basically, what
this is saying is

92
03:58.410 --> 04:02.160 align:middle line:90%
this is kind of like converting
an Excel file into a text
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

92
03:58.410 --> 04:02.160 align:middle line:90%
this is kind of like converting
an Excel file into a text

93
04:02.160 --> 04:02.670 align:middle line:84%
document.

94
04:02.670 --> 04:05.220 align:middle line:90%
That's basically the
gist of what it's doing.

95
04:05.220 --> 04:07.710 align:middle line:90%
And then using
the HTTP protocol,

96
04:07.710 --> 04:10.620 align:middle line:90%
specifically with the
POST method-- remember,

97
04:10.620 --> 04:12.960 align:middle line:90%
we did talk about these
in those API Nuggets--

98
04:12.960 --> 04:16.440 align:middle line:90%
it's going to post these
JSON and XML documents

99
04:16.440 --> 04:18.690 align:middle line:90%
containing that
SQL data straight

100
04:18.690 --> 04:20.550 align:middle line:84%
in to the malicious web server.

101
04:20.550 --> 04:21.930 align:middle line:84%
That's really the gist of it.

102
04:21.930 --> 04:24.270 align:middle line:90%
That's how the HTTP
protocol works.

103
04:24.270 --> 04:25.440 align:middle line:84%
And that's the idea.

104
04:25.440 --> 04:27.400 align:middle line:84%
That's the theory behind this.

105
04:27.400 --> 04:31.230 align:middle line:90%
And this is why we call this a
major indicator of compromise.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
04:27.400 --> 04:31.230 align:middle line:90%
And this is why we call this a
major indicator of compromise.

106
04:31.230 --> 04:34.920 align:middle line:90%
When we start seeing
read and write volume

107
04:34.920 --> 04:39.570 align:middle line:90%
skyrocketing on our database,
or we see just the intensive CPU

108
04:39.570 --> 04:42.330 align:middle line:90%
load, or the disk
IO load is starting

109
04:42.330 --> 04:45.540 align:middle line:90%
to skyrocket on the
virtual machine that

110
04:45.540 --> 04:49.410 align:middle line:90%
runs our database in general,
we know something is abnormally

111
04:49.410 --> 04:51.240 align:middle line:84%
happening on our database.

112
04:51.240 --> 04:54.510 align:middle line:90%
What we should then look is
either on our web security

113
04:54.510 --> 04:56.730 align:middle line:84%
appliance or our firewall logs.

114
04:56.730 --> 05:00.420 align:middle line:90%
We should start looking at
the volume of outbound data
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
04:56.730 --> 05:00.420 align:middle line:90%
We should start looking at
the volume of outbound data

115
05:00.420 --> 05:03.000 align:middle line:90%
and to what endpoints
is it going.

116
05:03.000 --> 05:05.820 align:middle line:90%
We can even do PCAPs
or packet inspections

117
05:05.820 --> 05:08.010 align:middle line:90%
to see what data
is going outbound.

118
05:08.010 --> 05:10.470 align:middle line:90%
We should check
those payloads to see

119
05:10.470 --> 05:15.450 align:middle line:90%
if we are exfiltrating data
in the form of JSON or XML.

120
05:15.450 --> 05:18.480 align:middle line:90%
Again, because the
HTTP protocol comes

121
05:18.480 --> 05:22.860 align:middle line:90%
with methods, like GET methods,
POST methods, PUT methods,

122
05:22.860 --> 05:26.160 align:middle line:90%
and the DELETE methods,
it is perfectly set up

123
05:26.160 --> 05:30.780 align:middle line:90%
to send and receive data
using the HTTP protocol.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
05:26.160 --> 05:30.780 align:middle line:90%
to send and receive data
using the HTTP protocol.

124
05:30.780 --> 05:34.380 align:middle line:90%
And it can handle all of
these payloads as part of it.

125
05:34.380 --> 05:37.350 align:middle line:90%
The web server knows
if the incoming traffic

126
05:37.350 --> 05:40.260 align:middle line:90%
is going to be XML, or
if the incoming traffic

127
05:40.260 --> 05:42.570 align:middle line:90%
is going to be JSON
data, because that's

128
05:42.570 --> 05:46.710 align:middle line:90%
what's going to be listed in
the header of the HTTP protocol.

129
05:46.710 --> 05:47.910 align:middle line:84%
And here's the real kicker.

130
05:47.910 --> 05:52.020 align:middle line:90%
When we look at a Wireshark
capture of HTTP traffic,

131
05:52.020 --> 05:55.110 align:middle line:90%
what you see here, this is
actually pretty much always

132
05:55.110 --> 05:56.860 align:middle line:84%
going to use HTTPS traffic.

133
05:56.860 --> 05:58.620 align:middle line:90%
Especially if the
hacker is smart,

134
05:58.620 --> 06:01.680 align:middle line:90%
they're going to want to try
and encrypt this data as it's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
05:58.620 --> 06:01.680 align:middle line:90%
they're going to want to try
and encrypt this data as it's

135
06:01.680 --> 06:03.190 align:middle line:84%
flowing across the wire.

136
06:03.190 --> 06:05.280 align:middle line:90%
So even if you do
a packet capture,

137
06:05.280 --> 06:09.510 align:middle line:90%
you can't see exactly what data
is being captured unless you

138
06:09.510 --> 06:15.250 align:middle line:90%
have a next gen firewall that
can do SSL handshake capturing,

139
06:15.250 --> 06:18.240 align:middle line:90%
and then decoding of the SSL
traffic as it's going on.

140
06:18.240 --> 06:20.890 align:middle line:90%
There are firewall
appliances that can do that.

141
06:20.890 --> 06:24.270 align:middle line:90%
It can capture the
SSL and TLS handshake,

142
06:24.270 --> 06:26.520 align:middle line:90%
and perform decryption
of the traffic

143
06:26.520 --> 06:27.870 align:middle line:84%
as it traverses the firewall.

144
06:27.870 --> 06:30.130 align:middle line:90%
So know that that is an
option out there for you.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
06:27.870 --> 06:30.130 align:middle line:90%
So know that that is an
option out there for you.

145
06:30.130 --> 06:32.130 align:middle line:90%
But the big thing that
you should keep in mind--

146
06:32.130 --> 06:36.660 align:middle line:90%
an eye out for is the amount of
traffic for a specific protocol

147
06:36.660 --> 06:38.100 align:middle line:84%
and the destination.

148
06:38.100 --> 06:42.810 align:middle line:90%
If I see some very large packets
that are constantly going from

149
06:42.810 --> 06:47.670 align:middle line:90%
one IP to the same destination
and it's really adding up over

150
06:47.670 --> 06:51.350 align:middle line:90%
time-- it may even be choking
out my bandwidth that I have

151
06:51.350 --> 06:52.410 align:middle line:84%
at the corporate uplink--

152
06:52.410 --> 06:54.360 align:middle line:90%
that may indicate
to me that we have

153
06:54.360 --> 06:56.707 align:middle line:90%
some sort of HTTP
exfiltration attack

154
06:56.707 --> 06:57.790 align:middle line:84%
that's going on right now.

155
06:57.790 --> 07:00.540 align:middle line:90%
So that's been understanding
how HTTP can be used
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
06:57.790 --> 07:00.540 align:middle line:90%
So that's been understanding
how HTTP can be used

156
07:00.540 --> 07:01.922 align:middle line:84%
as an exfiltration technique.

157
07:01.922 --> 07:03.630 align:middle line:90%
I hope this has been
informative for you.

158
07:03.630 --> 07:05.680 align:middle line:90%
And I'd like to thank
you for viewing.