hello i'm philip wiley
thanks for everyone for attending my
talk
the way of the adversary threat actor
philosophies and mindsets
i appreciate this opportunity to get to
present here this year
a little bit about myself
my name is philip wiley i have my cissp
oscp and sam's gw apt
most proud of those is the oscp that was
a tough
process to study for and
get certified the exam was pretty tough
but i learned a lot when i was
getting started as a penetration tester
i'd moved over from application security
got laid off from my job
and went to work as a consultant doing
pen testing i'd run vulnerability
scanners and worked in appsec for
several years and security and worked as
a sys admin but i needed to learn how to
hack so i went through the oscp so
that's a was a really great experience
so i'm very proud
to get that it wasn't easy for me i had
to learn how to hack and that was uh was
a really good one for me to learn how to
hack
i'm also the in my career-wise i am the
office of an offensive cyber security
professional instructor
i have been in
offensive security for a little over
nine years of my 23 plus years of i.t
and cyber security
have a little over 17 years of dedicated
cyber security experience i'm an adjunct
professor at dallas college i teach
ethical hacking and web app pen testing
i'm also the home school project founder
the pone school project was created to
give my students a way to further their
education
students down towards the end of the
very first semester i taught were asking
me
where do i go next where do i go to
learn more about this subject the
college didn't offer any more than just
the ethical hacking class at the time
so i decided to found the palm school
project
it started out mainly being
topics on
uh offensive security but with our debt
meetings uh then texas
didn't have uh a security community
there so those meetings tend to be more
than just
uh offensive security we spread into
other areas because the goal is to help
people get started in security or people
in security to advance their careers
so i'm also the concept creator and
co-author of the pentester blueprint
starting a career as an ethical hacker
this talk came out of a
lecture that i used to give my class
at the beginning of each semester
some of the other uh professors at the
college asked me to give the talk to
their students
and you know the first time i gave this
presentation was in uh january 2018 was
starting out teaching at dallas college
so from january
to to november of that same year of 2018
it became a conference talk and i gave
the talk at several conferences
i was featured in the tribe of hackers
red team book
and
the publisher wiley publishing asked me
if i'd be interested in writing a book
myself and i thought
for a while that the pentester blueprint
would be a good book to
to write about a lot of other resources
teach you how to be a pen tester teach
you pin testing but no one was really
telling you this is what you need to
learn before you start these are some
good learning resources to learn pen
testing i'm also the host of the hacker
factory podcast and in the spirit of a
lot of things i do
uh it's to help people get started as
pen testers so i have different guests
on each episode
telling about how they got started in
cyber security
and pen testing
and their tips on how to get started so
this is a
in the spirit of the other thing the
other things i do is try to help people
and help people get started
i'm also innocent lives foundation
ambassador the innocent liars foundation
helps unmask anonymous child predators
so they work with volunteers the duo
cent that try to collect this
information that they turn over to law
enforcement to hopefully apprehend these
these uh
these people that are harassing children
online these predators i'm also a
hacking is not a crime advocate
and this we're trying to take back what
the true meaning of hacker because the
media has portrayed it as uh you know
we're as we're all cyber criminals
and so the goal of that is to help
the name of the the hacker you know when
hacking started out it was more about
people that were actually coding
building things uh you know some of this
came out of the
mit railroad club where you know
people were there working with different
technologies and stuff and that in
general you know hackers have really
been more of
uh
makers and and people that were able to
enhance
you know capabilities of product of
different products and software's
different technology
and that's kind of where the hacking
turn came about they were able to hack
it or make it do things it wasn't
supposed to do and enhance the
capabilities and then you know over the
years we got to learn the term
you know it came to be more about you
know hacking into something be able to
bypass security controls or something
like that finding
bugs and systems but the original term
was
uh
based on
you know
development because you look at the
hackathons hackathons are programming
competitions so these aren't really
anything about computer hacking so so
hacking is not crime we're just trying
to bring awareness
to the media and the public
because as an ethical hacker or a
penetration tester offensive security uh
professional over the years people ask
me what do you do for a living and it's
easier to say
ethical hacker than penetration tester
because people don't understand it that
term and it takes a little more
explanation
when you say ethical hacker the intent
is to make it easier for them to
understand but i've had several people
ask me is there such a thing as an
ethical hacker so
you know there's a lot of work that we
need to do to to you know help bring
awareness to that
and make up for what what the
the media has done
so the way of the adversary threat actor
philosophy's mindsets uh
most of your most of your uh talks and
most of your trainings and stuff that
you go through in cyber security
especially offensive security so many
times we focus on
the victims the targets the people we're
testing you're focusing on the
psychology
of those specific targets
and sometimes overlooking the psychology
and mindset of the adversaries
while
understanding the psychology of the
victims or the end users how
to successfully social engineer them is
very important but i think to be a
really good adversarial
uh
professional or you know offensive
security professional is to understand
the psychology of who we're trying to
emulate
so the threat actor philosophy
and
psychology should be considered
war teaches us
to know our adversaries same thing is in
martial arts or other combat sports
and sports in general know your
adversary know your opponent
even like football teams will
review videos of their opponents prior
to the game to to see how they work and
uh cyber
cyber professional cyber security
professionals are fighting cyber wars so
we must know our adversaries in that
same way
so kind of to get into some of the
philosophies and stuff the conscience of
the hacker also known as the hacker
manifesto is a small essay written
january 8th 1986 by a computer security
hacker who went by the handle or
pseudonym of the mentor
his birth name lloyd blankenship
who belonged to the second generation of
the hacker group legion of doom
it was written after the author's arrest
and first published in the underground
hacker ezine frack and can be found on
many websites as they tell as as well as
on t-shirts and films
consider the cornerstone of the hacker
culture the manifesto access guideline
to hackers across the globe especially
those new to the field it serves ethical
foundation for hacking and asserts
that there is a point of hacking
that supersedes selfish desires to
exploit harm
harm
other people and that technology should
be used to expand our horizons and help
keep the world free
so this this is is a good reference here
uh for
like the the philosophy of hackers and
this is more in the mindset of
you know professional hackers
or ethical hackers people are trying to
do this for good
you get into some of the cyber criminals
and hacktivists and sometimes they don't
always take these things into
consideration hacktivists sometimes will
be not wanting to injure people but
maybe their uh you know
uh activists towards
you know
climate change
in the environment and they'll just want
to do things like deface
websites or do things to get attention
not harm people
but then again there's other there's
other types of
people that use these adversary
techniques that
that uh don't keep this in mind so they
that this can kind of vary from the type
of
hacker adversary and keep in mind when
we're talking about hacker we're talking
about the when i'm referring to the
skill set not say you know because
hacker and cyber credibles criminals are
not used interchangeably it's just the
tools and techniques that are that are
shared
so these the philosophies vary between
different types of hackers for example
some nation states and cyber criminals
aren't concerned with the safety
and well-being of their targets
which contradict the hackers manifesto
in some cases during you know nation
states during cyber wars
and you know they're not concerned with
the safety of people maybe the person
doing the action maybe they are but the
people that they are working for
don't consider that so these
philosophies vary that's why it's really
hard to define the philosophy so if you
went to like a
a criminal philosophy compared to just a
hacker philosophy it's going to be
different but there's going to be some
things that are even
similar
in
all types of hackers all types of people
that that hack
so
learning and practicing ttps
would also you know known as the
long-term techniques techniques and tech
techniques tactics and procedures help
develop the hacker mindset so developing
the hacker mindset
is is developed by hands-on practice so
working in labs working in
bug bounties and doing these things
hands-on hacking is going to help build
that mindset
and it's always things once you've
worked as a penetration tester or done
some sort of hacking
you kind of learned that you know you
see things for instance i was an air at
an airport back during my consulting
days waiting for my luggage at the
luggage carousel
and i saw a usb stick laying on the
ground
and the first thing i come to mind as
i'm thinking of what malicious payload
is on that
that usb stick
because i know as an adversary emulator
a penetration tester that
a lot of times we deliver payloads that
way and so will
adversaries so will the the bad guys so
when you see those things you just kind
of learn to you get that hacker
mentality you start to think like a
hacker and you know you see certain
vulnerabilities on a system
you know you see apache web server or
you see tomcat and you know sometimes
they're
vulnerable to um
to uh payload uploads and you know
unrestricted uh uploads or
something like you know default
credentials so sometimes you know you're
able to get a payload to that system and
maybe get access so as you see those
things and you develop those hacking
skills learn the different
vulnerabilities and exploits
you kind of learn that
you put those things together when you
see it you think okay this is what i do
next and that's that's kind of
a description of the hacker mindset the
hacker mindset's universal whether it's
used for good or bad you know it's the
intent that is different it's not
necessarily so the the understanding how
to get into things
peace kind of uh
is universal
so the different adversary types so we
have hacktivist
state actors
cyber crime groups insiders scammers and
script kitties
so these are just you know there
there could be more groups and this can
be broken down further
uh your hacktivists are usually just in
this because it's for a cause some
ideology uh you know you could be people
that are
that are you know for the environment
and they may go after
some uh companies or energy companies
that are polluting the environment
so they're doing it for a good cause
they're trying you know it's just taking
activism a step further you know one of
the things we look at in the digital age
you know protesting certain things were
in person just some of the
old school hack
activist type of
opportunities and ways of doing things
have transformed along with you know our
digital age in the communications
uh state actors this could be any you
know foreign country
nation states that this could be their
cyber warfare team this they're trying
to possibly steal
intellectual property from other
countries they're trying to disable
you know
power grids or something for other
countries in different you know enemy
states
and you get cyber crime groups
uh which this can vary the types
insiders of course a lot of times people
overlook and there's a higher percentage
of people are insiders and this could be
disgruntled employees
and this is not always
you know
an actual employee this could be someone
as implanted in the organization
i was speaking with a company last year
and they were kind of sharing some uh
intelligence with us and they were
talking about a company that that
produced hardware
that someone was implanted from another
government there to steal intellectual
property
and so these
insiders can also be disgruntled
employees you hear the stories
of past where someone a programmer for a
bank
programmed the application to put like
like a tenth of a percent into his
account from all the accounts in the
bank and after so long they got this
money
i never verified if that's true or not
it could could well possibly be
sometimes those stories come from
from facts but i can't validate for sure
but you hear those kind of stories so
you see people that are doing all sorts
of things for
job security
they want to document things they don't
want
people to be able to replace them so
sometimes they do malicious activities
they get
you know upset with their employer they
do things
still intellectual property and all
sorts of things so insiders
are also a threat
and so the motivation
and so we some of these are going to
kind of over
you know kind of overlap with some of
the the with the uh
the other slide but hacktivism
financial retaliation cyberterrorism
curiosity challenge and thrills these
are some of the motivations
and these last three the curiosity and
challenge
these are the more the universal traits
motivations because a lot of people
whether they're
you know a malicious threat actor
or just someone that does bug bound is
someone that is playing around hack the
box the curiosity and the challenge
and the thrill is kind of a motivator
and this is really some of the things
that motivate like script kitties you
know they may find some tool they're
wanting to see if it actually works on
a production website and so they try it
on a website and
so but this the curiosity and challenge
and thrills what gets people into
hacking in general
and so financial one of the things we're
seeing with financial you know this
could be
someone directly
breaching a system
and getting access to funds or
things of value
and then there's also you know
ransomware has been one of the more
popular ways that attackers can monetize
their attacks so using ransomware
you know files are encrypted and then
the victim has to pay
to
you know get the decryption code keys to
be able to decrypt their data so this is
one way attackers have
have
found to to
monetize
attacks and using
cryptocurrency they're able to get the
the funds without
being traced as easily as you would back
in the days of someone who's doing a
wire transfer to a bank or
or actually sending money physically or
whatever so these are kind of ways that
those things have kind of evolved over
the years
and so how to start so getting to know
the adversary so to get to know the
adversary you need to understand their
attacks so one of the ways to start out
that is kind of a good shortcut to that
because otherwise you can do a lot of
studying and i advise that too if you're
interested
in offensive security especially more
towards the red teaming or adversary
emulation then it's good to study all
the different attack techniques and
stuff out there but
mitre has made this more easy for us
through the miter attack framework and
you can find that at attack.miner.org
and so they've got like a
resource there that you can go through
and see these different atps and the
different ttps that they're using for
their attacks
so this is kind of a way to get to
understand you look at these different
apts and see how they're operating so
the cool thing about that is you know
just from the ttp standpoint this is
something that could go across different
apts but getting to understand different
apts can be important to your
organization so maybe you you work for
a power company
or some other resource like natural
resource type company and you can go out
and look and find these different apts
and find out what may be the ones that
may be attacking your industry more
uh specifically so that way you kind of
know to understand that adversary more
and then cyber security threat
intelligence
so cyber threat intelligence
is uh is something good to know whenever
you're you're trying to learn
what these adversaries are doing so
that is a good area to
to know is knowing your adversary from
threat intelligence
and so if you're not familiar with mitre
miter attack is at the address mentioned
above
attack.miner.org
miner attack is a globally accessible
knowledge base of adversary tactics
techniques based on real world
observations
the attack knowledge base is used
as a foundation for the development of
specific threat models and methodologies
in the private sector in government and
in cyber security product and service
community so this is a good way to you
know you're working on they mentioned
here your threat model so you're working
your threat model you know they're
specific when you're building out that
threat model
uh you want to take in consideration
the adversaries that you may have trying
to attack your environment so that's one
of the good ways to know that so this
kind of gives you
the uh
the definition from minor attacks
website
so using the the so getting more into
the cyber threat intelligence
katie nichols has some really good stuff
out there and she's a sans instructor
and she's also
i believe she works for
i think canary possibly
not real sure at that i was looking
prepare any slides but any rate katie
created this uh
this intelligence training
with adam pennington so you can access
that on a miner's website so they get
some videos and stuff to teach you how
to uh
to learn that threat intelligence and
where i first found out about katie and
the threat intelligence
i follow her on twitter for years but
where i found out about her threat
intelligence involvement
was going through looking at some some
material from sands some information on
on purple teaming and red teaming and
when they cover some of the stuff on
threat intelligence uh you know saying
sans
uh has katie as an instructor there so
looking at some of the information she
had
to offer there some links back to
mitre and some and also
some other resources
so on that resource there's actually
like some videos and stuff too so that's
a good resource
and a cyber threat intelligence
self-study plan
by katie nichols this is on our medium
uh page
and
today to believe all there is just the
part one out there but this is a really
good place to start that shows you some
different places ways to do self-study
on threat intelligence
a good low cost i mean it doesn't cost
you anything it's free resources so you
go out there and use this to to learn
about threat intelligence and also
crowdstrike has some good information
out there
and what is a what is cyber threat
intelligence by crowdstrike
so you can find that on their security
101 section on their website
so that's that's a good resource there
that you can use
and so defending against the adversary
so you you've learned you're
learning this knowledge of how threat
actors work so you can use this to
defend against threat actors
so you know this threat intelligence is
good for you know red teamers to emulate
adversaries but this is also good
and very important to the defenders to
know what to defend against you can go
out look at mitre
you look at the different type of apts
what ttps that they're using and you can
go in and make sure you're protecting
against those you know to watch for
those try to detect and prevent against
those type of
ttps
and so for the offensive side this is
kind of the more the area that's more
that i'm more passionate about but i
wanted to include some of the defense
stuff in there too because
uh in my pintester blueprint talks in my
book
you know i share with how
offensive cyber security knowledge is
good for defenders
it's good for
for sock analysts it's good for
network security
operation security different defenders
not necessarily
just the offensive team but it's good
for the defenders to be able to defend
against
the bad guys
so for offensive security
using the knowledge to emulate threat
actors so you got red teaming this is
true adversary emulation and i want to
make sure to you know clarify there is a
difference
uh red teaming and blue teaming are used
to generically
identify
offense and defense
but true red teaming is adversary
emulation
pen testing is using the adversary ttps
during security assessment so you're
performing a security vulnerability
assessment you're using these different
ttps during
that test
a pen tester is trying to find every
vulnerability
that can be exploited
and exploiting those
as a red teamer during a red team
operation you're trying to find
high impact
vulnerabilities that can be exploited
something that would emulate a breach so
you're finding one or two ways in
having a secondary weigh-in in case you
get that first uh
option is blocked or something happens
the system that gets root rebooted you
can't get back on having a backup plan
another way to get in so you're doing
things that lead to a breach it's more
emulating what a threat actor would do
like a nation state
or those type of actors
so you're like i said you're looking for
the things that can be breached
you're going through
and trying to you know get access trying
to exfil data see if that's a
possibility see what you can get to
you're trying to go undetected
penetration tests
you've got a limited time so you're
really not trying to go undetected
you're using vulnerability scanners
whereas in red teaming you're not using
the vulnerability scanners you don't
want to be caught you're doing
techniques that are there to go
undetected so
you keep this in mind pen testing
less time you're trying to find every
vulnerability and try to exploit
everything that's vulnerable
and purple team is collaborating with
the blue team so red team and blue team
working together to try to prevent these
type of attacks
and so when it comes to renting
operations you plan to execute your your
operation so you leverage mitre
to emulate adversaries we have a
screenshot here of what the attack
matrix looks like
so you can see there's a reconnaissance
resource development initial access
execution persistence
privilege escalation
defense as defensive asian credential
access discovery and lateral movement
and so
you know also maintaining persistence
one of the things that goes on during
this time so you can go through here and
pick the apt that you want to use
choose the apt for your engagement and
execute the operation and then write
your report
but also one of the things you can do is
you can be more creative
as far as choosing apt
uh first choice you might find
apts
that are common to your industry
and work with those work on those first
then later on you can get more creative
and
just kind of do your own come up with
your own
ttps and own attack methods because you
know
these things before
the community knows about it before
mitre has it in their database go
unknown so being creative and building
your own
uh
ttps
is is a good practice as well
and so pen testing so you leverage the
ttps during the security assessment so
in this case you know you're you're
using whatever you know like eternal
blue when it was you're still seeing
that environment but that's one of the
ones that you could try to leverage see
if these vulnerabilities are
are vulnerable to something like that so
you try to see if you can
you look for your vulnerabilities and
see if they can be exploited and then
you see how far you can go so you're
you're still leveraging some of the same
techniques
as an adversary using these ttps
but
you're you're you're doing this
in a way where you're not worried about
going undetected and to also
kind of share it's good to do pen test
and red team engagements both because
the red team engage the blue the
pen tests are going to get your security
defenses up a little bit quicker you're
doing your regular reoccurring
vulnerability scans you're doing your
pen tests
so
red team engagements are more for more
mature operate more mature organizations
so once your organization gets a little
mature then you don't have to you know
then you can kind of move on to
the adversary emulations of red team
engagement
so purple team as we kind of mentioned
while ago
uh you're working with the red team red
team blue team are working together
to to make sure that things are being
detected
so going back to to mitre you know
selecting the different apt groups
select specific apd seeing if you can
run mini cats in your environment or if
powershell is enabled by default
just going through and working on those
executing mimikats if that executes
successfully then you need to make sure
your endpoint protection is detecting
and blocking those and so you work this
is really good to do after a red team
engagement or penetration test because
by going in and shutting down certain
tools then you make it more difficult
for attackers to get their attacks
through
so this is a great resource and really
one of those things when you're starting
your pen tests
and your vulnerability assessments are
running purple teaming is something to
put in there because that helps bring up
the maturity of your your security
environment
and so thanks for attending my talk
before i became an instructor
i was also
sharing information with people that
wanted to become
oscp certified wanting to become pen
testers so i've done a lot of mentoring
before
i started teaching and i do a lot more
now mentoring and teaching
so feel free to reach out to me i'm
happy to answer your questions
and i'll be answering your questions on
the the defcon discord
but if after the fact or you just want
to connect feel free to connect with me
i'm always big on building my community
my network of
professionals and and so forth so you
see my linkedin there my twitter
uh my hacker factory podcast can be
found on itsp magazine
and for all the rest of my links you can
go to
my link tree link there that's got my
twitch channel i stream once a week on
twitch
i have a youtube channel
and uh and so some other social media
stuff i share in there so for the rest
of the links you can go there
so thanks again for attending my talk
and i hope you enjoy the rest of defcon
and thanks to
abby and
all the adversary village volunteers for
putting this on and i hope everyone has
a good time
thanks