Instructor: Rogue devices. 2 2
One of the things you have to be concerned 3 3
about on your network are rogue devices. 4 4
Now, anytime a device is connected to your network, 5 5
these network devices are identified using the 6 6
hardware interface MAC address and their IP address. 7 7
So if I connect my smartphone to the network 8 8
or I connect a laptop to the network or a smart TV, 9 9
all of these devices if they have a network card, 10 10
have a MAC address and will hopefully be assigned 11 11
an IP address. 12 12
When that happens you can use that to identify 13 13
these devices across your network. 14 14
Now, if you want to prevent things from connecting 15 15
to your network that aren't authorized, 16 16
one of the best mitigations you can use is 17 17
to use digital certificates on those endpoints and servers, 18 18
forcing them to authenticate 19 19
and encrypt traffic using IPSec or HTTPS. 20 20
This will make sure that only devices you authorize 21 21
will get onto your network. 22 22
Now, if you get an unauthorized device on your network, 23 23
this is known as a rogue device 24 24
and that's what we're going to focus on inside of this lesson. 25 25
Now, when we talk about rogue devices 26 26
these are any unauthorized device or service, 27 27
such as a wireless access point, a DHCP server, 28 28
or a DNS server that's on a corporate or private network 29 29
that allows unauthorized individuals 30 30
to connect to that network. 31 31
Now, most often people think of rogue devices 32 32
as things like a wireless access point, 33 33
or a switch, or a hub that's being added, 34 34
but they actually include much more than that. 35 35
For example, if I have this thumb drive 36 36
and I stick it into a server, is that a rogue device? 37 37
Well, yes it is because that thumb drive could be attached 38 38
to the server to download sensitive data. 39 39
It's something that is not authorized 40 40
and it's being connected to my network 41 41
through that workstation or through that server. 42 42
And so this is an idea that you have to think about as well 43 43
when you start talking about rogue devices. 44 44
One of the most important things to do 45 45
with rogue devices is detect them, 46 46
because if you identify these things 47 47
you can then remove them. 48 48
So rogue system detection is simply a process 49 49
of identifying and removing machines on the network 50 50
that are not supposed to be there. 51 51
So for the rest of this lesson, 52 52
we are going to talk about rogue systems. 53 53
We need to figure out first what is considered 54 54
a rogue system. 55 55
Well, there's a lot to them out there. 56 56
We have network taps and wireless access points, or WAPs. 57 57
We have servers, we have wired and wireless clients. 58 58
We have software that's installed without our permission. 59 59
We have virtual machines and we have smart appliances. 60 60
All of these things can be rogue devices or rogue systems. 61 61
Now, one of our jobs as a cybersecurity analyst 62 62
is to identify everything that's on our network 63 63
and identify what shouldn't be there. 64 64
Based on that, we can then go 65 65
through this rogue device system detection, 66 66
find out what's not supposed to be there, 67 67
and get it off our network. 68 68
So let's talk about all of these different categories 69 69
of rogue devices. 70 70
First, we have network taps. 71 71
Now a network tap is a physical device that is attached 72 72
to cabling to record packets that are passing 73 73
over that network segment. 74 74
We talked about network taps earlier in this course 75 75
because we use them as cybersecurity analysts. 76 76
We want network taps that are 77 77
in our control so we can collect information 78 78
and detect things on our network by looking through all 79 79
of our packet captures and network flows. 80 80
But we don't want a road network tap 81 81
that is under the control of some adversary 82 82
and that's what we're talking about here with network taps. 83 83
The next area is wireless access points or WAPs. 84 84
Now these are different devices that can be connected 85 85
to your network and they extend your physical network 86 86
into the wireless spectrum. 87 87
Now, there's lots of problems when you start dealing 88 88
with wireless access points, 89 89
especially ones you don't control. 90 90
One of them is that there can be rogue access points 91 91
on your network. 92 92
Now, there's two ways of looking at this. 93 93
One is you have a rogue access point that's connected 94 94
to your network, which can allow an adversary to connect 95 95
to their wireless access point 96 96
and then convert their radio signal 97 97
from the parking lot going into your access point 98 98
into the physical network over your ethernet network. 99 99
Now, the other type of rogue access point we can have 100 100
is where an attacker gets close to you 101 101
and then sets up their own access point 102 102
with its own connection to the internet. 103 103
Now, that point isn't going to actually connect to your network 104 104
but it can be used as an evil twin 105 105
and make it look like it's part of your network. 106 106
So for example, if I set up a rogue access point 107 107
in the middle of Starbucks 108 108
and you try to connect to the Starbucks wifi, 109 109
you may be connecting to the Starbucks wifi 110 110
or you may be connecting to mine. 111 111
If you're connecting to mine, 112 112
I now act as a man in the middle 113 113
and capture all your traffic and put you at risk. 114 114
As a cybersecurity analyst, 115 115
we want to make sure this doesn't happen. 116 116
And so we're going to scan our airwaves 117 117
and find out what wireless networks are near us, 118 118
identify those rogue devices and get them taken down. 119 119
Now, often students ask me, 120 120
"How hard is it to create one of these rogue access points?" 121 121
Well, if you have something like a wifi pineapple shown here 122 122
you can easily create a rogue access point 123 123
and then become a man in the middle 124 124
for all those unsuspecting users. 125 125
The next type of rogue device we're going to talk 126 126
about is a server. 127 127
Now, an adversary may try to set up a server as a honeypot 128 128
to start harvesting network credentials or other data. 129 129
By doing this, they can then be another server 130 130
on your network and try to trick your users 131 131
into giving them critical information. 132 132
They could also use things like ARP poisoning 133 133
or corrupting name resolution to be able to divert traffic 134 134
into their server instead of yours. 135 135
So you want to make sure you're identifying 136 136
these rogue servers and get them off your network. 137 137
Another type of rogue device you might have is a wired 138 138
or wireless client. 139 139
For example, if somebody brings in their personal laptop 140 140
takes out the connection from their work laptop 141 141
and plugs it into their personal laptop 142 142
they have now added a rogue device, their personal laptop, 143 143
to your organizational network. 144 144
This can be a big problem 145 145
because these are devices you don't control. 146 146
They have webcams on them, which can see inside the room. 147 147
They have microphones to record conversations. 148 148
They might bring malware into your network. 149 149
Lots of different things can happen 150 150
when you don't control the device. 151 151
In an organization if you're using 152 152
a bring your own device policy, 153 153
this would not be considered a rogue device 154 154
because you're allowed to bring them in under that policy. 155 155
But in most organizations, 156 156
if you don't have a bring your own device policy, 157 157
bringing your own personal laptop is not going to be authorized 158 158
and it would be considered a rogue device. 159 159
Now, another thing to think about when you talk 160 160
about authorized client devices is 161 161
that they could be used in an unauthorized way. 162 162
For example, I have a workstation in my office 163 163
that the company gives me. 164 164
I can log in there using my username and password. 165 165
All of that is authorized. 166 166
But I don't have permission to try to SSH into a server 167 167
or perform network scans or tether my smartphone to it. 168 168
All of these are things that are unauthorized 169 169
and so if I do those things, 170 170
I now have turned that authorized client into a rogue device 171 171
because that's not following the right procedures. 172 172
The next type of thing we want to talk about is software. 173 173
And software can actually be rogue as well. 174 174
If I just go to the internet and download a piece 175 175
of software on my workstation and install it, 176 176
that can go against company policy 177 177
and it would be considered a rogue device at that point. 178 178
This can actually have things 179 179
like malicious DHTP or DNS servers, 180 180
it might be malware, it could be covert spying software. 181 181
All of these things could be installed 182 182
as part of this rogue software. 183 183
So instead, you should always install software 184 184
using the appropriate change management processes 185 185
and make sure that software is clean 186 186
and ready to go on the network. 187 187
Another type of rogue device is virtual machines. 188 188
If you're using a very highly virtualized environment, 189 189
people can start creating virtual machines 190 190
that could be used to create rogue servers 191 191
and services inside that virtualized environment. 192 192
Now, in the old days if somebody wanted 193 193
to bring a new server into your offices 194 194
you would probably see them carrying this big computer 195 195
and hooking it up. 196 196
But with virtual machines, it's just software code. 197 197
So if they could spin up a virtual machine 198 198
and run software to run a server on it, 199 199
that would be a way to put a rogue server in your network. 200 200
So keep that in mind as well. 201 201
The final area we want to talk about is smart appliances. 202 202
Now these are devices like printers and webcams 203 203
and VPN sets and VTC systems, 204 204
and washing machines, and refrigerators, 205 205
and smart TVs, and all sorts of other things these days. 206 206
Everything seems to be internet connected. 207 207
And when they're internet connected, 208 208
that means there are potential vulnerability 209 209
that an adversary could exploit. 210 210
A lot of these devices 211 211
are running Linux-based operating systems, 212 212
but they don't receive the patching and updating 213 213
like your Linux servers would. 214 214
And so they are something that could bring vulnerabilities 215 215
into your systems. 216 216
As we talk about things like ICS and SCADA 217 217
we'll go back and revisit smart devices as well. 218 218
But it is something to think about 219 219
when you start talking about rogue devices. 220 220
If you install a new TV in the conference room 221 221
does that TV have wifi and did you plug it into the network? 222 222
Because if so, that device could be something 223 223
that could be used by an attacker against you. 224 224
So now that we've talked about all the different kinds 225 225
of rogue devices, and I told you all the bad news out there, 226 226
how can you figure out what rogue devices there are 227 227
and how do you detect them? 228 228
Well, we could perform rogue device detection 229 229
in lots of different ways. 230 230
One of them is by doing a visual inspection 231 231
of ports and switches. 232 232
Especially if you're dealing with wired networks, 233 233
this is one of the best ways to find rogue devices. 234 234
Now, when you're conducting your physical inspection 235 235
you want to make sure that you're careful 236 236
to ensure the attacker didn't install some additional piece 237 237
of equipment or counterfeit equipment with fake asset tags. 238 238
For instance, if you have a rack of a bunch of Cisco gear 239 239
and somebody brings in another device 240 240
that looks like a Cisco device 241 241
and you had five there yesterday and now you have six, 242 242
will you be aware of that? 243 243
Will you see it as you walk in on a daily basis? 244 244
Well, if you had five and six, you might. 245 245
But if you had 50 and now you have 51, you might not. 246 246
And so this is something to keep in mind 247 247
as you're looking at things. 248 248
As you go through, you should do inventories either monthly 249 249
or quarterly to see all the devices 250 250
that you expect are there and no additional devices. 251 251
Another detection mechanism for rogue devices 252 252
is to conduct network mapping and host discovery. 253 253
You can use an enumeration scanner to help identify hosts 254 254
via banner grabbing and fingerprinting 255 255
of those devices across your network. 256 256
As you start running scans across your network 257 257
and performing this enumeration, 258 258
you'll start figuring out exactly what's on your network. 259 259
You've got 10 Linux servers and they're this version. 260 260
You've got five Windows 2019 servers, 261 261
you've got three Windows 2016 servers. 262 262
Whatever those things are, this will help you do that. 263 263
And if you know what your baseline is 264 264
and you write another scan 265 265
and now you have three new servers, 266 266
you can then figure out why do you have 267 267
those three new servers? 268 268
Because if they didn't go through 269 269
the proper change control process, 270 270
they would be rogue devices. 271 271
If you're worried about wireless devices, 272 272
you can conduct wireless monitoring. 273 273
This is also known as wireless sniffing and discovery. 274 274
And this can be used to find unknown 275 275
or unidentifiable service set indicators, or SSIDs, 276 276
showing up within the range of your office. 277 277
So again, if you have an office 278 278
and the name was Dion Training as your wifi, 279 279
and right next door is a coffee shop 280 280
and somebody sits up a rogue access point 281 281
called Dion Training and you start seeing 282 282
there is three different signals coming out 283 283
from Dion Training, but you only have two in your office, 284 284
well, that would be a rogue device, 285 285
and wireless monitoring can help you figure that out. 286 286
Another good detection mechanism is to use packet sniffing 287 287
and traffic flows. 288 288
This can be used to identify any unauthorized 289 289
protocols that are on your network 290 290
or any unusual peer-to-peer communication flows. 291 291
For example, if you're not running any web servers 292 292
on your network, but you start seeing port 80 is running 293 293
and sending data out often, 294 294
that could be an indication that somebody set up 295 295
a malicious or rogue web server inside your network. 296 296
And so you want to look into that. 297 297
And finally, we have NAC and intrusion detection. 298 298
A lot of security suites 299 299
and appliances can combine automated network scanning 300 300
with defense and remediation suites 301 301
to try to prevent rogue devices from accessing the network. 302 302
If you're using NAC, you might be using something 303 303
like usernames and passwords to gain access to the network 304 304
or even better, digital certificates. 305 305
If somebody doesn't have that digital certificate, 306 306
that device can't get on the network. 307 307
If you're dealing with intrusion detection, 308 308
it can go and scan the network and say, 309 309
"I found this new thing. 310 310
I don't know what it is, and therefore I'm going to flag it." 311 311
And that way an analyst can look into it further 312 312
and figure out if it's a rogue device.