Narrator: Lateral Movement and Pivoting. 2 2
If you've ever watched American football, 3 3
you've probably seen a lateral pass. 4 4
Now, a lateral pass occurs when the player tosses the ball 5 5
to a teammate by throwing it to the side or behind them, 6 6
and that way you're moving the ball 7 7
to another player instead of towards the goal. 8 8
Now, this doesn't mean they aren't still trying 9 9
to make further progress towards the goal, 10 10
but at this particular point in the game, 11 11
it's more important to get that ball 12 12
to another player and away 13 13
from the one who's holding it, for example, the quarterback, 14 14
because somebody might be trying to tackle them. 15 15
Now by going laterally, you're not really making 16 16
forward progress, but you are getting it 17 17
to a new position where you can then see 18 18
if there's another opportunity to move the ball forward. 19 19
If you're lucky, you may be able to get an additional five 20 20
or 10 yards closer to the goal line, because once you catch 21 21
that lateral pass, you can turn and start running forward. 22 22
Now, why am I bringing up this idea of a lateral pass? 23 23
Well, because it's very similar 24 24
to the concept known as lateral movement, 25 25
then an attacker might do inside your network. 26 26
Now, lateral movement is a technique to progressively move 27 27
through your network to search for key data 28 28
and assets that are ultimately the target 29 29
of the attack campaign. 30 30
As the attacker does this, they're trying to search 31 31
for more and more ways to get to their end goal, 32 32
and a lot of times that just means they're moving 33 33
to the side and not forward and deeper into your networks. 34 34
For example, let's consider the following network. 35 35
Let's say that an attacker got one 36 36
of your wireless clients and they were able to exploit it. 37 37
They may have used an exploit or a phishing campaign 38 38
or something else, but for whatever reason, 39 39
they now have control of that particular system. 40 40
Now, from that single point, 41 41
they can start searching out the rest of the network. 42 42
This is what we're doing as part of lateral movement. 43 43
So they start looking at the other clients 44 44
in the wireless network by doing reconnaissance 45 45
and doing port scanning and doing pinging, 46 46
and doing all sorts of things like that. 47 47
And then they might go further, 48 48
and they go after the backbone switch, and then 49 49
they start doing reconnaissance against the other switch. 50 50
And there we see three more machines in a printer, 51 51
and then they look and they see a bunch of servers. 52 52
And as they keep going through and doing this reconnaissance 53 53
and the searching, they're doing this 54 54
as a means of preparing for further movement. 55 55
This is the whole idea with lateral movement. 56 56
Now, one 57 57
of the ways you can start identifying lateral movement 58 58
is to identify any irregular peer-to-peer communication. 59 59
This can help you identify lateral movement because, again, 60 60
most of the time when an attacker gets an initial point 61 61
on your system, that first laptop, 62 62
they're going to then start searching what else is out there 63 63
that they can further exploit and lateral move onto. 64 64
Now, another concept that often comes up when we talk 65 65
about lateral movement is the concept known as pivoting. 66 66
Now, pivoting is the use of one infected computer 67 67
to attack a different computer. 68 68
Now, this is an important concept because pivoting 69 69
is going to use the compromise system to attack other systems 70 70
on the same network to avoid the restrictions 71 71
such as firewall configurations 72 72
that prevent them from attacking 73 73
from the outside directly. 74 74
Now we're going to cover more about lateral movement 75 75
and pivoting as we go through the rest of the lessons 76 76
in this section. 77 77
And I want you to keep in mind that oftentimes lateral 78 78
movement and pivoting, although they sound very similar, 79 79
they are distinctly different, but security 80 80
professionals will often use them interchangeably. 81 81
As we go through this section of the course, 82 82
I am going to use them 83 83
in their unique method of lateral movement, 84 84
moving laterally, 85 85
and pivoting being to use a single system 86 86
to attack other systems on the network.