1 1 00:00:00,870 --> 00:00:03,300 Lateral Movement and Pivoting. 2 2 00:00:03,300 --> 00:00:05,400 If you've ever watched American football, 3 3 00:00:05,400 --> 00:00:07,950 you've probably seen a lateral pass. 4 4 00:00:07,950 --> 00:00:10,800 Now, a lateral pass occurs when the player tosses the ball 5 5 00:00:10,800 --> 00:00:14,040 to a teammate by throwing it to the side or behind them, 6 6 00:00:14,040 --> 00:00:15,420 and that way you're moving the ball 7 7 00:00:15,420 --> 00:00:18,180 to another player instead of towards the goal. 8 8 00:00:18,180 --> 00:00:19,890 Now, this doesn't mean they aren't still trying 9 9 00:00:19,890 --> 00:00:21,600 to make further progress towards the goal, 10 10 00:00:21,600 --> 00:00:23,910 but at this particular point in the game, 11 11 00:00:23,910 --> 00:00:25,530 it's more important to get that ball 12 12 00:00:25,530 --> 00:00:27,000 to another player and away 13 13 00:00:27,000 --> 00:00:29,820 from the one who's holding it, for example, the quarterback, 14 14 00:00:29,820 --> 00:00:32,490 because somebody might be trying to tackle them. 15 15 00:00:32,490 --> 00:00:34,680 Now by going laterally, you're not really making 16 16 00:00:34,680 --> 00:00:36,630 forward progress, but you are getting it 17 17 00:00:36,630 --> 00:00:38,550 to a new position where you can then see 18 18 00:00:38,550 --> 00:00:41,130 if there's another opportunity to move the ball forward. 19 19 00:00:41,130 --> 00:00:43,589 If you're lucky, you may be able to get an additional five 20 20 00:00:43,589 --> 00:00:46,650 or 10 yards closer to the goal line, because once you catch 21 21 00:00:46,650 --> 00:00:50,061 that lateral pass, you can turn and start running forward. 22 22 00:00:50,061 --> 00:00:52,409 Now, why am I bringing up this idea of a lateral pass? 23 23 00:00:52,409 --> 00:00:54,570 Well, because it's very similar 24 24 00:00:54,570 --> 00:00:56,640 to the concept known as lateral movement, 25 25 00:00:56,640 --> 00:00:59,160 then an attacker might do inside your network. 26 26 00:00:59,160 --> 00:01:01,860 Now, lateral movement is a technique to progressively move 27 27 00:01:01,860 --> 00:01:03,930 through your network to search for key data 28 28 00:01:03,930 --> 00:01:06,060 and assets that are ultimately the target 29 29 00:01:06,060 --> 00:01:07,920 of the attack campaign. 30 30 00:01:07,920 --> 00:01:09,856 As the attacker does this, they're trying to search 31 31 00:01:09,856 --> 00:01:12,570 for more and more ways to get to their end goal, 32 32 00:01:12,570 --> 00:01:14,490 and a lot of times that just means they're moving 33 33 00:01:14,490 --> 00:01:17,725 to the side and not forward and deeper into your networks. 34 34 00:01:17,725 --> 00:01:20,378 For example, let's consider the following network. 35 35 00:01:20,378 --> 00:01:22,260 Let's say that an attacker got one 36 36 00:01:22,260 --> 00:01:24,990 of your wireless clients and they were able to exploit it. 37 37 00:01:24,990 --> 00:01:27,330 They may have used an exploit or a phishing campaign 38 38 00:01:27,330 --> 00:01:29,340 or something else, but for whatever reason, 39 39 00:01:29,340 --> 00:01:32,340 they now have control of that particular system. 40 40 00:01:32,340 --> 00:01:34,350 Now, from that single point, 41 41 00:01:34,350 --> 00:01:36,750 they can start searching out the rest of the network. 42 42 00:01:36,750 --> 00:01:39,120 This is what we're doing as part of lateral movement. 43 43 00:01:39,120 --> 00:01:40,890 So they start looking at the other clients 44 44 00:01:40,890 --> 00:01:43,140 in the wireless network by doing reconnaissance 45 45 00:01:43,140 --> 00:01:45,390 and doing port scanning and doing pinging, 46 46 00:01:45,390 --> 00:01:47,220 and doing all sorts of things like that. 47 47 00:01:47,220 --> 00:01:48,750 And then they might go further, 48 48 00:01:48,750 --> 00:01:50,790 and they go after the backbone switch, and then 49 49 00:01:50,790 --> 00:01:53,370 they start doing reconnaissance against the other switch. 50 50 00:01:53,370 --> 00:01:55,980 And there we see three more machines in a printer, 51 51 00:01:55,980 --> 00:01:58,410 and then they look and they see a bunch of servers. 52 52 00:01:58,410 --> 00:02:01,230 And as they keep going through and doing this reconnaissance 53 53 00:02:01,230 --> 00:02:02,880 and the searching, they're doing this 54 54 00:02:02,880 --> 00:02:05,760 as a means of preparing for further movement. 55 55 00:02:05,760 --> 00:02:08,003 This is the whole idea with lateral movement. 56 56 00:02:08,003 --> 00:02:08,970 Now, one 57 57 00:02:08,970 --> 00:02:11,100 of the ways you can start identifying lateral movement 58 58 00:02:11,100 --> 00:02:13,931 is to identify any irregular peer-to-peer communication. 59 59 00:02:13,931 --> 00:02:17,340 This can help you identify lateral movement because, again, 60 60 00:02:17,340 --> 00:02:19,770 most of the time when an attacker gets an initial point 61 61 00:02:19,770 --> 00:02:22,140 on your system, that first laptop, 62 62 00:02:22,140 --> 00:02:24,660 they're going to then start searching what else is out there 63 63 00:02:24,660 --> 00:02:26,904 that they can further exploit and lateral move onto. 64 64 00:02:26,904 --> 00:02:29,395 Now, another concept that often comes up when we talk 65 65 00:02:29,395 --> 00:02:33,390 about lateral movement is the concept known as pivoting. 66 66 00:02:33,390 --> 00:02:36,090 Now, pivoting is the use of one infected computer 67 67 00:02:36,090 --> 00:02:37,864 to attack a different computer. 68 68 00:02:37,864 --> 00:02:40,590 Now, this is an important concept because pivoting 69 69 00:02:40,590 --> 00:02:43,590 is going to use the compromise system to attack other systems 70 70 00:02:43,590 --> 00:02:46,020 on the same network to avoid the restrictions 71 71 00:02:46,020 --> 00:02:47,760 such as firewall configurations 72 72 00:02:47,760 --> 00:02:49,360 that prevent them from attacking 73 73 00:02:50,228 --> 00:02:51,061 from the outside directly. 74 74 00:02:51,945 --> 00:02:52,830 Now we're going to cover more about lateral movement 75 75 00:02:52,830 --> 00:02:54,960 and pivoting as we go through the rest of the lessons 76 76 00:02:54,960 --> 00:02:56,160 in this section. 77 77 00:02:56,160 --> 00:02:58,800 And I want you to keep in mind that oftentimes lateral 78 78 00:02:58,800 --> 00:03:01,533 movement and pivoting, although they sound very similar, 79 79 00:03:01,533 --> 00:03:03,812 they are distinctly different, but security 80 80 00:03:03,812 --> 00:03:07,170 professionals will often use them interchangeably. 81 81 00:03:07,170 --> 00:03:08,730 As we go through this section of the course, 82 82 00:03:08,730 --> 00:03:09,600 I am going to use them 83 83 00:03:09,600 --> 00:03:11,440 in their unique method of lateral movement, 84 84 00:03:11,440 --> 00:03:13,200 moving laterally, 85 85 00:03:13,200 --> 00:03:15,319 and pivoting being to use a single system 86 86 00:03:15,319 --> 00:03:18,123 to attack other systems on the network.