1 1 00:00:00,480 --> 00:00:02,340 Common identifiers. 2 2 00:00:02,340 --> 00:00:04,320 In this lesson, we are going to talk about 3 3 00:00:04,320 --> 00:00:06,330 some specific common identifiers 4 4 00:00:06,330 --> 00:00:07,860 that we can use when we're talking 5 5 00:00:07,860 --> 00:00:09,480 about specific vulnerabilities. 6 6 00:00:09,480 --> 00:00:12,060 Now, there are many different scanning tools out there. 7 7 00:00:12,060 --> 00:00:14,340 But they all use the same ways 8 8 00:00:14,340 --> 00:00:16,770 to identify these same vulnerabilities. 9 9 00:00:16,770 --> 00:00:18,660 This allows us to have a consistent method 10 10 00:00:18,660 --> 00:00:20,580 as we look across different tools. 11 11 00:00:20,580 --> 00:00:22,380 So regardless of whether you're using Nessus 12 12 00:00:22,380 --> 00:00:24,450 or Qualys or OpenVAS, 13 13 00:00:24,450 --> 00:00:25,680 they're all going to be able to report 14 14 00:00:25,680 --> 00:00:26,940 on the same vulnerabilities 15 15 00:00:26,940 --> 00:00:29,400 and identify those using the same methods. 16 16 00:00:29,400 --> 00:00:30,720 Now when I talk about this, 17 17 00:00:30,720 --> 00:00:33,180 there are really six main things that we're going to use 18 18 00:00:33,180 --> 00:00:35,280 to commonly identify vulnerabilities 19 19 00:00:35,280 --> 00:00:37,410 on the different platforms that we're going to look at. 20 20 00:00:37,410 --> 00:00:39,420 These include things like the common vulnerabilities 21 21 00:00:39,420 --> 00:00:43,260 and exposures or CVEs, the National Vulnerability Database 22 22 00:00:43,260 --> 00:00:48,000 or NVD, the Common Weakness Enumeration or CWE. 23 23 00:00:48,000 --> 00:00:50,940 The Common Attack Pattern Enumeration and Classification 24 24 00:00:50,940 --> 00:00:55,140 or CAPEC, the Common Platform Enumeration, the CPE 25 25 00:00:55,140 --> 00:00:58,530 and the Common Configuration Enumeration or CCE. 26 26 00:00:58,530 --> 00:01:01,380 In this lesson, we're going to dive into each one of these. 27 27 00:01:01,380 --> 00:01:05,212 First CVEs or common vulnerabilities and exposures. 28 28 00:01:05,212 --> 00:01:06,990 This is a commonly used scheme 29 29 00:01:06,990 --> 00:01:08,880 for identifying vulnerabilities that was developed 30 30 00:01:08,880 --> 00:01:11,100 by MITRE and adopted by NIST. 31 31 00:01:11,100 --> 00:01:13,374 Now because this was one of the first ones 32 32 00:01:13,374 --> 00:01:14,340 that was really widely accepted, 33 33 00:01:14,340 --> 00:01:16,770 this goes back a long way in history. 34 34 00:01:16,770 --> 00:01:19,380 And so when you look up CVEs, you can find a long history 35 35 00:01:19,380 --> 00:01:22,050 of all the different CVEs that were out there. 36 36 00:01:22,050 --> 00:01:23,520 Now when we talk about a CVE, 37 37 00:01:23,520 --> 00:01:26,550 each vulnerability is going to have a unique identifier known 38 38 00:01:26,550 --> 00:01:29,280 as a CVE and the format looks like this. 39 39 00:01:29,280 --> 00:01:33,093 CVE, dash, the year, dash, the number. 40 40 00:01:33,093 --> 00:01:36,165 So for example if I wanted to pull up this CVE, 41 41 00:01:36,165 --> 00:01:38,790 I can go to the website and I can look at it. 42 42 00:01:38,790 --> 00:01:42,027 And this one is identified as CVE-2017-0144. 43 43 00:01:45,180 --> 00:01:48,330 This tells me this common vulnerability was identified 44 44 00:01:48,330 --> 00:01:52,830 first in 2017 and it was the 144 vulnerability identified 45 45 00:01:52,830 --> 00:01:54,450 for this manufacturer. 46 46 00:01:54,450 --> 00:01:55,980 Now if I look in the description of this, 47 47 00:01:55,980 --> 00:01:58,290 I can see that this was for Microsoft Windows 48 48 00:01:58,290 --> 00:02:00,870 and it associated with SMB vulnerabilities. 49 49 00:02:00,870 --> 00:02:02,760 If I actually dig into this and read more, 50 50 00:02:02,760 --> 00:02:05,340 you can see there's a description, there's references. 51 51 00:02:05,340 --> 00:02:06,390 If I scroll down the page, 52 52 00:02:06,390 --> 00:02:07,980 it would tell you what things can exploit it 53 53 00:02:07,980 --> 00:02:09,270 and what you can do to fix it. 54 54 00:02:09,270 --> 00:02:11,970 Now this CVE is actually a really well-known one. 55 55 00:02:11,970 --> 00:02:13,980 If you've been in cybersecurity for a while, 56 56 00:02:13,980 --> 00:02:15,150 you might have heard of it. 57 57 00:02:15,150 --> 00:02:17,220 It's actually known as EternalBlue. 58 58 00:02:17,220 --> 00:02:19,050 Well, technically EternalBlue is the tool 59 59 00:02:19,050 --> 00:02:20,850 we use to exploit this vulnerability. 60 60 00:02:20,850 --> 00:02:21,990 But this is the vulnerability 61 61 00:02:21,990 --> 00:02:24,000 that's being exploited by EternalBlue. 62 62 00:02:24,000 --> 00:02:26,010 Now, why is EternalBlue so important? 63 63 00:02:26,010 --> 00:02:28,470 Well, because it was used by WannaCry, 64 64 00:02:28,470 --> 00:02:31,350 the ransomware that took hold in 2017 65 65 00:02:31,350 --> 00:02:33,240 and spread all over the internet. 66 66 00:02:33,240 --> 00:02:36,150 The WannaCry ransomware and EternalBlue both exploited 67 67 00:02:36,150 --> 00:02:39,453 this same vulnerability, CVE-2017-0144 68 68 00:02:42,360 --> 00:02:43,800 and that's how these CVEs works. 69 69 00:02:43,800 --> 00:02:47,370 You can start figuring out what exploit goes with what CVE. 70 70 00:02:47,370 --> 00:02:49,020 And when you're detecting things, 71 71 00:02:49,020 --> 00:02:51,750 what mitigations you can find are being detected. 72 72 00:02:51,750 --> 00:02:53,880 And when you're trying to detect these vulnerabilities, 73 73 00:02:53,880 --> 00:02:55,920 which CVEs those are associated with because 74 74 00:02:55,920 --> 00:02:58,140 if you know the CVE, you can look it up. 75 75 00:02:58,140 --> 00:02:59,700 You can find out what patches exist 76 76 00:02:59,700 --> 00:03:00,990 and how you can mitigate it. 77 77 00:03:00,990 --> 00:03:03,300 Now the next one we're going to talk about is NVD, 78 78 00:03:03,300 --> 00:03:05,790 which is the National Vulnerability Database. 79 79 00:03:05,790 --> 00:03:08,310 This is a superset of the CVE database 80 80 00:03:08,310 --> 00:03:09,810 so it contains all that information 81 81 00:03:09,810 --> 00:03:12,240 from the CVE database that's maintained by NIST. 82 82 00:03:12,240 --> 00:03:14,610 And then it also adds additional information 83 83 00:03:14,610 --> 00:03:17,340 such as some analysis, some criticality metrics 84 84 00:03:17,340 --> 00:03:19,950 like CVSS scores, which we'll talk about later. 85 85 00:03:19,950 --> 00:03:21,840 And any appropriate fix information 86 86 00:03:21,840 --> 00:03:24,390 or instructions for remediating these issues. 87 87 00:03:24,390 --> 00:03:28,445 So NVD takes all that CVE information and adds more to it. 88 88 00:03:28,445 --> 00:03:31,800 Now the next one we're going to talk about is CAPEC, 89 89 00:03:31,800 --> 00:03:34,080 which is the Common Attack Pattern Enumeration 90 90 00:03:34,080 --> 00:03:35,550 and Classification. 91 91 00:03:35,550 --> 00:03:36,990 This is a knowledge base maintained 92 92 00:03:36,990 --> 00:03:39,812 by MITRE that classifies specific attack patterns focused 93 93 00:03:39,812 --> 00:03:43,080 on application security and exploit techniques. 94 94 00:03:43,080 --> 00:03:45,016 Now at first glance this might sound a lot 95 95 00:03:45,016 --> 00:03:47,220 like the MITRE ATT&CK framework that we've talked 96 96 00:03:47,220 --> 00:03:49,830 about previously but there is a big difference. 97 97 00:03:49,830 --> 00:03:51,750 When we're talking about the attack framework, 98 98 00:03:51,750 --> 00:03:54,330 that's a tool for understanding adversary behaviors 99 99 00:03:54,330 --> 00:03:56,340 within a network intrusion. 100 100 00:03:56,340 --> 00:03:57,360 But when we're talking about 101 101 00:03:57,360 --> 00:03:59,130 the Common Attack Pattern Enumeration 102 102 00:03:59,130 --> 00:04:01,680 and Classification tool, we're talking about 103 103 00:04:01,680 --> 00:04:03,450 the attack patterns focused on 104 104 00:04:03,450 --> 00:04:05,760 the application security itself. 105 105 00:04:05,760 --> 00:04:07,620 So we're looking more at the technical details, 106 106 00:04:07,620 --> 00:04:10,890 not the person like we are when we're dealing with attack. 107 107 00:04:10,890 --> 00:04:13,110 The next one we want to talk about is CPE, 108 108 00:04:13,110 --> 00:04:15,510 which is the Common Platform Enumeration. 109 109 00:04:15,510 --> 00:04:17,910 This is a scheme for identifying hardware devices, 110 110 00:04:17,910 --> 00:04:20,310 operating systems and applications. 111 111 00:04:20,310 --> 00:04:21,780 When you're dealing with CPE, 112 112 00:04:21,780 --> 00:04:24,510 it's going to be shown in the format that looks like this. 113 113 00:04:24,510 --> 00:04:28,980 CPE colon slash part, colon vendor, colon product 114 114 00:04:28,980 --> 00:04:32,850 colon version, colon update, colon edition, colon language. 115 115 00:04:32,850 --> 00:04:36,330 Ha, notice, this is all essentially a key pair 116 116 00:04:36,330 --> 00:04:38,760 that we can use to be able to identify the CPE 117 117 00:04:38,760 --> 00:04:41,190 with that particular piece of hardware. 118 118 00:04:41,190 --> 00:04:43,020 Now the one piece in here that is something 119 119 00:04:43,020 --> 00:04:44,340 that should be noted is 120 120 00:04:44,340 --> 00:04:46,230 that most of these are pretty self-explanatory, right? 121 121 00:04:46,230 --> 00:04:48,870 Like the part, the vendor, the product, the version, 122 122 00:04:48,870 --> 00:04:50,910 the update, the edition and the language. 123 123 00:04:50,910 --> 00:04:53,880 But there is this one part that is called part 124 124 00:04:53,880 --> 00:04:56,250 that you may wonder what is that really referring to? 125 125 00:04:56,250 --> 00:04:59,250 Well, that first thing part will actually have either an O 126 126 00:04:59,250 --> 00:05:02,010 if it's an operating system, A if it's an application 127 127 00:05:02,010 --> 00:05:03,960 or H if it's a piece of hardware. 128 128 00:05:03,960 --> 00:05:06,481 And this is the three main categories that we would support. 129 129 00:05:06,481 --> 00:05:09,270 So for example if I was looking at Windows, 130 130 00:05:09,270 --> 00:05:13,770 I might be looking at CPE, colon, O for operating system, 131 131 00:05:13,770 --> 00:05:18,090 colon, Microsoft for vendor, colon, Windows for product, 132 132 00:05:18,090 --> 00:05:21,390 colon 10 for version and so on as you go through. 133 133 00:05:21,390 --> 00:05:22,950 This will allow us to uniquely identify 134 134 00:05:22,950 --> 00:05:25,110 that particular Windows variant inside 135 135 00:05:25,110 --> 00:05:26,670 the Microsoft operating system, 136 136 00:05:26,670 --> 00:05:30,000 inside of that family as a unique CPE. 137 137 00:05:30,000 --> 00:05:32,220 The next one we're going to talk about is CCE 138 138 00:05:32,220 --> 00:05:33,750 and this is our final one. 139 139 00:05:33,750 --> 00:05:36,990 CCE is our Common Configuration Enumeration. 140 140 00:05:36,990 --> 00:05:37,823 This is a scheme 141 141 00:05:37,823 --> 00:05:39,960 for provisioning secure configuration checks 142 142 00:05:39,960 --> 00:05:41,940 across multiple sources. 143 143 00:05:41,940 --> 00:05:44,190 Now essentially CCE is a collection 144 144 00:05:44,190 --> 00:05:46,494 of configuration best practice statements. 145 145 00:05:46,494 --> 00:05:48,270 It allows us to have these 146 146 00:05:48,270 --> 00:05:51,090 and go through those with an automated tool. 147 147 00:05:51,090 --> 00:05:53,760 The CCE is going to provide us with unique identifiers 148 148 00:05:53,760 --> 00:05:55,950 for the different system configuration issues. 149 149 00:05:55,950 --> 00:05:58,650 This way we can can very quickly and rapidly 150 150 00:05:58,650 --> 00:06:01,920 and accurately get a correlation of the configuration data 151 151 00:06:01,920 --> 00:06:04,320 across multiple information sources and tools 152 152 00:06:04,320 --> 00:06:06,840 because we're all speaking the same language. 153 153 00:06:06,840 --> 00:06:08,670 Just like I mentioned in a previous lesson 154 154 00:06:08,670 --> 00:06:11,310 where a lot of our checklists used to be manual processes. 155 155 00:06:11,310 --> 00:06:12,720 An assessment administrator had to go look 156 156 00:06:12,720 --> 00:06:15,810 at different tools and check all this information manually. 157 157 00:06:15,810 --> 00:06:18,210 Well, this is another way to make things easier 158 158 00:06:18,210 --> 00:06:19,650 and allows us to automate. 159 159 00:06:19,650 --> 00:06:21,390 Because if we're all talking the same language 160 160 00:06:21,390 --> 00:06:22,860 and using the same identifiers, 161 161 00:06:22,860 --> 00:06:25,590 we can correlate all that data across all the systems 162 162 00:06:25,590 --> 00:06:27,893 to give us a better picture of what we're doing.