Between Two Nerds: The eye of Sauron

0:03Tom Uren: Hello, everyone. This is Tom Uren. I'm here with The Grugq. G'day, mate. How are you? G'day, Tom. I'm fine. And yourself? I'm very well. This week's edition is brought to you by Socket, the open source supply chain security company that makes sure that packages are not malicious. Find them at socket.dev. So you sent me a paper by someone we've spoken about a paper of his before, Vladimir Styran, who's at the Ukrainian special SSSCIP, basically their cybersecurity authority. So last time we spoke about his other paper, which was Rethinking Exploitation in Cyberwar, who is looking at how much are exploits actually used.

0:49And the number that he came out with looking at his data set was or looking at looking at the Ukrainian CERT data set was something like 20 to 25 percent. And that matches sort of like the DBIR report and a few other ones as well. So it seems that the number of exploits used is a constant regardless of whether it's criminals or states, roughly speaking. So that paper was very interesting. But he has this other paper, which I like not to play favorites, but I do like this one more because I think it's devious.

1:31Tom Uren: Yeah, so it is called the Offense Death Cycle, which is a catchy title, Proactive Environmental Control as a Method of Persistent Cyber Defense. So when you first told me about it, well, let's explain what it is. So the idea is that if you're in control of a network, you're defending a network, you've got ways to try and stop baddies getting in in the first place. But once they're in, you want some mechanism or way of getting them to do stuff, getting them to change their behavior that they might be detected. And he basically proposes network changes or the threat of network changes to try and force intruders to act.

2:20Tom Uren: When they act or change their behavior, that's an opportunity to get detected. That's the brief takeaway, very brief summary. That's the very, very high level. yep and just to be clear this is for after they've established themselves right so like after they've broken in and it's sort of it's become routine for them like they go in every wednesday to do their collection and then they go home and you know do other things and they come back the next wednesday whatever right it's because you haven't caught them yet you're not going to catch them now like they've gotten to the point where they're not detected and they're still operating Yeah, yeah, yeah.

2:55Tom Uren: So what I like about the paper, and maybe this is appealing to the inner academic in me, is that he starts from the theoretical perspective and he talks about cyber persistence theory and maintaining initiative. and the idea is that once an intruder has gotten hold in the network, basically they've kind of got the initiative. The standard paradigm is that the defender's kind of sitting back just waiting for something to happen. It's a very reactive posture and placing it within that theory, the idea is that you basically start doing things, regain the initiative. Right. So I like that as a, like as I've said before, I kind of think that persistence theory is right for reasons that are unclear.

3:50Tom Uren: And I think this is a really clever way to integrate it into that theory and kind of give it a theoretical justification that kind of intuitively makes sense. Right. So it's a sort of thing you could come up with from vibes. But he has grounded it in offensive cyber theory that we both agree is correct in theory. Yeah, so I guess now one immediate pushback to me is that for a while there was a whole lot of marketing efforts, products based around, air quotes, deception. Right. And the only product I'm really aware of that's hung around for any length of time is canary tokens, Thinxt tokens of all different sorts, right?

4:45Tom Uren: And you wouldn't necessarily call them like they kind of are deceptive. So the idea is that you have basically a honeypot, except it warns you, hence the name, canary. and they're so attractive that attackers can't help but try and touch them somehow because they basically have what they're after but all the other deception products that i'm aware of they've kind of disappeared right so there's been a lot of them have come out and they've tended to do things like in a way it might appear similar to this like there's been ones which are like we will change your network dynamically, which is obviously an insane thing to do to a functioning network.

5:29Like, those things are barely working as it is. Yep. And so to come in and just, like, randomly alter things is, like, that's a non-starter. Like, that's not going to really, that's not going to work in so many places. Also, it's unclear to me what the theory of victory is in that. Right. Like, because, you know, with the approach that Thinkst takes, it's based on Harun Mir's axiom, I guess, is that hackers don't look for vulnerable systems. They look for valuable systems. Right. Right. So he's going after something innate to attackers, which is they need valuable stuff. Like, that's why they're doing it.

6:12So if you create valuable things, that's what attracts them. That's when it tricked them up. whereas a lot of the honeypot stuff for a long time was like, why don't we put up a Linux box that is misconfigured and easy to hack? And you're not getting the sort of hackers that you want from that because the hackers are not looking for random vulnerable boxes or the ones that are interesting anyway. They're looking for specific things. And that's what he does. is he's found this trick of exploiting the nature of the hacker, like the nature of the role that they're playing is you have to collect things of value.

6:52Where Vlad has done something similar is he's also found an intrinsic property of a hacker is that they need to stay undetected despite changes to their environment.

7:07Tom Uren: I mean, I get the feeling that he's talking about a particular type of hacker, right? A state-backed intelligence collection-type hacker, not a smash-and-grab extortionist or a ransomware who's going to encrypt your network. But if they stayed on for six months, that ransomware gang would have really been tripped up. That's right. So that's, I suppose, one caveat. it and that's very true is is like this death cycle is absolutely focused on people who need long dwell time to do their job right like they they need to persist in your network for you know years if possible for them to do their job for them to do their job they just need to be present and that's the vulnerability that is exploiting no way like that the fundamental right i mean it's It's more than just be the present, but that's a precondition of anything else, right?

8:08Right. Yeah.

8:10Tom Uren: So one question, since we mentioned Thingston canaries, why not just use canaries? I guess the premise of his paper is that they haven't set off canaries in the first place. Right. But that's not to say that if you had the same network with canaries sprinkled in, I mean, I guess one answer might be air gap networks or networks that are highly isolated. But I don't think canaries necessarily rely on that, do they? So my sense is that you probably could. And for some percentage of hackers, it would work. So if I'm a state hacker and I just sort of generally have the direction of like, find out everything I can about the Rutanian government in exile, right?

8:58And I'm in some of their networks and suddenly I see a new web server pop up. I'm going to have a look at it. There's a new email server that comes up. I'm going to have to try and get access because my remit is very, very broad. It's like, you know, just monitor everything you can. And so if a canary gets added in that appears to be a new system that has something that might be interesting, that forces me to act just because it's such a broad remit. On the other hand, if I've got a very, very narrow task, right, if I'm supposed to monitor, like, I don't know, the defense department's procurement pipeline focusing on whatever, I don't care if new things get added to the network in general.

9:46because I'm laser focused on this one thing already.

9:50Tom Uren: I guess so the more precise the tasking is or the more, I don't know, professional, but the sort of pointier the target in a way, the more likely it is that they'll be very, very cautious about touching anything, I guess. Right. So if you're after the prime minister's email, you would do a lot of work to figure out exactly what is the prime minister's email server. And if there's a canary one set up to look the same, you're not going to touch it straight away. You're going to go, is that really the server that we're after? Could it be something else? And so I guess this is an approach in a way for the most advanced and cautious groups.

10:37Yeah, I was going to say like... I don't think he explicitly says that,

10:40Tom Uren: But to me, that seems kind of right. I think it's an implicit assumption in here. But so I think if you look at sort of like the way that a spy organization manages its assets, like the agents that it recruits, they will make them do illegal things. You know, like go into your office, take classified documents and bring them out, take photographs and then give me the photographs. Right. Like that is an illegal, dangerous thing. But if you say, hey, good news, I'm friends with the guy next door. He'll let me go into his office. I can take his classified documents too. They will freak out and say, stay there.

11:20Like, do not do that. Stay away. Do not get involved. Right. Or if you say, like, I know another guy who's, like, selling classified documents. I could talk to him and they'll say, like, do not get involved in something that might compromise what I want you to do. Like, don't do anything that threatens the real task I have. Like, stay away. And I think that that's sort of, that's the mindset to consider, right? Like, you've got someone who, they have a specific task. It doesn't matter if you add something shiny. They're going to look at it and be like, that's a distraction from what I'm supposed to be doing.

11:55Like, that's a risk I do not need. But that's not true for everyone. In fact, I think that's true for a small number of hackers. So, in Ukraine, it's probably more true than it is in other countries.

12:08Tom Uren: Yeah, so that was the other thing I thought was interesting is that he puts a theoretical framing around it that I thought was quite nice and very clever to integrate it that way, to give it that kind of justification. And the other thing I thought is really interesting is just who he is, where he's operating, the kind of experience he is being in computer defense in Ukraine, which has obviously been under vast attack for decades. And so that someone in that position is even suggesting this, it makes me think this is something I should take seriously. I'm going to go out on a limb and say he's not spitballing with a couple of guys in the office going like, how do we get published?

12:53What's just something we can throw together to get a paper out there, right?

12:58Tom Uren: Yeah, so I think if it came from a US venture capital startup, I would go, whatever. ever. Yeah. If this was like a, whatever, like a Y Combinator, you know, class of whatever, and they were like, we've got this great idea, you're going to introduce network changes to like detect hackers, I would go, that's the dumbest thing I've ever heard. And just ignore them. But with someone, with like with his credentials and his pedigree coming out saying like, this is a thing you could do. but he doesn't just say this is the thing you could do he's like here are the theoretical underpinnings of why this works and then here are the like um the the frictions and asymmetries that exist in the cyber domain right that you are exploiting and that that they are inherent to cyber it talks about a lot of things we've mentioned either in passing or directly about the asymmetries between attackers and defenders.

14:01Tom Uren: Right. And so this section talks about those asymmetries. So, you know, attackers hold the starting initiative. They force defenders to be reactive. Their focus is narrow and deliberate, which I guess reflects what we were talking about with canaries. And in contrast, the defenders is broad and divided. This is interesting. Generally, attackers possess deeper technical knowledge of targeted systems which i'm not sure that the vast majority of people would think is true but is true when you're an attacker or when you're a good attacker right so for example the world's best experts on um like windows domain stuff are obviously Chinese state employees in a particular and on the other hand defenders have decisive asymmetries too they possess and here's a pretty significant caveat total potential awareness of their networks and full control over their posture and so able to reconsider segment patch replace or temporarily shut down systems or networks at will.

15:15Tom Uren: And so we've spoken about this, I think a long time ago, and the way I think maybe you framed it was that the defender is the terrain. They've got total control of the landscape. They can modify it how they like. I think it is nice when you talk about living off the land, that it is in fact, yes, living off the land, but it is someone else's land and so they can um they can change anything they're they're it's like inception they're in control of the dream that you're you're living within right and so like this is a real asymmetry of power but i think there's a little bit of a in theory here yes potential so he talks about the defender's power to change the environment forces attackers to continually adapt and often invalidates their effort.

16:11Tom Uren: However, exercising this power carries real costs. It disrupts users, consumes IT staff time and may conflict with operational requirements. So I think this is also nice in that it says the reason why you can win is because you hold this power. It's a constrained power. It's not like a magic ring without consequences. There's definitely consequences. This just reminds me of, there's a joke on Twitter where basically a CISO, it's one of these like little, you know, CISO and then all these other things reply. And the CISO says, how many Windows server, like how many Windows devices do we have? And Ops replies, you know, 3 ,714.

16:54And then like IT helps says, you know, 5 ,629. You know, each of them just gives a completely different answer and like so yeah in theory you control all of those devices however many they happen to be right yes and you can change you can arbitrarily change them in theory but i mean we're like one of the things to remember i think is that if you've ever worked at an organization you will know that there are these legacy systems that you simply cannot touch so like yeah in theory it could replace that you know that ancient windows 2000 server and put in something better but the entire like accounting stack runs on a single access database stored on there and we're not allowed to touch it right so when you show up okay i figured out how we do this we're just going to change the network and it's like you are not going to change anything my friend you're going to stay the hell away yeah so i briefly said at the beginning that the idea

17:56Tom Uren: is that the defender uses this power, takes advantage of it by making changes that force the intruder to react. And just very, very briefly, so just to show how this works against sort of real attackers, if you remember one of our previous episodes where we discussed the Chinese CTI report about the NSA hacking, I think it was like the atomic clock at a university. There was some timekeeping center or system or something. Yeah. I think we were talking generally about China publishing more. And so the focus wasn't the timekeeping system per se of the episode, but yeah. But one of the things that we highlighted there, which I thought was very interesting, and it is an example or demonstration of how this works in practice, is they stated that every time files changed on a system, NSA would go in and figure figure out why right like why did this happen was it that this new software installed was it that someone has adjusted how they're using the box and we need to like take account of that so they were very very keenly aware of changes that were happening in their environment and investigated everything to see what operational impact it would have on them so that they could adapt yep yep so situational awareness is a job and i so vlad is suggesting that you take advantage of that and you, I guess, impose costs, for lack of a better term.

19:31Tom Uren: You add frictions. To get them to do things and with any luck, some of those things will raise the chance that they'll get pinged and discovered and therefore evicted, right? Right. So there's a Murphy's Law of War which covers this, which is anything you do can get you killed, including doing nothing. And I think that that sort of, that covers the sort of environment he's trying to create that he suggests that, you know, because, you know, we were talking earlier, and I think this is a good point, actually, is that if you are an attacker, and you see that there's a scheduled system upgrade coming on Friday, you have to treat that as a true thing that's going to happen.

20:18and you have to adapt accordingly. Like you have to be prepared to maybe re-intrude on Saturday. You have to make sure that like the things that you have don't get wiped out or that they can survive and upgrade and all of that. And so as a defender, you can just say, this is going to happen on Friday. You don't have to do it, right?

20:42Tom Uren: Right, yes. And so the thing is, like the attacker always has to believe you because if they don't then the one time you're not lying they will get caught out so it seems to me that you would have some series of changes you could make that you really want to make so you make them you would have some series of changes that with a good understanding of your known network and possible ways that an intruder might be hiding would force them to do something you would think. Maybe you don't actually need to make those changes for various reasons. And I guess going back to the starting assumption, it is that you have an intruder who is in your network and has avoided your controls beforehand.

21:29Tom Uren: Right. So whatever you're doing right now is insufficient. Yes, exactly. And one pushback might be you would be better off investing in those preventative controls rather than in doing work after. I prefer not to get hacked in the first place. Exactly. Yeah. And I suppose one comeback is, well, everyone prefers not to get hacked in the first place. And yet you have many places with persistent intruders. Right. So I still think that leaves from a resource allocation point of view. Like how, if I'm... if you've got so much budget, how much budget do you spend getting ready for this that you can detect any response?

22:16Because what you're trying to do is seize the initiative and make the attacker react. But that's only useful if you're watching when they react. So you still have to – you can't send an email saying, hey, Saturday we're deploying a new EDR. And then you take the weekend off and come back and be like, well, they probably had to react to that, suckers.

22:38Tom Uren: I mean, I think it is maybe this is something that works in government, right? Because there is a long track record of governments prioritizing security to some degree, and also a long track record of them getting hacked and having intruders in there for months and years, right? So they're an environment where you've got historical data that this is a constant problem. Right. Well, it's sort of like the State Department never stops being a target of interest. That's right, yeah. And we learn every few years that, oh, yes, they were hacked for some series of months. Whereas if you're a, I guess you're a corporate that is maybe long-term intelligence adjacent, like you kind of don't feel like you're a real target.

23:28Tom Uren: You don't have that same history. It's like, I don't think you can go to the board and say, look, I've read cyber persistence theory. There's this nice paper. I need more money to do this. Right, right. Dear board, I assume that we're hacked. It's not because I haven't been doing my job, but what I would like to do is disrupt everyone else in the business because there's a possibility that the job that I failed to do could now be accomplished by disrupting everything else. Yeah. I think it's a tough sell in spaces that don't have that mindset. Yeah. So I think it makes sense if you're the Ukrainian cybersecurity authority and probably for many Five Eyes cybersecurity authorities.

24:12Right. Well, I think that maybe in Ukraine in general, it makes more sense because they understand that the situation they're in means that this thing is going on. Right. They're more aware of it and they're probably more exposed to it in general. Whereas I think if you went to a French company and tried to sell them on this, or a random company sort of anywhere else in the world, basically. You need a mature organization that is aware of the reality of the threats they face.

24:51Tom Uren: Right, yeah. And that tends to be government organizations that just have the historical data and awareness of this, where, for example, cyber is only a new variant of this sort of threat. Like having agents in places is a thing that they've always been aware of. So if you just say, oh, this is like doing a mole hunt would have been, but it's for a computer. You know, like it's conceptually, conceptually, it makes sense with historical attacks. Yeah. One place, and this just occurred to me because I used to work in a think tank, is think tanks. Because they're, I guess, government adjacent. Particularly in the US, there's a long history of people moving in and out of think tanks back into the government.

25:35Tom Uren: And so there can be high priority targets. They often talk to people and get a good sense of what's going on. So that seems like a place where, and they actually have that same history of often being hacked. So that seems like a place where they might have the motivations, but not necessarily the resources, I guess. It seems like a really intriguing idea. And I presume that they, Vlad, has seen it either in practice or had, I guess, intimations. Maybe he's had examples where there's been a network change and that has resulted in an intruder being detected, even if it wasn't part of a regular program.

26:22Tom Uren: I'm presuming that that might happen because it must happen sometimes, right? This seems like an idea that it makes intuitive sense. He doesn't have any stats or even anecdotes in the report, though, does he? No, unfortunately not. But it's the sort of thing that I know I've heard about, but I can't think of specific examples. So Vlad in his paper actually says what next steps in its research and empirical validation. So I actually think that there's, in a way, there could be anecdotal verification. So I think there's probably a lot of stories of people who've said, yes we detected so and so because we were making a network change i think there must be a lot of those stories and so i guess if if there's people listening to have those stories sorry sorry reach out to vlad let him know yeah we will happily forward them on to him so you know send us all your send us all your funny stories yeah yeah so i mean i think that what's missing is really the how effective is it when you're in that situation when you're one of those organizations how much effort should i be devoting to this idea because it seems like an intuitively appealing idea right all you need to do is segment your network every other week

27:53yeah i also can think of half forgotten stories

27:55Tom Uren: systems yeah but those costs are real like i think that yeah you're speaking about it in a joking way but the he's absolutely right when he says that they're real costs and so like you can't do that that's just not like it's a great theory but it's just never gonna you can't do it and i think that that's sort of exactly the point is that if you cannot introduce changes you can at least piggyback on existing changes that are coming through and put the detection infrastructure in place to take advantage of it. Right. So that seems like a smaller ask. That's why I think the real win is over here, is that even if you cannot take advantage of that, you know, owning the terrain and being able to adapt and change it as you will, you will still have to do changes.

28:47Like it's just, that is a thing that will happen. So if you're aware that these changes could force a reaction from an attacker, you can at least take advantage of that in some way. You can be prepared to exploit that and maybe catch them. So I think even if you cannot implement it directly, there's absolutely ways that you can take this and use it in your own network. You don't need to inject changes. you can just exploit the changes that you're going to do naturally and just look a bit harder

29:23Tom Uren: at alerts or or whatever that that happens anomalies at that time right just on heightened awareness for example a little bit before and a little bit after sort of to just cover if they do sort of like if they preempt and make adjustments beforehand you want to catch that and if they do things afterwards you want to catch that so i think this is useful even if you do not have the power to you know force arbitrary changes whenever you feel like them it's like it's so i guess in a way that's turning it around from uh being the terrain to being the eye of soron so like it's it's not the controlling the terrain but it's being able to observe it at any time and focus in on a particular area.

30:15Tom Uren: Right. And I guess it's just knowing that you should be focusing in at a particular time and place that is the trickier, the low, I guess the best bang for buck or the best ROI given the concept. Right. I think that's the free win out of all of this because you should be monitoring anyway. You can just, I don't know, double the staff for a day before and after sort of thing. Like it's, you know, it's a free win version of this that I think anyone can implement. I guess what I like about this deception is that on the one hand, you have things that we know work that you sort of have to put effort into implementing, however minimal that effort is.

30:56And so like things canary, like we know that it works, but you still have to, you know, get them or deploy the canaries yourself or any of these other things. It might be an ask too far. It might not be possible in an organization. But this sort of deception, it's not actually a deception in a way. He's not adding... This deception doesn't require you to do anything. You could just take advantage of it innately.

31:30Tom Uren: I mean, I guess there's... Canaries are meant to be low cost to deploy. And then I guess this is low cost in the sense that if you don't impose extra changes, it's no cost at all because you have to do those changes anyway. It's rolled into your maintenance. So there you go. Like the best defenses in life are free.

31:56Thanks, Kroc. Thanks a lot, Tom.

32:05...