#intrusiondetection

Andrew 🌻 Brandt 🐇For those who don't know (which is most of you), this project has been the intense focus of my work, taking up a huge amount of my time, energy, and investigative effort for the past 14 months - while still helping others at Sophos publish their research; running an election campaign where I was a candidate for school board; speaking at Blue Hat, Defcon, Saintcon, Virus Bulletin and other conferences; guest lecturing to classes at CU Boulder; volunteering my time canvassing for political candidates; serving as a docent at the Media Archaeology Lab; and starting up the Elect More Hackers organization.Whew. It's actually kind of daunting just to read that. I also sometimes sleep and eat.<a href="https://infosec.exchange/@SophosXOps" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@SophosXOps</a> has been, at its core, an institution that values radical transparency, and this story (and the earlier research investigations into the Operation Pacific Rim threat actors and incidents) demonstrates Sophos' commitment to truth and journalistic integrity, following a story wherever it leads. I hope our publication today starts a larger conversation and collaboration within the cybersecurity industry - inside and outside the Cyber Threat Alliance, which Sophos actively supports and where I am proud to represent my employer - to work together to thwart the ambitions of nation-state threat actors such as the perpetrators of Operation Pacific Rim, in order to protect the privacy and safety of everyone, everywhere.<a href="https://infosec.exchange/tags/PacificRim" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PacificRim</a> <a href="https://infosec.exchange/tags/OperationPacificRim" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OperationPacificRim</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/china" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#china</a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hacking</a> <a href="https://infosec.exchange/tags/hacks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hacks</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/firewalls" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#firewalls</a> <a href="https://infosec.exchange/tags/intrusiondetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#intrusiondetection</a> <a href="https://www.sophos.com/en-us/content/pacific-rim" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.sophos.com/en-us/content/pacific-rim</a>

Tinker ☀️There is something so satisfying in kicking off an entire RFC1918 scan.Doing a single port at a brisk but safe (for my environment) pace.~/# nmap -Pn -n -p <single port number> -T4 --open 10.0.0.0/8~/# nmap -Pn -n -p <single port number> -T4 --open 172.16.0.0/12~/# nmap -Pn -n -p <single port number> -T4 --open 192.168.0.0/16(command broken out for dramatic effect - also note that I break out each of those CIDRs into /24's so that if anything breaks, I can pick up easier where the last known good ended. It's scripted and I prefer it this way.)I am not doing a ping sweep or a DNS resolution. I'm assuming all hosts are up. And I'm looking for every host with a single port open. So even if they dont respond to pings (or something is preventing pings), I should get an answer back.Note, I could certainly do faster (T5 or masscan, gawd) - but this is about as fast as I'm going to do in my environment and still be safe.Also, only looking for open ports right now - no fingerprinting yet.A cool thing about this approach is many intrusion detection still will only look for multiple ports on a single host to trigger an alert. Some still ignore many hosts / single port scans (to their detriment). We've long sense purple teamed this, so I sent a notification to SOC letting them know my actions and asking them nicely (I bribed them last week) to not stop me, lol.Should take a couple weeks to a month at this pace and in my environment to hit every single one of the just shy of 18,000,000 hosts 😂 <a href="https://infosec.exchange/tags/pentesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pentesting</a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hacking</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/penetrationtesting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#penetrationtesting</a> <a href="https://infosec.exchange/tags/blueteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#blueteam</a> <a href="https://infosec.exchange/tags/redteam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#redteam</a> <a href="https://infosec.exchange/tags/intrusionDetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#intrusionDetection</a>

Recent searches

Search options

Administered by:

Server stats:

#intrusiondetection