Transcript
this discussion on advanced detection of rogue devices, devices that are attempting to remain hidden on your network. We have some really interesting real-world intelligence for you on this topic, and I'm joined by my colleagues Daniel Dos Santos and Liran. Right there, there you go. And we're going to talk a little bit about what we encountered, what that meant for the victim of this, I guess, espionage attempt, and how we can counter that kind of threat. So Daniel, do you want to walk us, first of all, through what we encountered, what was actually happening? Yeah, sure. It's very interesting because when you say rogue devices, that's not entirely new, right? Like, people have been talking about and seeing rogue devices for a very long time, and people at this point might be thinking, oh, we're talking about rogue devices again. But actually, what we saw earlier this year was something very, very kind of unique and interesting in an evolution of some of the attacks that happened in the past, right? And actually, a couple of things happened in sort of a quick succession that led us to think a little bit more about rogue devices again. So the main instance was actually at a financial services institution, where what happened was that a corporate laptop was, first of all, stolen, removed from a bank branch. And then a rogue router with a 4G or 5G connection was inserted physically in that same bank physical location, right? And then... That's not in itself, like, super new, right? As you said, people plug even malicious things into existing infrastructure to achieve malicious ends. So there's something specific about what this router looked like, right? Yeah, exactly. So that's specifically a router in the configuration that the attackers did when physically placing it there. It was configured to not advertise its MAC address when connecting to the switch, right? So basically, you would not see any signal on the network, or actually, you would see some signal. We'll talk about that later on. But you would not see, without the right kind of visibility, the signals on the network saying that, you know, there is a new device popping up. It's requesting an IP address and so on and so on. That device was actually just used to create a tunnel back to that stolen laptop so that the users could request, the attackers, could request access into the network as if, you know, just physically placing a stolen corporate laptop directly on the switch. That's what it looked like from the switch's standpoint, right? So it was... So it's effectively in like a transparent mode, like in a transparent bridging mode, right? Exactly. Yeah. And then after that, we saw some other attacks somewhat similar to that, not always using a transparent mode, but somewhat similar, with also well-known pen testing tools that do some of those kinds of tricks on the network being used for audits and compliance checks and pen tests on financial services institutions as well. So it's something that, as I said, in quick succession, we saw a very real example, and then pen testers and others capturing that and using similar types of attempts in other organizations. So that sounds, on the face of it, pretty, I don't know, about complex, but certainly non-trivial to detect, Liran. So how do we go about seeing that kind of stuff? Yeah. So I just want to expand a little bit about what Daniel said earlier, is that, as we all know, hackers are always a step ahead of us, trying to be a step ahead of us. So the transparency nature of things was something that we need to take an action off. So with FOSCA visibility into the infrastructure and our integration with the infrastructure, the infrastructure, the switches, the routers, can provide us that information that, hey, we found a device that doesn't have a MAC address. So the hacker even took a step further and mimicked one of the switches' MAC address. So MAC address spoofing. Yeah. So what we are learning is that they are trying to find ways and hold in the visibility, in the blind spot of a network visibility. And it applies to even a fully network access control deployed with 802.1X and authentication. And it allows you to overcome that sort of traditional MAC defense effectively. You are literally, what you're doing, you are doing a shadow IT on your network infrastructure. What I mean by that, you take somebody else's authorization on the network, if it's the switch on the network, or if it's, in Daniel's example, was a stolen laptop, and use that authorization to bypass any control on the network. So if we're not seeing, you know, ARP requests, if we're not seeing DHCP requests, what are we seeing? Link active. That's it. We are seeing, we are seeing literally a message from the switch that I found the device on the network that doesn't have a MAC. And we are taking action based on that, alerting the false cut administrator or your SOC with, look, there is something here that is not acting as we are expecting to act. So what- And so that's a normalist behavior, effectively. Exactly. Exactly. Right. Okay. So thinking about it, it's not, there are parallels to this as well, right? I mean, Daniel, if we think about, I know there's been 5G modems components found in Chinese manufactured devices that were not in the bill of materials, not in the manifest for that device that were installed on cranes in ports, for example. And there are other examples as well, right? This is not an isolated incident. It's more part of an ongoing trend that has historically been more associated with APT threat actors or with state-driven threat actors, right? Yeah. Yeah. That's an interesting question because actually most of the, so the original case that I mentioned was definitely a cyber criminal case, right? They were trying to get access to the bank's network to probably do some operations that would not be authorized otherwise. And similar cyber criminal activity has been spotted and discussed in other parts of the world as well. But yes, this is not only a cyber criminal issue. This is an issue also used for espionage, also used for potential disruption, prepositioning into specific networks that will allow you later on to, you know, sabotage or disrupt that network, right? So obvious previous examples that people might have heard are the Raspberry Pi found on NASA's JPL's network in 2008, which was used for data exfiltration and for very likely espionage, right? There are not so many public details about that, but very likely it was used for espionage. And then there are all the cases that have been happening much more recently that you discussed Rick, of reported extra components. Let's put it this way. Bonus. Bonus components. Right. In things like cranes, like shipping cranes in ports, things like battery energy systems and solar inverters and so on in the power grid. So those things are, you know, very, very critical. And the fact that there are devices there that you might not have the right level of visibility on, that you might not know about their presence, that, you know, they may allow attackers to connect directly to those devices without even, you know, going through your regular wired infrastructure, right? That is definitely very problematic. So it's definitely not something that it's cyber criminal activity only. It's only for financial gain. It can be much, much more damaging than that in critical infrastructure. Yeah. In general, I think like as a historical trend, what we tend to see is that the more sophisticated attack methodologies start with state driven actors, right? State directed, state aligned, whatever it might be. And that tends to trickle down over time into more run of the mill, let's call it, financially motivated cyber crime or even hacktivism, I think, to a certain degree. Is that the kind of thing you expect to see? Do you expect to see this becoming more common over time? I do. I do expect that it will become more common. It's interesting that you mentioned hacktivists. We've been doing a lot of work on hacktivists recently, even together, right? I'm not sure that that would be the type of threat actor that would fit this profile right now. But definitely cyber criminals are already doing that and APGs have been doing that for a while as well. So it would be definitely interesting and we'll keep an eye on how this kind of attack evolves. It's also interesting, as I mentioned before, that this is not only something that we see, you know, real world attacks happening, but we do see audits and pen tests and kind of compliance checks where some organizations are not ready for this kind of attack. They think, oh, I have my full network, you know, secured, protected. I have all my, you know, EDR and whatnot, my SIM and so on. But guess what? There are simple attacks with ready-made tools out there that might bypass a lot of your controls and you might not be aware of them, right? So even if you're not, you think you might not be really targeted for something like that at this point, pay attention to your next, you know, pen test, audit check and so on. You might be surprised with some of the tools that people are using. I guess, yeah, talking about surprised, you know, if we still live in a world where a SQL injection attack is possible and widespread, I guess we shouldn't be surprised that we also live in a world where Mac spoofing can be so dangerous. What is the risk, Liran, to a business? Like from these kinds of attacks, what are the potential outcomes? Why is this a growing concern? So it's absolutely a business concern. First and foremost, and the easy part of the business impact, you would fail your internal and external audits. We are seeing red teams and adversarial tools using those techniques. So this is the easy part, to fail an audit. Right. The hard part is insider threat. In the financial, in the FSI world, 83% of FSIs have said, hey, I've been, I've seen at least one incident that involved insider threat. And on top of that, I think it's the overall supply chain attacks that we are seeing to make sure that every device that you have, you know what it is, it's accounted for. And even if you authenticate all of your devices with AW1X and RADIUS, but you still have at least what we refer to MAP, MAP authentication bypass, this is the treasury for this kind of guy, the bad actors. They would find on market authentication bypass, printers, phones, IP cameras, you name it, but surrounding you, audio and video, all of those things that do not comply with authentication and AW1X, this is the risk for you. And all of your unmanaged devices, right? I mean, it's the whole unmanaged devices thing. And it's interesting, you know, you mentioned it specifically in a financial services perspective, but not only. You mentioned insider threat, because we know that in recent evolution, if we look at threat actors like Scattered Spider, for example, some of the more higher profile ransomware as a service operators are actively recruiting and offering percentages or one-off payments to people to surrender their credentials or to provide access to the network of their employer. So there's obviously a significant move in that direction from established threat actors for recruitment of insiders now, specific advertising, right? Yeah. In the specific example that Daniel shared about this transparent bridge in financial institutions, literally they bribe the employer, the employee, they bribe them, hey, lose your laptop and take this device and put it on the network. This is absolutely- And that's all they need, right? That's the access they need. So, you know, we've spoken about what it looks like from a technical perspective in terms of effectively what's not being seen on the network rather than what is being seen. Of course, Forescout, we can do something about that, right? We can help potential victims or victims of this kind of attack to gain the visibility that they need. How does that work? What are we doing? Exactly. So what we are doing, as I said earlier, we are integrating with your infrastructure. The infrastructure has messages to provide us, hey, I've seen this anomaly, Rick, and you suggested, hey, I see something on the port that doesn't have a map. This would create an anomaly detection system at Forescout. And then from there, we can integrate with your security operations center, with your incident response team. It has to be a part of your entire process, how to deal with that. And from the Forescout platform, we have the ability to shut this port off or to take other further actions to maybe take the snippet of the data to see what is going on over there that we don't see. Okay. And we can integrate that also in part of a zero trust architecture as well. It's not simply we can interface with a switch and we can shut that port down, but we can actually integrate that as part of an overarching zero trust security architecture. Absolutely. Absolutely. So it's more than just, you know, everybody talks about ZTNA zero trust network access, but what about the universal zero network access, which are all of those unmanaged devices? How do you manage the life cycle? How do you manage the risk of the unmanaged? How do you manage the risk associated with your MAC authentication bypass? This is all a part of your zero trust architecture paradigm or program. Fantastic. You know, the longer I work in this industry, the more I think to myself, there's nothing new, just forgotten. And it seems to be that every time we take our eye off of one thing to focus on the new emerging technique, threat, whatever it might be, then something is brought back from the dead and resurrected as a threat vector. And this seems to be one of those things, right? Absolutely. Absolutely. For sure. And I think that's probably an interesting message to leave people with, right? It's like you can invest in the new shiny detection tool for something very, you know, process injection, whatever malware out there. But then if you're not detecting this kind of thing inserted physically in your network, you have a big blind spot out there. So I think that's a very interesting message, Rick. It's like, don't just pay attention to what's shiny and new and, you know, AI enabled and all that. Pay attention to the basics and the old stuff as well. Yeah, I do agree. And I think that AI would just make it easier for those bad actors. Yeah, when we talk about, you know, full automation orchestration of the attack chain, not just the defense chain. We're entering into new territory right now at this very moment. It's been fascinating. Thanks very much, both of you, for taking the time to chat with me about this. If you want to find out more about the research work that we do at Vidaria Labs in Forescout, then obviously head over to forescout.com slash research. You'll find plenty of white papers, blogs and constantly updated material there. If you're interested in finding out more about how we face up to these kinds of threats and the solutions that we offer with the Forescout 4D platform, then, of course, head on to forescout.com. You'll find plenty of information about the solutions, the platform, and also a bunch of self-guided demos where you can dig deeper into these kinds of protection techniques. Once again, thank you very much for joining us. Thank you, Daniel. Thank you, Liran. And we'll speak to you again soon.
