NICK DE CRISTOFARO: Hi, everyone.
My name is Nick De Cristofaro.
I'm a customer engineer network specialist,
and I'll be your presenter today.
So today we're going to talk about packet mirroring.
So what is packet mirroring?
Packet mirroring is a feature which
allows you to monitor VPC traffic flows in real time.
This monitoring ability gives security-conscious enterprises
the ability to observe and to react to traffic patterns which
may be malicious in nature.
Packet mirroring is often used in conjunction
with an organization's IDS, or Intrusion Detection System,
to provide threat detection and mitigation.
Packet mirroring captures all ingress and egress
traffic and packet data, such as payloads and headers.
And it exports all traffics, therefore
providing full network visibility.
The mirror traffic can be sent out of band
to security and monitoring appliances
from an extensive list of partners
for threat detection and also network performance
and application troubleshooting.
Packet mirroring can be enabled on a subnet level, network
tags, or specific instances.
Now here's an overview of the demo.
In this demo, we'll specifically deploy a Jenkins server,
apply a firewall rule to allow only trusted access
to the server.
We'll then act as a malicious user,
use the script console to run a reverse shell session back
to the untrusted device.
The untrusted device now has shell access to your Jenkins
servers as root and can check credentials, perform
malicious actions, et cetera.
We'll then verify that packet mirroring sent mirrored packets
to the IDS.
And Surakata, in this case, should
identify this rule violation and report it in the logs.
So let's see how this works.
I've already configured Surakarta, my Jenkins server,
my attacker VM, and the packet mirroring policy.
Note for simplicity of this demo,
the attacker VM is on GCP.
But in reality, it could be any machine out on the internet.
Now, first I'm going to log on to my Surakata VM
and look at the IDS logs with the following command.
So let's leave these logs open.
So here we can put a couple of enters
to make a line break between the previous logs
and the log for this demo.
So next I'm going to log on to the attacker VM machine
and run a simple netcat command.
Let's open a new tab here.
So here I have netcat running with the flags-LVP on port
4444.
So we'll keep this SSH window open.
And let's move on to our Jenkins browser.
So since I've prepped the IDS and the attackers
with the hacker's receiving Linux machine,
let's work on the Jenkins server now.
So here's my Jenkins machine.
So what I'm going to do is log on
and go to the script console of the Jenkins server.
So here's my script console.
So next we'll enter the reverse shell script
with my Linux machine's external IP.
I'm going to copy/paste this part of the code.
Once I've done that, then we will click the button here,
Run.
So we've now run the reverse shell script.
And we should have access to the Jenkins server
from the Linux machine.
So if I return to the Linux machine,
we see here that it has updated a connect statement here.
So if we return to the next machine,
notice that the Linux SSH window that we kept up
has updated to showcase a connection from your Jenkins
external IP address.
So if we want a better SHH experience,
we can run a bash script.
And now, as you can see, I'm actually
as root on the Jenkins server.
So I've invoked a bash shell.
And now I'm connected as root.
So we can run who am I?
And you can see here that I've gained root access
to the Jenkins server.
So now technically the attacker can extract credentials,
et cetera, do anything that they want as root
on the Jenkins server.
So if we go back to this tab here,
recall that I had a tail on the IDS
logs to check if there were any incidents.
So you can see here the IDS has detected
that there is a meta [INAUDIBLE] reverse SSH attempt.
So as you can see, we successfully
set up packet mirroring to an IDS
to catch malicious activity or a policy violation.
You can choose to do continuous packet mirroring
or enable and disable packet mirroring
based on predefined triggers.
For example, a DevOps or network team
may want to analyze traffic patterns
to understand why an application is experiencing
degradated performance or generating error messages.
In this demo, I've already configured the components
that you see in this diagram, namely the VPC, subnets,
global load balancer, web servers, collectors,
the packet mirroring policy in its disabled state,
and finally Cloud Logging, Cloud Function, Pub/Sub,
and the environments to trigger packet mirroring.
Now, if we look at this demo, the packet mirroring execution
flow is as follows in the diagram.
Step one, an invalid request is sent to the load balancer,
triggering a 500 error code from the web servers.
Step two, an event is generated by Cloud Logging monitoring,
logging the error message.
Step three, Cloud Pub/Sub is configured
as a sync for cloud monitoring and is
receiving the error message.
Step four, when an event is pushed into Cloud Pub/Sub,
Cloud Function is configured to trigger on that topic
to enable packet mirroring.
Finally, in step five, packet mirroring is enabled,
and traffic is mirrored to the collector
VMs for further investigation into the potential error
messages.
We will be utilizing TCP dump in this demo
to look at packets captured.
Now let's see this in action.
Now, here I've SSH-ed into my collector VM.
And I'm going to run TCP dump to capture mirror traffic.
The specific TCP dump syntax is stating
that I want to capture traffic to this VM,
but I do not want to capture traffic
from networks that are in this specific [? CIDR ?] range.
And this is because traffic from the [? CIDR ?] range
is actually destined for this specific VM.
So this VM is actually in that [? CIDR ?] block.
So I want to capture traffic that's
not destined for this VM, therefore
being the mirrored traffic that's coming to the collector.
So as you can see, I'm running TCP dump right now,
but I'm not receiving any traffic at this time.
And above here you can see the packet mirror policy
that I've created.
And you can see that currently the policy enforcement
is disabled.
So packet mirroring is not enabled.
I'm not receiving any traffic at the moment.
So I'm going to leave this session open,
and I'm going to open a new window here in Cloud Shell.
Next I'm going to trigger an HTTP 500 error
message to my HTTP load balancer endpoint.
So here I can simply do a curl to my HTTP load balancer
endpoint.
And as you can see here, it triggered a 500 internal server
error.
So let's return to the collector terminal window here.
And now we can see that traffic is being
received by the collector.
So the traffic that we're actually seeing here
is the health check probes that are being received
by the web server instances.
So now we can close the TCP dump session here
and issue a Control-C. And we can exit out
of the collector VM.
Now, if I navigate to the Cloud Functions section,
here's my Cloud Function that I defined earlier.
If I select the three buttons under Action
and click View Logs, we can see here from the logs
that packet mirroring was triggered based on the 500
error code and that was generated by the web server
instances.
So you can see here in the first statement here,
function execution started.
The 500 error was detected and an activating packet mirroring
for analysis.
And then we called the API to trigger a packet mirroring.
Note that while the solution provides an example of what is
possible using a simple HTTP error message code--
in this case, the HTTP 500 error code--
the solution can be customized to support
a variety of different environments and use cases.
Advance logic can be created for your own customized
application, looking at a variety of different metrics,
anomalies, and logging events.
Now, if I return to the packet mirroring section,
and we have a look at the packet mirroring policy,
you can see here that the policy enforcement is set to enabled.
Now
This concludes our demo.
Here are some useful resources for configuring packet
mirroring, as well as useful solutions for configuring demos
such as these.
Thank you.
[MUSIC PLAYING]