Presentation at Networkshop46. Phishing simulation exercises, by Michael Jenkins, Brunel University. Rogue wifi - by Danny Moules, professional security services: security assessment specialist, Jisc Implementing cyber essentials - Ged Nicholson, Hartlepool College of FE

1. Security human
Chair: John Chapman,
Head of security
operations centre, Jisc

2. Phishing simulation
exercises
Michael Jenkins,
Brunel University

3. EMAIL IS THE No 1 THREAT VECTOR
225B e mails per day
90% THREATS START BY E MAIL
99% OF HACKERS RELY ON USERS TO RUN
MALICIOUS CODE
IMPACTS:
MALWARE INFECTION / COMPROMISED ACCOUNTS / LOSS
OF DATA
Threats
using social
engineering

4. Human Click Enabled v Technical Threats

5. Human Click Rates

6. Levels of authenticity

7. Executive Assistants
Head of Legal Affairs
HR Director
COO
CFO
Finance Staff
IT Staff
Threats by Individuals

8. Spoofing E mail
addresses
The tools necessary to spoof email addresses are surprisingly easy to get. All you need is a working
SMTP server (aka, a server that can send email), and the right mailing software.

9. Which tools are used to train users?

10. Who measures an organisations susceptibility?
2015 2016 2017
63% 66% 75%
Average click rates:
Healthcare 15%
Public Sector 14%
HEI’s ?
All 11%

11. People are targets
must let them know they are targets
must let them know criminal TTP’s
people make defence work

12. Video of the threat……..
Tactics, Techniques, and Procedures…..(TTP’s)
Youtube Video:
An Anatomy of an Attack
WE ARE A TARGET

13. Cyber Attacks – The Adversary
Not Just Security – It’s Defence

14. TransNational
Crime

15. The Kill
Chain

18. Staff Phish

19. Student
Phish

21. Phish Last
Week Staff
Students
9%
10%

22. Any
questions?

24. Rogue WiFi
Danny Moules,
Professional security services:
security assessment
specialist, Jisc

25. >WEP -> WPA (Personal+Enterprise) -> WPA2 -> WPA3
>Public WiFi -> Passworded WiFi (Open Wireless
Movement)
>WPS (WiFi “Protected” Setup)
>Ninety quadrillion* accredited Enterprise protocols:
>EAP-TLS
>EAP-TTLS/MSCHAPv2
>PEAPv0/EAP-MSCHAPv2
>PEAPv1/EAP-GTC
>PEAPv2/EAP-GCM
The state of the art

26. > Well-established attack tools
> airbase-ng (2004+)
> WiFi Pineapple® (2008+)
> Fluxion, etc, etc
> Mistaken identity
> Streamlined WiFi workflows hide underlying
network ‘complexity’ from user – Unable to
detect or respond
Wireless Access Point Spoofing (Rogue WiFi)

27. > Basic case: WPA2 PSK cracking or stolen via other channels
(e.g. guest client compromise)
> Mitigated by WPA2 Enterprise – but only if server certificate
verification is enforced. Hard & rare.
> WPA2 Enterprise only permits detection of direct spoofs by a
technical user – doesn’t prevent homograph attacks
> User already connected to the real network? Can’t break the key?
Certificate verification set up? Denial of Service.
> De-authentication
> Jamming
Wireless Access Point Spoofing

28. > Active Directory clients spew credentials over HTTP, SMB,
LDAP etc to anyone who asks nicely enough
> Spoofed relays can replay credentWials
> Spoofed services can crack passwords of most AD
networks (upgrade!)
> Phishing. Capture portals especially vulnerable – insecure
by design
> Network pass-through. Attacker can be connected to spoofed
network, providing realistic experience but introducing insecurities
at leisure
What are the risks?

29. > Easy for attacker. Tools are easy to use, documented,
and can be performed with nothing but a laptop or cheap
stand-alone hardware
> Problems of phishing compounded by trust in network,
Capture Portals, and promiscuous use of MITM attacks
as industry-standard practice
> Laptops are crammed full of credentials and can be
induced to give them up in myriad different ways, outside
of the protections of their normal business network
What are
the risks?
Attack Properties

30. > Not vulnerable to de-auth (in theory) – Hurrah!
> Jamming unaddressed
> Dragonfly protocol – secure key negotiation
> Enables public wifi without password
> No/limited security proof?
> Solves unencrypted data problem but doesn’t appear to add a
new authentication element. Easier to spoof than PSK? Watch
this space™
> Enables NFC-based setup – security properties unknown.
WPS all over again?
The Next Generation - WPA3

31. > Detection is very hard to achieve – de-auth fix is helpful but not
silver bullet
> Incident response is very hard – CERT/SIRT not much help here
> Credentials can be stolen or abused even outside your own
network – tighten your Group Policies!
> APTs targeting research can incorporate WiFi phishing in to all
sorts of complex social engineering scenarios with less fear than
other, better monitored, approaches
Residual Risks

32. > Not enough risk for ya?
> Swap WiFi hotspots for phone base stations and n^2
your threat model!
> Heard of Stingray? It’s not just for law enforcers!
> Not as mature as WiFi spoofing but maturing very rapidly
and nearing off-the-shelf use
> Current options for defenders?
1. Be paranoid & ahead of the curve
2. Adopt religion and pray
Not just
WiFi
Different, but the same

33. Except where otherwise noted, this work is licensed under CC-BY-NC-ND.
Danny Moules
Security assessment specialist
danny.moules@jisc.ac.uk
I have been…
One Castlepark, Tower Hill, Bristol, BS2 0JA
T 07867 552072
customerservices@jisc.ac.uk
jisc.ac.uk

34. Any questions?
Further reading:
• YouTube: DEFCON 23 - Sniffin WiFi Sippin
Pineapple Juice

35. Implementing
cyber essentials
Ged Nicholson,
Hartlepool College of FE

36. The Cyber Essentials scheme has been developed by
the UK Government and industry to fulfil two functions
It provides a clear statement of the basic controls all
organisations should implement to mitigate the risk from
common internet based threats, within the context of the
Government’s 10 Steps to Cyber Security
And through the Assurance Framework it offers a
mechanism for organisations to demonstrate to
customers, investors, insurers and others that they have
taken these essential precautions
What is
Cyber
Essentials

38. Five Key Controls
Boundary firewalls &
internet Gateways
Secure
configuration
Access control &
administration privilege
management
Patch
Management
Malware
Protection

39. > Self assessment questionnaire verified by
certification body
Which option
> Verification carried out independently by a
certification body

40. cyberessentials.ncsc.gov.uk/
Where to
go for help

41. cyberessentials.ncsc.gov.uk/
Where to go
for help

42. Accreditation Bodies
Direct - Portal
CE £300
CE+ ?
40 Questions
48 Suppliers
CE £300 +
CE+ £1250 +
34 Questions
Vulnerability
Scan Included
20 Companies
CE £250 +
CE+ £500 +
35 Questions
4
Companies
?
?
?
?
Direct + 143 Suppliers
CE £300 or £400
CE+ Varies
62 or 171 Questions
Bundle with IASME
governance & GDPR
assessments
cyberessentials.ncsc.gov.uk/getting-certified/

43. > Decide CE or CE+
> Select Certification Body through one of the Accreditation
Body
> Verify that your IT is Secure
> Write business scope
> Fill out Questionnaire
> Option – Arrange Vulnerability scan/Visit
> Buy picture frame and await for Certificate
> Renew after one year
Steps to
Certification

44. > Make sure you have the 5 key controls covered
> Review the questions before you start the process
> Take your time to selecting a accreditation and
Certification bodies
> Select which option is best for your needs CE or CE+
> Getting the Scope correct is vital especially for CE+
> Be prepared to justify your answers and results
Our
Experience

45. Limitations
Not designed for Education
Scheme not consistent
CE relies on the company honesty
Is only a snapshot in time
Can be expense for CE+

46. Is it worth the Time and Cost?
Good starting point for Cyber Security
Simple, straightforward and cost affective
certification process
Keeps management, auditors and insurers happy

47. Except where otherwise noted, this work is licensed under CC-BY-NC-ND.
Gerald Nicholson
IT manager
gerald.nicholson@hartlepoolfe.ac.uk
I have been…
Hartlepool College of Further Education, Stockton Street, Hartlepool, TS24 7NT
T 01429 404181
enquires@hartlepoolfe.ac.uk
www.hartlepoolfe.ac.uk

48. Any questions? /
Thank you