HideNSneak - A framework to obfuscate attack traffic

Presented at CarolinaCon 14 (2018), April 15, 2018, 1 p.m. (60 minutes)

HideNSneak evolved as a tool to expand evasive penetration testing capabilities. It allows users to rapidly deploy, manage, and quickly take down a distributed cloud attack infrastructure by leveraging features of large Cloud Providers and their content delivery networks. Techniques include domain fronting with multiple providers, distributed scanning, and source of attack obfuscation. Leaning on the reputation of these networks allows traffic to more easily blend in to network traffic and create difficulty in blocking attack infrastructure. Furthermore, the ephemeral nature of the tool itself provides a realistic threat simulation, which also simulates the realistic headache this type of attack causes defenders, when they try to attribute actions to certain sets of hosts. The overview of the toolsets features will contain an explanation of the tactics and techniques in order to provide both red teamers and blue teamers alike with more insight into why this works in "modern" networks, as well as real world scenarios. Finally, information will be provided to blue teamers in an effort to provide knowledge that can be brought back and leveraged to increase security posture.


Presenters:

  • Mike Hodges
    Mike Hodges is a Senior Security Consultant for the Optiv Attack and Penetration Practice. His current focus is on expanding evasive penetration testing methodologies while similtaneously impostering as a developer. When is not wrist-deep in technical work he is on the BJJ mats, hopefully not in an armbar.

Links:

Similar Presentations: