NCL: Facilitating Cybersecurity Experimentation as a Community - PowerPoint PPT Presentation

NCL: Facilitating Cybersecurity Experimentation as a Community Liang Zhenkai National Cybersecurity R&D Lab (NCL)

National Cybersecurity R&D Lab • National Cybersecurity R&D Lab (NCL) – Shared national infrastructure of Singapore for cyber-security research & development • Objectives – Simplify research and experimentation effort – Provide realistic testing environment – Enrich users' testing and validation • Offered services – Infrastructure, Ready-to-use Environments, Data

Services of NCL Environments Infrastructure Data • 200 • Ready-to-Use • Data vulnerability Servers collection configuration • Software • Malware • Malware defined • Akamai runtime network • Data • Cyber Range • GPU hosting components Servers and access • Flexible control network • IMPACT topology dataset

Life Cycle of Cyber Security Research Research Setup Attack Analysis Solution Description Goal: Reuse existing configuration efforts

NCL Infra from User’s View NCL Infrastructure Data Repo

Virtual Enterprise Network

Catalog of Vulnerabilities

The WannaCry Ransomware • Outbreak on May 12, 2017 – Infected more than 300,000 computers over 150 countries. – Encrypting user files – Asking for Bitcoin • Target vulnerability CVE-2017-0143 (MS17- 010) – Vulnerability in SMB (port 445), originally exploited in ETERNALBLUE – Patch released on March 14, 2017 by Microsoft

Virtual Enterprise Network

WannaCry Network Behavior • Kill switch – www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com • HTTPS request to a few IPs – 199.254.238.52 – 154.35.175.225 – 128.31.0.39 – ....... • Random probing of next target – Local network first, then external network – Different interval of probing, 10 – 25 per second

More Network Behaviors • Propagate but never connect with TOR servers • DB349B97C37D22F5EA1D1841E3C89EB4 • Never propagate but do connect with TOR servers • 509C41EC97BB81B0567B059AA2F50FE8 • Query a domain first, and do nothing if no response • 8DD63ADB68EF053E044A5A2F46E0D2CD

WannaCry System Behaviors • Malware related files appear • Background of desktop changes • Encrypted files ‘*.WNCRY’ appear • Notification window appears • Original files disappear

Variants of System Behavior • Different order of events • Different filename extension of encrypted files • E.g. ‘*.wry’ of 8DD63ADB68EF053E044A5A2F46E0D2CD • Different notification windows and backgrounds of deskop

Life Cycle of Cyber Security Research Research Setup Attack Analysis Solution Description Goal: Reuse existing Goal: Share and reuse configuration efforts research knowledge

Facilitating Research • A community-maintained resource set on NCL to support research – E.g. network behavior modeling, binary analysis to identify vulnerability for zero-days.

NCL as a Knowledge Base • With automated vulnerability setup, we can gather knowledge of experiments • E.g., three level of information – CVE description – Executable environment – Analysis results from research projects

The NCL Platform Flexible Ready-to-use Infrastructure Environments NCL Platform http://ncl.sg Data and data Community management Knowledge Base