Q&A: Rapid7's Beardsley and Brown dish on Mirai botnet, pen testing

Ask information security professionals how they spend their time, and odds are the answers will include mention of penetration testing and incident response. In some ways, these are two sides of the same coin: One involves putting in the time to find out where the weaknesses are, while simultaneously being prepared to respond to emergency situations where time is of the essence.

Tod Beardsley, director of research, and Rebekah Brown, threat intelligence lead, both at Rapid7, sat down with SearchSecurity in November at Rapid7's UNITED 2016 event in Boston, and they shared their wide-ranging opinions on the pursuit of information security.

In the first part of the interview, Brown and Beardsley offered their thoughts on the increasing threats posed by insecure devices connected to the internet of things (IoT), especially as exemplified by the series of attacks using the Mirai botnet. Also on the table were some of their more notable -- and entertaining -- war stories collected over years of doing pen testing and incident response.

Editor’s Note: This interview has been lightly edited for length and clarity.

What are your thoughts on the Mirai botnet attacks and the other similar kind of malicious IoT activity that we're seeing so much of recently?

Tod Beardsley: So, Mirai is definitely a wake-up call. For many years, we've been looking at IoT through the lens of that [it] is too easy; it's junk hacking; it's stunt hacking; and it's hacking on easy mode. The security industry tends to be pretty dismissive of IoT. And I think the Mirai event [was a] bummer for DynDNS, but not so bad for everyone else, because it really illustrates like, 'No, no, no. This is real, and this is serious.' And we've been seeing this coming for a while -- 2016 is really when IoT kind of came out of the ghetto, the security research ghetto anyway, for both attackers and defenders. We're all taking a look at this in a much more serious way now, because I think the thing that the Mirai botnet had illustrated is twofold.

One, it shows that not only do we have to defend these IoT devices and make sure that they're built securely so your personal data doesn't get leaked and your camera's not on the internet, but we have to get it to a point where we're able to defend against it. So, security on IoT is not only securing the device and securing your stuff, but it's securing everyone else, too. So, there's a social good there that needs to be done.

And, secondly, it didn't really matter. Most of these things are like DVRs, CCTVs and things like that, and that particular data didn't matter at all. It's not what the attacker was going for -- the attacker was going for CPU, a little bit of storage and a little bit of bandwidth, multiplied many times.

And so I think that Mirai really will help wake up not just the security industry to [the idea] that, 'No, this is serious; this is not just joking around and stunt hacking,' but also wake up every manufacturer there that makes an internet-connected device, which is actually every manufacturer.

Rebekah Brown: The whole issue with default passwords or hardcoded passwords, we're seeing that in other devices, as well. We've known about it for years and years, and everyone says, 'Oh well, but nobody's going to do that. And no one's going to use it.' So, this is a very clear example of, yes, they actually do.

The attackers know about all the flaws you know about. You can't keep anything a secret, [and] you can't hope that they don't know about it. And then also you raise a very interesting point where they didn't care about the data, and they didn't care about the stuff on there. But that doesn't mean they won't in the future. It doesn't mean now that they're going to say, 'Oh, OK, well, here's one way we can use this.' Let's just say that they could be coming up with a more creative way now that they're very comfortable in the 'Let's hack all the IoT stuff space.'

Beardsley: Right, and it's that kind of shift in thinking that we saw with ransomware last year ... where the attacker doesn't care about the data. They care that the data's there, and that it's something to encrypt.

Brown: Yeah, they care that somebody will pay.

Beardsley: But, really, I'm not going to steal all your grandkids' pictures and sell them on the internet. That's not very viable. It's much more viable to just ask for money directly.

Have you got any good pen testing or incident response horror stories? What are the craziest, most unbelievable things you found during tests? And you don't have to give names, so the guilty can remain unmarked.

Brown: So, this was before I was at Rapid7. I was working at the state and local government space, and they have no resources and no funding and no staffing. So, it's a very difficult job. They would come to me when they had problems, and I would help out as much as I could. And there was one time, there was this city and their city hall had gotten something through their logs. And they thought, 'OK, something's wrong with our networks. Give me all your stuff.' We looked into it and realized two of their domain controllers were just completely riddled with malware. And these are domain controllers that basically can touch everything else in the entire city. All of their infrastructure was connected.

And so we told them, 'Oh my gosh, this is bad. We don't even have data past six months.' We can see at least it's been back six months, so we're good. And so we kind of came up with a plan for how we could help them and their sys admin says, 'No, no, it's OK. I wiped the boxes, so we're good.' And I said, 'You wiped them?' He said, 'Yeah. I only had been allocated two hours to solve this problem. So, I just wiped them and I got to go work on my other stuff.' And I said, 'All right, I'll see you next week then I guess,' because it's very clearly not solved. But that was the way they approached the problem, and this was only a few years ago. This was not 20 years ago.

Beardsley: And I think that illustrates that there remains a gap between IT people and security people. And so we're hopeful that we can start bridging that gap a lot more seriously. A lot of people talk about it; we're actually trying to do it with our Insight platform. It's not merely to make things easy, but at least make the easy things easy so you have time for the hard and kind of fun stuff. I got started in security from IT. You know, the kids these days go and they get their cyber degree, and they are instantly into security. And they have no background in the realities of change control review boards.

Brown: Absolutely, absolutely.

Beardsley: And the deadlines come and you have to produce. And so, I think we need to see more in the way of not just how security vendors like us talk to security departments within customers, but how we talk to IT people and how we talk to developers, because like I said, everyone is making an internet-connected something. And I cannot imagine a future where we'll have less internet in our life.

Brown: Actually, one of my most fun pen-test engagements was because of that IT guy we were working with. It was a red on blue, so they were trying to do live responses to us, and I was actually on the blue team side at this point. And the red-team guy kept messing with us. And so we got the brilliant idea by talking to one of the IT support guys from this organization. We asked him where the mouse drivers were on the Windows machine. We were able to get access to the red team machine and wiped their mouse drivers, so he can no longer use his mouse to attack us. We wiped the keyboard at the same time. Then, we took a nice coffee break while he tried to figure out exactly what was wrong with his machine. It was a good time.