NOC REPORTING TEMPLATE
Date Updated: Name: Nicholas Lograsso
A. Introduction
As an IR manager for the NOC I will be verifying Psinuvia’s security posture in response to public web exploits.
My first task is to follow
...
NOC REPORTING TEMPLATE
Date Updated: Name: Nicholas Lograsso
A. Introduction
As an IR manager for the NOC I will be verifying Psinuvia’s security posture in response to public web exploits.
My first task is to follow the NOC’s SOP by running a vulnerability assessment to detect and report any
intrusions on Psinuvia’s systems. This task will be accomplished by using the Performance Assessment Lab
Area to run the vulnerability scan in a virtual environment. Screenshots will be provided for each part of the
lab.
B. Vulnerability Scan
(Attach as Appendix A)
C. Scan Summary
After performing a vulnerability scan report, I noticed the following. Out of the 3 identified systems, there is a
total of 130 vulnerabilities. 4 of which are serious and 31 are labeled as high. When looking at the report based
on host IP address, the host identified with these serious and high vulnerabilities belongs to host 172.20.1.131.
This should be the NOC’s primary focus as it is critically exposed. Looking at the alarms report it appears that
host 172.20.1.131 was attacked approximately 4,036 times. Host 172.20.1.129 was also attacked for a total of
3,592 times, meaning this asset should be secured immediately as well. The attacker IP the NOC should take
action against is identified as IP 10.216.31.246. The top alarms to take note of are the following: at least 6,665
SQL injection attempts, 934 multiple SQL injection attempts from the same source IP, as well as 30 additional
web server attacks including cross site scripting and brute force authentication via SSH.
Assessment Questions:
Has the information been confirmed to be correct and accurate?
Although the information appears to be accurate from the report, exact log dates would need to be cross
examined and analyzed for a timeline of events related to the attacks.
Who, what, when, where, why, and how?
Our reports indicate the host (172.20.1.131) was being attacked by IP (10.216.31.246) during the timeframe of
July 1, 2019 – January 25, 2020. The attacker executed a variety of webserver attacks including: SQL injection
attempts, cross site scripting, and brute force authentication via SSH. At this time the attacker’s intentions are
unknown.
What information is available from the firewall, router, server, system, intrusion detection system (IDS), system
logs, etc.?
At this time the NOC is only able to access web server information based on the vulnerability and alarm
reports.
What type of data is involved, and what is its classification?
Currently available data is only webserver related including host and attacker IP addresses. Classification is not
available at this time.
Are there obscenities, child pornography, or confrontational data?
Not that the NOC can determine at this time.
Is there criminal activity?
It can be assumed that the attacker was attempting to exfiltrate data by performing SQL injection and cross site
scripting attacks, however we cannot confirm this yet.
Is the data protected by an encryption solution?
Not that the NOC is aware of.
What is the magnitude of the systems being impacted?
Once classification and sensitivity of the data is determined, the NOC would be able to determine impact to
Psinuvia and its organization.
Is the event still in progress?
It is very likely the attacker still has access to valid accounts and is able to perform more webserver attacks.
Has preliminary containment been performed (i.e., disable account, reset password, remove remote access,
isolate device in segregated segment)?
Preliminary containment is underway and will be performed to prevent further attacks.
What is the estimated value of the impacted data and systems?
Value of impacted data and systems will be determined by performing a asset evaluation of Psinuvia’s systems
and the data involved.
D. Detailed Analysis
The first 2 attached screenshots are provided from the OSSIM alarm report for log analysis. Clearly we can see
that attacker 10.216.31.246 has been executing numerous types of webserver attacks including SQL injection
attempts and cross site scripting against host 170.20.129. The NOC must assume compromise and rapidly
evaluate the top vulnerabilities related to these attacks in order to prioritize what to eradicate from Psinuvia’s
systems first. Although we do not have details on hand about the data contained within the affected systems
we should assume that the data being targeted is sensitive and high priority. The following screenshots from
Appendix A (aka scan report) provide extended details of these top vulnerabilities that the NOC should review
before remediation steps.
Looking closer at the first serious vulnerability, it appears that the Windows SMB server contains multiple
vulnerabilities. The main cause of this vulnerability is the lack of a critical security update. Without the overdue
update, the server is exposed to remote code execution leading to data exfiltration and disclosure. There are
multiple Windows software and operating systems exposed to this vulnerability making it even more critical that
the attacker can use multiple vectors to exploit. This would make it harder to determine which host and
operating system the attacker is using during an attack. In order to mitigate this vulnerability the NOC will have
to follow the appropriate Microsoft documentation to properly update the affected products.
The second serious vulnerability appears to be an EOL detection for OpenSSL. This vulnerability affects port
443, meaning HTTPS for secure web browsing. This affects the integrity of communication between hosts since
OpenSSL involves the signing of digital certificates and verifying users are who they say they are. If an attacker
is aware of an out-of-date version of OpenSSL, they could easily exploit this and abuse digital certificates to
appear as an authenticated user. This would most likely lead to data exfiltration and giving the attacker the
ability to “live off the land” as they wish. The NOC must scan for all hosts that are exposed to this vulnerability
and apply the appropriate patches.
The last serious vulnerability to look at is the PHP end of life detection. Seeing that this vulnerability affects
both HTTPS and HTTP, this affects all of the public web facing applications that Psinuvia may have. Since PHP
is used to develop backend transactions and data handling for web applications, it is very likely an attacker
could exploit the out-of-date version of PHP by attempting a remote code execution, manipulating backend
code, querying backend databases, etc. The NOC should immediately patch all versions of PHP that may be in
use for Psinuvia’s web applications.
Taking a step back after reviewing the top serious vulnerabilities, this matches up with the top alarms reported
by AlienVault. If the majority of alarms are SQL injection attempts and webserver related attacks then it makes
sense as to how they were allowed to occur. A web server related attack could easily be executed by exploiting
an out of date software like PHP or OpenSSL. The same goes for the SMB vulnerability, data can easily be
stolen or allow for command and control to maintain persistence within a system like a web server
[Show More]
.png)
- Test Bank.png)
.png)
