Teaching Old Dogs New Tricks
The need for security professionals to understand permission systems and how their complex structures create paths that aren't visible in spreadsheets or flat lists has become more important than ever. The introduction of OpenGraph to BloodHound unlocked opportunities to apply graph theory to analyze other permission systems and expand the map beyond the borders of Active Directory.
To illustrate how graph theory can be applied to any complex permission system, this talk will walk through the process of creating RACFHound, an open-source integration for RACF, the predominant security manager for mainframes. RACF is used to secure the most critical assets of the global financial system.
Armed with the knowledge of how to implement such an integration, and how the results give unprecedented insight into once opaque systems, you will be ready to apply this approach yourself.
No knowledge of AD, RACF, or even BloodHound is required.
Permission systems have long been audited as individual lists in isolation. Attackers exploit the same permissions using the paths created when these individually valid controls are chained together. Several hops of legitimate access can end with full compromise. As systems grow and change over time the gap between intention and outcome becomes wider.
The use of graph theory to model each user, group, and resource as a node and to model each grant as an edge between them closes the gap between individual permissions and the effective privilege that is granted through chains of membership, inheritance, and/or delegation. BloodHound used this approach to provide insight into Active Directory and by opening the framework up with OpenGraph it is easy for anyone to define their own nodes and edges.
The hard part isn't the graph itself; the technology here is solid. Working out how to model the nodes and edges correctly to allow for analysis. Which grants apply to which nodes and in what direction? What are the outcomes that are most important? How do defaults and evaluation logic impact the paths? The answers to such questions are usually specific to a platform, but the methodology and process from planning to implementation are transferable.
The RACF/mainframe use case is a perfect example of how complexity and idiosyncracy challenge the security practitioner. The process of modelling the system, the final visualization and ability to query the information using a common framework lowers the barrier for technical specialists, security personnel, and administrators to speak a common language.
A live demonstration follows the graph from ingestion to real escalation paths.
The audience will leave with:
- A method for modelling any permission system as a graph and the design decisions that method requires
- A working understanding of OpenGprah as a general purpose ingestion layer
- Insight into how to query the graph for escalation paths and privilege issues
The talk is aimed at auditors, system administrators, and analysts, anyone with the need to understand a permission system too large to review by hand. No knowledge of AD, RACF, or even BloodHound is required.
Jonathan spends a large proportion of his time breaking the things enterprises trust most but understand least. He specialises in IBM z/OS and IBM i security, not because it's fashionable, but because someone has to, and the systems running your bank's core transactions deserves more than a checkbox audit.
He analyses authorization models, maps privilege escalation paths, and explains to enterprises why their carefully designed access controls are actually a roadmap for attackers. At home he runs a lab that includes two AS/400s and enough enterprise equipment to make most corporate IT departments uncomfortable, because the best way to understand how to break something is to pwn one.
His current research applies modern offensive security methodology to platforms the industry forgot to threat-model, and demonstrates that the gap between a compromised AD account and privileged access on a mainframe may be smaller, and more traversable, than anyone in your SOC wants to hear.