<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
As much as I love CANVAS (and Impact and MSF), for penetration
testing, there are times when we have to replicate much more
realistic attacks for our clients, especially relating to
post-compromise long term data ex-filtration and lateral movement. <br>
<br>
In particular, there is an ongoing theme of "Incident Response
Response" that we see. Chris Gates points out some features of this
in <a
href="http://carnal0wnage.attackresearch.com/2016/01/purple-teaming-lessons-learned-ruxcon.html">his
recent talk on "Purple teaming"</a> but I wanted to go further and
look at what INCIDENT RESPONSE RESPONSE really is.<br>
<br>
Lucky for me, around minute 10, one of our engineers goes into
detail as to what INNUENDO does when the IR team starts to block its
C2. This is the exact moment I realized what we could do that
CANVAS/MSF/etc cannot.<br>
<br>
<a class="moz-txt-link-freetext" href="https://vimeo.com/153178215">https://vimeo.com/153178215</a> (This is the second video, but watch
this first)<br>
<a class="moz-txt-link-freetext" href="https://vimeo.com/153154139">https://vimeo.com/153154139</a> (First video, but watch this second.)<br>
<br>
There's both ENGINEERING and a completely different set of mental
concepts for how you do penetration in here. Everyone else is so
obsessed with maintaining a connection to your target. But for
INNUENDO, the design goal is "Target may only be at Starbucks for 2
hours a week - we still want full capability".<br>
<br>
-dave<br>
<br>
<br>
</body>
</html>