Convention Wi-Fi networks are a chaotic atmosphere the place hundreds of gadgets, every with their very own historical past and configuration, converge and join.
A typical problem is that attendees’ laptops and different gadgets, configured for ‘safer’ house or company environments, usually join to those convention networks with an implicit degree of belief. This exposes delicate secrets and techniques, which an opportunistic attacker can exploit.
The Safety Operations Centre (SOC) at Cisco Dwell Melbourne is on the frontlines of this problem. To successfully shield the community and educate attendees, our analysts must quickly perceive the torrent of information flowing via our techniques. We leverage highly effective instruments like Endace, which offers us with invaluable full packet seize capabilities, providing a deep, granular view of each byte traversing the community. Nonetheless, uncooked packet information, whereas complete, is an unorganized library. It’s with instruments like Splunk Enterprise Safety that we will really extract worth.
Speedy Orientation with Splunk’s area abstract
One of many easiest methods we speed up understanding of latest logs is by utilizing Splunk Processing Language (SPL) instructions designed to profile information shortly. The fieldsummary command is especially efficient: it analyzes a dataset for accessible fields, information varieties, cardinality, and null charges, giving analysts a quick and clear image of essentially the most beneficial fields in a knowledge set.
Typical movement: Ingest a brand new supply, search for attention-grabbing fields after which run fieldsummary on them to disclose their most notable values, then pivot to focused searches and dashboards tailor-made to the dataset’s most informative attributes.
Instance SPL to shortly profile a brand new index:
index=se_network_endace ```comprises all endace packet occasion logs```
| fieldsummary service path proto app motion ```spotlight fields which may include attention-grabbing values```Can you see the protocols that might curiosity an attacker? Whereas there are fairly just a few, this weblog will concentrate on a handful.
Pivot: HTTP Authorization Headers and OAuth 2.0
With the info higher understood, we will pivot to HTTP site visitors that included Authorization headers. Fashionable net authentication closely depends on TLS to guard secrets and techniques in transit, so it was very disappointing to see the amount of plain HTTP authentication.
Endace’s full packet seize was vital for exact reconstruction of periods and headers for validation. Packet-level proof confirmed that the noticed Authorization scheme aligned with OAuth 2.0 patterns, generally seen as Bearer and Refresh tokens. Anybody who obtains Bearer or Refresh tokens can entry the sources these tokens grant till they expire or are revoked.
Why TLS is non-negotiable: OAuth 2.0 depends on Transport Layer Safety (TLS) to guard secrets and techniques over the wire. With out robust, appropriately configured TLS, credentials and tokens despatched in headers are uncovered in transit.
Pivot: Uncommon Kerberos Exercise on a Convention Community
One other notable remark was the presence of Kerberos exercise on the visitor community. Kerberos is a broadly deployed authentication protocol sometimes discovered on inside enterprise networks (generally inside Lively Listing domains). Kerberos makes use of a trusted Key Distribution Heart (KDC) to situation time-bound tickets that show id securely with out repeatedly sending passwords. Shoppers receive a Ticket-Granting Ticket (TGT) from the KDC, then request service tickets to entry particular person companies. These tickets are cryptographically protected and time-limited. In attackers’ arms, a Kerberos ticket will be leveraged to realize unauthorized entry, transfer laterally throughout the community, or escalate privileges by impersonating authentic customers, making its detection on the community engaging for attackers.
Why Kerberos site visitors issues to defenders:
- Secret Publicity: Kerberos on a transient, public community can point out gadgets carrying company configurations right into a convention atmosphere, which can leak weakly encrypted secrets and techniques/passwords unintended for public networks.
- Public-facing KDC: Utilization of Kerberos on the web suggests a public-facing KDC (probably additionally a Area Controller) which is a pretty goal for attackers.
Frequent assault surfaces to concentrate on (high-level consciousness for defenders):
- Ticket Replay and Impersonation Makes an attempt: Reuse of legitimate tickets inside their lifetime window to impersonate a authentic person or service.
- Weak or Misconfigured Encryption: Use of deprecated ciphers or configurations that allow downgrade, interception, or decryption of tickets.
- Kerberoasting: An attacker with a sound ticket can request service tickets from the KDC that are encrypted with the service account password. If the password is weak, it may be decrypted.
- Time Skew and Validation Gaps: Unsynchronized clocks or lax validation could make replay and ticket acceptance extra doubtless.
The Energy of the Ecosystem
The Cisco Dwell SOC exemplified how a contemporary safety ecosystem amplifies every element’s strengths whereas enabling deeper dives when warranted. Every platform contributed distinctive visibility and proof, and every linked again to its native interfaces for expert-level evaluation.
- Splunk: Speedy orientation with fieldsummary and quick pivots to hunts throughout various telemetry. Ultimate for correlation, dashboards, and automation hooks.
- Endace: Packet-level fact on demand. PCAP confirmed protocol semantics, reconstructed headers, and validated behaviors that logs alone couldn’t conclusively show.
- Cisco XDR: Cross-signal correlation and incident administration spanning Safe Firewall, Safe Entry (DNS), Safe Community Analytics, and accomplice telemetry. Decreased swivel-chair evaluation and tightened response loops.
- Safe Firewall and Safe Entry: Inline enforcement and DNS-layer perception, turning detection into motion whereas feeding again wealthy logs for investigation.
- Safe Community Analytics: NetFlow analytics to floor scanning, beaconing, and anomalous connection patterns at scale.
Collectively, the ecosystem shortened each detection and response instances. Analysts might begin with SPL summaries, escalate to correlation in XDR, and shut the loop with packet proof in Endace.
Try the opposite blogs by my colleagues within the Cisco Dwell Melbourne 2026 SOC.
We’d love to listen to what you suppose! Ask a query and keep related with Cisco Safety on social media.
Cisco Safety Social Media
