grand unified logging program do you really …...gulp grand unified logging program do you really...
TRANSCRIPT
![Page 1: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/1.jpg)
GULP Grand Unified Logging Program
Do you REALLY know who your users are
LockDown 2018July 15, 2018
Joel RosenblattDirector, Computer & Network security
Columbia University, CISO
![Page 2: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/2.jpg)
Copyright (c) 2018 The Trustees of Columbia
University in the City of New York
Columbia Network Environmentl Large research university
l Decentralized management structure
l Over 250,000 network nodes
l Over 100,000 MAC addresses active on average
l Decentralized computer support
l No sniffing traffic or scanning machines allowed
l “Free Love” IP address assignments
l No university wide, corporate like, firewalls
l 130,000 email accounts
![Page 3: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/3.jpg)
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
Initial problems to solvel We wanted to offer pain free use of our
network to visiting peoplel We needed to reduce the overhead of
registering machines
![Page 4: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/4.jpg)
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
The solution is ….
FreeLove
![Page 5: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/5.jpg)
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
What is “Free Love”l From http://www.educause.edu/ir/library/pdf/erm0266.pdf
“Free Love” and Secured Services, by Vace Kundakci
“Free love” allowed all computers, whether public or private, wired or wireless, in residence halls, at the libraries, in faculty and staff offices, or anywhere else on campus to connect directly to the network, and thereby to the world, without further ado.
![Page 6: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/6.jpg)
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
NEW Problems to solve
l How do you answer the question…l Who is using a certain IP address?l Who is using a certain MAC address?l When was a certain IP address being used by
a certain user?
![Page 7: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/7.jpg)
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
The NEW solution is …
GULP
![Page 8: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/8.jpg)
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
Grand Unified Logging Program - GULPl Problem – How do you know who is using an
IP/MAC address without registration?l GULP processes the logs from 14+ different
services that require authenticationl GULP includes information from LENELl It processes information from DHCP and the ARP
cache to associate MAC address with IP addressl GULP correlates all informationl A user can be tracked by IP, MAC, or UNI – even
if the IP is not on the Columbia networkl The data is kept for 28 days and then purged
![Page 9: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/9.jpg)
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
Basic GULP workflowl Pull all logs that associate an authenticated
user, process, timestamp and IP addressl Dump information into a databasel Pull information from the network that
associates IP address, MAC address and time (DHCP and ARP cache)
l Add network information into appropriate records in the database
l Includes ID Card transactions – “Door Swipes”
![Page 10: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/10.jpg)
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
Network securityvs
Public Safetyl What machine used
that IP address at 3:00pm
l Was the machine with MAC address XX connected to the network yesterday
l How many MACs used that jack
l Who used that IP address at 3:00pm
l Did the person named John Doe log in to the network yesterday
l How many people used that IP address – and when
![Page 11: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/11.jpg)
Sample GULP for UNI Joel
![Page 12: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/12.jpg)
Gulp for IP 68.197.91.126
![Page 13: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/13.jpg)
Sample GULP for audrey0
![Page 14: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/14.jpg)
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
Questionl No one has seen this
student for 10 days, can you tell me anything?
![Page 15: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/15.jpg)
Lost person procedurel Look up ID of missing person using GULPl Analyze login records for location and timesl Work with Public Safety to establish if this
information matches up with missing person report
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
![Page 16: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/16.jpg)
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
Questionl A (faculty, staff,
student) received this anonymous email from Yahoo – can you tell me who sent it?
![Page 17: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/17.jpg)
Procedure to track down some anonymous email senders l Get IP address of email sender from headers
(this does not work easily with Gmail)l Pop into GULPl See what comes upl We have found that, quite often, the offender
will fire off the nasty email, then login to our systems to check on their own email, once they authenticate, GULP has them
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
![Page 18: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/18.jpg)
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
Questionl We got a call from LE
that someone is applying for Credit Cards using the identities of employees, can you help?
![Page 19: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/19.jpg)
Procedure to help Law Enforcement find Bad Guysl Get some data from LE – in this case, we got
the IP address that the applications were being submitted from
l Pop into GULP and see what you getl P.S. The person is currently in jail
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
![Page 20: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/20.jpg)
Copyright (c) 2018 The Trustees of Columbia
University in the City of New York
Questionl (Department that runs
their own network – I
know you have them
J)
We can’t find this
machine anywhere. All I
know is the IP address,
can you help?
![Page 21: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/21.jpg)
Procedure to find lost computersl Take the IP address and pop into GULPl The user or users of that computer will be
displayed – then it is a simple matter of calling them and asking where they are
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
![Page 22: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/22.jpg)
GULP data miningl Use GULP data to discover compromised
passwordsl Use GULP data to satisfy Audit requirementsl Use GULP data to expose MAC spoofers
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
![Page 23: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/23.jpg)
Compromised Password Discoveryl Create a daily process that looks at the last few days of
GULP data (we use 72 hours)
l Look at the location information of the logins (We use
ASN data)
l If a user logs in from “x” locations or more (we use 6
ASNs) in the time period, there is a strong possibility that
the password has been compromised
l We also look for logins from more than 2 countries
l Using Lenel data allows pinning physical location to
campus
Copyright (c) 2018 The Trustees of Columbia
University in the City of New York
![Page 24: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/24.jpg)
User login by country
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
![Page 25: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/25.jpg)
GULP of users account
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
China & Taiwan
Swipe at CU
![Page 26: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/26.jpg)
Notes on GULP of userl Use Start/End to limit size of reportl Colors make it easy to see jumps in CIDR
ranges
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
![Page 27: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/27.jpg)
Look up first suspicious IP address Click on it in Hostname column - China
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
218.27.82.114
![Page 28: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/28.jpg)
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
![Page 29: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/29.jpg)
Check of second IP shows it is from Taiwan
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
103.98.74.117
![Page 30: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/30.jpg)
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
![Page 31: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/31.jpg)
Now look at the timestamps
Copyright (c) 2018 The Trustees of Columbia
University in the City of New York
• New York swipe at 10:32
• Taiwan login at 07:30
• China login at 05:21
•That is China to NY in about 5 hours
• Either this person has their own Transporter, or more than 1 person is using the
account J
![Page 32: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/32.jpg)
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
Summaryl GULP is a powerful and useful tool for
bringing together disparate pieces of information.
l GULP can be used in a “free love” or a managed environment.
l Once you have GULP, it will quickly become the “go to” tool for any question that involves WHO or WHERE
![Page 33: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/33.jpg)
To get your Build your own GULP kit, send email to me
Make sure to include GULP Kit in the subject line
Copyright (c) 2018 The Trustees of Columbia University in the City of New York
![Page 34: Grand Unified Logging Program Do you REALLY …...GULP Grand Unified Logging Program Do you REALLY know who your users are LockDown2018 July 15, 2018 Joel Rosenblatt Director, Computer](https://reader033.vdocuments.mx/reader033/viewer/2022053006/5f09db9c7e708231d428d4f2/html5/thumbnails/34.jpg)
Questions?
Copyright (c) 2018 The Trustees of Columbia University in the City of New York