Post on 15-Jan-2015
description
Hackers (Not) HaltedTechniques for doing things wrong
Paula JanuszkiewiczCQURE: CEO, Penetration TesteriDesign: Security Architect
Paula Januszkiewicz CQURE: CEO, Penetration Tester iDesign: Security Architect paula@cqure.pl | paula@idesign.net http://idesign.net
Contact
Session Goals
Be familiar with the administrator’s mistakes that are:
… or just lack of knowledge issues
Indirectly or directly influencing security in the infrastructureWe are NOT talking about the hardening!
… but we are discussing some options
My goal: Define one of the problems in your network
Agenda
1
Introduction
Summary
2 3
Cases of Technology (NOT) Working
Agenda
1
Introduction
Summary
2 3
Cases of Technology (NOT) Working
Misunderstanding Passwords
Will you share your passwords with others? We do this every day!
How do services store passwords?
Passwords are often similar to your other passwordsAt least one of them can be easily accessed by the administrator of the service
Be prepared for password loss and service recovery
Passwords Never Sleep
I will steal your laptop anyway…
Ignoring Offline Access
Ignoring Offline AccessOffline access allows someone to bypass a system’s security mechanisms
Useful in critical situations
Almost every object that contains information can be read offline
It is a minimal privilege for the person with good intentionsIt is a maximum privilege for… everybody else
Simplified offline access is acceptable if you do not value your information
Ignoring Access to Your Hardware
(Not) Known Data in the Network
(Not) Known Data in the Network
Violation of the one well known rule:Do not allow traffic that you do not know
Most of the protocols have space for dataWhy not put the sensitive information there and send it out?
Malicious traffic can be easily connected to the process
It can happen once a month
You need context based tools: Network Monitor, Network Miner etc.
Monitoring Network Traffic
(Not) Too Much Control
(Not) Too Much Control
Services When used as a part of software that was not installed in %systemroot% or
%programfiles% Installed in a folder with inappropriate ACLs
Permissions Should be audited Should be set up as a part of NTFS, not as a part of shares
BackupRead / BackupWrite Copy operation that is more important than ACLs Used by backup software
Why (Not) to Use Granularity?
Cool and still working (Not)…
Using Old Technology
Hacker’s role here is very valuable
It is hard to be up to date with technologyBut some of the antiques like NT4.0 should be thrown on the scrap heap!
Perform periodic revisions
Even old technology requires updatesSometimes it is not possible (f.e. LNK vulnerability in W2K)
Old Technology a Little Bit Too… Old
Trust (Not) One Network Layer
1-Layer EncryptionData Encryption
Protects from offline access – stolen laptops, tapes
Transmission EncryptionProtects from outsiders testing the network sockets
HTTPS – Man-In-The-Middle
Encryption is problematic for usersLet’s use the lower layer encryption (BitLocker, IPSec)
Encrypt when you can!
Easy and Useful Encryption
(Not) Signed Software
Installing Pirated Software& My Small Research
Installation of software is performed on the administrative account
Malformed installation files are not necessary recognized by antivirus software
UAC is not the protection method as everybody is used to giving Installer high privileges
Keep your toolbox up to date and keep the checksums in a different place
No…
20 of 20 IT admins said:
Do you check for the file’s signatures
before installation?
Do you perform periodic security checks of your folder with installation
files?
No?
17 of 20 IT admins said:
Malware Around the Corner
What You See Is (Not) What You Get
What You See Is NOT What You Get
Explorer.exe is owned by user
Lack of the NTFS permissions does not mean that somebody cannot access the file
Troubleshooting after the injection is difficultRootkits influence the operating system behavior
Conclusion: Always have at least two methods of troubleshooting the same issue
Blinded Operating System
Too Much Trust In People
Too Much Trust in People
The cheapest and most effective attacks are often nontechnical
People tend to take shortcutsIt is hard to control their intentions
They should not be a part of a security chain
Monitor them… and show that you’re doing it
Perform periodical audits of your infrastructure
Too Much Trust… (Not)
Lack of Documentation
Lack of Documentation & Training
Is this really the admin’s sin?
The negative side of this sin is that you need to trust peopleMost companies are not prepared for the IT Staff going on a… vacation
Set up the rules before creating the solutions
Agenda
1
Introduction
Summary
2 3
Cases of Technology (NOT) Working
Be Proactive!Split and rotate tasks between admins
Eliminate at least one of the sins in your organizationPeriodically attend trainings and organize themAudit your environment
Use the legal code
Source: Heard.TypePad.com
Areas of Focus
Problem: Too much information to control
Solution: Select areas with high probability of infection
DLLsServicesExecutablesDrivers
This attitude works as a first step
Dirty Games: Protection Mechanisms
Introduced in Windows VistaPart of Digital Rights Management
Protection is provided in two waysExtension to the EPROCESS structureSigning policy
ProtectedProcess bit
Protected Processes
Hooks
http://www.lukechueh.com/
Allow to run our code instead of the system oneWork on running code
Allow to intercept API CallsDoes not require special privileges
Useful for developers… and for the ‘bad guys & girls’
Hooking