Windows 10 Decontamination Scripts

One of the main benefits of our setup we have is that our system will not update automatically. The main problem though, is that it will not update automatically. But we still do want security updates, so it would be nice to let those through, while still blocking any other unwanted updates and the other undesirable activity that is also conducted from the same process (svchost.exe). So instead, I installed Python and wrote my own, which was far less difficult than I had originally assumed since you can generally scrape all the info you want from catalog.update.microsoft.com

, , ,

No Comments

Signed Malware

I recently saw a quote on Twitter along the lines of “I couldn’t be in threat intel because I’d get too carried away, go too far, and end up calling some hacker’s mom.” I had to laugh since I can relate. It is easy to get carried away and you can find a lot of […]

No Comments

Hack-back in the Real World

ProtonMail just recently (yet briefly) bragged about shutting down a phishing campaign that it was the target of by hacking back the phishing server… Earlier this year, a member of the US Congress (Rep. Tom Graves) proposed the “Active Cyber Defense Certainty Act (ACDC)” to amend US law to allow private entities, with mandatory reporting requirements to law enforcement, to conduct certain forms of hack-back… Following this proposal, discussion online exploded… My timeline was filled with “If people tried hack-back, this would happen!” but you don’t have to hypothesize. You can see what did happen in the myriad examples of hack-back in the real world. So below I assembled a list of publicly recorded hack-backs, with the results of each and reference to original sources.

No Comments

Hoarder

A few years ago, I gave a DerbyCon presentation on the Ambush open-source host intrusion prevention system I was working on, as well as evasion techniques you can use against systems like that, implemented in the hoarder project. Ambush was an interesting project in dynamic system-wide user-mode hooking which has since faded away a bit, […]

No Comments

Supply Chainsaw: Practical software supply chain attacks for everyone

I recently presented Supply Chainsaw: Practical software supply chain attacks for everyone at the OPCDE technical security conference in Dubai.
To summarize:

No Comments

Goals

In any complex system, a solution that best meets one goal will fall short in other areas. Computer programs to solve nearly any problem in the fastest manner will not be the algorithms that use the least memory. Solutions that can be written in the least amount of time will neither be the fastest nor […]

No Comments

Climate Change Archive

For another short detour from information security… Climate policy is again in the news. The past year has seen record high temperatures, the election of a US President who claimed global warming was a hoax invented by the Chinese (then later backed off), and the 10th anniversary of probably the most authoritative decision regarding climate […]

No Comments

Just Too Much Administration – Breaking JEA, PowerShell’s New Security Barrier

Update – 10/9 The PowerShell team has been very responsive in addressing these issues. The documentation should be updated soon (if not yet). Lee Holmes from the PowerShell team also addressed these issues in another DerbyCon presentation: https://www.youtube.com/watch?v=JDtUmue9mIw&feature=youtu.be&t=1766 tl;dr Just Enough Administration (JEA) is a new Windows 10/Server 2016 feature to create granular least privilege […]

No Comments

Intercepting Passwords to Escalate Privileges on OS X

A few weeks ago, a lot of attention was paid to Dropbox for “hacking” macs. Dropbox asked for your admin password when it was installed, then used that root access to enable privileges later even if you try to disable them. Despite the internet’s indignation and Dropbox’s impoliteness, Dropbox wasn’t exploiting any vulnerability or breaking […]

, ,

No Comments

The Security Pretend Game – Sudo and Runas

Common wisdom would have you believe when you run sudo that you are only granting root privileges to one command at one point in time. In reality, you are granting root privileges to any hacker who has ever run any code in any process at any previous time in your account and decided they wanted escalated privileges.
Use completely unprivileged accounts for day-to-day tasks, then log out and log in with a privileged, trusted account for privileged tasks; don’t use runas or sudo from your day-to-day account; it eliminates the security benefits of using the unprivileged account.
Control should always flow from a more privileged and more trusted environment to the less privileged, untrusted environment; going the other way, even when presenting credentials, only allows those credentials to be stolen and hackers to ride up to the higher privileges. This is not a new idea; it is why Microsoft’s #1 recommendation to secure privileged accounts from credential theft is to make it so you cannot log into a privileged account from an ordinary, untrusted workstation. But this principle frequently seems to be forgotten.

No Comments