Catching dropped executable files without a sandbox
Posted by scriptjunkie in Defense on October 30, 2013
One common technique used by a lot of exploits, malware, and obfuscated software is to dynamically generate or download an executable or DLL file, run it or load it, then delete it. I frequently catch even legitimate software doing this, but I am always curious as to what executable code the authors are trying to hide. Saving those automatically generated files is a core feature of any decent sandbox out there, but in many cases, you see this activity on a production system and don’t know where the file is coming from. Especially if it only happens infrequently, it often doesn’t make sense to try to put the whole system in a sandbox. So instead, I just use a simple trick with NTFS file permissions.
The Infosec Revival – DerbyCon 2013
Posted by scriptjunkie in /dev/urandom, Defense on September 29, 2013
DerbyCon this year was awesome as usual. I presented “The Infosec Revival: Why owning a typical network is so easy, and how to build a secure one.” The video is here on Youtube: Or you can check out the slides here: The RDP video is here: And the VM isolation video is here: I should […]
Remote Desktop and Die – How to RDP Faster Without Getting Robbed
Posted by scriptjunkie in Defense on September 14, 2013
Unless you have not patched your domain controller in the past five years, chances are, if an intruder gets domain admin or enterprise admin level access, they probably did it through credential theft. One of the biggest recurring themes of countless intrusion and pentest reports is that to accomplish lateral movement and privilege escalation to […]
Secure random password generation
Posted by scriptjunkie in /dev/urandom, Crypto on September 8, 2013
Ideally you never use a password, but sometimes, you have to anyway. One very common scenario is in signing up for a web application. Such passwords can be stored on the server, hashed with a fast algorithm such as MD5, and over which you have no control. You do not want your password to be […]
Ambush Standalone
Posted by scriptjunkie in Defense on July 13, 2013
Ambush was designed in a server-client architecture to make it easy to deploy to lots of systems, but sometimes you just want to get it running on a single system, without the hassle of requiring a custom server setup or signature creation.
Fixing Pass The Hash and 14 Other Problems
Posted by scriptjunkie in Defense on June 24, 2013
A combined solution to 15 different serious problems with password-based authentication, including the Pass-The-Hash (PTH) attack. No other measures come close to solving all these problems, and for many of the problems, I am unaware of any other solution at all. Sadly, both Microsoft and other security researchers did not really consider this solution or discounted it as unrealistic. The objections either showed flaws with only implementating half a solution or assuming legacy equipment or implementation difficulties will doom the project, due to a focus on what a large enterprise would be likely to implement with minimal effort right now. It reminds me of an immigration debate that focuses on people who are already here, paying less attention to future immigrants only to find that 30 years later, what happened to the future immigrants is all that mattered. Here are the objections, and why they should not stop you.
Breaking and Building a Secure Network – BSides San Antonio
Posted by scriptjunkie in Defense on May 8, 2013
This past weekend I gave a talk at BSides San Antonio titled “Pigs Don’t Fly – Why owning a typical network is so easy, and how to build a secure one.” I took a top-down look at the security barriers in a typical organizational network, the many techniques attackers use to break them, and how […]
Economics in One Lesson
Posted by scriptjunkie in /dev/urandom on March 13, 2013
This is off the security topic, but I was really excited to find this online, so deal with it. Everyone who votes needs to understand this. We have all heard the fallacies before, and it’s hard not to disagree. When people need jobs, why can’t the government create jobs with public works projects? Don’t all […]