Attack Overview – Video
Any good hacker will take a few common steps to attack a site these can generally be ordered from 1-4.
- Reconnaissance
- Scanning
- Research Vulnerabilities
- Performing the attack
Often you are going to be attacked by “script-kiddies” the easiest way to protect against them is simply make their job hard and they’ll move on somewhere else.
- Make sure OS and Apps are up to date with patches
- Turn off and remove un-necessary services and software
- Run a host-based firewall
- Don’t display information in service banners
- Don’t provide any information about your network/systems publicly
The SecurityOrb Show – An Interview with Haiti CyberCon Co-Founder Michel Arbrouet
HaitiCyberCon is an InfoSec/Hacker conference for professionals and enthusiasts alike located in
Haiti, offering training as well interesting and inventive talks and workshops. We had the opportunity to speak with MICHEL ARBROUET, the co-founder of the conference about the event, the goal of the event and some other interesting topics.
You can obtain more information about Haiti CyberCon below and see how you can get involved:
https://www.haiticybercon.com/
https://www.facebook.com/haiticybercon/
8662398227
@HaitiCyberCon
A Book Review of “Pentesting Azure Applications” by Matt Burrough
In this book review, I looked at the topic of pentesting cloud-based applications, specifically Microsoft’s Azure. While the focus of the book was for Azure, a lot of the information will be beneficial no matter the cloud environment. Even thought Cloud hosting has been around for several years, it is still a new technology and many senior security professionals are learning the do and don’ts of how to secure the infrastructure.
Matt Burrough
I found “Pentesting Azure Applications” to be informative and Matt does a great job of sharing links to additional information on topics that can help secure your Azure deployment(s). In this aspect, while this book is meant to be used for pentesting Azure, it is also a great resource in securing and locking down your subscription. Just by looking at and using the “Defender’s Tips” that Matt includes, you will definitely make your network and systems more secure.
The text consists of 8 chapters, each chapter stands by itself and there is no need to read chapters 1 thru 7, if you are looking to understand logging and alerting in chapter 8. Below is a breakdown of each chapter and what can be found in each. Since the book can be used for all levels of security testers, you may find that some chapters are more useful than others. A lot of large pentesting firms have a team that handles the preparation and legal aspects for multiple teams, and you may want to jump straight to reconnaissance or network investigations chapters.
Chapter 1 – Preparation
In this chapter, Matt Burrough covers what to me is the most important part of any type of pentesting, the scope and legal issues. Scope is an essential part of setting up the engagement rules, identifying the assets to be targeted and what, if anything, is out of bounds. When compared to normal assessments, it is even more important to firmly define the scope in any cloud environment. Matt makes sure to point out that assessments of this type involve three parties, the testing company, the tested organization and Microsoft, in the case of Azure. All legal aspects should be reviewed by the pentesting companies’ lawyers to ensure compliance with all local and national regulations. As with most endeavors, preparation is the framework for a successful, safe and legal penetration exercise.
Chapter 2 – Access Methods
Matt starts out by describing the two basic deployment models Azure Service Management (ASM – Legacy) and Azure Resource Manager (newer role-based system). He spends time going over the advantages and disadvantages of both models as well as defining the weaknesses that can be targeted. He details how certificate-based authentication works with in ASM and the difficulties of managing certificates. He points out that the limit of certificate and owner tracking can be a problem, as well as name reuse, certificate revocation lists, storage, and nonrepudiation. Matt recommends, as good security practice in Azure, that any legacy ASM model deployed should be migrated to ARM.
Matt details several tools that can be used at each phase, listing where to find them and how to use them to get the most out of each. Even though I have used Mimikatz in the past, I found that I picked up a new trick or two that I will definitely be using in the future. He covers some basic information gathering techniques, like looking for credentials in unencrypted documents or saved tokens. Additionally, he covers what to do if you run into systems that are using 2 Factor Authentication.
Chapter 3 – Reconnaissance
If you have done any work as pentester or defender, you will be familiar with the reconnaissance phase of pentesting, the knocks on the doors and the taps on the windows. Most are familiar with basic port scanning looking for open ports and services, but with cloud environments such as Azure you have additional web services that are now susceptible to reconnaissance and attack. As in chapter 2, Matt goes over several tools that will help in evaluating what services and networks are available for exploitation.
As with other Microsoft products, PowerShell is a key tool in managing your Azure deployment and as such is also a tool that can be used to perform reconnaissance. Keeping with providing Defender’s tips, Matt provides some great information on securing PowerShell. The step by step directions that are provided are really good to be able to just jump in and start mapping out the services.
Matt provides numerous basic commands that will get you started, including gathering information that will be essential as you move on from the reconnaissance phase. One key aspect that he points out about VM pricing tiers that can help in identifying what might be running on that system. Other information that can be found during this portion of the assessment, such as, IP addresses, Firewall rules, possible services will be of great benefit when you get to chapter 5.
Matt has links to a couple very useful PowerShell scripts, one for each access model that automates the manual command line processes that he discusses. This allows you to quickly gather the information and then review it at a later time.
Chapter 4 – Examining Storage
Here Matt describes Azure cloud storage and how there are two keys that grant full control to the data contained within the storage. He starts off with some best practices, which also, if not implemented, points to some weaknesses that can be targeted. There are three types of access to storage accounts, account keys, user credentials and Share Access Signature (SAS) tokens. He goes into each of these types and details how they work and where they can be used. Next, he spends some time discussing where to find these keys, such as built in to source code, configuration files and storage utilities. If these methods don’t bare fruit, he covers several tools that can aid in getting access. Once you have access to a storage account, Matt lists the steps of identifying the storage types and provides a script that can automate the process.
Chapter 5 –Targeting Virtual Machines
Here the author spends a great deal of time explaining various techniques and methods that are used in generic pentesting activities of more traditional infrastructures. If you are able to obtain storage access as identified in chapter 4, Matt shows you how to take a snapshot of running VMs and then download them to work on them on your own hardware. Another useful tool, autopsy, a disk forensic tool, is discussed and shown how it can have advantages over other tools used to explore the virtual hard drive (VHD). Matt includes directions and several screenshots that allow even a novice to quickly start exploring the disk image. A review of how best to start working with a Windows or Linux system, including various ways to crack password for both. I have to admit it brought back some old memories when he was discussing Cain & Abel for password cracking.
Chapter 6 – Investigating Networks
This chapter starts with the available network options offered by Azure. On top of basic network configurations, there are system level firewalls that are included by Azure for their SQL servers and application services. Additionally, for web applications there is a paid Web Application Firewall (WAF) offering. Azure does also allow Next-Generation firewalls as a service to be offered to their clients, which can add another level of difficulty in your pentesting attempts. By understanding what is offered by Azure, a pentester can know what to expect and have the right tools and methods will work best.
Matt points out that there are several VPN connection options available for connecting corporate network to cloud networks. He provides a PowerShell scripts to export the details of VPN connections that are discovered, including ExpressRoute. ExpressRoute is a custom Microsoft offering that offers dedicated connections between your local and cloud networks.
Next, Matt covers the Service Bus, and how to gain details and how to look at messages for sensitive PII, code executions or SQL interactions. Lastly in this chapter, Matt discusses two ways of connecting non-Azure services to Azure.
Chapter 7 – Other Azure Services
In previous chapters, the focus was on Azure core offerings, in chapter 7, some of the newer or lesser known services are discussed. Matt takes a look at Azure Key Vault, Web Apps, and Automation and discusses the functionality, capabilities and vulnerable aspects of each. He points out that like most tools, these services if configured incorrectly can be both the issue and the solution.
Chapter 8 –Monitoring, Logs and Alerts
In the final chapter, Matt detours from the attacking nature of pentesting and shift his focus to how Azure can be useful in monitoring your cloud environment. Here he shows how system events and logs can be used to generated alerts that could help defect or at least detect the things he was teaching in chapters 2-7.
He covers the Azure Security Center (ASC), the Operations Management Suite (OMS) and the Secure DevOps Kit. ASC (paid subscription) has both detection and prevention components, it can alert on potentially malicious activity and also look at service configurations and make suggestions on increasing security of those services. In chapter 2, Matt discussed using the tool MimiKatz, well here in chapter 8 he shows how just using that program can generate an alert for that activity. If you don’t have a robust logging and monitoring platform, such as Splunk, the OMS offering can provide the same services for cloud and on-premise systems.
Lastly, Matt covers the Secure DevOps Kit, a collection of scripts, that when used will review your Azure subscription and test for numerous configuration issues and produce a report with results.
Conclusion
While this book serves those interested in pentesting Azure, it is also a good guide for pentesting in general and additionally offers a lot of information on securing your infrastructure. Being more of a defender, myself, I found useful advice throughout the book, but was particularly interested in chapter 8. The book is available online and can be purchased at the No Starch Press website here, as well as a link to scripts that were discussed in the book.
How-to Display a Warning Banner Before the Login Prompt
It is best to have a warning banner displayed before a user is logged in. Below is how you will implement this task.
1) By default sshd server turns off this feature.
2) Login as the root user; create your login banner file:
# vi /etc/ssh/sshd-banner
Append text:
* * * * * * * * * * W A R N I N G * * * * * * * * * *
This computer system is the property of XYZ. It is for authorized use only. By using this system, all users acknowledge notice of, and agree to comply with XYZ’s Acceptable Use of Information Technology Resources Policy (“AUP”). Unauthorized or improper use of this system may result in administrative disciplinary action, civil charges/criminal penalties, and/or other sanctions as set forth in XYZ’s AUP. By continuing to use this system you indicate your awareness of and consent to these terms and conditions of use.
If you are physically located in the European Union, you may have additional rights per the GDPR. Visit the web site dataprivacy.utk.edu for more information.
LOG OFF IMMEDIATELY if you do not agree to the conditions stated in this warning.
* * * * * * * * * * * * * * * * * * * * * * * *
3) Open sshd configuration file /etc/sshd/sshd_config using a text editor:
# vi /etc/sshd/sshd_config
4) Add/edit the following line:
Banner /etc/ssh/sshd-banner
5) Save file and restart the sshd server:
# /etc/init.d/sshd restart
6) Test your new banner (from Linux or UNIX workstation or use any other ssh client):
$ ssh user@host
Output:
* * * * * * * * * * W A R N I N G * * * * * * * * * *
This computer system is the property of XYZ. It is for authorized use only. By using this system, all users acknowledge notice of, and agree to comply with XYZ’s Acceptable Use of Information Technology Resources Policy (“AUP”). Unauthorized or improper use of this system may result in administrative disciplinary action, civil charges/criminal penalties, and/or other sanctions as set forth in XYZ’s AUP. By continuing to use this system you indicate your awareness of and consent to these terms and conditions of use.
If you are physically located in the European Union, you may have additional rights per the GDPR. Visit the web site dataprivacy.utk.edu for more information.
LOG OFF IMMEDIATELY if you do not agree to the conditions stated in this warning.
* * * * * * * * * * * * * * * * * * * * * * * *
Is Digital Privacy A Right Or A Privilege?
By
There are many dimensions to our digital worlds. We buy everything online. We entertain ourselves with endless piles of digital content. We communicate and socialize with friends and colleagues. We’re all digital, all the time. But what we do, what we buy, who we visit and what we think is now on sale.
Have we thought carefully enough about this? Is everyone OK with selling browsing histories? I’d sure like to know which sites my friends, colleagues and enemies visit. Wouldn’t you? I’m sure that retailers would love to know what I do online. Many of them already do, of course, but we’re about to tell them more about me – and you – than anyone – except them – really wants to know.
Several recent events should make us re-think our digital rights and privileges. The debate about net neutrality, which I’ve discussed before, is important here, especially given the recent decision by the United States Congress to allow Internet Service Providers to collect and sell browser data. When I asked my students if they were aware of the proposed changes to the law, they were surprised to learn that their surfing habits could now be collected and sold, though they all already know about cyber stalking when they search for Spring break deals. They immediately started to hypothesize where browsing histories could be exposed with varying results, such as what might happen if their parents knew everything they did online, or if the sites that politicians or their staffs visited were posted on social media. Or how insurance companies might leverage browsing histories to set rates. It didn’t take them long to identify lots of weird scenarios. While most of these scenarios are unrealistic, some may well occur if the new regulations are sloppily interpreted.
The proponents of net neutrality rollbacks argue that tiered rate schedules will fund infrastructure innovation. The supporters of anti-privacy legislation argue that there’s little distinction between media companies (like Facebook) and ISPs, and both should have the right to collect and sell data that reflects the behavior of their customers. These are the business arguments. Are there other arguments we might want to consider?
Read more at Forbes here.
National Cyber Security Awareness Month – Week 1: Make Your Home a Haven for Online Security
National Cyber Security Awareness Month
Week 1: Make Your Home a Haven for Online Security
October 1, 2018
We’re excited to kick off the first week of National Cyber Security Awareness Month. This week, we’ll focus on how you can secure yourself at home. We have several resources available to help you, including:
- Four simple steps for protecting you and your family in your daily lives
- The top three online threats to your children and what you can do about them
- The methods criminals use for gaining information about you and your family
If you’re interested in participating in this week’s activities, visit the NCSAM Activity Page, where you can also find online safety tips, interesting trends, and blog posts.
Remember: security depends on you – Know it. Own it. Protect it.
