Oct 2nd we prevented an attack on an Okta account. Forensics led us to believe that the point of entry was actually due to a compromise within Okta's Support environment. Okta has now confirmed that to be the case, other customers affected.
@KimZetter
Our team prevented an attack on Oct 2nd and escalated within Okta the belief that the attack was made possible because Okta themselves had been compromised. Further technical details in our blog here:
"We don't have IIS so..." The issue is there if you have anything leveraging http.sys. E.g. Run netsh http show servicestate (check port/pid to find http.sys process mappings). Enterprises will have a variety of WinRm, FDResPub, WIA, Spooler, Razer, etc.
Reminder with
#PrintNightmare
you can drop your .dll to any valid Print\Environments. E.g. Windows NT x86 (W32X86) and then call RpcAddPrinterDriverEx with that path directly. Old/new copy will still take place in x64 but worth checking the nuance in case that is avoidable.
Excited to be back at
@BeyondTrust
building on all of the great progress that's been made. Thank you to the infosec teams that invited me in to work along side them the last few years. I will bring that empathy forward with what I do next.
@LBPD_PIO_45
@KimZetter
@LagunaBeachPD
I drive that road often in my Tesla, would never use autopilot there. Autopilot is great on established freeways as a lane guided cruise control with 100% attention. People clearly cant be trusted to pay attention, software should narrow scenarios where autopilot can be enabled.
Infosec teams who chase individual vulnerabilities more than they control their attack surface, will always be softer targets. Control your attack surface. E.g. Do more things like this:
And disable spooler, what are you doing printing in 2021 anyways? :)
You can debate what happened during Kavanaugh's teenage years but there is zero debate about the grown man sitting in front of the senate right now coming off like an entitled petulant frat kid, and not displaying the character of an person that should sit on the Supreme Court.
@KimZetter
covered, in Countdown to Zero Day, how I hacked into a water plant in ~2011. Hardest part was figuring out from a plant engineer what all evil I could have done. Sounds like someone figured that out...
I was recently interviewed on
@VICENews
where we discussed hacking as a career path.
@BiaSciLab
clearly shows the future is amazing and vibrant, with a strong glow of terminal green.
Good work
@Sahad_nk
surprised we do not see more hijacking of abandoned azurewebsites and related. Reminds me of phone phreaks leveraging abandoned numbers back in the day.
@0xdabbad00
when you want a break from AWS, Azure ready for you. :) via
@safetydet
I had the pleasure of working with
@ohjeongwook
for many years at eEye. He is one of the kindest and most brilliant people I have had a chance to work with. Check out his new company and the training/etc they offer!
Just made a new company: - starting as a Security Intelligence and Training Platform Company. Very early phase but we are opening new curriculums teamed up with other security and machine learning experts. Stay tuned and contact me for potential service.
That moment your fiancee takes you for bday to dive bar and the band ends with NiN and Tool covers. It is going to be alright. Miss you brother Barns. Cannot burn enough pianos but I'll try.
@KimZetter
One of my favorite versions of this was sending an employee flowers. Sat on their desk with better access to WiFi and more importantly a ton of crappy office Bluetooth devices.
Are you following our Podcast "Adventures of Alice & Bob"? Don't miss this week's insightful and candid chat with the one & only
@shehackspurple
. Full episode with Tanya can be found wherever you listen or
E.g. Drop to spool\drivers\W32X86
pEnvironment: Windows NT x86
pDriver: ntprint_inf_x86 (Get-PrinterDriver for valid x86 paths)
pConfig: syswow64\kernelbase
Then recall normal x64 exploit against the .dll you dropped in spool\drivers\W32X86 etc...
@Laughing_Mantis
This was the local news thing that Derek and I did. He leveraged his CSRSS privesc, Vista specific, but paired it with your MSPUB vuln (at time not patched by MS) so we could make the “hacking vista” more complete/interesting to average users.
The SolarWinds “intern password” is more noteworthy as it relates to the ransomware groups that have been targeting managed IT companies vs. being at all useful to measure advanced intel. team operations.
@Laughing_Mantis
Seriously watching you discover your second (real :)) Office vuln that weekend was one of the happiest moments of my career. Whole team was on it but everyone was without a doubt hoping it would be you, knowing how much it would mean to you. Love you dude, thanks for sharing that
2002 I found an RCE in NAI's PGP Outlook plug-in. Victim views email, attacker executes code. 2018 *steal victims email*, send back to them repeatedly to decrypt.
#efail
like most named vulns, is an example of progress in security or the continued decline of public vuln research.
I was recently interviewed on the
@moderncto_io
podcast by Joel Beasley. They did their homework, even asked about one of the times I got cursed out on the phone by a leader of Microsoft’s security team.
Something weirdly nostalgic about this... my buddy and I ditching class to go see what new hits we had in PhoneTag. Personally think it would be hilarious if there are some kids out there zoom dialing while they are stuck home during lockdown.
Automated Zoom conference meeting finder 'zWarDial' discovers ~100 meetings per hour that aren't protected by passwords. The tool also has prompted Zoom to investigate whether its password-by-default approach might be malfunctioning
@egyp7
@scriptjunkie1
Reminds me of failing my typing class in 9th grade. I was faster than the teacher but did not use home row so I was told I was goofing around. Which I guess if someone was hacking the districts VMS during class that would count as goofing around? 🤔
@0vercl0k
@HenkPoley
Nice POC
@0vercl0k
! For others asking about other processes bound via http.sys: netsh http show servicestate - correlate listener url to PID/software etc. netsh http show urlacl - is also useful.
@dugsong
@cnoanalysis
Generation later infosec companies still define anomaly as "Something bad![tm]" vs. "something different, abnormal, peculiar, or not easily classified." And is adding keywords like chocolatey to your PowerShell command line, to bypass popular EDR solutions, the new fragmentation?
@DennisF
@TheBrianDonohue
@DennisF
getting his Larry King on! That was fun to listen to again. I particularly like my snarky old guy comment about the kids having it easy with LinkedIn whereas we had to put on some old clothes and jump into corporate trash dumpsters.
Most orgs barley control what binaries are on their systems let alone the nuance of legitimate apps having their configuration modified to make them work as a backdoor. Whether it be this example of Absolute Software Lojack, Tanium, AD/SS, backup software... the list goes on.
Lojack, the software companies embed in employee computers to track their location if stolen, was found to contain callback references to malicious command-and-control servers known to be used by the Russian nation-state hacking group Fancy Bear
netsh http show urlacl is also a helpful command. If you work in offense or defensive you should understand the nuance of how http.sys works. You know, bypassing some EDR among other things.
@4Dgifts
@ortegaalfredo
@mis2centavos
Ah nice, we should definitely have more voting security hinge on the ability for people to write file parsers - let alone not leverage outdated ones. :-p
@Laughing_Mantis
@khaxan
Is this where I quote top gun and say you can be my wing man any day? Or like we go roller blading through grand central? I would not break myself on roller blades for many people, would for
@Laughing_Mantis
though.
@dugsong
Guttermouth, 98ish, first time crowd surfing also. Learned quick that a song ending drops you faster than gravity (punk physics, don't question it).
@bascule
I feel that! Strict egress filtering/detection on servers feels timeless as a 'good security thing' (tm). The Rainbow Books are covered in the tears of those who have never learned security physics or maybe security first principals or maybe I dunno but egress filtering is cool.