Blog

clearinfosec.com ↗

Author: Clear Infosec

  • THM Walkthrough – Vulnversity Part 2

    THM Walkthrough – Vulnversity Part 2

    In this blog as promised last time we will compromise the webserver with Burp Suite.

    Task 4: Compromise the webserver

    I have tried uploading few extensions like .jpeg, .txt, .php etc but it was blocking my uploads.

    Now we need to find out extension that can be successfully uploaded. To do that Option 1 is to do this process manually by uploading file and if the website rejects it then upload another file with different extension and keep repeating this process until something gets through. But its tedious, time consuming and no fun as I have already tried with few files.

    So, for this we will use Option 2 which is the Fuzzing technique. For that my go to tool is Burp Suite.

    Burp Suite:

    For this blog I am using free “Community” edition which comes preinstalled with Kali.

    If you are suing Burp for the 1st time, then you need to configure your we browser to use it. For that please refer https://portswigger.net/burp/documentation/desktop/getting-started/proxy-setup/browser

    Also don’t forget to install Installing Burp’s CA certificate. https://portswigger.net/burp/documentation/desktop/getting-started/proxy-setup/certificate

    Last and optional step of burp setup is configuring some add-on that will allow you to easily switch between web proxies with a single click. For my Firefox browser I am suing FoxyProxy. https://addons.mozilla.org/en-US/firefox/addon/foxyproxy-standard/

    Below is my configuration for Burp proxy. 

     

    So now using this add-on, I can easily switch to Burp with a simple click when needed.

    Now lets move on to part where we will have some hands-on action with Burp.

    Here we will use Intruder to fuzz the Vulversity website upload function and find out which extension is accepted.

    Intruder has 4 types of Attack: Sniper, Battering ram, Pitchfork, Cluster bomb. Out of them Sniper attack is most suitable here.

    Burp Intruder Sniper Attack:

    Sniper – This uses a single set of payloads. It targets each payload position in turn, and places each payload into that position in turn. Positions that are not targeted for a given request are not affected – the position markers are removed and any enclosed text that appears between them in the template remains unchanged.

    This attack type is useful for fuzzing a number of request parameters individually for common vulnerabilities. The total number of requests generated in the attack is the product of the number of positions and the number of payloads in the payload set.

    Step 1: Start a New/Temporary Project on Burp Suite. Go to Target and set up scope. Add Vulnversity IP address. http://10.10.249.116:3333

    If you also get this Proxy History logging, click yes and move on. So now we can see that the target is added in the scope.

    Step 2: Go to Target > Site map > click on Filter and you will get following options.

    Here select show only in-scope item filter.

    Step 3: Go to Proxy and click on Intercept tab and ensure that interception is on (if the button says “Intercept is off” then click it to toggle the interception status).

    Step 4: Now before visiting to Vulnversity website it’s a good idea to go to Proxy > HTTP History tab. Click on filter and enable show only in scope items.

    Step 5: Go to Foxy Proxy and turn the Burp on

    Step 6: Now, Go to vulversity site and upload any extension file on that. I am uploading Pwd.txt file here.

    Step 7: Now check in Proxy > HTTP History. You must have a captured a POST request for file upload on  vulnversity site internal upload page.

    Select that and send it to Intruder sing right click.

    Step 8: When you go to Intruder > Positions tab, you will find following.

    Clear § – This removes all position markers, either from the entire template or from the selected portion of the template.

    Here click on clear which will clear all 3 selected payload positions like Filename, contents of file, Submit.

    Step 9: Now only select extension of a file, in my case I have selected “txt” and click on add which will insert a new payload marker for extension of file.

    Add § – If no text is selected, this inserts a single payload marker at the cursor position. If you have selected some text, a pair of markers are inserted enclosing the selected text.

    Step 10: Now Go to Intruder > Payloads tab. Check for Paylod set selections as below.

    Step 11:  Now here we can either create our own simple word list file with all possible extensions and upload that or can also add few manually in payload options. But I know very good GitHub Repository which has many possible and common files of word lists for different purposes. We will also be using this for other tasks in this blog. https://github.com/danielmiessler/SecLists

    I have cloned it in my Kali machine.

    Step 12: Click on the load button and Select payload.

    Here I am using extensions-most-common.fuzz.txt file.

    As you can see content of file is loaded here in Payload options. So this sniper attack will try to upload this 30 extensions to find out which one works.

    Step 13:  Click on start attack. Once Sniper attack starts, and it will take few sec to run and will provide us with following results.                                              

    Here when checking a length column for each file extension type, we can see that .phtml stands out. Yei..!!! Attack successful. So using fuzzing technique and sniper attack, now we know that this website allows only .phtml file uploads.

    Quick google search about What is a PHTML file gave me following:

    Files with the .phtml extension are most commonly associated with PHP Web pages. The PHTML files contain PHP code that is parsed by a PHP engine. This allows the Web server to generate dynamic HTML that is displayed in a Web browser. The PHTML files are often used to access databases. The pages containing the PHTML code are usually displayed with the .php page extension.

     

    Using Reverse Shell:

    Now we will use a PHP reverse shell payload. A reverse shell works by being called on the remote host and forcing this host to make a connection to you. So you’ll listen for incoming connections, upload and have your shell executed which will beacon out to you to control!

    There are many php reverse shell you can use but the one we will use is by provided by pentestmonkey on Github.

    You can use the one which is available in Seclists which we just downloaded. You can find it in Web shells directory.

    But this machine instructed us on using following so we will go with that for this walkthrough. There are many php reverse shell you can use but the one we will use is by provided by pentestmonkey on Github.

    https://github.com/pentestmonkey/php-reverse-shell

    Download it to /usr/share directory.                                                        

    Checking if its cloned correctly.

    Since I am using this pentestmonkey’s reverseshell 1st time, so i was curious about what it does and how it works so I decide to check out code.

    And here I found out that loopback address is specified in the IP address and we have to change that. But 1st lets analyze the rest of the code.

    Okay so after going through this script, now we know that it will make an outbound TCP connection to a hardcoded IP and port and the recipient will be given a shell running as the current user (Apache normally).

    Now coming back to changes for IP Address, I must change it to my current IP address of my local machine. For this use Command: ifconfig

    For port number you can specify any port.

    While saving the changes I have Saved file using the “phtml” extension that we discovered with our sniper attack.

    Yes, it’s here.

    Uploaded php-reverse-shell.phtml.

    Yes..!!! That’s uploaded successfully as expected.

    Now we are one step closer to hacking the Vulnversity machine.

    Stay tuned for Next part where, we will find out where that file is being uploaded. Then connect to the machine using php reverse shell and try to find out user flag and root access through privilege escalation. Till then, Happy Hacking..!!!

    References:

    https://portswigger.net/burp/documentation/desktop/tools/intruder

  • Optimum – HackTheBox Walkthrough – Part 2

    Optimum – HackTheBox Walkthrough – Part 2

    As we saw in the first part of this Optimum walkthrough, it is a beginner-level machine that is more of an enumeration of services with known exploits. These exploits are easy to work out and get the flag.

    Let us continue from where we left.

    As I had an issue with Windows-Exploit-Suggester I am using Metasploit to do privilege escalation.

    msf6 exploit> use post/multi/recon/local_exploit_suggester

    before using the post-exploitation, we have to know the session

    then set the session in my case

    >set SESSION 1

    Sherlock

    PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities: https://github.com/rasta-mouse/Sherlock/

    We have to import the Sherlock script to Powershell to execute it.  DO NOT USE SHELL !! it won’t work. Use Powershell

    meterpreter> powershell_import /home/kali/Downloads/Sherlock/Sherlock.ps1

    meterpreter>powershell_execute Find-AllVulns

     Title      : User Mode to Ring (KiTrap0D)

    MSBulletin : MS10-015

    CVEID      : 2010-0232

    Link       : https://www.exploit-db.com/exploits/11199/

    VulnStatus : Not supported on 64-bit systems

     

    Title      : Task Scheduler .XML

    MSBulletin : MS10-092

    CVEID      : 2010-3338, 2010-3888

    Link       : https://www.exploit-db.com/exploits/19930/

    VulnStatus : Not Vulnerable

     

    Title      : NTUserMessageCall Win32k Kernel Pool Overflow

    MSBulletin : MS13-053

    CVEID      : 2013-1300

    Link       : https://www.exploit-db.com/exploits/33213/

    VulnStatus : Not supported on 64-bit systems

     

    Title      : TrackPopupMenuEx Win32k NULL Page

    MSBulletin : MS13-081

    CVEID      : 2013-3881

    Link       : https://www.exploit-db.com/exploits/31576/

    VulnStatus : Not supported on 64-bit systems

     

    Title      : TrackPopupMenu Win32k Null Pointer Dereference

    MSBulletin : MS14-058

    CVEID      : 2014-4113

    Link       : https://www.exploit-db.com/exploits/35101/

    VulnStatus : Not Vulnerable

     

    Title      : ClientCopyImage Win32k

    MSBulletin : MS15-051

    CVEID      : 2015-1701, 2015-2433

    Link       : https://www.exploit-db.com/exploits/37367/

    VulnStatus : Not Vulnerable

     

    Title      : Font Driver Buffer Overflow

    MSBulletin : MS15-078

    CVEID      : 2015-2426, 2015-2433

    Link       : https://www.exploit-db.com/exploits/38222/

    VulnStatus : Not Vulnerable

     

    Title      : ‘mrxdav.sys’ WebDAV

    MSBulletin : MS16-016

    CVEID      : 2016-0051

    Link       : https://www.exploit-db.com/exploits/40085/

    VulnStatus : Not supported on 64-bit systems

    Title      : Secondary Logon Handle

    MSBulletin : MS16-032

    CVEID      : 2016-0099

    Link       : https://www.exploit-db.com/exploits/39719/

    VulnStatus : Appears Vulnerable

     

    Title      : Windows Kernel-Mode Drivers EoP

    MSBulletin : MS16-034

    CVEID      : 2016-0093/94/95/96

    Link       : https://github.com/SecWiki/windows-kernel-exploits/tree/master/MS16-034?

    VulnStatus : Appears Vulnerable

     

    Title      : Win32k Elevation of Privilege

    MSBulletin : MS16-135

    CVEID      : 2016-7255

    Link       : https://github.com/FuzzySecurity/PSKernel-Primitives/tree/master/Sample-Exploits/MS16-135

    VulnStatus : Appears Vulnerable

    Title      : Nessus Agent 6.6.2 – 6.10.3

    MSBulletin : N/A

    CVEID      : 2017-7199

    Link       : https://aspe1337.blogspot.co.uk/2017/04/writeup-of-cve-2017-7199.html

    VulnStatus : Not Vulnerable

    There are only 3 exploits that seem to work MS16-135, MS16-032, MS16-034.

    Out of three only MS-16-032 – This module exploits the lack of sanitization of standard handles in Windows’ Secondary Logon Service. The vulnerability is known to affect versions of Windows 7-10 and 2008-2012 32 and 64 bit. This module will only work against those versions of Windows with Powershell 2.0 or later and systems with two or more CPU cores.

    Now let’s see if the exploit is available in Metasploit

    >search ms16-032

    We got the exploit so now set the necessary options and don’t forget to set the session. Without setting the session the exploit will not work

    EXPLOITED !!!  We got the session perfectly and after checking the id

    >getuid

    Server username: NT AUTHORITY\SYSTEM

    Now finally to get the flag we have to go to the administrator folder

    >type\Users\Administrator\Desktop\root.txt

    We successfully pwned(owned) the system.

     You can also use this exploit https://www.exploit-db.com/exploits/41020/

  • THM Walkthrough – Vulnversity Part 1

    THM Walkthrough – Vulnversity Part 1

    I am back with my favorite type of blog which is walkthrough of THM machine. In this machine we will Learn about active recon, web app attacks and privilege escalation. We will also learn how to attack using burp suite Intruder.

    Task 1: Deploy the machine 

    Got Connected to THM server and OpenVPN Servers and deployed Vulnversity machine.

    Task 2 : Reconnaissance

    Using Nmap for this with command: namp -T4 -sC -sV -vv <IP>

    As we can see here in the namp Scan results,
    • We found 6 open ports.
    • Squid http-proxy is open on port 3128
    • http is open on port 3333
    • They are using OS Ubuntu Linux
    As ftp is open on port 21, lets try to connect:

    Both of them are password protected. So we should try other ways.
    From namp scan we also got that http is running on port 3333. Let’s browse it to find out what do we have:

    Task 3: Locating directories using GoBuster

    Now that we have a website access, Lets start scanning the website to find any hidden directories. Here this machine required us to use GoBuster tool for that but you can use any other tool. Check Out my  Rick & Morty Blog I have used dirbuster tool for same purpose. 

    GoBuster is a tool used to brute-force URIs (directories and files), DNS subdomains and virtual host names. For this machine, we will focus on using it to brute-force directories.

    If you are like me and don’t have gobuster installed in your system, Download GoBuster here, or run sudo apt-get install gobuster

    But when I tried to install it, I was having following issues:

    I tried to troubleshoot by checking and adding source repositories to source file /etc/apt/sources.list (It Can be found here: https://www.kali.org/docs/general-use/kali-linux-sources-list-repositories/)

    But again, got same error message. Then I thought of cloning it from git repository.

    Still it was not getting installed. Upon investigating further got to know that my system was lacking Go language.

    Since this tool is written in Go language we need to install the Go language/compiler/etc. Full details of installation and set up can be found on the Go language website. Once installed, we need at least go 1.16.0 to compile gobuster.

    This is one way to do it or you can directly go to https://github.com/OJ/gobuster/releases and install this latest release ( at the time of writing this blog, I have used this: gobuster-all.7z ) which comes with everything we need to make gobuster work like go language and compiler.

    Finally got my Gobuster installed and running:

    Now to get started with directory search, we will need a wordlist for GoBuster (which will be used to quickly go through the wordlist to identify if there is a public directory available. If you are using Kali Linux you can find many wordlists under /usr/share/wordlists.)

    Command: gobuster dir http://<IpAddress>:<Port> <Path To Wordlists>

    gobuster dir -u http:// 10.10.135.231:3333 -w /usr/share/wordlists/dirb/common.txt

    dir: uses directory/file brute forcing mode

    -u: the target URL or domain

    -w: path to word list

    After Checking, Out of all this results, found something interesting in /internal page.

    Yes your guess is right…!!! It’s a File upload Vulnerability.

    In this part of the blog, I have completed Task 1,2 & 3 of the vulnversity machine.

    In next part we will learn how to compromise the web server. We will also use Application security testing tool, Burp Suite and I will show you step by step process to execute Burp suite Intruder attack, so we can compromise Vulnversities webserver and get user flag. It will be interesting so stay Tuned for next part. Until then, Happy Hacking…!!!

  • Optimum – HackTheBox Walkthrough

    Optimum – HackTheBox Walkthrough

    Optimum is a beginner-level machine that is more of enumeration of services with known exploits. These exploits are easy to work out and get the flag. We will be having two parts in this blog. This is the first part

    Tools Used:

    • Nmap
    • Metasploit
    • Windows Exploit Suggester

    $ sudo nmap -sSV -T5 -p- 10.10.10.8 –allports

    We can see that only PORT 80 is open. HttpFileServer (HFS) version 2.3 is running on the webserver.HFS rejetto is an open-source file-sharing webserver. The latest version is 2.3m but this machine runs on version 2.3 which is outdated and vulnerable. After a quick google search, I found this version has multiple Remote Code Execution.

    As always, I opened my Metasploit and searched if there is a pretty good exploit. I got an excellent RCE. let’s try it and see if the magic works.

    I did a mistake while setting options, I didn’t add SRVHOST and SRVPORT. So, it simply did not open the meterpreter session. After checking the options I came to know SRVHOST option is used when exploiting a webserver.

    I mentioned SRVHOST and SRVPORT and it worked perfectly.

    At last, I got the session, and let’s check what we can extract. I checked for the system info and got a bunch of information.

    The machine runs in windows 2012 R2 and x64 architecture. Also, the build is 6.3 9600 which is a pretty old version. If this is not well patched, we can easily exploit and gain access.

    Now I want to view the full system information. So I opened the shell and gave the command systeminfo and got the below information

    Microsoft Windows [Version 6.3.9600]

    (c) 2013 Microsoft Corporation. All rights reserved.

     C:\Users\kostas\Desktop>systeminfo

    systeminfo:

    Host Name:

     OPTIMUM

    OS Name:  

     Microsoft Windows Server 2012 R2 Standard

    OS Version:               

    6.3.9600 N/A Build 9600

    OS Manufacturer:          

    Microsoft Corporation

    OS Configuration:        

     Standalone Server

    OS Build Type:

     Multiprocessor Free

    Registered Owner:          

    Windows User

    Registered Organization: 

     

    Product ID:              

     00252-70000-00000-AA535

    Original Install Date:

    18/3/2017, 1:51:36

    System Boot Time:        

     9/9/2021, 8:20:21

    System Manufacturer:

    VMware, Inc.

    System Model:             

    VMware Virtual Platform

    System Type:              

    x64-based PC

    Processor(s):             

    1 Processor(s) Installed.

                             

     [01]: AMD64 Family 23 Model 49 Stepping 0 AuthenticAMD ~2994 Mhz

    BIOS Version:

    Phoenix Technologies LTD 6.00, 12/12/2018

    Windows Directory:

    C:\Windows

    System Directory:

    C:\Windows\system32

    Boot Device:       

    \Device\HarddiskVolume1

    System Locale:            

    el;Greek

    Input Locale:             

    en-us;English (United States)

    Time Zone:                

    (UTC+02:00) Athens, Bucharest

    Total Physical Memory:   

     4.095 MB

    Available Physical Memory:

    3.492 MB

    Virtual Memory: Max Size: 

    5.503 MB

    Virtual Memory: Available:

     4.951 MB

    Virtual Memory: In Use:   

    552 MB

    Page File Location(s):    

    C:\pagefile.sys

    Domain:                   

    HTB

    Logon Server:            

     \\OPTIMUM

    Hotfix(s):                

    31 Hotfix(s) Installed.

                          

    [01]: KB2959936

     

    [02]: KB2896496

     

    [03]: KB2919355

     

    [04]: KB2920189

     

    [05]: KB2928120

     

    [06]: KB2931358

     

    [07]: KB2931366

     

    [08]: KB2933826

     

    [09]: KB2938772

     

    [10]: KB2949621

     

    [11]: KB2954879

     

    [12]: KB2958262

     

    [13]: KB2958263

     

    [14]: KB2961072

     

    [15]: KB2965500

     

    [16]: KB2966407

     

    [17]: KB2967917

     

    [18]: KB2971203

     

    [19]: KB2971850

     

    [20]: KB2973351

     

    [21]: KB2973448

     

    [22]: KB2975061

     

    [23]: KB2976627

     

    [24]: KB2977629

     

    [25]: KB2981580

     

    [26]: KB2987107

     

    [27]: KB2989647

     

    [28]: KB2998527

     

    [29]: KB3000850

     

    [30]: KB3003057

     

    [31]: KB3014442

    Network Card(s):          

    1 NIC(s) Installed.

     

    [01]: Intel(R) 82574L Gigabit Network Connection

     

    Connection Name: Ethernet0

     

    DHCP Enabled:    No

                                    

    IP address(es)

                                    

    [01]: 10.10.10.8

    As I go the full sysinfo, Here I used the Windows-Exploit-Suggester as this is Windows server 2012 R2. So before we run this exploit I have to download the system info in a text file and run it with the windows exploit suggester.

    meterpreter> execute -f “cmd.exe /c systeminfo>sysinfo.txt”

    After downloading and saving it in my local I used the sysinfo with exploit suggester.

    $ python2 windows-exploit-suggester.py –database 2017-08-27 -mssb.xls –systeminfo /location of the txt file you downloaded

    But it threw an error mentioning excel(xls) library. I tried to update the windows exploit suggester but that didn’t work

    $ python2 windows-exploit-suggester.py –update

     

    Here I like to mention that there are two ways, one is windows exploit suggester and another one is using Metasploit exploit suggester. I am trying to use Windows exploit suggester as this is a new tool I’m working on.

    I am currently troubleshooting the error and will fix this and show you guys both the exploit suggester in the next part

  • Managing Vulnerabilities

    Managing Vulnerabilities

    Contents:

    1. Introduction
    2. Vulnerability Statistics – 2021
    3. Risk – Threat – Vulnerability
    4. Model for Vulnerability Management
         a. Capability Maturity Model certification (CMMC) framework
         b. SANS Vulnerability Management Maturity Model
    5. Vulnerability Management best practices
    6. Final Thoughts

    The year 2020 has been a tough year for the most. With a greater level of optimism, we have stepped into 2021 which is not much different from 2020. But we have learned to adapt to the changes around us.
    The remote working shift was the biggest challenge for every business across the globe, changing entirely the way businesses work and how the workforce connects to their workplace. It increased the attack surface of IT infrastructure.
    An attack surface is the entire network and software environment that is exposed to remote or local attacks. It can also be explained as the different ways through which an application or network can possibly be exploited by a bad actor. No doubt that no business wants to expose itself to such risks and the workforce moved out of the secure zone left them with a wider attack surface.

    Vulnerability Statistics – 2021

    Leaving behind a vulnerability unnoticed can cause harm that is beyond our expectation as it is through exploiting the vulnerabilities, the bad actors gain access to your systems. Cybersecurity statistics say that in 2020, the number of vulnerabilities published is more than 18000, which is higher than the preceding years.

    The below graph shows the number of Common Vulnerabilities and Exposure (CVE) found over the years. 88% of the CVE’s existing now are at least  0-5 years old.

    Credits: Edgescan

     

    Risk – Threat – Vulnerability

    Risk, Threat, and Vulnerability are almost related terms that signify different things.

    In cybersecurity, Vulnerability is a weak spot which a bad actor can exploit and gain unauthorized access to one’s system. With the gained access, they can install malware and can get their hands on the sensitive data and that is not something an organization will expect to happen.

    A threat can be any event, action, or circumstance that exploits a vulnerability, causing damages. The objective is to gain unauthorized access to sensitive systems or data. The person causing the threat can be the threat actor who takes advantage of the vulnerabilities. When a threat actor exploits a vulnerability, which can give him unauthorized access posing potential damage or loss is a Risk.

    Organizations must adopt strategies that increase the visibility of vulnerabilities and risk mitigation to reduce the attack surface and risk exposure.

    Model for Vulnerability Management

    SANS has developed a Vulnerability Management Maturity Model from the Capability Maturity Model Integration (CMMI) with a goal to provide insight and guidance in the areas important to Vulnerability Management. This maturity model is not intended to resolve all your problems but to categorize them into more manageable pieces for you to handle them easily. Let us look into the levels of CMMI first and then move to SANS Vulnerability Management Model.

     Capability Maturity Model certification (CMMC) framework

    This is a proven industry framework to improve product quality and development efficiency for both software and hardware. It is sponsored by the Department of Defence (DoD) in co-operation with Carnegie Mellon University and Software Engineering Institute (SEI).

    This model uses 5 levels to describe the maturity of organizations. It provides the organizations with a way to focus and manage hardware and software development from product inception through deployment and maintenance. At present, your organization can be at any level of this model. It is always better to start from where you are and move up.

    Level 1:

    This level involves organizations performing a set of specified practices. Thus, it deals with processes that are maintained in an ad-hoc manner. Processes can be unpredictable, poorly controlled, and reactive. It may not even meet the specific objectives as it may not be stable.

    Level 2:

    This level involves organizations that establish and document practices & policies to implement their CMMI efforts. Thus, it deals with managed processes that are planned and executed in accordance with policies by skilled people.

    Level 3:

    This level involves organizations to establish, maintain and resource a plan demonstrating management of activities for process implementation. Thus, it deals with defined processes that are well understood, deployed, and executed proactively.

    Level 4:

    This level involves organizations to review and measure practices of effectiveness. Thus, it deals with processes that are measured and controlled well. This enhances the detection and response capabilities to address and adapt to varying tactics, techniques, and procedures.

    Level 5:

    This level involves organizations to standardize and optimize process implementation. Thus, it focuses on continuous quantitative improvements. It increases the depth and sophistication of cyber security capabilities.

    SANS Vulnerability Management Maturity Model

    Credits: SANS Institute

    Prepare

    Preparation is the first and vital part of a vulnerability management program. The team must figure out all the assets, the key assets that need to be protected, their importance, plan for evaluating the vulnerabilities, and knowing how to treat them. The accepted vulnerabilities should also be included to ensure the acceptance of its risk.

    Identify

    The team should finalize all the assets that need to be evaluated in the preparation step itself and identifying the key assets is the second one. Those have critical data stored in them, those have critical uptime required, etc. Not just the assets, but the access paths to them should also be included in the evaluation process. With the assessments and scans, the vulnerabilities in all assets are identified.

    Analyze

    Right after identifying the vulnerabilities, what needs to be done is evaluating them and prioritize them according to the risk each of them possesses. This gives an idea of the security posture of the assets and environment. The level of impact is evaluated, and the priority of which needs to be treated first is decided based on it. This process can be simple as running a scan to a complex set of processes to evaluate all the controls that are already in place.

    Communicate

    Most organizations prefer to jump into treating the vulnerabilities right when they are discovered, avoiding this step. The vulnerability management team must sit and discuss with the Ops team, Sys Admins and executives, etc to plan on how and when to treat the vulnerabilities. Validate all the vulnerabilities found with the team. This will keep everyone in the team know about what is going on and prevents human errors to a great extent.

    Treat

    This is the ultimate goal of a vulnerability management program where the vulnerabilities are treated to reduce the risk. This is not actually a final step as this entire thing is a cyclic process. After validating vulnerabilities that hold a potential risk to the organization, the next step involved is to find ways to patch the vulnerabilities.

    • Remediation involves nothing but patching the vulnerabilities so that a bad actor cannot exploit them.
    • Mitigation is a process of adopting measures that can lessen the impact of an attack if a bad actor exploits that vulnerability. It can always be adopted as a temporary solution until a patch is available.
    • Acceptance involves taking no actions to fix the flaw or lessen the impact. Vulnerabilities that can be marked as acceptable ones are those that possess low risk, and the cost of fixing is higher than the expense incurred if it is exploited.

     

    Identifying and Analyzing vulnerabilities

    Finding and Evaluating vulnerabilities needs an efficient team and skilled professionals to perform assessments, choose the best tools, deploy an attack simulation, etc.

    Many are still mistaken that Vulnerability assessments and Penetration testing is all that vulnerability management is consisting of. But the reality is very far from that as they both are just processes involved. But Red teaming is entirely different which involves security professionals manipulating your workforce and using all possible ways and technologies to compromise your system security.

    Vulnerability Assessment

    It is done with the use of tools either automated or manual against a system, network, application, etc. A detailed raw scan report will be available after the scan with all the vulnerabilities found and with descriptions and all. All the vulnerabilities need to be verified manually to confirm a true positive.

    Penetration Testing

    Performing Vulnerability assessments alone will not be much effective as it gives you only a list of vulnerabilities that your system has. In pen tests, the vulnerabilities are exploited and tried to leverage the access obtained to dig deep into your systems. Only a Penetration test will show you which of those listed vulnerabilities need immediate actions and thus helping you to categorize them all.

    Red Team

    The above-mentioned methods are all technical evaluations. But Red Teaming is entirely different, and it aims to get into your systems by any method using any possible means (within legal limits). It is a kind of real-world attack simulation where the team will try to exploit your vulnerabilities of systems by technical means as well as workforce by their social engineering skills.

    Vulnerability Management best practices

    Organizations with a proactive and pre-emptive strategy to secure their systems, networks, and applications will be able to stay safer from cyber threats. But with today’s evolving technologies, the attackers, as well as attacks, are so advanced that they can even bypass some of the advanced security methods.

    We have seen in our previous blog, Infosec insights to the new normal, that cybersecurity is not just an IT team’s job now and it is not some random rules to follow blindly. Let’s look at some best practices for improving your vulnerability management program.

    1. Schedule scans regularly
    2. Scan every device and endpoint
    3. Document all the scan result
    4. Ensure detected critical vulnerabilities are taken care of
    5. Follow the risk-based prioritization
    6. Empower your IT team and entire workforce with desired security training
    7. Frequently review the test results and the entire program

    Final Thoughts

    An efficient vulnerability management program enables you to address the growing cyber risks and will give confidence in your Infrastructure integrity, availability of system, and confidentiality of your sensitive information. No need for a complicated set of security tools and all to improve your cybersecurity posture. The right vendors and a team of skilled security professionals can shoulder the responsibilities and make your pursuit of information security less toil.

     

    Leave no vulnerabilities open to attackers or malware.

     

    Reference:

    1. SANS Vulnerability Management Resources
    2. Tripwire – Successful Vulnerability Management
    3. Edgescan Vulnerability Statistics Report – 2021
    4. Daniel Miessler Blog on Vulnerability Assessments, Pen Tests, Red Teaming and Bug Bounties
    5. ThreatSketch –(Threat -Assessment-Vulnerability-Risk model)
    6. CMMI Framework

  • CISA’s Top 30 Bugs from oldest to recent : Get patch immediately

    CISA’s Top 30 Bugs from oldest to recent : Get patch immediately

    Government agencies in the US, UK, and Australia are encouraging public and private-sector organizations to secure their networks by ensuring firewalls, VPNs, and other internally connected devices are patched against the most widespread cyber threats.

    Globally, cyber criminals continue to target a wide range of targets, including public and private sector organizations, by exploiting publicly known and often outdated software vulnerabilities. Companies can mitigate these vulnerabilities by applying patches and implementing a centralized patch management system to their systems worldwide.

    According to the US Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre (ACSC), the United Kingdom’s National Cyber Security Centre (NCSC), and the US FBI, “ Almost all of the top vulnerabilities that were exploited last year have been revealed in the past two years., A 2017 vulnerability is among the top 30 most exploited vulnerabilities in 2021, almost seven months later.”

    Agencies says Cybercriminals will continue to exploit older known vulnerabilities, such as CVE-2017-11882, as long as they remain effective and unpatched systems are not patched. In addition to complicating attribution, the use of known vulnerabilities by potential actors reduces costs and minimizes risk because they are not investing in developing a zero-day exploit for their exclusive use, which they risk losing if it becomes known.”

    CVE-2017-11882 gets the highest attention due to the stack buffer overflow in equation editor of Microsoft Office which leads to remote code execution (RCE). Vendors have been warning about this exploit for years. The frequency is so high for an organization in 2020 using their devices and technology connected to networks without patching leads to the top four most exploited vulnerabilities which were discovered between 2018 to 2020.

     

    Top four Vulnerabilities:

    • CVE-2019-19781: a critical bug in the Citrix Application Delivery Controller (ADC) and Citrix Gateway that left unpatched outfits at risk from a trivial attack on their internal operations. According to a report published in December 2020, 17 percent of companies were unpatched. That is about one in five of the 80,000 companies.
    • CVE 2019-11510: a critical Pulse Secure VPN flaw exploited in several cyberattacks that targeted companies that had previously patched a related flaw in the VPN. In April 2020, the Department of Homeland Security (DHS) advised users to change their passwords for Active Directory accounts, because the patches were released too late and bad actors were able to compromise those accounts.
    • CVE 2018-13379: a path-traversal weakness in VPNs made by Fortinet that was discovered in 2018 and which was actively being exploited as of a few months ago, in April 2021.
    • CVE 2020-5902: a critical vulnerability in F5 Networks’ BIG-IP advanced delivery controller networking devices that, as of July 2020, was being exploited by attackers to scrape credentials, launch malware, and more.

    2020 Top 13 Exploited Vulnerabilities:

    1. Citrix: CVE-2019-19781 : The Citrix NetScaler RCE, which debuted over Christmas in 2019, is at the top of the list because of gaining access to a Defense recruitment database that hit close to home for Aussies.

    2. Pulse: CVE-2019-11510 : Pulse Secure Connect where an attacker can run arbitrary scripts on any host that connects to the VPN once they have gained access to it. Anyone who connects to the VPN could be a potential target for a hacker.

    3. Fortinet: CVE-2018-13379 : Fortinet’s version of a directory traversal bug can lead to an attacker gaining usernames and passwords. “Multiple malware campaigns have taken advantage of this vulnerability. The most notable being Cringe ransomware (also known as Crypt3, Ghost, Phantom, and Vjszy1lo),” the agencies warned.

    4. F5- Big IP: CVE-2020-5902 : This CVE scored a perfect 10 when it was announced. Basically, it was a user interface for traffic management that allowed any old user to gain access to it.

    5. MobileIron: CVE-2020-15505 : Security agencies have warned that state-backed hackers and organized crime are exploiting a vulnerability in MobileIron mobile device management software.

    6. Microsoft Exchange: CVE-2020-0688 : This vulnerability happened when exchange servers failed to create a unique cryptographic key for the Exchange control panel at install time, which resulted in attackers being able to use malformed requests to run code under the SYSTEM context.

    7. Atlassian Confluence: CVE-2019-3396 : The NSA tried to warn people about these vulnerabilities last October. This old Atlassian Confluence vulnerability adds a touch of server-side template injection to the path traversal and remote code execution antics of other vendors.

    8. Atlassian Crowd: CVE-2019-11580 : Attackers can exploit this flaw to install arbitrary plugins, which can lead to remote code execution. This vulnerability was specifically mentioned by the agencies concerned.

    9. Drupal: CVE-2018-7600 : Drupal’s hook-crazed codebase lacks input sanitation, which can allow an unauthenticated attacker to gain remote code execution.

    10. Telerik: CVE-2019-18935 : The Telerik framework, which is used by ASP.NET apps, has a hole in refining the serialized input that can lead to RCE and crypto-jacking.

    11. Microsoft Sharepoint: CVE-2019-0604 SharePoint had a vulnerability when deserializing XML due to a lack of proper refinement, which could lead to remote code execution.

    12. Microsoft Windows Background Intelligent Transfer Service: CVE-2020-0787  : An attacker could exploit this vulnerability by mishandling symbolic links and executing arbitrary code with system-level privileges.

     13. Microsoft Netlogon: CVE-2020-1472 When it was first announced, it was commended as one of the worst bugs ever, and with a CVSS score of 10, it’s easy to see why

    Most Exploited Vulnerabilites in 2021 :

     From 115.8 million ransomware attacks in Q1 to 188.9 million attacks in Q2, ransomware attacks are on the rise. “This will be the worst year for ransomware” SonicWall has recorded, even if no ransomware attempts are detected in the second half of 2021

    This year’s flaws have also been actively exploited by CISA and other agencies:

    • Microsoft Trade: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE2021-27065: 4 flaws that can be chained collectively in the ProxyLogon group of security bugs that led to a patching frenzy. As of March, 92 p.c of the Trade Servers have been vulnerable to ProxyLogon, states Microsoft justifying the panic.
    • Pulse Protected: CVE-2021-22893, CVE-2021-22894, CVE-2021-22899, and CVE-2021-22900. As of May, CVE-2021-22893 was currently being applied by at least two state-of-the-art persistent threat actors (APTs), most likely joined to China, to attack U.S. protection targets, amid some others.
    • Accellion: CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104. These types resulted in a slew of attacks, including one on Shell. Around 100 Accellion FTA customers, including the Jones Working Day Law Firm, Kroger, and Singtel, were hit by FIN11 and the Clop ransomware gang.
    • VMware: CVE-2021-21985: A critical bug in VMware’s virtualization management platform, vCenter Server, that makes it possible for a remote attacker to exploit the merchandise and consider management of a company’s impacted procedure.

    As a best practice, update systems with the latest software versions whenever they become available to minimize vulnerabilities. If the patch isn’t available, use the vendor’s temporary fixes to mitigate the risks. Prioritizing the fixation of critical vulnerabilities will aid in the prevention of potential cyber intrusions.

    There are a variety of ways that cybercrime can affect companies around the world. Don’t worry we got your back, just register now to speak with one of our experts and learn how to think like an attacker.

     

    Reference:

    Vaas, A. L., &amp; Vaas, L. (n.d.). CISA’s top 30 Bugs: One’s old enough to buy beer. Threatpost English Global threatpostcom. https://threatpost.com/cisa-top-bugs-old-enough-to-buy-beer/168247/.

    Duckett, C. (2021, July 28). Get patching: US, UK, and Australia ISSUE joint advisory on top 30 exploited vulnerabilities. ZDNet. https://www.zdnet.com/article/get-patching-us-uk-and-australia-issue-joint-advisory-on-top-30-exploited-vulnerabilities/.

  • NIST Recommendations for Computer Security Incident Handling

    NIST Recommendations for Computer Security Incident Handling

    Computer security incident response is a very important component of information technology programs. Because performing incident response effectively is a complex and time-consuming task, establishing a successful incident response capability requires substantial planning and resources. The NIST Computer Security Incident Handling Guide provides in-depth guidelines on how to build an incident response capability within an organization.

    So, in this blog, we will talk about steps defined by NIST to approach Security Incidents Handling. The NIST incident response lifecycle breaks incident response down into four main steps: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity

    Now, let’s take a look at each step individually.

     

    1.Preparation:

    NIST’s Incident response methodologies typically emphasize the preparation part by giving many guidelines for establishing an incident response capability so that the organization is ready to respond to incidents when needed. Along with that it also emphasizes preventing incidents by ensuring that systems, networks, and applications are sufficiently secure.

    The below image provides the starting point that is very useful during the preparation of incident handling.

    Keeping the number of incidents sensibly low is vital to secure and protect the business processes of the organization. Incident response teams are generally not responsible for securing resources, but they may be able to identify problems that the organization is not mindful of. This can be very significant for risk assessment as it helps to identify gaps.

    The National Software Reference Library (NSRL) Project maintains records of hashes of various files, including operating system, application, and graphic image files. The hashes can be downloaded from http://www.nsrl.nist.gov/. 

     

    2.Detection and Analysis:  

    The most challenging part of the incident response process is accurately detecting and assessing possible incidents. To make it more manageable we can look into signs of an incident.

    Once an incident is detected, every organization should have step-by-step instructions to be prepared to handle any incident. Incident can happen in countless ways, but some common attack vectors are covered here, which can be a starting point in the development of specific handling procedures.

    When an alert is suggesting that an incident has occurred, the team should rapidly perform an initial analysis to determine the incident’s scope. Performing the initial analysis and validation is very challenging, so we have covered some basic recommendations.

    Immediately after an incident is suspected, it should be documented properly.

    The most critical decision point in the incident handling process is to Prioritize how an incident handling will take place. According to NIST, Incidents should not be handled on a first-come, first-served basis, because it will result in resource limitations. Instead, it should be prioritized based on the relevant factors, such as the following:

    When an incident is analyzed and prioritized, the incident response team needs to notify the appropriate people so that all who need to be involved will play their roles. The exact reporting requirements can vary in every organization, but we have a list of people that are generally notified.

     

     3.Containment, Eradication, and Recovery: 

    Once an incident is detected, it can easily overwhelm resources and that may increase damage. That’s where containment comes, as it provides time for developing a step-by-step remediation strategy. An essential part of containment is decision-making (for example, which system to shut down, which system should be disconnected from a network, which functions should be disabled for how much time etc…).

    After an incident has been contained, Eradication and recovery should be done in a phase because at that time all the remediation steps need to be prioritized. For large-scale incidents, recovery may take several weeks to months. So, the early phases of recovery should only be focused on increasing the overall security with relatively quick (days to weeks) high-value changes to prevent future incidents.

     

     4.Post-Incident Activity : 

    The last part of the NIST incident response methodology is learning from previous incidents to improve the process. So after remediating an incident, the organization should take steps to identify and implement any lessons learned from that incident.

    Lessons learned activities should produce a set of objective and subjective data regarding each incident. Over time, the collected incident data can be useful in identifying security weaknesses and threats, as well as changes in incident trends. This data can also help develop the risk assessment process, which all can help in the determination and execution of extra controls.

     

    Incident Handling Checklist:

    The checklist provided the following covers the major steps to be performed in the handling of an incident. Actual steps performed may vary based on the type of incident and the nature of individual incidents, but this can be taken as a guideline provided by NIST.

     

    Recommendations:

    The key recommendations presented in the NIST document for handling incidents are summarized below.

     

    References:

    https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final

    https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

  • Cybersecurity terms that everyone should know

    Cybersecurity terms that everyone should know

    Cybersecurity, being very important from the invention of computers and networks, is gaining more attention as even the most advanced organizations have fallen victim to cyber-attacks in just the past decade. But it stayed a responsibility of the IT team of an organization for a long period. The pandemic of 2020 had established that cybersecurity is not just an IT team’s responsibility but of the entire employees’.  

    Regardless of your role in your organization, this article will cover a lot of cybersecurity terminologies that will keep everyone, from security professionals to general end-user, informed. Take your time to grasp and upon interest, you can expand your knowledge about one or many, which you may find interesting and want to excel.

     

    A

    Access control: It ensures the resources are granted to the right users with the right permissions

    Advanced Persistent Threat (APT): It is a security event in which the bad actor gains access to a system or network without being detected

    Adware: Refers to any piece of software or application that display advertisements on the user’s computer

    Algorithm: A set of step-by-step instructions for solving a problem, especially one that can be implemented by a computer.

    Asset: An asset can be any material that is used to complete a task.

    Authentication: It is the process of verifying that a person is who he claims to be.

    Authorization: Process of giving the right permissions to the authenticated users.

    Availability: The surety that a system can meet its purpose and is accessible to all the users using it.

     

    B

    Backdoor: A hidden method/tool used by the attacker on the compromised system to bypass security and gain unauthorized access to the restricted parts of a system

    Baiting: The process of luring users into a trap that steals their personal information or inflicts their systems with malware

    Blackhat: A Blackhat hacker is an attacker who violates a computer or network for personal gain.

    Blacklist: List of a specific set of files that are known to be malicious or otherwise unwanted.

    Botnet: A collection of computers that are compromised and used to create and send spam or virus to flood with messages causing a Denial-of-Service attack

    Bring Your Own Device (BYOD): Refers to whether the employees can bring their own devices to work and access resources through them.

    Brute force attack: Activity that involves repetitive successful attempts of trying various password combinations to break into any web application.

    Bug: It refers to an error, fault, or flaw in a computer program that may cause it to behave abnormally.

     

    C

    Cache: Pronounced as CASH. It is a high-speed storage mechanism.

    Chain of Custody: It is important to the Federal rules of evidence and its handling.

    Ciphertext: Encrypted form of a message being sent

    Clickjacking: Also known as UI Redress attack. A common hacking method is where an attacker may use an invisible page or HTML to overlay the legitimate page.

    Common Vulnerabilities and Exposures (CVE): It is an online database operated by the MITRE organization which has the details of all attacks, exploits, and compromises for the public’s benefit.

    Confidentiality: The need to ensure that the information is disclosed to only the authorized users.

    Cracker: It is the proper term to refer to an unauthorized person or an attacker, instead of the term hacker.

    Cryptography: The application of mathematical processes on data at rest and data in transit to ensure its safety.

    Cyber Ecosystem: The collection of computers, networks, communication paths, applications, users, and data.

    Cyberespionage: The unethical act of leaking data while violating an organization’s privacy and security.

     

    D

    Daemon: A program that is often started at the time of booting runs continuously without interventions.

    Data integrity: Term ensuring the data is unmodified and therefore original, complete, and intact.

    Data mining: Process of analyzing data in order to find the relevant and significant items

    Data theft: Act of stealing data intentionally

    Distributed Denial of Service (DDOS) Attack: An attack method that blocks the users to access the resource

    Decrypt: The act of transforming a cyphertext back to its original form.

    Demilitarized Zone (DMZ): A segment or subnet of a private network where the resources are hosted in a publically accessible manner. That is, to the public through the internet.

    Digital forensics: Process of gathering digital information to be used as a piece of evidence in a legal procedure.

     

    E

    Eavesdropping: The act of listening to a network while a transaction or communication is made.

    Encode (Encrypt): The act of converting a message into a coded format, named ciphertext.

    Exploit: A malicious application that can take advantage of a computer’s vulnerability.

     

    F

    Firewall: A software or hardware that screens out viruses, attackers, and worms that are trying to enter one’s system.

     

    G

    Gap analysis: The comparison of actual performance against the anticipated or required one.

     

    H

    Hacktivism: Attacking a system or a network with a motivation driven by a cause or a belief rather than personal gain.

    Honeypot: A trap or decoy for attackers

     

    I

    Identity cloning: A type of identity theft in which the attacker holds the identity of the victim and live in the network with that stolen identity

    Incident: An adverse event in an information system or network

    Incident response plan: A plan to execute or the way to respond if a security event has occurred

    Insider threat: The likelihood that internal personnel may pose a risk to the security of an organization

    Intrusion Detection System (IDS): A tool that detects the presence of intruders or the occurrence of a security violation and notifies the admins.

     

    J

    JavaScript-Binding-Over-HTTP (JBOH): An Android-specific mobile device attack that allows an attacker to start the execution of arbitrary code on a compromised device.

     

    K

    Keylogger: Any method of recording a victim’s keystrokes as they are typed into a physical keyboard.

    Kernel: The central component of a computer operating system, the core, which provides basic services to all other components.

     

    L

    Least Privilege: The principle of granting users or applications only the least amount of permissions they require to carry out their intended function.

    Loopback Address: a pseudo-IP address (127.0.0.1) that always refers back to the localhost and is never broadcast over the internet.

     

    M

    MAC Address: It is a physical address on a network device which is a numeric value that distinguishes it from every other device on the planet.

    Malicious Code: Software that appears to perform a useful or desirable function while gaining unauthorized access to system resources or tricking a user into performing malicious logic.

    Malware: Any code written with the intent of causing harm, disclosing information, or otherwise jeopardizing a system’s security or stability.

    Morris Worm: A worm program that flooded the ARPANET in November 1988, causing problems for many of the hosts. It was written by Robert T. Morris, Jr.

    Multi-Factor Authentication (MFA): a method of confirming a user’s identity by requiring them to provide multiple pieces of identifying information.

     

    N

    National Institute of Standards and Technology (NIST): A physical sciences lab and a non-regulatory agency of the United States Department of commerce. They promote and maintain measurement standards.

    Network Address Translation (NAT): used to distribute one or a few publicly routable IP addresses to many hosts

    Network Mapper (Nmap): A utility used for network discovery and security auditing. It is open-source and free.

    Non-Repudiation: The ability for a system to prove that a message was sent by a specific user and only that user and that it has not been altered.

    Null Session (Anonymous Logon): A method of allowing an anonymous user to connect to a network and retrieve information such as usernames and shares without requiring authentication.

     

    O

    Outsider threat: The possibility that an external entity, such as an ex-employee, competitor, or even an unhappy customer, could jeopardize an organization’s stability or security.

     

    P

    Packet: A message fragment sent over a packet-switching network.

    Password Authentication Protocol (PAP): A simple, weak authentication mechanism in which a user enters a password, which is then sent across the network in cleartext.

    Password Cracking: The process of trying to guess passwords, given the password file information

    Password Sniffing: Also known as Passive wiretapping, is a method of obtaining password information by listening in on a local area network.

    Patch: A small update released by a software company to fix bugs in previously installed software.

    Penetration: Bypassing a system’s protections and gaining unauthorized logical access to sensitive data.

    Personal firewall: Firewalls that are installed and run-on personal computers

    Pharming: A more advanced version of a MITM attack where a user’s session is hijacked and redirected to a spoof website.

    Phishing: Act of tricking a user into entering valid credentials at a fake website by sending them e-mails that appear to come from a trusted source.

     

    R

    Ransomware:  A type of malware that is a form of extortion and it works by encrypting a victim’s hard drive and preventing them from accessing critical files.

    Risk: The product of the threat level and the level of vulnerability

    Risk assessment: The process of determining an organization’s risk level.

    Root: The name of the administrator account in Unix systems.

    Rootkit: A collection of tools used by hackers for masking intrusion and gaining administrator-level access.

     

    S

    Sandboxing: A method of testing or evaluating applications, code, or entire operating systems by isolating them.

    Secure Shell (SSH): A program that allows you to log into another computer over the internet, run commands on that machine, and transfer files from one machine to another.

    Secure Sockets Layer (SSL): Protocol developed by Netscape for sending confidential documents over the Internet.

    security perimeter: A network’s or a private environment’s perimeter where specific security policies and rules are enforced

    Session: A virtual connection between 2 hosts.

    Session Hijacking: The act of taking over some else’s session.

    Social Engineering: Art of manipulating people into doing something or disclosing some sensitive information.

    Spear phishing: the misleading practice of sending emails pretending to come from a known or trusted sender in order to persuade recipients to reveal confidential information.

    Spoof (spoofing): An unauthorized entity attempting to gain access to a system by impersonating an authorized user.

    Spyware: Type of software that gets installed itself on a device and monitors it secretly.

     

    T

    Tailgating: Act of someone without authentication entering a restricted area following an authorized person.

    Threat: When a circumstance, capability, action, or event exists that has the potential to breach security and cause harm, there is a potential for security violation.

    Threat assessment: It is the process involved in finding out the types of threats that an organization might be exposed to.

    Threat Model: A model which describes the given threat and the impact on it

    Threat Vector: The method by which a threat approaches the target.

    Time to Live: A mechanism for limiting the amount of time data can be stored in a computer or network.

    Traffic: Amount of data sent and received by visitors at a given time

    Trojan: Malicious software that is created by hackers disguised as legitimate software to gain access to target users’ computers. Also known as Trojan Horse.

    Tunnel: a protocol for transferring data from one network to another in a secure manner.

     

    U

    Unauthorized access: Unauthorized Access occurs when someone who does not have permission to connect to or use a system gains access in a way that the system owner did not intend.

     

    V

    Virtual Private Network (VPN): It defines the opportunity to establish a secure network connection when using public networks.

    Virus: a malicious software program that is installed on a user’s computer without their permission and performs malicious actions.

    Vishing: A type of phishing that is carried out over a call

    Vulnerability: A security flaw in a system that an attacker can exploit to gain unauthorized access

     

    W

    Whaling: A form of phishing targeting high-profile businesspersons and managers.

    Whitehat: Legal hackers who work for organizations to test their systems by attacking them.

    Whitelist: A list of trusted apps that can be executed in a restricted system

    Worm: A type of malware that is primarily concerned with replication and distribution.

     

    X

    X-509 certificate: Used in SSL/TLS connections to ensure that the client (Web browser) is not tricked by a malicious impersonator posing as a well-known, reliable website.

    X-mas Scan: This scan sets the ACK, SYN, URG, RST, and FIN flags all at once and got this name as it lights the packet like a Christmas tree

    XML injection: A type of attack that manipulates or compromises the logic of an XML application.

    XSS (Cross-Site Scripting): A type of attack aiming at the vulnerabilities found in browsers enabling the attacker to inject scripts into web pages.

     

    Y

    Y2K Bug (Year 2000 bug or Millennium bug): It refers to a widely used computer programming shortcut that was predicted to cause massive havoc as the year 2000 was approaching.

    Yara Rules: It is a way of finding malware by creating malware family descriptions based on textual or binary patterns

    Yaska: An open-source program that scans source codes for security vulnerabilities, code quality, performance, and compliance with best practices.

    Yersinia: A valuable and widely used tool for Unix-like operating systems that aims to exploit flaws in various network protocols.

     

    Z

    Zero Day: A recently discovered vulnerability that needs to be fixed as soon as possible because if found by a bad actor can be used to gain unauthorized access.

    Zombies: A zombie computer is an Internet-connected computer that has been compromised, infected with a computer virus, or infected with a trojan horse.

    As long as computers exist, we humans have to take cybersecurity seriously and what we have covered in this article are “just some” of the terms in cybersecurity. Yes. This is just the tip of the iceberg in terms of the entire terminologies that exist.

    But there is nothing much to worry about if you know what you are doing…!

  • PRIMER ON MITRE ATT&CK 101

    PRIMER ON MITRE ATT&CK 101

    I am here with a blog on the MITRE ATT&CK because it has gained a lot of attention and popularity in recent years.

    ATT&CK is a framework developed by MITRE. It is globally accessible knowledge base of adversary tactics and techniques based on real-world observations.

    ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge.

    It is a way of telling a story, a story about how an attacker is going to progress through their mission, what steps they are going to take or what steps are possible for them to take in order to execute a successful attack.

    It does 2 things:

    1. It narrow downs your search by giving you all the possibilities of different techniques.
    2. They have been collecting the data on well-known attackers and mapping that to their framework constantly, which makes them unique.

    Because, it is based on real-world observations of past attacks, it gives us detailed insights on what adversaries have done in past to conduct attack, and on what adversaries are likely doing pre and post attack.

     

    Why ATT&CK was created:

    It is like an encyclopedia which has all the information’s about different activities of attackers.

    ATT&CK is open and available to any person or organization for use at no charge.

    The main reason why ATT&CK was created and it became so popular in short time in the industry is that it provides same language for all the teams of an organization. It’s also a great starting point to get multiple people and teams on the same page, using the same terminology for security testing and mitigation as it provides specific name and numbers for different attack techniques.

     

    MITRE ATT&CK can help us achieve Difficult task of detecting TTPs:

    ATT&CK focuses on TTPs: Tactics, Techniques, and procedures

    Let’s understand why it focuses on TTPs using pyramid of pain shown below:

    The point of detecting this indicator is to respond to them by analyzing it and stopping adversaries at that level. It depends on how quickly we can deny adversaries using one of those indicators when they are trying to attack us.

    It shows 6 different indicators. The point of detecting this indicator is to respond to them by analyzing it and stopping adversaries at that level. It depends on how quickly we can deny adversaries using one of those indicators when they are trying to attack us.

    This pyramid shows what is easy for adversaries to do and what is most difficult for adversaries to do. So here at the apex we can see

    TTPs : Tactics, Techniques and procedures

     When we detect and respond at this level, we are operating directly on adversary behaviors. It is the most difficult thing for an adversary to change in their behaviors and pattern of carrying an attack. So instead of figuring out which tool they are using, first if we can get to know their TTPs, we can secure our systems far better and if we are already under attack, we can detect it in early stage and mitigate those.

    MITRE ATT&CK Framework can help us figure out those TTPs very quickly and with that,

    If we can respond to adversary TTPs quickly enough, we force them to do the most difficult and time-consuming thing to do which is learning new behaviors.

     

    MITRE ATT&CK Matrices:

    It is Free, Open, globally accessed tool. You can access it on: https://attack.mitre.org/

    It contains 3 Matrix:

    1. Enterprise
    2. Mobile
    3. ICS (Industrial Control Systems)

    Enterprise it the most popular one. The Matrix contains information for the following platforms: Windows, macOS, Linux, PRE, Azure AD, Office 365, Google Workspace, SaaS, IaaS, Network, Containers.

    They are displayed in matrices that are arranged by attack stages, from Reconnaissance and initial system access to Privilege escalation, Command and Control to the Impact of the attack.

    It is constantly being updated but at the time of writing this blog it has:

    Enterprise Tactics: 14

    Enterprise Techniques: 185

    Enterprise Sub-techniques: 367

    Tactics and techniques is a way of analyzing real-world cyberattacks.

    Top Row is Tactics                           : Adversaries Technical goals
    Under each of those Techniques : How the adversary achieve their goal

    Here the techniques are most important because it is a specific single step taken by attacker to exploit any system. And if we can detect it early enough, we can prevent future attacks or stop the one which is currently happening. For that ATT&CK provides many details about each technique including a description, examples, references, and suggestions for mitigation and detection.

     

    MITRE ATT&CK VS Lockheed Martin’s Cyber Kill Chain:

    After looking at the Matrix, some of us might remember Lockheed Martin’s Cyber Kill Chain. They both resemble each other because they define the steps an attacker uses to achieve their goal. So let’s compare them:

    As we can see, both follow the same pattern, but ATT&CK provides us with more detailed techniques and sub-techniques.

    We can say that they are complementary. ATT&CK sits at a lower level of definition to describe adversary behavior than the Cyber Kill Chain. ATT&CK Tactics may not be followed by adversary in the same order, because the goal of an adversary changes throughout an operation and also based on type of attack, whereas the Cyber Kill Chain have all the phases are in ordered manner to describe high-level adversary objectives.

    But the Cyber Kill Chain does not go deep into what to do after an attacker has broken into your network successfully, and all those different techniques which ATT&CK Matrix has.

    So, we can say that Cyber kill chain has several security gaps because it has not been modified since its created, but MITRE ATT&CK Framework has filled in all of those gapes and the main advantage is, it’s constantly being updated and expanded by the community.

     

    Different Enterprise ATT&CK Tactics:

    1. Reconnaissance: Techniques an adversary uses to do active or passive information gathering. Which can be used to plan out the roadmap of an attack. Such information may include details of the victim organization, infrastructure, or staff/personnel. This information can be leveraged by the adversary to aid in other phases of the adversary lifecycle.
    2. Recourse development: Techniques an adversary uses when he is trying to establish resources which they can use to later to support different stages of their operations. These resources can be leveraged by the adversary to use in other phases of the adversary lifecycle, such as using purchased domains to support Command and Control, email accounts for phishing as a part of Initial Access, or stealing code signing certificates to help with Defense Evasion.
    3. Initial access: Techniques an adversary uses when he is trying to get into your network to establish that initial foothold within the network. Footholds gained through initial access may allow for continued access, like valid accounts and use of external remote services, or may be limited-use due to changing passwords. It can be gained by Exploiting public facing application, Phishing/Spear phishing etc.
    4. Execution: Techniques where an adversary is trying to run an adversary-controlled malicious code on a local or remote system. An adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery, or it can abuse windows command shell, python scripts or java scripts.
    5. Persistence: Techniques used by an adversary to maintain persistent access of a compromised system. They make sure that restarts, changed credentials, and other interruptions that could cut off their access. It can be achieved by Adding Office 365 Global Administrator Role, Boot or Logon AutoStart Execution
    6. Privilege escalation: Techniques used by an adversary to gain higher-level privileges on a system or network. Adversaries start with entering and exploring a network with unprivileged access, but it requires elevated permissions to gain sensitive information and complete the attack. It is achieved by taking an advantage of system weaknesses, misconfigurations, and vulnerabilities.
    7. Defense evasion: Techniques where the adversary is trying to avoid being detected through the whole attack. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. He may Bypass User Account Control (UAC) mechanisms to elevate process privileges on system.
    8. Credential access: Techniques for stealing credentials such as account names and passwords. He can use Techniques like keylogging or credential dumping, brute force attack, Forced Authentication, etc.
    9. Discovery: Techniques where the adversary is trying to figure out your environment and gain knowledge about the system and internal network. So, he can observe the environment and prepare himself before deciding how to act.
    10. Lateral movement: Techniques used by adversary when he is trying to move through our environment after compromising it. Adversary typically have to pivot through multiple systems and accounts to find the weakest link in the chain of machines, to ultimately reach their end objective. They might install their own remote access tools to do this. He can also use techniques like Remote service session hijacking, pass the hash etc.
    11. Collection: Techniques used by adversary when he is trying to gather relevant data which will help them with their end goal. They can use Input capture, Audio capture, Man-in-the-Middle etc.
    12. Command & Control:Techniques used by adversary to communicate with compromised systems to control them. This type of the channel provides attackers with direct remote access to the compromised system in the target environment. There are many ways an adversary can establish command and control with various levels of stealth depending on the victim’s network structure and defenses.
    13. Exfiltration: Techniques used by adversary to steal data from our network. Most of the times adversaries package collected data to avoid detection while removing it. Compression and encryption can be used for that. For getting data out of a victim’s network, adversary typically transfers it over their command-and-control channel or an alternate channel. It can be also done over physical medium or through web services.
    14. Impact: Techniques used by adversary to disrupt availability or compromise integrity by manipulating, interrupting, or destroying victim’s system and data or using Denial of Service. Techniques used for impact can include Account access removal, destroying or tampering with data or Endpoint Denial of Service. In some cases, business processes can look fine, but it may have been altered by adversaries to achieve their goals.

    Now that we’ve covered the basics of ATT&CK framework you can look forward to future blog post where I will write about how you can start using ATT&CK for Cyber Threat Intelligence (CTI).

    Thanks for reading.

  • The PrintNightmare

    The PrintNightmare

    As a security researcher, I used to search for new exploits and vulnerabilities daily or more often.

    In the past few days, I have been sighting “ PrintNightmare” more often on Twitter and Reddit. That made me curious, and I was digging up more onto it. After some research, I came to know that it is a 0-day bug that was misunderstood to be fully patched but not.

    PrintNightmare was initially described as CVE-2021-1675 as low elevation of local privilege escalation (LPE) vulnerability by Microsoft during the June 8th patch update. But things changed on June 21, when Microsoft changed the CVE-2021-1675 to ”Critical” as this leads to Remote Code Execution (RCE) attacks.

    An RCE attack happens when an attacker accesses and manipulates a system/server without authentication from its owner.

    The printer Spooler bug has a history as it was used in “Stuxnet” an ICS malware found in 2010, a dangerous worm that created vast damage to the nuclear plants of Iran by affecting more than 45000 networks.

    A proof-of-concept (POC) for a critical windows security vulnerability that allows RCE and LPE attack was released on Twitter by a Chinese security researcher Zhiniang Peng but was taken down later. But soon the PoC was forked in Github and started spreading widely with an updated version of the original POC. You can find the copy of the original PoC here – https://github.com/afwu/PrintNightmare/

    If remote adversaries can bypass the authentication of RpcAddPrinterDriver, this could lead to the installation of a malicious driver in the print server. The flaw is in RpcAddPrinterDriver, a service that allows remote printing and installs drivers. Print Divers can create a big mess as they have full code execution as SYSTEM. The function will allow users with “SeLoadDriverPrivilege” by default administrators and Print Operators can add drivers to a remote Print Spooler.

    PrintNightmare has affected Windows 7 to Windows 10 and from Server 2008 to Server 2019. The most dangerous is that it can affect Active Directory domain controllers because PrintSpooler is enabled by default. Domain control takeovers are a real nightmare for organizations as this will widely affect the business-critical data and also financially.

    Hacker Fantastic posted a tweet where he shows a fully patched Windows 2019 Domain Controller was exploited easily by CVE-2021-1675 by a regular domain user account which is scary. This could also lead to Ransom attacks which are widely happening in recent times. At first, PrintNighmare was addressed as CVE-2021-1675 but after the severity, it was updated to CVE-2021-34527

    PrintNightmare has been added to WinPwn and Automation for internal Windows Penetration testing.

    Temporary mitigation for PrintNightmare – (CVE- 2021-1675) :

    • Update/patch your systems to the most recent version right away.
    • Disable print spooler service on unnecessary systems and servers
    • Create a Deny rule for the driver’s directory and all subdirectories, which will prevent the SYSTEM account to modify its contents

    To Remove this restriction just add $Acl.RemoveAccessRule($Ar) instead of $Acl.AddAccessRule($Ar)

     

    Reference:

    https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527/

    https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/

    https://github.com/afwu/PrintNightmare/

    https://twitter.com/ShitSecure/status/1410870403145388034?s=19