Category: Defense

Defense

Perimeter Security Vendor Hell – Unauthenticated RCE’s and other…

Disclaimer

If your can’t take an honest view on real challegnes we face you probably want to click the back button now!
The three laws of IT apply:

  • Software has bugs
  • Hardware breaks
  • Humans Make Mistakes

It doens’t mean however we shoulnd’t strive to do better! so now that’s out of the way here’s a fast blog on shit you should care about and patch (if you haven’t already!)

Also please note these are not ALL the vulnerabilities you should care about, just some choice ones that are enough to make you cry!

Introduction

“Don’t worry, we’ve got that behind a firewall or VPN!” is something I’ve heard a lot over the years, which to be honest is starting to look more and more worrying. Think that’s just me giving my opinion? Well think again, here we have collated SOME of the vulnerabilities in security products which if unpatched/mitigated really leave you. well quite insecure!

Read more “Perimeter Security Vendor Hell – Unauthenticated RCE’s and other crazy you didn’t want in your security devices!” →
Defense

Configuring SYSLOG integration with F5 BIG-IP

CVE-2020-5902 Defensive Guidance (FAST publish)

This week’s been a whirlwind, once again teams of people scrambled to help defend networks from criminals trying to abuse CVE-2020-5902.

If you want to see this in action check out my video on youtube!

The main issue (other than the vulnerability itself (path traversal and unauthenticated remote code execution) is exposing management interfaces to the internet (or other insecure/untrusted networks). Yesterday we looked at IOCs in the “/var/log/audit” file.

Now a sensible attacker who has ROOT level access would have likely cleared their tracks! However, a good sysadmin would have the logs shipped off the device!

Read more “Configuring SYSLOG integration with F5 BIG-IP” →

Defense

Hunting a breach… CVE-2020-5902

I’ve spent the last 24 hours (including a sleeps) gathering intel, testing in the lab and looking at what the path traversal and RCE for the F5 BIG-IP as outlined in CVE-2020-5902 looks like.
Well I’ll be honest.. the whole scenario is a bit of a bloody mess! We’ve got people leaving management interfaces exposed to the internet, we’ve got a vulnerability that’s incredibly old in a security appliance (it’s not exactly uber 1337 either) and we’ve had the release scenario that’s probably ruined peoples weekends and weeks (I’m not going into an Offensive Securitry Tools debate/argument, if you want that go talk to a brick wall or someone else!)

Read more “Hunting a breach… CVE-2020-5902” →
Defense

KB4551762 (CVE-2020-0796)

A recent information disclosure by Microsoft revealed there is a remote code execution vulneability in the SMB3 services (client and server). This vulnerability could be leveraged in a simmilar manner to MSBLASTER/NACHI/WannaCry etc.

This is a CRITICAL vulnerability, yet currently there are no reports of this being exploite in the wild (epect that the change in the near future)

Read more “KB4551762 (CVE-2020-0796)” →
Defense

Internet Presence Technology and Security Management

Living on the internet in the digital age

I have watched enough technology deployments occur over the last 20 years to have learnt a thing or two. One constant I find is the perception that deploying and technology in a business environment is ‘simple and easy’. However, history and experience teach us that this simply isn’t the case. Whilst working on a project recently I thought I would try and show this in terms of looking at foundational technology and security management capabilities regarding internet presence. In this post I’m going to outline a look at foundational capabilities for Domain Registrar, DNS and internet preens management. Read more “Internet Presence Technology and Security Management” →

Defense

Active Directory Security: Securing the crown jewels with PingCastle…

Securing the crown jewels

At the heart of most organisations are a Windows server active directory domain (or multiple of these), yet one of the most common findings when we review organisations security postures are there are significant weaknesses in their active directory deployments, both from an architectural, operational and security perspectives.

Active directory provides a range of functionality to organisations, from authentication, authorisation as well as supporting services such as printer and share listing, DNS, people/information lookups and integration for 3rd party services. It’s the very hub that links most modern networked systems together and now it’s expanded beyond the corporate walls into the cloud with integration into Azure Directory Services as part of Azure or Office 365.

Essentially Active Directory can be considered a castle whereby crown jewels are held! This may be in the form of credentials/identity or by nature of granting access to business systems that hold sensitive data (such as using AD integration to log into an HR or Finance system). Read more “Active Directory Security: Securing the crown jewels with PingCastle 2.8.0.0” →

Company News

Get your dark knight on to create a brighter…

Capturing all the flags

For BSIDES Leeds 2020 we’ve pulled out the stops and created a new CTF game which features both offensive and defensive challenges. The arena includes a number of servers, so you will need to get your pivot on if you are going to breach the crown jewels!

We’ve teamed up with Sky Betting Group to create a CTF which includes both old and new technologies for BSIDES. It features traditional CTF puzzles alongside a PwnDefend norm, an arena network featuring Windows targets!

The games start in line with BSIDES Leeds, at 0900 on the 24th January 2020 the following url will light up with flags across the virtual globe on the Facebook ctf platform.

https://ctf.bsidesleedsctf.com

The challenges are designed for a range of skill levels and all are welcome, if you can use a web browser and know what the magic F12 button does you are in with a chance of getting a flag or two!

I’ll also be presenting with my good friend Mathew Haines on the rookie track at 1400 where we are going to talk about CTF’s and how people can get started (they aren’t just for those who prefer a hoodie!)

I want to give a big thanks to everyone who has helped! From the team at BSIDES Leeds (and the man Large Cardinal himself) through to Sky Betting Group’s Glenn Pegden for hosting the games platform and making some awesome games through to community members, Ben Bidmead (pry0c) from Navisec and Daniel Ward (
@ghostinthecable) who made a community vm challenge!

I create PwnDefend games and content to benefit the community and to help people and organisation better defend themselves so it’s great not only to have community support but also to be able to give back, it’s even better to be able to team up with the team from SBG to bring this to the community!

See you on the cyber battlefields!

for more info on the CTF please visit:

https://www.bsidesleedsctf.com/

Defense

Ransomware from an RDP Vector

Internet facing exposed RDP services with a weak securiy configuraiton are never a good idea. In our latest video Matthew Haynes and Daniel Card take a look at the RDP threat lanscape and then following up with a lab demo of a simple RDP brute force attack.

You can see the video here on our youtube channel! Remember to like and subscribe! Stay safe!

RDP Threat Intel Video


For more security news, threat intelligence and information on our consulting services please subscribe to our free newsletter

Subscribe
Call Now!