Adversary Emulation w/ Carlos Perez – PSW #789
Full Audio
View Show IndexSegments
1. Pen Testing & Adversary Emulation – Carlos Perez – PSW #789
In this segment we welcome Carlos Perez back to the show! Carlos will discuss methods we can use to hide one systems and cover our tracks. We'll cover how on a system (as administrator) the blue team's struggle using default logs or even on a default install of Sysmon to detect an attacker. Attackers can selectively disable modern event log providers, take action and then re-enable. We will demo this and how to best monitor for this technique.
Announcements
Stay up-to-date with us on X (formerly known as Twitter) for the latest show clips and updates! Find us @SecWeekly and stay connected with our cybersecurity community.
Guest
![](https://image-optimizer.cyberriskalliance.com/unsafe/1920x0/https://files.scmagazine.com/wp-content/uploads/2024/03/Carlos_Perez-0.jpg)
Carlos is currently the Principal Consultant, Team Lead for Research at TrustedSec and well-known for his research on both Metasploit and Windows Powershell. His blog www.darkoperator.com carries the tag line: “Shell Is Only The Beginning”.
Hosts
2. Melting Neighbors, SBOMs, DIY 2FA – PSW #789
In the security news: You got so many CVEs you need your own, dedicated, vulnerability scanner, melting your neighbors with hacking, The FDA’s SBOM and OSS, when the vulnerability scanner has a vulnerability, violating CISA directives at scale, make 2FA a little easier with this device, NSA’s BlackLotus mitigation guide: who needs those certificates anyhow? All that and more on this episode of Paul’s Security Weekly.
Announcements
Join us at an upcoming Official Cyber Security Summit in a city near you! This series of one-day, invitation-only, executive level conferences are designed to educate senior cyber professionals on the latest threat landscape. We are pleased to offer our listeners $100 off admission when you use code SecWeek23 to register. Visit securityweekly.com/cybersecuritysummit to learn more and register today!
Hosts
- 1. Red Team Tactics: Writing Windows Kernel Drivers for Advanced Persistence (Part 2)
- 2. CVE-2023-27997 Vulnerability Scanner for FortiGate Firewalls
Developing reliable checks for vulnerabilities that are both accurate and safe (i.e. don't cause the process or system to crash) is tricky business. Bishop Fox has highlighted their work creating such a check for one of the recent FortiGate vulnerabilities. You can download the checking tool here: https://github.com/BishopFox/CVE-2023-27997-check. There is still a chance that checking for the vulnerability can cause the system to crash. Perhaps a better way is to query your systems for the latest version of software/firmware, then see if its the latest, then cross-reference that with known CVEs. While safer, you rely on the data being accurate vs. actually checking for the vulnerability. My advice has always been to use both methods.
- 3. Why is it so hot here? Hacking Electra Smart air conditioners for fun and profit
This post was very well-written. It documents the methods and findings of the researchers who were able to enumerate all the controller devices and install malicious firmware. I found it interesting that the company also provided the researchers with a new (but older) product to test as the version tested was claimed to be a development board. The researchers found the same problems. While I would love to be able to control, and get more data, from HVAC equipment in my home, the security of these products has to be up to par. The product in question was used in an apartment building, so you can imagine the impact of attacks. Don't like your neighbor? Maybe someone freezes them out or tries to melt them. Unethical for sure, but shows the real-world impacts of poor security in devices.
- 4. Secfault Security – LibreOffice Arbitrary File Write (CVE-2023-1883)
- 5. Iceman Fork – Proxmark3
- 6. Why the FDA’s SBOM Mandate Changes the Game for OSS Security
This is important to read and understand: "the FDA mandates that medical device manufacturers submit "a plan to monitor, identify, and address, as appropriate, in a reasonable time, postmarket cybersecurity vulnerabilities and exploits" and to "design, develop, and maintain processes and procedures to provide a reasonable assurance that the device and related systems are cybersecure." This includes patching "on a reasonably justified regular cycle" and as-soon-as-possible patches for serious vulnerabilities found outside of the normal patch cycle." - They also have to include an SBOM. This impacts OSS as well, it could mean we get more secure OSS and medical devices. It could also be a barrier to entry to creating OSS as people may not want to deal with the headache. This is why it is important for OSS software groups, such as the Linux Foundation, to continue to work on projects that make it easy for developers to create SBOMs. IN fact, you may not even have to worry about it, it will just happen.
- 7. Nessus Plugin Flaw Let Attackers Escalate The Privileges
"The plugin uses a variety of methods to perform this detection. Previously, one of the methods used in some cases was to execute the java runtime binary with a -version argument and read the output. This method has been removed from the plugin, and replaced with different methods that provide equivalent detection." - This is plugin that executes locally, so an attacker would have to replace the Java command with a malicious version, then that version would be executed when the system is scanned with higher privileges. This issue has been fixed, and I don't believe we need to change how we do vulnerability management as a result.
- 8. New Mockingjay process injection technique evades EDR detection
- 9. Process Mockingjay: Echoing RWX In Userland To Achieve Code Execution
- 10. Hundreds of devices found violating new CISA federal agency directive
I believe attack surface management is key to mitigating the risk posed by exposed services that were discovered: "We discovered nearly 250 instances of web interfaces for hosts exposing network appliances, many of which were running remote protocols such as SSH and TELNET," Censys said. "Over 15 instances of exposed remote access protocols such as FTP, SMB, NetBIOS, and SNMP were also found running on FCEB-related hosts." Censys also discovered multiple servers hosting MOVEit transfer, GoAnywhere MFT, and SolarWinds Serv-U managed file transfer platforms, known attack vectors in data theft attacks." - This must be part of your organization's strategy, CISA mandates it for federal agencies, hopefully there is work being done to remmediate.
- 11. Prominent cryptocurrency exchange infected with previously unseen Mac malware
- 12. For Science! – Using an Unimpressive Bug in EDK II to Do Some Fun Exploitation
Why is it for science? This particular vulnerability happens during the DXE phase, and is "closed off" once DXE ends. An attacker would need another vulnerability to exploit this vulnerability. Interesting how it was found in the reference implementation, EDK II, my co-workers audited that code some time ago and kill a ton of bugs. This could be important later. Also, I am glad people are looking at these vulnerabilities!
- 13. chonked pt.1: MiniDLNA 1.3.2 HTTP Chunk Parsing Heap Overflow (CVE-2023-33476) Root Cause Analysis
- 14. chonked pt.2: exploiting cve-2023-33476 for remote code execution
- 15. Hackaday Prize 2023: Sleek Macro Pad Makes 2FA A Little Easier
The opening paragragh will spark some debate: "We all know the drill when it comes to online security — something you know, and something you have. But when the “something you have” is a two-factor token in a keyfob at the bottom of a backpack, or an app on your phone that’s buried several swipes and taps deep, inconvenience can stand in the way of adding that second level of security. Thankfully, this “2FA Sidecar” is the perfect way to lower the barrier to using two-factor authentication." - The project is super cool, rather than digging out your phone you can build this and press a key to generate the auth codes. The ESP32S3 was used, along with some other hardware, as described in the post.
- 16. IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits
- 17. CVE-2023-20178
- 18. NSA BlackLotus Mitigation Guide
"Because BlackLotus integrates Shim and GRUB into its implantation routine, Linux administrators should also be vigilant for variants affecting popular Linux distributions." - Whoa, interesting to think about this idea. This is a "why didn't I think of that" moment: "The Linux community may remove the Microsoft Windows Production CA 2011 certificate on devices that exclusively boot Linux."
- 19. Fun with container images – Bypassing vulnerability scanners
- 20. Zero Day Initiative — CVE-2022-31696: An Analysis of a VMware ESXi TCP Socket Keepalive Type Confusion LPE
- 21. Finding bugs in C code with Multi-Level IR and VAST
- 22. NimExec
- 23. nOAuth: How Microsoft OAuth Misconfiguration Can Lead to Full Account Takeover
- 24. Microsoft’s bootkit patches offer ‘false sense of security’ against BlackLotus threat, NSA says
- 25. IoT devices and Linux-based systems targeted by OpenSSH trojan campaign
- 26. Fortinet fixes critical RCE flaw in FortiNAC zero-trust product
- 27. THE KEYS TO THE KINGDOM AND THE INTEL BOOT PROCESS
I helped write this one
- 28. ‘Open’ mobile phones blocked via Bluetooth: experts from Tarlogic, a Spanish cybersecurity company, share use cases for their BlueTrust solution
- 29. https://www.csoonline.com/article/643618/sec-notice-to-solarwinds-ciso-and-cfo-roils-cybersecurity-industry.html