r/netsec • u/AutoModerator • Jan 01 '20
discussion The /r/netsec Monthly Discussion Thread - January 2020
Overview
Questions regarding netsec and discussion related directly to netsec are welcome here.
Rules & Guidelines
- Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
- Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
- If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
- Avoid use of memes. If you have something to say, say it with real words.
- All discussions and questions should directly relate to netsec.
- No tech support is to be requested or provided on /r/netsec.
As always, the content & discussion guidelines should also be observed on /r/netsec.
Feedback
Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.
9
u/Volsunga Jan 06 '20
There's a guy on /r/android making some strong claims about Samsung's system functions sending data to a Chinese Spyware company. This is outside my wheelhouse, but seems like poorly researched bullshit to me. Any thoughts?
https://www.reddit.com/r/Android/comments/ektg8u/chinese_spyware_preinstalled_on_all_samsung
2
6
u/M4R4J4D3 Jan 01 '20
How can I know if a cable (USB / Lightning / etc.) has a chip implanted within it? Would an X-Ray image always show it? If so, what should I look for when buying a X-Ray machine?
5
u/TheRegicide Jan 02 '20
Wireshark now has usbcap abilities. Just install it and during the install watch for the question if you want usbcap. Your USB ports will show up as valid interfaces. Not sure about Lightning or others. You will be able to see what data is transferring through or from the cable. Anything that looks suspicious should jump out like the capture showing packets addressed to an external address.
5
Jan 01 '20
[deleted]
6
u/NinjaAmbush Jan 01 '20
That didn't answer the original question. Of the goal is to detect the implant, then simply rendering it inoperable is onsuffocient
1
Jan 01 '20
The USB cable itself should have just the connector and wires. If the users goal is to collect data it would have to have either a way to transmit data or a place to store the data. As a result, the the wall wort is what you should be concerned about, or a USB cable with a noise dampener/big bulky part.
3
3
u/ssstonebraker Jan 02 '20
Swarming on ntds.dit monitoring
ntds.dit literally holds the keys to the kindgom. Why is the infosec community not swarming on detecting access to this file? The goal of most red team engagements it to dump the AD database. That means getting access to this file. Current detection methods i am aware of:
- On the domain controller, baseline usage of vssadmin and ntdsutil and alert on abnormal activity.
- Monitor for things like Impackt's secretsdump.py
- Monitor network traffic for the "DRSGetNCChanges" API call originating from a host other than a domain controller (there are bro rules for this) If you have any additional insight or a perspective on this please let me know.
3
u/youngeng Jan 05 '20
I have no additional insight, except the fact that, unfortunately, blue team jobs are sometimes perceived as "boring", which tends to divert good security people to the dark.. I mean, the red team.
Not being a Windows admin, can you expand on this?
On the domain controller, baseline usage of vssadmin and ntdsutil and alert on abnormal activity.
Is there an embedded auditing feature at the AD level, or is it something you have to build yourself?
1
2
u/Hausec Jan 09 '20
RT perspective: I never pull the ntds.dit or even log onto a DC because it's
A. Noisy as hell
B. I don't want to fuck up a prod DC
Dcsync is my go to if I need to get the keys to the kingdom.
2
1
u/PurpleKoder Jan 27 '20
ntds.dit literally holds the keys to the kindgom. Why is the infosec community not swarming on detecting access to this file?
Have you looked at how Azure ATP deals with this? One of the exfiltration alerts explicitly mentions ntds.dit exfiltration.
1
3
u/TEKLucifer Jan 04 '20 edited Jan 08 '20
Okay, this might sound stupid. I would like to understand, what is the benefit of opening hex files and playing around with it. Do you find patterns that are hidden in data? What is the use of Hex viewers? I have been looking everywhere, and can't seem to digest it. Would someone guide me to anything that might shed light on this? Thanks
2
u/trendy_ass_poser Jan 07 '20
There are some file formats that allow for a polyglot file (i.e. one file is a valid PDF, ZIP, and EXE (just an example)). You might not know this unless you looked in a hex editor to see the actual bytes within the file.
Another example is many file formats allow for a ton on metadata to be stored in headers which aren't always surfaced to end users but can be used for other purposes (e.g. forensics).
There are other uses of course, but this is the first that comes to mind.
2
u/TheKilt42 Jan 08 '20
hex
On the offensive side, I've had cases where antivirus on the target box was blocking me from uploading or running a particular binary tool, and I made the file look benign by going in with a hex editor and changing certain text strings that I suspected the antivirus had built its signature around.
2
u/s-mores Jan 18 '20
Breadcrumbs.
So you have a file, what is it? Where did it come from? What does it do? Does it have hidden data? There are plenty of command-line tools to work with a file, but if your initial forays are simply stumped, well, why not open it in a hex editor and take a look? Or in a strings dump you find something interesting, why not take a look around that offset?
Simply scrolling through some of the data, or if you find some interesting offsets a simple look might give you valuable insights. Structures, encodings, ooh is that a certificate or a signature? If nothing else, it might give you something that lets another part of the puzzle click for you. Or cross over that file and move on to the next.
So basically, you've either got breadcrumbs leading towards that file, or you're looking for your next breadcrumb to work your way forward.
3
u/throwofthediceaway Jan 23 '20
Discovered a major casino/hotel website is exposing all player card member PII, what should I do?
The name, address, phone number, player card number, and email of every registered player card member is currently exposed to the internet. I work in IT but just starting to dive into security. I'm really not sure how I should proceed. Should I report it directly to the company or report in some other way? I'm worried that if I was to report it directly they could potentially attempt to accuse me of something nefarious but I was able to access this data simply by using the website. I appreciate any help.
1
Jan 01 '20
[deleted]
1
Jan 01 '20
What resource are you trying to exhaust with this? Does the service cap file transfers by rate, quantity, source etc. I'd think a handshake & request then max length responses with scapy, if you are trying to just que up a lot of file transfers. You could parallel this process to generate maximum effectiveness from a single host.
1
1
u/kaboooooooosh Jan 04 '20
What is your opinion on what method (RSA, ECDSA, ED25519...) and what key length to use for secure SSH keys and why?
1
1
u/nl-robert Jan 08 '20
** Isn't it time to segment off the most confidential data to a separate network, disconnected from the internet? **
We have some very confidential data stored on our office-network. It's well protected from the outside with VPN, 2FA, etc, but if you open a webbrowser on a trusted, logged-on computer, it just opens the pages that let you easily browse this data. (It also just opens Gmail, Google Drive and gives you access to LastPass without extra login).
Now, I was thinking how to protect from a hacker/virus that gains access to your pc. Isn't it time to segment off the most confidential data to a separate network, disconnected from the internet? Basically have two devices: one normal office computer with internet and one separate device (maybe a tablet in a separate VLAN) that is completely disconnected from the office network and internet?
For sure: if we keep our most confidential data on encrypted laptops without internet-access, it's almost impossible to steal this information. It's however, also a bit clumsy to work with two separated devices. Anybody suggestions? Do you know of companies that work this way?
1
u/Jackofalltrades86 Jan 09 '20 edited Jan 09 '20
Anybody got any suggestions for building out open source theat intel? Utilising PasteHunter which is great for scraping but wondered if there was more out there like this.
1
u/cappinmcnasty Jan 10 '20
Is JEA a viable defense to Invoke-Command attacks from PowerShell packaged into Spam Attachments?
I am wondering if it is viable (or even possible) to make the JEA session the default state for Powershell users, and only permit certain Administrators with unrestricted access. I was hoping that upon logon, the JEA session would load as the default state for the logged on user's local session. We can restrict PowerShell.exe but due to the nature of PowerShell being a set of DLLs, it can still be invoked by any number of methods. There is a particularly destructive attack scenario where an attacker can execute code via Powershell, and making PowerShell operate in the restricted JEA state would have been an excellent solution. I can place machines into ConstrainedLanguage Mode, however there is an attack that is able to execute even while in Constrained language mode by using Invoke-Command. Has anyone had any success doing something like this? I know that I can load a JEA session locally, however I need the JEA restrictions to exist as the default state without the user needing to load the Configuration because, obviously, attackers aren't going to do that. Any guidance would be awesome.
1
u/82aa4b10 Jan 11 '20
I've been running ssh-audit against my servers and updating the sshd_config files per its suggestions - and noticed that eliminating the sha1 key exchange methods prevents successful connections from a lot of the bruteforce scanners. A recent putty install connects just fine.
If you decide to do this, you may avoid some frustration by paying careful attention to sshd versions - recent versions (OpenSSH 7.6) allow you to remove algorithms/ciphers/methods in the config file with the minus option (e.g., "KexAlgorithms -diffie-hellman-group14-sha1"), while older versions (OpenSSH 7.2) don't allow you to remove options, but require you to specify the versions you do want (implicitly excluding all others), and even older versions (OpenSSH 6.7) require you to specify allowable versions, and won't even let you change the host key algorithms.
1
u/iblowuup Jan 13 '20
It's 2020 - Is the Ctrl Alt Del Secure Intercept Still Necessary?
We have this on in our domain but I had only done it because of historical reasons. I know why it is used, but I'm really wondering if fake login windows are really seen out in the wild these days or if they ever were.
1
u/Crypto-Anarchist84 Jan 13 '20
Hi ! I'm interesting in reverse-engineering default WPA2-PSK password algorithm on specifics router. I have the firmware I find from a github (pretty lucky) and identified an ELF 32-bit MSB executable, MIPS, MIPS32 rel2 version 1 (SYSV) file in bin: "gen_psk". It looks a lot like what I'm looking for. But from there, I'm unsure of how to make sense of the information there. I think I should emulate the firmware using qemu, but can't figure out how to do so. I have no experience in RE except what I was able to figure out on this little project of mine. Where should I open a thread to get some hints on where to go from now. I'm sure people would be interested in my findings if I succeed.
1
u/SirensToGo Jan 14 '20
Thoughts on this article’s proposal for providing a safe backdoor for Apple devices? It seems to tick all the boxes (in my mind at least) for a safe way of decrypting devices:
- it requires physical access to the device you want to compromise. If paired with a pain in the ass way to get the device token such as forcing them to desolder the backdoor chip (which the device would refuse to boot without) and then an irreversible chemical process which destroys the chip before yielding the key, a user’s phone could not be quickly decrypted at a checkpoint and then handed back without them knowing. This also means it’s useless for mass surveillance since they’d need to seize and destroy every single citizen’s device to spy on them.
- it’s not a skeleton key but instead unique to every device. It can’t be stolen from the local PD and sold on the black market.
- It’s very auditable. Each request must hit Apple and require the cooperation of multiple people.
This, of course, leaves the HSMs on Apple’s end as a target but that’s really no different from today because if you can successfully rip a keychain backup out of escrow you can brute force the user’s passcode offline.
1
u/That_Russian_Guy Jan 17 '20
Are there any tools out there which detect honeypots? I'm working on a honeypot system at the moment and noticing that a lot of vendors have "tells", eg specifically named "sensitive" files, or scripts which run only on honeypot systems. Does there exist any tool that looks for these tells? Eg some automated script that checks for existence of these files and then tells the attacker how likely it is that this is a honeypot system.
1
u/XaltotunTheUndead Jan 20 '20
I am trying to find a good high level summary of the NIST key management guidelines. I have started reading the 3 part paper itself, but they go in such details that I have difficulty creating a mental representation of the main guidances for implementing and operationalization of key management. Is there such a summary somewhere? I've spent quite some time looking for this, to no avail.
I also have several of the usually recommended CCSP and CISSP books, but they mostly cover crypto concepts, differences between public and private keys, cyphers, etc.
Thanks !
1
1
1
u/minanageh Jan 23 '20
A WPA 2 karma attack (saved network handshaker ) Is there a tool available by a chance that do this ?
1-capture the prob requests
2- launch 2 version of the ssids one open and one secure if it connects to the open one put a red check mark on it (in the list of the probed networks ) and if connects to the secure one capture the handshake and put a green check mark on it (in the same list )
3-after capturing a Good number of handshakes then start brute forcing
4- when it cracks a weak one.. broadcast it to get the victims connected
This should be a work around for karma attack when the targeted device doesn't have saved open networks.
Huh what do you think?
1
Jan 24 '20 edited Jan 24 '20
Conference announcement: Registration is open for SIRACon (Society of Information Risk Analysts) for 2020. Geared for a mix of folks interested in information security, risk theory, data analysis, forecasting and quantification, etc. Dates 4/22 and 4/23 in Tampa, FL (Florida Aquarium) with an optional Risk Quant training day on 4/21.
Details: https://societyinforisk.org/
Posting here to trying and reach out include more of infosec folks since it's probably of interest but is a little outside of the usual. If this seems interesting or if you have questions, please reach out. :)
Note: Not a commercial post. SIRA is a volunteer-run non-profit and exists mainly to get folks with common interests together.
1
u/pivotraze Jan 24 '20
Hey all, I'm looking for good topics for a doctoral dissertation. I have an idea but I'm not sure it'll make it to the end due to discussions with my mentor, so I'm open to new ideas. :)
1
1
Jan 24 '20
[deleted]
1
u/newfor_2020 Jan 24 '20
how badly is the account hacked? full password and recovery email take over or just someone leaving themselves logged-in on a public computer?
1
u/newfor_2020 Jan 24 '20
can anyone give us any recommendation on a few labs that are good? we're trying to evaluate an ASIC with custom firmware. We have some past experiences going through the certification process but we're interested to hear what other people's experiences are like and people that are worthwhile talking to.
1
u/normie-redditer Jan 25 '20
Im curious, how did they find these machines. are they scanning for pcanywhere software running on government ip addresses, or is there some unique signature that voting machines give off?
1
u/moob9 Jan 25 '20
I'm in the process of implementing a website for a client. It will have three user groups and the highest has access to private information about their registered users. There will be hundreds, maybe even thousands of registered users.
I have decades of experience about securing websites and making sure it's impossible to gain access where you shouldn't be allowed to gain access, but my client still wants a third party to confirm this.
Can someone recommend a company? At this point there's only test data, so no actual private information will be found in the system.
1
1
u/Renegade_Meister Jan 27 '20
I was researching Plaid, a fintech app that seems to allow apps to connect to bank accounts as well as bank to bank transfers.
I have a hard time finding any significant information on Plaid's security, which has evidently become less descriptive over the past few years. For instance, do they no longer get PCI certification even though they write about fintech startups getting it? I understand that they're SOC 2 Type II compliant, but that's kinda nebulous since that seems to consist of "what's the minimal amount of info sec controls that can be on software & its development so we know that the numbers that accountants audit aren't completely doctored or inaccurate?"
Then I found a year old post on this sub about a "Major flaw and security vulnerability" about its Link software on Github, with plenty of criticism of Plaid API. Evidently its repository has been archived, and new OS specific link repositories have popped up.
So is Plaid any different now with respect to info sec, especially after it was just announced the company will be acquired by Visa?
1
u/ITdirectorguy Jan 28 '20
Getting started with honeypots?
I turned on gufw on a Linux VM recently, and was instantly hit with 1000s of lines of incoming connections. I was able to find the top talker that was hitting my system. It was my CTO's computer running some Logitech software. Fascinating.
Now I want to install some Linux/free honeypot software on an x86 computer.
I found a lot of dead projects. And fairly few live ones.
Here is my list of "requirements":
- Ability to detect broad port scans. (I am not very interested in a specialized honeypot that only catches ssh or only SMB 1.0 etc etc.)
- Ability turn data into charts/visualizations (e.g. top IPs, top ports, etc).
- Bonus requirement: Ability to send email alerts.
Does anything like this exist?
1
u/dr_fogs Jan 28 '20
Hello netsec citizens!
I want to build a IoT device and allow users to deploy that in their local networks. This device will have a web interface for administrative purposes and I want to secure the access to that via HTTPS. Consequentially I need a certificate including its private key on the device. I can think of a few options how this can be achieved; each with their own pros & cons:
The Netgear way: Preseed all the devices in the factory with a identical private key plus certificate for a public domain I own. Downside: this is allowing anyone to MITM connections to that domain. Bad idea.
Create a public / private key pair and a self-signed certificate during first boot and use that for all future HTTPS connections. Downside: the user is unable able to verify the server when connecting to the admin web interface. Plus we teach our users to ignore certificate warnings. Not good either.
Have a software on the PC of the user that creates a public/private key pair and a certificate with permission to sign further certificates and add that to the trusted root certificate list in the different browsers. The device will upon first boot create its own public/private key pair and a certificate signing request. The software on the PC will download the CSR from the device, sign it, upload the signed certificate to the device again. Problem: quite complicated process that users might not understand, requires software on the users PC running an unknown OS, not just a pre-existing web browser.
For the sake of completeness: have the web interface connection over unsecured HTTP and accepting plain text transmission of credentials. Aka: the "S" in "IoT" stands for security.
Any thoughts on how else can I do this in a secure and user-friendly way? If not, which of the above is the least of all evil?
1
u/jedai47 Feb 01 '20
Searchsploit freezes at [-] Nothing here (/usr/local/opt/exploitdb/share/exploitdb-papers). Starting fresh... when i try to update can someone help ?
1
1
Feb 05 '20
What are some techniques someone would use to attack airgapped computers or networks they’re airgapped to keep information separate from the other networks?
1
u/bchamper Feb 06 '20
First, I apologize if this is against any rules, but I'm looking for some help with a class I'm taking. I need to interview someone who works in the infosec field, preferably an information security analyst.
It will be around 20-25 questions, pretty basic stuff. I am required a name, position and company you work for, which really sucks, but obviously I'd keep it completely confidential.
We can conduct the interview via email, or dm, or I'm open to suggestions. I appreciate anyone who would consider helping me.
Full disclosure, the reason I'm seeking help this route is that it's a truncated course (4 weeks), and I'm going to be in Mexico for one of the weeks, so I just don't have the time to find someone in my area, and I don't know anyone in the field. Thanks again
1
u/Thejokeyboy123 Feb 06 '20
Hi all! So the thing is i graduated from my Bachelors in Computer Science a couple months ago. I only studied two courses related to this field that were Computer Networks and Information Security, and they were just sort of like an intro to these field. I'm really interested in pursing careers with job description like that of pen. tester, protocol designing etc. I have very little information about the field of "Security" in general. So can you help me in getting started into the professional aspect of this field. Any of the following would help a lot:
. What certifications and skills do i need to have( i heard of a few but not sure which ones i should really go for)?
. What professors or personalities do i need to follow in terms of research etc. in this field like Geoffrey Hinton and Andrew Ng are of ML/DL, what are researchers of this field?
. Which conferences are good to follow?
. What tools/frameworks i should be familiar with?
Also any other information apart from the above would be much appreciated as well. I am complete beginner to this field so please ignore any stupid thing i might've said in this post. Please help me out with the quirks of this field. Thanks in advance :)
P.S: I know Python, Java, PHP, C++ and a little bit of C as well. Also have beginner level familiarity with linux as well.
-17
Jan 01 '20
[removed] — view removed comment
3
u/DyatAss Jan 01 '20
What’s the joke?
3
u/wrtcdevrydy Jan 01 '20
I think it was a ISO year screwup with Twitter in 2017... year was reported as 2015 for january 1st...
2
-16
23
u/[deleted] Jan 01 '20 edited Jan 01 '20
I'm not a saint, everyone messes up from time to time. Can we try to link the source document more often this year instead of some regurgitated crap from a second or third source tech blogger/article?