4 ms·

I dunno, but things seem to be getting worse. I remember when it used to be "Have physical access to the local machine, then it's game over". After a while it b

I dunno, but things seem to be getting worse. I remember when it used to be "Have physical access to the local machine, then it's game over". After a while it became "Have remote shell access to the machine, then it's game over". Have we really come to the point where it's now "Having access to the internal network is a 'game over' scenario for 95% of real-world networks" ? WTF is happening to our security ?

tptacek 11y ago
Yes. Yes, we really have. Yes. On a network large enough to have an important AD DC, internal network access is always game-over. Some of our largest and savviest clients would pay us to do "internal network penetration tests". Despite these clients having huge security teams and despite internal network security being so important to them that they'd actually spend consultant dollars to test it, those projects were invariably a bonanza for the testers. I think this explains some of the reaction on Twitter from software security people: if you've done consulting work, you already assumed these networks were totally insecure.
- jra_samba 11y ago
  Remember, many branch offices have read-only DC's on them, which makes them vulnerable to this bug. It doesn't have to be "important" DC's. Anything with a password database will do. I must confess, on my own internal networks I've moved to trying to avoid any unencrypted traffic on the network. SMB3 helps a lot with this (finally Windows clients will do SMB-level encryption to servers).
  - raesene9 11y ago
    If you're interested in what pentesters (and presumably their bad guy equivalents) are doing these days on internal pen tests where they start from Local LAN access it's a good idea to look at tools like responder(https://github.com/SpiderLabs/Responder https://github.com/SpiderLabs/Responder), which spoof responses to various queries and can then be used to grab hashes to either to Pass-the-hash attacks or get passed to password cracking tools for recovery of passwords. There's also tools like bettercap (https://www.bettercap.org/docs/ https://www.bettercap.org/docs/) which can already use various tricks to grab creds once a MiTM is sorted..
    - jra_samba 11y ago
      Interesting toolset. Only NTLMv1/v2 mitm attacks possible against a Windows/Samba server though. And the latest patchset should make those impossible if the server were properly configured (i.e. all machines joined to AD, using krb5 auth and SMB3 encrypted file traffic). Of course, I bet few networks are actually set up this way. But correctly configured Windows/Samba networks should be safe from this.

tptacek 11y ago

Yes. Yes, we really have. Yes. On a network large enough to have an important AD DC, internal network access is always game-over. Some of our largest and savviest clients would pay us to do "internal network penetration tests". Despite these clients having huge security teams and despite internal network security being so important to them that they'd actually spend consultant dollars to test it, those projects were invariably a bonanza for the testers. I think this explains some of the reaction on Twitter from software security people: if you've done consulting work, you already assumed these networks were totally insecure.

jra_samba 11y ago
Remember, many branch offices have read-only DC's on them, which makes them vulnerable to this bug. It doesn't have to be "important" DC's. Anything with a password database will do. I must confess, on my own internal networks I've moved to trying to avoid any unencrypted traffic on the network. SMB3 helps a lot with this (finally Windows clients will do SMB-level encryption to servers).
- raesene9 11y ago
  If you're interested in what pentesters (and presumably their bad guy equivalents) are doing these days on internal pen tests where they start from Local LAN access it's a good idea to look at tools like responder(https://github.com/SpiderLabs/Responder https://github.com/SpiderLabs/Responder), which spoof responses to various queries and can then be used to grab hashes to either to Pass-the-hash attacks or get passed to password cracking tools for recovery of passwords. There's also tools like bettercap (https://www.bettercap.org/docs/ https://www.bettercap.org/docs/) which can already use various tricks to grab creds once a MiTM is sorted..
  - jra_samba 11y ago
    Interesting toolset. Only NTLMv1/v2 mitm attacks possible against a Windows/Samba server though. And the latest patchset should make those impossible if the server were properly configured (i.e. all machines joined to AD, using krb5 auth and SMB3 encrypted file traffic). Of course, I bet few networks are actually set up this way. But correctly configured Windows/Samba networks should be safe from this.