3 ms·
> The attacker who uses your stolen password is just as likely to be trying it a year from now than he is to be trying it the moment he captures it. Although t
by iuguy 16y ago
> The attacker who uses your stolen password is just as likely to be trying it a year from now than he is to be trying it the moment he captures it.
Although this might sound a bit off to other readers, this actually correlates quite well with what we see in the (suddenly now sexy) APT space when a network gets 're-popped'. If the attacker has been in before they'll usually have some good intel on the Internal network structure and will often try old passwords, then potentially variants of them assuming the same lockout as when they took the configs/policies.
I can also vouch for the pen test story. It's also why I generally take last year's report with me, as it usually helps me find out what the password was. We don't usually write the password down in the report but do give subtle clues to jog the tester's memory.
I'm not sure what you mean about sweeping the machine for textual passwords. It's not uncommon to search the filesystem for files containing a current password or 'password', 'username' etc. but it's not that common in the wild as it generates a lot of i/o and can raise suspicions. The last thing you want is for the end user to ctrl-alt-del and see notepad.exe using a load of disk activity. Of course an adversary worth their salt would've migrated to a different process by then but even so, if you're wondering why is csrss.exe thrashing the drive like that, then you might have something worth investigating.
For places like reddit, I'd say sharing passwords between sites is fine as long as you're comfortable with them all being compromised. I have the same passwords for things I don't really care for as far as compromise is concern. For more important information assets I find it better to adopt a defence in depth approach than to rely on several hundred passwords alone.
- LiveTheDream 16y agoWhat is the APT space? Guessing it has nothing to do with the advanced packaging tool. ("apt" is not very google-able, and no acronyms particularly stood out to me).
- tptacek 16y agoI'm hoping he doesn't mean "Advanced Persistant Threat" (gag), which is a marketing term invented after the Google/Aurora debacle to try to sell products and services ("APT defenses") on a "don't let this happen to you" message. He might mean "Application Penetration Test", except that app pentests rarely pivot to internal networks and passwords (they're usually part of the software development lifecycle and are about "is this app safe to deploy").
- iuguy 16y agoNo I do mean Advanced Persistent Threat, and the term pre-dates Aurora by a few years, it's just been misappropriated by Mandiant's marketing department and then every man and his dog has smelt money. Traditionally we've used the term Targeted Attack or CNE (meaning Computer Network Exploitation), but people tend to ask what that is. I die a little inside when I use the APT term, but people who get it, get it, and people that listen to marketers (rightfully) act suspicious. The attacks are real and have been going on since the 90s, but it's not as clean cut as people make out. The primary distinguishing factor is the 'P' for persistence, not necessarily the 'A'. Anyone selling on a "don't let this happen to you" message is obviously selling bunk. You're either a target or not for this stuff, and that depends on a whole load of factors. If you're not a target then your biggest similar threat is probably broad malware attacks (more associated with botnets) or unfocused criminal activity. If you're susceptible to APT, it's because you've already been hit. That's why "don't let this happen to you" doesn't work - it will happen, and it will happen again. The trick is to detect it and kick the buggers out before they cause any (qualified) damage. You make an interesting point about App Pen Tests. I'm surprised that you say that it rarely pivots. We do all the time. We routinely face people who say Cross-Site Scripting isn't an issue, until we show them different ways of attacking their users - as opposed to the dull alert('XSSLOL'); Likewise for SQL injection I certainly find that breaking in and hunting around leads to all kinds of things you otherwise wouldn't see. If you're not trying to break in, it's not really a 'Penetration' test as much as the app equivalent of a Vulnerability Assessment.
- techbio 16y agoAutomated Penetration Testing?
- iuguy 16y agoAdvanced Persistent Threat - A misappropriated buzzword to describe what used to be called targeted malware attacks or in some cases Computer Network Espionage (or sometimes Exploitation). There's a metric shedload of garbage out there, so if you want to read some more, here's some interesting links: http://www.uscc.gov/researchpapers/2009/NorthropGrumman_PRC_Cyber_Paper_FINAL_Approved%20Report_16Oct2009.pdf http://www.uscc.gov/researchpapers/2009/NorthropGrumman_PRC_... http://www.f-secure.com/weblog/archives/00001637.html http://www.f-secure.com/weblog/archives/00001637.html http://www.infoworld.com/d/security-central/shell-rolls-royce-reportedly-hacked-chinese-spies-652 http://www.infoworld.com/d/security-central/shell-rolls-royc... http://www.scribd.com/doc/6967393/Project-Grey-Goose-Phase-I-Report http://www.scribd.com/doc/6967393/Project-Grey-Goose-Phase-I... http://www.scribd.com/doc/13442963/Project-Grey-Goose-Phase-II-Report http://www.scribd.com/doc/13442963/Project-Grey-Goose-Phase-... http://www.youtube.com/watch?v=XXnIvBBASLI http://www.youtube.com/watch?v=XXnIvBBASLI