3 ms·

Go on...did you manage to keep operations running on Monday? Everyone else has all the cool stories meanwhile here I am aspiring to live Homer Simpson's lifest

Go on...did you manage to keep operations running on Monday? Everyone else has all the cool stories meanwhile here I am aspiring to live Homer Simpson's lifestyle. Oh well.

sleepybrett 4y ago
I've never worked at a company where the security department was actually key to uptime. Mostly they are responding to design proposals/consulting with engineering teams, responding to scanner alerts, etc.
- chris_wot 4y ago
  He said the IT team.
tomjakubowski 4y ago
Homer Simpson was friends with Gerald Ford, toured with the Smashing Pumpkins, and he's even been to space. I bet he has some pretty cool stories.
jiggawatts 4y ago
Yes! This was an legal firm with something like 100-200 staff. The vague memory I have of the incident that triggered the whole thing was that a drug gang bribed someone in IT to get inside information about a rival gang's case. We got dragged in on Friday mere hours after the entire IT staff (not just SecOps) was walked out the door, with several people apparently escorted by police. The non-IT staff had no passwords other than to their own normal staff accounts, and there was no accessible hardcopy of any documentation. I found a plain-text password in SYSVOL with some "server admin" rights, used that to find a plain-text domain admin password in a scheduled task, which we then used to dump out the Active Directory hashes. I have a vivid memory of a nice fancy lunch in a central business district on a quiet Saturday with my colleague while my laptop GPU was making turbine noises back at the customer site running hashcat. By the time lunch had finished we had about 80% of all passwords, including more than half of all admin and service accounts. The only credential we couldn't obtain by Monday morning was the Cisco firewall appliance root password. We found some documentation and reverse-engineered the rest. It was an eye-opening experience to see just how fast the security of a network can fall against an "attacker" with LAN access and just some basic tools you can download from GitHub, nothing fancy. There was another similar incident where an sole IT admin had a rapidly deteriorating mental illness. Similarly he was walked on a Friday to prevent him "salting the Earth behind him", which apparently he had threatened. That network was reverse engineered in a similar timeframe with little effort...
- green-salt 4y ago
  Fascinating! Is this part of a disaster recovery type of service? If I had the energy still this would be a niche position I'd enjoy.
  - jiggawatts 4y ago
    Disaster recovery specialists tend to focus on things like restoring from tape drives in a hurry. I do general IT consulting, and all that was required was some "general security knowledge". There's like a couple of tricks that will crack open any large-ish network in seconds given nothing much more than a command-line. If you want to get fancy, Deathstar[1] will break open the vast majority of Active Directory networks in minutes. In some talk about it I saw on YouTube, one of the authors quipped that it'll grant you "Domain Admin in under 5 minutes, or your money back." We didn't have to run it. I just used one of the initial attack vectors (scanning SYSVOL for passwords) and went from there. This "one trick"[2] will get you an admin account password on something like 50% of all Active Directory networks: dir \\domainname\SYSVOL -Recurse | Select-String 'password' The other trick is that the Configuration Manager client (or any similar agent) is often mis-configured to use the same account and password across the whole network. That, or it deploys packages with similar embedded passwords that can be read from any workstation. These type of accounts are very nearly domain admin accounts, and their password hashes are typically available on every workstation and server. Any user granted local admin rights to their own workstation can obtain it with a short PowerShell snippet. Reversing password hashes on Windows networks is now hilariously simple, because the NT hash is very old and weak. For compatibility reasons it's almost never replaced with something stronger. Any Windows password that is shorter than about 9 characters should be considered trivially reversible, to the point that it should be treated as "plain text" for security purposes.[3] [1] https://github.com/byt3bl33d3r/DeathStar https://github.com/byt3bl33d3r/DeathStar [2] https://adsecurity.org/?p=2288 https://adsecurity.org/?p=2288 [3] https://www.tomsguide.com/us/8-character-password-dead,news-29429.html https://www.tomsguide.com/us/8-character-password-dead,news-...
- anitil 4y ago
  I'm so impressed that you could get that running so quickly!

Go on...did you manage to keep operations running on Monday? Everyone else has all the cool stories meanwhile here I am aspiring to live Homer Simpson's lifestyle. Oh well.

sleepybrett 4y ago

I've never worked at a company where the security department was actually key to uptime. Mostly they are responding to design proposals/consulting with engineering teams, responding to scanner alerts, etc.

chris_wot 4y ago
He said the IT team.

tomjakubowski 4y ago

Homer Simpson was friends with Gerald Ford, toured with the Smashing Pumpkins, and he's even been to space. I bet he has some pretty cool stories.

jiggawatts 4y ago

Yes! This was an legal firm with something like 100-200 staff. The vague memory I have of the incident that triggered the whole thing was that a drug gang bribed someone in IT to get inside information about a rival gang's case. We got dragged in on Friday mere hours after the entire IT staff (not just SecOps) was walked out the door, with several people apparently escorted by police. The non-IT staff had no passwords other than to their own normal staff accounts, and there was no accessible hardcopy of any documentation. I found a plain-text password in SYSVOL with some "server admin" rights, used that to find a plain-text domain admin password in a scheduled task, which we then used to dump out the Active Directory hashes. I have a vivid memory of a nice fancy lunch in a central business district on a quiet Saturday with my colleague while my laptop GPU was making turbine noises back at the customer site running hashcat. By the time lunch had finished we had about 80% of all passwords, including more than half of all admin and service accounts. The only credential we couldn't obtain by Monday morning was the Cisco firewall appliance root password. We found some documentation and reverse-engineered the rest. It was an eye-opening experience to see just how fast the security of a network can fall against an "attacker" with LAN access and just some basic tools you can download from GitHub, nothing fancy. There was another similar incident where an sole IT admin had a rapidly deteriorating mental illness. Similarly he was walked on a Friday to prevent him "salting the Earth behind him", which apparently he had threatened. That network was reverse engineered in a similar timeframe with little effort...

green-salt 4y ago
Fascinating! Is this part of a disaster recovery type of service? If I had the energy still this would be a niche position I'd enjoy.
- jiggawatts 4y ago
  Disaster recovery specialists tend to focus on things like restoring from tape drives in a hurry. I do general IT consulting, and all that was required was some "general security knowledge". There's like a couple of tricks that will crack open any large-ish network in seconds given nothing much more than a command-line. If you want to get fancy, Deathstar[1] will break open the vast majority of Active Directory networks in minutes. In some talk about it I saw on YouTube, one of the authors quipped that it'll grant you "Domain Admin in under 5 minutes, or your money back." We didn't have to run it. I just used one of the initial attack vectors (scanning SYSVOL for passwords) and went from there. This "one trick"[2] will get you an admin account password on something like 50% of all Active Directory networks: dir \\domainname\SYSVOL -Recurse | Select-String 'password' The other trick is that the Configuration Manager client (or any similar agent) is often mis-configured to use the same account and password across the whole network. That, or it deploys packages with similar embedded passwords that can be read from any workstation. These type of accounts are very nearly domain admin accounts, and their password hashes are typically available on every workstation and server. Any user granted local admin rights to their own workstation can obtain it with a short PowerShell snippet. Reversing password hashes on Windows networks is now hilariously simple, because the NT hash is very old and weak. For compatibility reasons it's almost never replaced with something stronger. Any Windows password that is shorter than about 9 characters should be considered trivially reversible, to the point that it should be treated as "plain text" for security purposes.[3] [1] https://github.com/byt3bl33d3r/DeathStar https://github.com/byt3bl33d3r/DeathStar [2] https://adsecurity.org/?p=2288 https://adsecurity.org/?p=2288 [3] https://www.tomsguide.com/us/8-character-password-dead,news-29429.html https://www.tomsguide.com/us/8-character-password-dead,news-...
anitil 4y ago
I'm so impressed that you could get that running so quickly!