Click here to load reader
Upload
tal-beery
View
1.562
Download
2
Embed Size (px)
Citation preview
The Enemy Within: Stopping Advanced Attacks Against Local Users
Tal Be’ery, Sr. Security Research Manager, Microsoft ATA, @TalBeerySecMarina Simakov, Security Researcher, Microsoft ATA
Speaker Info – Tal Be’erySr. Security Research Manager @MicrosoftDeveloping Microsoft ATA (Advanced Threat Analytics)Former VP for Research @Aorato (Acquired by Microsoft)15 years of security researchAuthor of the TIME attack on SSLRegular speaker in top conventionsNamed a “Facebook Whitehat”Twitter: @TalBeerySec
• Security Researcher @Microsoft• Developing Microsoft ATA (Advanced Threat
Analytics)• B.Sc and an M.Sc degree in Computer
Science (Magna cum laude)• Published several papers in the field of
Computational Geometry
Speaker Info – Marina Simakov
Agenda• Intro • Targeted Attackers TTPs and Windows Authentication• Local users authentication
• Local users in Targeted Attacks• Hidden links in the Attack Graph• Lateral Movement
• Hardening and Defending• Local Hero Scanner: Remotely Monitoring Local Users • Hardening: SAMRi10, Group Policy, LAPS
• DEMO!!! Blue + Red • Outro: Summary + Call for Action!
Intro
Attack kill chain
Attack kill chain
Attack kill chain and ATA
Walking through doors
Attackers Lateral Movement MONot going through walls
• Windows’ machines doors are usually locked• Lock = Auth Protocol• Keys = Credentials
• Good News: Multiple locks!• Bad News: in a “Daisy Chain”
Windows Authentication
NTLM Kerberos
Cached Credential
s
Local
PtH Remote Butler
OverPtH
NTLMRelay
Skeleton
Key MS14-068
PtT
?
• The oldest Windows’ auth protocol
• Credentials of local accounts:• Stored in the local SAM database• Encrypted in the registry
• NT-hashes = MD4(password)• No Salt• Same password, different user/computer
same NT password hash!• No “Key-Stretching” (PBKDF2)• Easy to crack
Local Authentication: Local Users
• “The Enemy Within: Stopping Advanced Attacks Against Local Users”, Be’ery and Simakov, BlueHat Israel 2017
• Good thing you are here!
Attacks Against Local Users Authentication?
“When the Cyber Kill-Chain Met Local Users”
Attackers Think in Graphs!Group:
IT Admin
s
User:
BobMemberOf
AdminTo
Computer: Server1 HasSession
User:
Mary
MemberOf
Group: Domain Admins
http://www.slideshare.net/AndyRobbins3/six-degrees-of-domain-admin-bloodhound-at-def-con-24
Defenders Must Think in Graphs Too!
• Same local admin user + password• Explicitly• Implicitly
• One edge away!
Beware of Invisible Links!
• Local users created via Group Policy
• Unsafe -> no longer supported • Relics on DC and Local Users
Beware of Invisible Links! (Again…)
• Enabled Guest Account • Even in tech savvy organizations users leave the front door
open…
Beware of Invisible Links! (And again…)
https://www.safety.com/wp-content/uploads/2012/12/Burglar-Entry-300x300.jpg
• Local Privilege Escalation• Compromise Credentials• Admin Recon • Remote Code Execution
Lateral Movement and Local Users + Groups
• Compromise domain credentials
• Brute force to get local admin password
Local Privilege Escalation
• Brute force a privileged local account• High attempt rate• Local authentication• No traffic overhead
Local Privilege Escalation: BruteForce Tool
• Run elevated cmd• Through logon screen• Using a scheduled task
• Perform privileged operations
Local Privilege Escalation: Switch to Local Admin
• Use mimikatz to extract all users hashes and keys• mimikatz by Benjamin Delpy• https://github.com/gentilkiwi/mimikatz
• Local users included!
Compromise Creds
• ‘Get-NetLocalGroup’• PowerSploit by @mattifestation
• List local groups & users• Queries over SAMR protocol• Required Permissions: Any domain
user
Admin Recon
Remote Code Execution
• Local Privilege Escalation:• ‘local_admin’ password guessed by Brute-Force
• Compromise Credentials: • Extract ‘Administrator’ hash
• Admin Recon: • Discover ‘Administrator’ on remote machine
• Remote Code Execution:• Using ‘Administrator’ hash
Lateral Movement and Local Users: Wrap-Up
• Identical passwords problem is common• PtH against local admins is very prevalent
In the Wild: Access via Local Users
Source: Praetorian
• Adding local user + adding it to privileged local groups• “Reverse hardening”: • Attackers remove other users’ privileges
Local Users + Groups Modifications
In the Wild: Adding Users
https://twitter.com/JohnLaTwC/status/777569424156921856
Defending
• Hardening:• Limit SAMR querying• Deny remote access using local credentials• Manage passwords of local accounts
• Not enough against advanced attackers!• There is a need to monitor local accounts’ activities
Protect Local Accounts
• Local users authentication is… well… Local• Local groups modifications are local too• A network monitoring security device cannot see it
Local Visibility Problem
Featuring the Local Hero Tool
• Periodic scans• Discover security issues• Abnormal login patterns• BruteForce attempts• Enabled Guest accounts• Privileged group modifications• Password configuration issues• Cloned Local Users
• Forensic data for Hunters
Local Hero Visibility Solution
• Fetch all domain machines records• Remotely scan all domain machines• Retrieve all local accounts’ data from SAM
• Load results into a database• Analysis is implemented as queries over DB• High performance• Scans ~13,000 machines in ~7 minutes
• No need to install agents
Local Hero: Under the Hood
• Dormant Local User Logon:
• Local User Brute Force
Local User Logon Anomalies Detection
User Added to Privileged Local Group Detection
Users Removed from Privileged Group Detection
• “Shallow copied” Local users: Hidden Attack Graph Links • Identified via identical PasswordLastSet password change time• 64 bit, 100 nano-second resolution• Timestamp identical only if copied
Duplicate Local Users Credentials Detection
• Execute Get-GPPPassword.ps1 (PowerSploit)• Compare results with Local Hero Scan
Group Policy Generated Local Users Detection
• Local Hero scan results
Enabled Guest Account
Local Hero Demo!
http://s1206.photobucket.com/user/harbottle1/media/Posters%202/LocalHeroQuad.jpg.html
Parting Thoughts
• An in-depth Survey of Targeted Attackers use of Local Users + Groups• Local Users are relevant to all Lateral Movement phases • Local Privilege Escalation• Compromise creds • Admin Recon• Remote Code Execution
• Local Users create hidden links in the attack graph• It really happens in the wild!
• Solutions and Mitigations:• Local Hero Scanner• Hardening with:
• SAMRi10• LAPS• Deny remote access for Local Users
What We Learned?
• Remember: each step in a targeted attack is just a link in the Cyber attack Kill-chain
• Defenders can break the chain, by breaking ANY of the links• Even if Defenders miss a step, they can still catch the next step• Therefore:• Harden your environment • SAMRi10• LAPS• Deny remote access for Local Users
• Monitor Local Users + Groups• Local Hero Scanner
Call for Action: Defense in Depth
Questions?
©2015 Microsoft Corporation. All rights reserved. This presentation is provided "as-is." Information and views expressed in this presentation, including URL and other Internet Web site references, may change without notice. You bear the risk of using it. Some examples are for illustration only and/or are fictitious. No real association is intended or inferred. This presentation does not provide you with any legal rights to any intellectual property in any Microsoft product. You may copy and use the contents of this presentation for your internal, reference purposes.
• Local users and groups querying can be limited!• “SAMR Moved On”
• Win10 allows admins to control SAMR Recon• Registry:
HKLM/System/CurrentControlSet/Control/Lsa/RestrictRemoteSAM• GP: “Network Access: Restrict clients allowed to make remote calls to
SAM”
Local Users & Group Recon Hardening
Win version
Who can query SAMR by default
Can default be changed
< Win10 Any domain user No
Win10 Any domain user Yes (only via registry)
> Win10 (e.g. anniversary)
Only local administrators Yes (registry or GPO)
• A free, easy to use tool by MicrosoftATA Researcher Itai Grady• https://gallery.technet.microsoft.com/SAMRi10-Hardening-
Remote-48d94b5b
Hardening with SAMRi10
• Group policies to restrict remote use of local credentials: • “Deny access to this computer from the network” • “Deny log on through Remote Desktop Services”
• Add the following security identifiers (SIDs) (introduced in KB 2871997):• S-1-5-113: NT AUTHORITY\Local account • S-1-5-114: NT AUTHORITY\Local account and member of
Administrators group
Group Policy to Deny Local Users’ Remote Access
• Local users cannot login through the network
• Local users cannot connect to a machine using RDP
Hardening Results
• Local Administrator Password Solution• Each Local Admin user’s password is generated• Strong random password• Changes periodically • Implemented as Group Policy
• Password is kept on DC• In plain-text• Accessible to Domain’s privileged users only
• Results:• No more identical passwords • No more guessable passwords
LAPS