2022 彙整 - Page 65 of 121

Why BYOK does not solve the problems you were led to believe it solves

Working in the security industry we are regularly in conversations about how BYOK (Bring Your Own Key) can help solve security concerns around data confidentiality, compliance, protection from espionage, and much more.

However, it is most often the case that BYOK does not and cannot solve the problems that people are led or misled to believe it does.

This post is an attempt to address some of these misunderstandings.

First, we need to establish the vocabulary; BYOK is short for Bring Your Own Key, which means the customer provides a data encryption key to the service provider, and the service provider then holds and uses this key for some security function in relation to providing service to the customer.

Already here now that we talk about it, it should be clear that there are a great many problems this scheme does not solve, as the service provider holds a copy of the key.

Another key acronym in security is MFA, or Multi-Factor Authentication. MFA requires that the customer does not just log in using a username and password, but that at least one more factor is provided, which could be a time-based code the user can read from a device only the user possesses. In a sense, this is unrelated to BYOK, but as we shall see, MFA is often the actual working solution to problems believed to be addressed by BYOK.

With that out of the way, let’s look at a few common myths of what BYOK brings to the table then go through why this is not actually the case:

Myth #1: BYOK protects my data in case my account gets compromised.

That would be lovely, but this is not the case at all. First of all, the data encryption key is online all the time. This is a necessary condition for the service to be available and online because what good would your cloud service be if data wasn’t accessible? So, your key is online and now your account gets compromised. An attacker successfully poses as you, so naturally, all data is available to the attacker just as it would be to you, BYOK or not.

Myth #2: In case of compromise, revoking my key renders data unreadable.

This is wishful thinking, unfortunately, and for reasons, you may not expect. As is the case on commonly available BYOK platforms (AWS to name one) the key you bring is not even used for the actual data encryption! Since the service provider cannot trust that a customer can competently generate a strong key, the service provider will use their own key for the actual data encryption.

This key though may then be encrypted with another key, and then finally this package can be encrypted with the actual customer-supplied key. What this means is that the customer has some degree of control over one of the keys used in the encryption of a ‘key package’ which may be used in concert with the encrypted data during a bulk transfer between regions for example. But this is a very niche use. In day-to-day operations, on the most well-established BYOK-enabled platforms in the world today, the customer-supplied key plays NO role in data encryption of the customer data.

The customer can lose the key, revoke the key, modify the key, get the key stolen, have the key tampered with, or all of the above, leaving the day-to-day operations of the service absolutely and completely unaffected because the customer-supplied key plays no role in day-to-day operations. This is not a ‘dirty secret’ in any way; this is well documented in publicly available descriptions of these systems.

The only realistic protection against account compromise is MFA. You can only do so much to make it more difficult for an attacker to compromise your account. That’s why you need to realize that when your account is compromised, someone can actually pose as you, and do what you can do. Cryptography cannot help you at this point.

Myth #3: If the service provider is compromised, I can revoke the key.

By now we know your key isn’t used for actual data encryption. But for argument’s sake, let’s play along and pretend it actually is (but it really isn’t). This means the service provider is encrypting data using the customer-supplied key to which they hold a copy, otherwise, they couldn’t use it.

Now, what happens if the service provider is compromised? Let’s say that either an attacker gains full control of the service provider platform or the government under which the provider operates seizes their systems. Well, the key is being used by the service provider for data encryption and decryption, so obviously the key is available there in one form or another. In other words; what the customer does with their copy of the key has no bearing on the copy that is available and in the hands of the service provider or whomever now controls their platform.

Realistic protections here are along the lines of choosing the region in which the service is provided carefully and ensuring the service provider implements a mature information security management system.

As was said famously by renowned cryptographer Bruce Schneier, ‘If you believe cryptography solves your problem, then either you do not understand your problem or you do not understand cryptography.”

There is a lot of truth in this statement. It does not mean that cryptography does not play an important role in solving security challenges, but it does underline that simple encryption in isolation does not solve the challenges we are facing.

BYOK is no silver bullet. In fact, it is very often not even helpful. Further, if the employment of BYOK delays initiatives to seriously implement MFA or other effective security mechanisms, then BYOK may be outright harmful to the overall security posture of your organization.

I hope this short write-up helps bring clarity to an area of information security that is too often not discussed in detail or even widely understood.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

2022 Keepit

Can User Behavior Analytics Help IT Security Mitigate Risk to Corporate Networks?

Your employees can use their laptops or mobile devices from anywhere within your corporate building to access your WiFi network. Convenience is often coupled with risk however, and many WiFi networks these days simply do not have the appropriate security measures needed, making them susceptible to cyber threats that put your company’s data and customer information at risk.

However, you can protect your network and sensitive data by using some of these best practices for WiFi network security. We’ll focus on the four most effective methods for WiFi security:

4 Best Practices for Enterprise WiFi Security

When it comes to WiFi security and preventing unauthorized access and data loss, businesses must take the time to thoroughly plan out a comprehensive strategy. Although the degree of protection needed, and the available budget determine the final security measures, the essential guidelines listed below can be helpful for getting started.

I. Maintain User Segregation Between Internal and Guest Users

When guests come to your place of business, they will most likely want access to your WiFi network. While giving this to your customers seems a perk, you must maintain a barrier between their access and that of your employees. If they do not need access to any company’s resources, it is beneficial to your company’s safety to ensure that they are kept separate.

II. Carefully Select Your SSID Name

Your SSID shouldn’t advertise your company. Organizations often expose their networks to attackers, and in densely inhabited areas the risks of a hack are much higher. Even with an unassuming SSID, hackers may locate your WiFi network. Yet, having a safename increases the difficulty of hacking a network. Note that banal SSIDs assist WiFi security but aren’t a must-have.

III. Utilize Intrusion Prevention Systems for WiFi Networks

Include a wireless intrusion prevention system (IPS) inside your Wi-Fi security to protect your system. These devices monitor and detect targeted WLAN cyberattacks that utilize packet floods,ARP (Address Resolution Protocol),spoofing, and malicious broadcasts.

Snort refers to a network intrusion prevention system that can swiftly detect and handle potential threats. as a preemptive approach to securing your network. As with intrusion detection, these systems also help monitor network traffic. Depending on your network administrator’s security controls, they can rapidly respond against a prospective exploit.

IV. Mobile Device Management (MDM)

Mobile device management (MDM) allows you isolate and manage access for numerous mobile devices which protects your corporate network and data in numerous ways, including:

Monitoring regulatory compliance activities.
Remotely deactivate or disconnect illegal users and their devices.
Centralize device update auditing.
Protect mobile devices with your company’s security protocols.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Verizon Data Breach Investigation Report 2021: What You Need to Know About This Report

Human interaction with IT structures represents one of the main cyber threats faced by organizations of the most diverse sizes and industries.

This is just one of the important pieces of information extracted from the Verizon Data Breach Investigation Report 2021, issued by telecommunications service provider Verizon.

The document reveals aspects of extreme relevance for organizations that wish to anticipate problems such as cyberattacks and data leaks, avoiding a series of inconveniences and losses.

In this article, we explain what exactly this report is and how you can use this data in your company’s favor. Check out our list of topics below:

Verizon Data Breach Investigation Report 2021: What Is This Report?
Data Extracted from the Verizon Data Breach Investigation Report 2021
Is Verizon Data Breach Investigation Report Reliable?
What Should Be Done in Practical Terms with the Information in the Report?

About senhasegura
Conclusion

Follow our text to the end!

Verizon Data Breach Investigation Report 2021: What Is This Report?

The Verizon Data Breach Report consists of an annual report, published by telecommunications service provider Verizon, on security incidents and data breaches that occurred in the previous year.

In this report, information is shared about the different types of attacks and vulnerabilities, also indicating the main changes that have occurred in the world when it comes to cybersecurity.

For the 2021 edition, prepared with the collaboration of 83 companies, 29,207 real security incidents were analyzed, which – according to Verizon – would have compromised the integrity, confidentiality, or availability of information assets.

Of this total, 5,258 violations were confirmed, which resulted in the unauthorized propagation of data.

In the next topic, we cover some important information extracted from the Verizon Data Breach Investigation Report 2021. Continue reading and check it out.

Data Extracted from the Verizon Data Breach Investigation Report 2021

The following are the main data collected by the Verizon Data Breach Report for its 2021 edition:

61% of Cyberattacks Surveyed Involved Privileged Credentials

Privileged credentials are among the main vectors of attacks by malicious agents and, according to the Verizon Data Breach Report, they motivated 61% of cyberattacks performed in 2021.

Therefore, organizations must adopt protective measures, raising awareness and training their employees so they can avoid risks, and adopting solutions such as PAM, which makes it possible to reduce insider and external threats.

Privilege Abuse Was the Cause of 70% of Attacks Involving Misuse of Credentials

Many organizations fail to apply the principle of least privilege, which grants each human user or machine only the required access to perform their activities.

As a result, they face internal risks, such as the privileges granted to active or dismissed employees.

The abuse of these privileges, granted in excess or not revoked, has caused 70% of attacks related to the misuse of credentials, according to the Verizon Data Breach Report.

Phishing Is the Main Tactic Used by Malicious Attackers

Phishing is a cyberattack in which the hacker uses the identity of a legitimate institution, gaining the trust of its victims to steal sensitive data, such as banking information.

Very common, this type of crime is the main approach applied by malicious attackers, according to Verizon Data Breach Report. For this reason, organizations must train their employees to avoid this threat.

For that, it is possible to perform exercises that simulate phishing campaigns, preparing users to detect it.

30% of Attacks Involved Social Engineering

The Verizon Data Breach Report reveals another factor that poses a major risk to the cybersecurity of organizations is related to the behavior of unsuspecting or poorly trained users, who may become victims of social engineering attacks.

This technique is widely used by malicious attackers to persuade their victims to send sensitive data or perform actions that facilitate their actions.

Information collected by the Verizon Data Breach Report points out that 1,761 social engineering attacks carried out in 2021 resulted in the disclosure of data, which often generated the loss of credentials, usually used in hacker and malware attacks.

Another relevant information is that most of these attacks were detected externally, showing that IT and security teams, system administrators, and employees of organizations would not be aware of these crimes.

Attacks Involving Cloud Are Increasing

The use of cloud-based solutions grew exponentially with the Covid-19 pandemic, which imposed social distancing, making room for remote work.

In addition, companies were able to know all the advantages related to these services, which include more speed and scalability.

However, despite its numerous benefits, the adoption of cloud computing challenges those who are concerned with ensuring digital security.

This is because many human users and machines use privileged credentials to access cloud resources, increasing the attack surface and risks.

In the Verizon Data Breach Report, it is possible to verify that, among the attacked assets, those from the external cloud were more common than the local ones. This information reinforces that hackers can take advantage of the lack of visibility inherent in cloud environments.

The Human Aspect Was Involved in 85% of the Attacks

Often, unintended incidents, such as the incorrect configuration of database assets, directly compromise an organization’s cybersecurity, as evidenced by the Verizon Data Breach Report.

In this latest version of the report, Verizon has detected and assessed 919 incidents, 896 with confirmed data propagation. Among the compromised information, 79% were personal data, 17% were from physicians, 13% related to banks, and 13% to credentials.

Moreover, it was noticed that 50% of violations generated by human errors are caused by administrators and 30% by developers, with incorrect configurations representing 50% of these errors and incorrect deliveries representing 30%.

Also, according to Verizon, data storage was observed being placed on the internet without controls and searched by security researchers.

Is Verizon Data Breach Investigation Report Reliable?

The Verizon Data Breach Report is a widely known and respected annual report, being one of the best in the world when it comes to violations and incidents globally.

It consists of a totally impartial initiative, since it does not promote any product or service. In addition, data are collected from institutions around the world, which makes it truly global.

This data is used to understand and share what are the vulnerabilities that generate violations and incidents, considering the technical and human risks.

Verizon works with transparency both with regard to its sources and the data analysis process.

What Should Be Done in Practical Terms with the Information in the Report?

Now that you have checked the key information raised by the Verizon Data Breach Report, you may be wondering what to do with this data in practice.

First, it is essential to analyze human risk factors and prioritize the key threats faced in this regard by your company, managing these risks more effectively.

It is also extremely important to use the Verizon Data Breach Report as a support instrument, showing the organization’s leaders the relevance of human risk and why it is recommended to invest in awareness and training of employees who interact with the IT environment.

Check out the main points to be considered below:

Awareness first: In this latest report, Verizon ranked the top risk factors for eleven different industries, recommending the Center for Internet Security’s top three controls to manage the risks of each of them. The only common control for all areas was Security Awareness and Training.
People are a major risk factor: 85% of the violations raised by the report are related to human interaction. Therefore, it is not enough for companies to adopt a technology-only strategy to eliminate risks and ensure cybersecurity. After all, the intention is not to protect the assets themselves, but the organization as a whole, which includes its employees.
Human errors generate many disruptions: many companies focus their security strategies on explicit threats such as the actions of malicious attackers. However, 20% of violations are caused by a human error committed by people trying to work the right way.

Among these errors, the incorrect configuration of cloud accounts stands out, which results in the sharing of the organization’s data with the wrong people. Therefore, it is highly recommended to have a solution that solves this type of failure and a professional responsible for it.

The two main types of attacks are associated with phishing and passwords: so, if you do not know where to start training your employees to get better human risk management, start with these elements, which should be an essential part of an awareness plan.

About senhasegura

We, from senhasegura, are part of the group of information security companies MT4 Tecnologia, founded in 2001, and we aim to provide digital sovereignty to our customers through the control of privileged actions and data.

With this, we prevent data leaks and theft, as we manage privileged permissions before, during, and after access through machine automation. We work to:

Optimize the performance of companies, avoiding interruption of operations;
Perform automatic audits on the use of permissions;
Audit privileged changes to detect abuse of privilege automatically;
Provide advanced solutions with the PAM Security Platform;
Reduce cyber threats; and
Bring the organizations that hire us into compliance with audit requirements and standards such as PCI DSS, Sarbanes-Oxley, ISO 27001, and HIPAA.

Conclusion

In this article, you saw that:

The Verizon Data Breach Report is an annual report on security incidents and data breaches that occurred in the previous year;
According to this report, the threats generated by human actions and errors stand out among the main risks faced by companies, in addition to the increase in attacks involving cloud solutions and attacks associated with privileged credentials;
The Verizon Data Breach Report is extremely reliable and recognized, also characterized by its transparency and impartiality;
It points out the need to invest in awareness and training of all professionals in a company and can be shared with leaders to seek support in this regard.

We hope this article has clarified your key questions about Verizon Data Breach Report and can be shared with more people.

ALSO READ IN SENHASEGURA’S BLOG

Configuration Management Database (CMDB): Learn More About It

Cybersecurity Risk Assessment According to ISA/IEC 62443-3-2

What is NIST and Why Is It Critical to Cybersecurity?

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

Segura 2022

Sysinternals Suite – Admin’s Little Helper

Intro

Sysinternals Suite is a bundle of 70+ tools authored by Mark Russinovich back in 1996.

Russinovich created them under his company name (Winternals) along with the help of his colleague and co-founder Bryce Cogswell.

Winternals was then acquired in 2006 by Microsoft, and Mark Russinovich ended up working for them. He is currently the CTO of Microsoft Azure!

Behind this amazing story stands an even more amazing bundle of tools.

Those little administrative tools can (and will) make your life much easier as a Sysadmin, IT Support Engineer, etc. However, they are also amply used by threat actors/adversaries, as well as Security personnel (from SOC Analysts to Threat Hunters).

As the name implies, Sysinternals can help you dig deeper into your Windows hosts.

Today, you can download it from the Microsoft Store by typing in Sysinternals Suite. Alternatively, you can use winget (Windows Package Manager) and PowerShell to fetch it from the MS Store for you.

You can simply do

winget install sysinternals

It’s all explained here.

Sysinternals suite utilities

Sysinternals offers the following utilities:

+Misc tools (everything else in the Sysinternals Suite)

For this article, I’ve picked the most interesting ones (although that may depend on the person) while trying to cover as many categories as possible.

Process Utilities

Autoruns

As per the definition found here:

This utility, which has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and when you start various built-in Windows applications like Internet Explorer, Explorer and media players. These programs and drivers include ones in your startup folder, Run, RunOnce, and other Registry keys. Autoruns reports Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more. Autoruns goes way beyond other autostart utilities.

As you can see from the image below, there are many tabs, some of which can be of great value to you.

Detailed entries about what processes are doing what to the registry (and when), for example, with the option of checking the hashes on VirusTotal, too (see below)

For example, this blog post describes (among other things) how Image Hijack can be …quite sneaky in that the Windows registry has a key to launch a certain process but instead is redirected to launch a different malicious process.

Adversaries are well aware of what they can exploit, and the registry being the db for the Windows OS is a prime target.

Autoruns can help you catch that. It can also help you check these entries for tampering, which can be one way they go on about establishing persistence.

Process Explorer

From the docs:

The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you’ll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you’ll see the DLLs and memory-mapped files that the process has loaded.”

From the image below, you can see that I’ve chosen one of many Firefox.exe subprocesses, and under TCP/IP tab, I’ve inspected one of the IPs I’m connected with through Firefox. When I check the IP for reputation, I get the following (image 2.):

1.)

2.)

And this makes sense, as I have a connection to MS Azure portal.

On right-click, you can submit the specific process’ hash to VirusTotal (It’s the same with Autoruns, you can check from the application against VirusTotal). You can also create a full and partial dump. This can come in handy. Always keep in mind though, that the act of uploading to VirusTotal while helpful, means that you’re sharing your samples with the world. There are merits to both sharing and not, so figure out your whole (threat) model before just clicking on that option.

Process Explorer is, as you may have noticed, color-coded. This is explained in these two blog posts.

Under the options tab, there’s also the option called Replace Task Manager, which, you guessed it, replaces the Task Manager with the Process Explorer. You can revert to Task Manager in the same way.

Also, note that malware would (commonly) hide within the svchost.exe – which is very nicely explained on the Malwarebytes blog I linked above. The reason behind this is primarily because the svchost.exe usually has a lot of children processes running at the same time, so it is kind of like security through obscurity. Or, in this case, maliciousness.

Process Monitor

Process Monitor or Procmon is a Windows monitoring tool; as per Microsoft’s documentation:

“Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such as session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.”

Process Monitor will capture an enormous number of events in no time!

Just as I started the app, it already has captured 78k events! By the end of the capture (around 81%), it shows ~5 million events!

This is probably one of the best guides to configure this little beast of a tool. It is an essential piece of info since you’d want to figure out what filters to use for your specific Procmon needs.

PSExec

Now this one is already somewhat infamous. Chances are you’ve heard of PSExec if you’re in Cyber. It is associated with the following MITRE techniques:

T1021.002 – Remote Services: SMB/Windows Admin Shares
T1569.002 – System Services: Service Execution
T1570 – Lateral Tool Transfer

Docs:

“PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec’s most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.”

Also, check out this resource for in-depth information on PSExec.

It’s all about sharing, or rather remote administration, which we all know how dangerous it can be, if not done right.

File and disk utilities

Streams

Another useful and interesting tool is called streams, and, as per MS docs, it:

“The NTFS file system provides applications the ability to create alternate data streams of information. By default, all data is stored in a file’s main unnamed data stream, but by using the syntax ‘file:stream’, you are able to read and write to alternates. Not all applications are written to access alternate streams, but you can demonstrate streams very simply. First, change to a directory on a NTFS drive from within a command prompt. Next, type ‘echo hello > test:stream’. You’ve just created a stream named ‘stream’ that is associated with the file ‘test’. Note that when you look at the size of test it is reported as 0, and the file looks empty when opened in any text editor. To see your stream enter ‘more < test:stream’ (the type command doesn’t accept stream syntax so you have to use more).”

Why does this matter? We know some malware devs have been using the ADS to hide their data. Further, if you, say, downloaded a file from the Internet, there are indicators written in its stream that it was indeed downloaded from the Internet.

Zone.Identifier is the keyword here. And as you can see:

ADS or Alternate Data Streams is specific to the Windows NTFS. Since all files will have at least one data stream – $DATA- if you ever need another one, it’s where the ADS comes in.

I can simply say:

echo This is my super secret password > secret.txt

Which creates the .txt file…

No nefarious stuff to be found here… but wait till we hide our secret in the ADS stream!

echo hidden in the stream... Pa$$w0rd1! > secret.txt:supersecret.txt

We check using CMD to see if everything went okay. Use dir /r (a very sneaky command, as /r will look for another stream – what we want!)

One answer on Stackoverflow explains this nicely.

The /r option of CMD’s dir command calls FindFirstStreamW and FindNextStreamW on each file or directory in a listing in order to list its $DATA streams.

You can notice our hidden supersecret.txt file hidden in the stream. We can uncover it with a simple command:

notepad secret.txt:supersecret.txt

You can have more alternate data streams!

*Note the first columns (which tells us the size in bytes, respectively) – this confirms to us that something is written in the ADS. It also gives us the ADS names.

notepad secret.txt:second.txt

*Note that you can do this for .exe’s too, which is when it all becomes potentially scary. I covered the .txt’s but the logic remains the same. Google this stuff, it’s fascinating and useful! Doesn’t matter if you’re an analyst or a Red teamer.

This attack vector might contain a slight element of creativity to it, but do not underestimate it.

SDelete

Secure delete, as it promises, deletes files securely. And per Microsoft’s documentation …implements the Department of Defense clearing and sanitizing standard DOD 5220.22-M, to give you confidence that once deleted with SDelete, your file data is gone forever.

Reliable, simple, and easy way to securely delete data, that’s Software-based. You can always use a magnet or a hammer too.

Sigcheck

A CLI utility that will give you a file version number, timestamp information, and digital signature details (as well as certificate chains). It will also have an option to check against VirusTotal.

I can quickly check my executables for any unsigned ones (on Windows systems, all .exes are to be found in the C:\Windows\System32 directory – except the Explorer.exe! Explorer.exe is located in the C:\Windows path)

I check by issuing a command:

sigcheck -u -e C:\Windows\System32

From MS docs:

-e Scan executable images only (regardless of their extension)

-u If VirusTotal check is enabled, show files that are unknown by VirusTotal or have non-zero detection, otherwise, show only unsigned files.

If you were to get a matching here, you should probably investigate that executable.

Honorable Mentions

Don’t disregard this paragraph. These are not less important or potent. I just didn’t have the space/have chosen otherwise, but I will briefly touch upon these few tools here. The reasoning is me covering just two out of (or 6 if you count misc) five categories the Suite offers.

Sysmon (Security utilities)
TCPView (Networking utilities)
Strings

Sysmon is extremely powerful. You can think of it as of an Event Viewer with much more details and controls. Sysmon can be used to hunt for malware, Metasploit, Mimikatz, persistence, etc. All the usual suspects, and more!

Strings – Working on NT and Win2K means that executables and object files will many times have embedded UNICODE strings that you cannot easily see with a standard ASCII strings or grep programs. So we decided to roll our own. Strings just scans the file you pass it for UNICODE (or ASCII) strings of a default length of 3 or more UNICODE (or ASCII) characters. Note that it works under Windows 95 as well. Source.

Strings extracted from malware samples can be of valuable insight. Also, you can scan/analyze binaries. Useful.

TCPView – Technically, Windows already offers this functionality built-in within the Resource Monitor (you can call it from command-line with resmon) – you can find it under the Network tab.

As stated on the MS docs:

“TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints on your system, including the local and remote addresses and state of TCP connections. On Windows Server 2008, Vista, and XP, TCPView also reports the name of the process that owns the endpoint. TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows. The TCPView download includes Tcpvcon, a command-line version with the same functionality.”

This is handy to have and can actually be used for some hunting too. Though, there might be better tools for the job.

Conclusion

This brings us to the end. I hope you liked the Sysinternals Suite introduction! I also hope to cover Sysmon in the future, so stay tuned.

Cover by Joshua Hanson

#sysinternals #procmon #autoruns #sdelete #procexp #psexec #streams #sigcheck #sysmon #strings #vicarius_blog

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

vRx 2022

Madrid improves the services of the EMT monitoring the data of its buses

The public service of buses of Madrid, the EMT, was one of the protagonists of Global Mobility Call that took place the 14th and 16th of June in IFEMA. The company from Madrid exposed its future plans tracing the route to continue transforming the capital into a Smart City where sustainable mobility and independent vehicles acquire great relevance.

Nevertheless, executing this plan would be impossible without a technology characterized by generating data on a steady basis.

That’s why the city has taken its chances on data control through monitoring. This is the secret for the success of the EMT, that already has established a monitoring system thanks to Pandora FMS.

Pandora FMS, the great secret for Madrid’s EMT success

The EMT counted on a system based on a central HOST, that is to say, a computer or a set of computers around where all the information circulated and to which others connected.

But, after a remarkable enterprise growth, this system became ineffective before an activity that seemed uncoverable, the reason why they were forced to change their IT infrastructure management.

The public transport company confronted a remarkable technological growth of buses and users, and they set the goal of having a trustworthy control over the whole system, both the hardware and the processes that take place.

And it was there where monitoring came up, that is to say, the reception and analysis of data and their management by means of a central console.

In other words, the EMT needed a system that canalized all the information to a single computer from which to access all the interconnected technology, and the agreement with the Spanish company Pandora FMS made such a solution available to them.

Through the alliance, the regional public giant managed to reduce costs and improve its service until becoming a reference in public transport for the smart cities of the future, as it has been shown in the Global Mobility Call.

“The EMT needed to remarkably improve the management of all the information.

It must be taken into account that its fleet is made up of more than 2,000 buses and that tens of thousands of users use this type of transport daily.

To satisfy this high demand they leaned on evolution to implement a monitoring system able to adapt to the systems the EMT already had in motion, but that could be able to coexist with future developments”,

explains Sancho Lerena, CEO of Pandora FMS

This monitoring system allows, among other things, to improve the process of checking bus availability through applications, thanks to which the user can see how much is left before the bus arrives from their phones.

It also makes it easy for maintainers to manage with real-time information on each machine, its performance, and its status.

By means of Pandora FMS technological solution, not only does it increase the control that exists over the fleet, but it also achieves better response to any incident apart from preventing possible breakdowns, which reduces the impact on the end user and maximizes the benefits.

“When this monitoring system is implemented in the EMT, a watchdog agent is also established that reduces workload.

What is achieved with this mechanism is that there is no need to carry out periodic checkouts to see that the system is working correctly and that, in the event of an error, it can be alerted in time to act and prevent similar ones”,

highlights the head of Pandora FMS.

EMT Madrid now has control of each bus, which by means of LAN networks constantly dump information to the central.

A step that in just a few years will be left behind, since they intend to improve data management until knowing in real time the capacity in each bus or even establish some that are completely autonomous.

A series of innovations that are framed within the goal of smart cities, where the use of technology for the efficient development of services is the fundamental pillar.

The power of real-time data

Investment in technological development has only just begun.

In the coming years, the use of 5G will end up being established, which allows higher connectivity and higher speed in the use of this type of networks.

In turn, this scenario will increase the ability of systems to obtain data in real time. And, therefore, service management itself may be more efficient by having the option of adjusting to the behavior of users with a correct monitoring system.

Madrid, which has reaffirmed in the Global Mobility Call its image of smart city, is already working on creating a digital twin (a virtual recreation of the city) that allows us to find out the movement that takes place in the distribution of its logistic microhub.

That way, as with the other services, circulation can be anticipated and improved and, therefore, more efficient and sustainable mobility is achieved.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

Pandorafms 2022