thanks very much could it offer to
everyone thanks it always was booked
this is some of that was good just
checking cool
okay so as introduced the pups this talk
is to discuss what happens when you
joined a fan ad the way how they use
network together so by way of an
introduction
I wrote this here they are explain Who I
am
final thought and then we'll break into
the actual technical detail so the teal
they are if she's researching progress
it's about a year in now but I'll still
what I care about it's different you can
find in the event as I keep on finding
new attack sizes I'd still find doing
them it's not a bad idea
well they clearly Amy plays a part net
this is about what the attack surface ad
George UNIX mistake looks like this is
how if you get a shell program not only
UNIX is still an enterprise network you
won't find that you actually have more
craters
use them so Who am I some Tim I have a
background working for financial
services organizations and for the last
15 years like I've been working in this
tank
use the word scram I spoke at a secure
table field I spent three years ago
looking up red tape and DevOps
well yeah I like podcasting or offensive
by nature that said the financial
services stuff was an operational right
I'm looking at security for a defensive
perspective and probably for the last
eight events or so I could focus impact
on the defensive side so one of the key
takeaways for this talk if you take
anything away is that there are
mitigations a lot of things you
shouldn't do in to defend your units
estates better and certainly some of the
stuff has been published on to the back
of this so far is very much geared at
how you how you protect yourself not
just how you attack so the plan for this
talk I'm going to give a little bit
background for those you that perhaps
haven't have any familiarity with what I
do is write look look I run through a
theory it's a possible attack
probably speaking wolof similar fact
turns on Windows AVG own systems are
very consumed designations and
recommendations a little bit but then
the response because the vendor response
it's been interesting or finally
reasonable conclusions probably a slight
change from the last time I presented
this the bonus material on this occasion
will be more detailed look at
recommendations and investigations I
switch it up a little bit for this
audience I understand a little more time
looking at how I came so far these other
both ways
how I came to find this weakness is that
all the factors of C just from doing
research and on the last time on what
you should do as a veteran or as an
enterprise is I think in an audience
like this there's a problem we'll be
more interested in breaking things than
the necessaries in defending that said
when you got into the real world I think
we need to say about both so the
background well I started doing
operational security on the UNIX estate
20 years ago
we were using Tivoli to essentially
manage flat tax files essential parts of
essential shadow etc security password
little fire to detect finally an
existent part we were simply managing
nice fire rather horrific enterprise
applications written by the likes of IBM
and you essentially modified those files
in real time actually made requests
probably your graphical user interfaces
as administrator these days a lot more
systems are looking to the ad joint I
had a conversation just this week I
think this equipment workers at the
moment are UK retailer
building up their cloud infrastructure
that it is yeah and they want this right
yeah what do we do about the UNIX boxes
we're going to have this cloud how do we
manage the identity on there we started
talking about well Haley is the right
way to go in the sense you have
centralized management you can applaud
the policies all that good stuff but
these are the things you need to think
about because maybe your university
administrators won't be familiar with
is very heretic so that's a little bit
about why let's look a specific
implementation so then tell this is what
we see a lot we see that possible my
hand'd was probably on something that's
called that directly Atlas was but is
actually something that Cisco use
internally for our network I'd say it's
an obvious place to start but there are
as a other implementations so why does
it all myself look at it from a
commercial standpoint we're expecting so
they push the ITM below were expected to
be able to tell our customers how secure
their networks which beta versus your
own networks from the perspective of the
team oil price in that's even more true
because we're directly out there
consulting to customers I mentioned
their customers doing this other stuff
yeah if I can't be sensible answers to
those questions when the password policy
directly it's not my shoes and then you
look at the bigger picture we protects a
local area networks so yeah I like bugs
the scale this is a bug that scales or
it's a weakness and scales to be
entirely fair face and vendors concerned
so I mentioned I've been talking a bit
more about how we went look at this the
approach was pre iterative I started out
by building out other environment I
could test against I could research that
I could evaluate specifically I saw that
with fit up I will say influences and
equivalent using red house open source
ad integration solution had a couple of
others but as I started building it out
then I start to think about the threat
level look like is that when I had some
understanding what would likely go
Gaylords assistance then I started
looking at what that meant as
implication so system somewhat worthy
attack service is a change locally on
reviews from the configuration files
around it
then landed on the idea that perhaps I
needed a fossilized components yet a
open source implementations are great or
certainly the closest implementations
you know they get very far
merely looking at it from the file
respective and looking at
racial perspective reverse engineering
because I'll talk about the facts that
this is something that's probably fairly
similar says the week this is your file
in Windows the cryptographic slightest
things look definitely similar than we
do to reverse engineer development more
fussing yeah you can see the pattern I
went through a palace and say it was
easier to follow this amount map so the
theory of what we were actually doing
those theory of what I was actually
doing was about exactly this so that's
what bread hats implementation sss d
looks like our typical unix similar
structures typically an exhibit of
judges the director so you've
essentially got small sent occasionally
identity you've got some policies and
essentially it's not dissimilar from the
bubbling will follow with most obviously
authority provides a little dns is also
provide me LDAP based on see the central
rather than the Kerberos SSD if you want
a normality
it's performing a similar role to else
else us our window system and it's
essentially some compactness and falsity
active directory making requests
invalidate users getting Kerberos
information back applying that to the
users profile and the system they've
logged into yada-yada-yada
you can see where the attack surface
more at this is there are some
differences so what do they attack
change looks like well I said I
installed in and I was going to do some
threatening so actually I will apply it
so it will did it properly
Cisco have a threatened or mental reason
certainly but I also use months of
stride methodology and like sort of
certain tools give myself so this is
like possibly share with other people
and essentially in the end loader
building out big spreadsheet a big big
spreadsheet as I went through issue of
civilly and every time I found something
long tended I have thought was kind of
interesting i maked night event to make
sure I went a little what other than
isn't don't what's and so it's the same
design problem and the spreadsheet at
some stage rather would be something I'd
like to share because I think as an
approach it's quite useful to show how
you go about doing this but I actually
think there are other implementations I
won't get a chance to look at it will be
quite quite cool to see all of the time
limitations get a similar level of
exposure
so VIN teller I said I threat model day
that's Francisco straight water tool on
each of those components has a set of
attributes that define a threat trap
models the attack services essentially
based we're broadly speaking just as on
Windows you have a user that comes in
over the network across a generic trust
line boundary in this case SSH windows
it'll probably be our DP SMB something
like that and then login and in the case
of Linux you'll appear through a process
that hosts a Pam library SSH and he
makes a library calls down into the
power infrastructure the power
infrastructure in the case of AD in the
case of business this isn't some talent
but also an SSD and the other
implementations typically use a UNIX
socket to call out to the host process
for the integration so I've been telling
you is feisty sss uses s SSD others we
use different process than video you get
that one that UNIX socket allows crown
to talk to it and of course fast service
component then does the integration
piece back into ad so in the case of an
authentication request it might make use
of all that it may make use of Kerberos
cached credentials is an interesting one
so mean by this is a bubble auditory
history of cache productions being a
source of weakness year he compromised
approach we don't know promoters you can
use either edge of those men absolutely
the same miss with faster with with SSS
date a lot of importations
in the case of Intel
yeah there's a whole bunch of things of
the file system which are quite
interesting clean the secret base base
allocation in the back sequel a database
that contains provisions of interest so
that's that's only speaking what it
looks like and like I said if you look
at it systemic most layers attack
surfaces have analogy for its limit
Windows or Linux
yeah you can you could take the same
approaches and of course other vendors
do exist
the reason it's interesting is because
on UNIX
we're probably 15-20 years behind the
times I say that somebody that spent
their entire life work with UNIX and try
to secure as a platform but we also need
20 years behind the times you IDs and
Yogi's are pretty much the young before
security barrier that really exists and
they people like to say that SELinux our
backup and such have improve sight in
the face a homely system you actually
see in the real ones that have been
effectively configured and deployed our
very best to likely to see if you're
likely to happen a state that I said to
you will on policy breaches it's very
rare that you'll happens slowly
enforcing because if you fully enforce
then you have a whole additional moment
overhead comparatively windows have
restricted accurate way from being paid
as come as a protection it has protected
users security groups that has TPM only
no surprises and morph as LS a
credential isolation so Windows 10 the
emphasized process the equivalent of a
State Department of s SSD is actually
virtualized away in a separate instances
the OS so you have a very final set of
API tools that you can leverage as a
normal user to talk to Alice asked to
make an authentication request or to or
some day to gain access to your taken
you really are quite limited so the full
question was what if I can get into UNIX
boxes what can I do and how do I
determine whether I can recycle any of
the ID infrastructure by getting in in a
huge array of tilting out there and in
fact I think it's fair to say there's no
useful tool amount there so from a
fantasy perspective there's a few five
abilities have been polished for someone
implementations X SSD in particular has
a bit of a checkered history around it's
like PC but there's not a huge amount
out there so the school crisis would
went a little bit like this people log
into UNIX boxes they submit their ID for
dentures
I think Isis they boxes are quite
interesting for our own sake
that's all the works at a sacrament
illustrator has interesting privileges
recycle effective just by logging in but
there's a hell of a lot of interesting
privileges they may have low network
yeah it's all about the system that is
used to for example host an application
and an application was developed
in-house does that mean attending have
access to their to their get rings so
their internal CIA LCD infrastructure
doesn't mean we get access to they might
not find out you know what I could
evolve their their colleagues and get
access the Louis is it's a whole raft of
different ways you can gain and most of
those people are in various actors at
windows of opportunities to attack with
from from the UNIX like that just just
as prevalent say some practicing plus
hacks so I've great wonderful saying X
SSD Intelli authentication services are
around the 80 integration president
three ways automatically color brush
I've called out something as well so
they can be seen as part of an ID
integration solution you will also see
them into isolation the canonical page
is probably something like a web app
Enterprise pencil web apples their
infrastructure and they like they gauge
you know we taught most of the issuer
accounts individually for this system
will perfect figure on that and what
does that mean
so Red Hat so so first a siphon source
potential attacks look like stealing her
she's from the files
stealing hashes of plaintext or memory
from a blue team perspective each
relatively well hardened I say that in
the sense that what compiler perspective
api's of ApS that are well used our
business degree of Kampala hardening
around fit the sack protection etcetera
ah
notable would have interesting it does
well as the root user others I
immediately it has a bit of actually
track records were my PC standpoint and
don't think there's any public pic2
around most of this but that cached
credentials well in the minimal
is actually relatively trivial to a
point you can probably look at the patch
that's available for absolutely
vulnerabilities and figure out the
trigger it and whilst you know
think that all UNIX boxes are a well
practical up to date that's not always
the case how about the public PhD for
that proved might happen at the SD that
works for them it's just as important
principle be able to be able to remember
the fact that the resultant work out so
it digest I set up an approach so that's
what the approach looks like with the
audit level what I really wanted to do
was understand what the attack surface
was that was introduced by the software
so I was looking at the file locations
the file permissions the contents of the
files processes sockets SDLC compliance
capacities the SSD slide I showed a
couple of slides back which useful to
know if vendors are probably things in a
safe fashion in telephone solution they
haven't been opposite the kitchen of
compiling that it was pretty much
compiled with spot DC settings from
probably 20 years ago probably part of
the reason I'd posit for that is the
fact that is available for a lot wider
so units is signed many of those
settings don't necessary have a direct
equivalence formula if you've got it my
ex temple - or a accessible one yet and
you're running us that's the idea
compiler you've probably thought might
have that emotional nature sets
sound probably the view also put the
something that compiled everywhere
didn't do too much work around improving
that make faster that it's and so you
end up with a situation where you're as
good as the worst case I want somebody
to review what it look like my review
what is understanding what the
difference between why this is still
like normally would look like so that
meant looking at the learn page little
bigger issues amongst tuning that loss
and I'm actual really helped in the case
of Intel as an example
didn't help from a security standpoint
in the sense we don't invent the product
and it will secure but when it didn't as
I have full access to certain as did I
can see traffic that was going there
that I really saw fit
you turned lot longer than my TV they
fill that sort of thing
great respond to it by positive cases
this has real-world valid protocol
limitations to work from so that's the
kind of artifacts you file your SSST
they range from - purchase through
porosity cases right down to
configuration files contain the
territory uses of information the bits
that are in italic you can't get to
unless you revisit the fairly common
with misconception is because that's no
different for Windows you can't you
can't accrue other peoples Kerberos
tickets or accrue other people's
password hashes or the Windows system of
market administrator relation rumor the
purposes this is this research wasn't
without the UNIX system that I have
access to it was to figure out how I eat
existed they're kind of tight on those
to the right of it look so the point is
if you get rid of a single development
instance of X AP does that mean you've
actually got a whole stack and
privileges that are associated with
other systems on the network that
problem the ultimately is contrasting as
I said in Tara's proprietor
multi-platform again you get Russia's
again you can still plantation that way
and even mess with the IPC
the IPC is more robust in a sense that
there's no public vulnerabilities
available for it on how the song
research that I did indicated probably
explorable conditions in the
implementation I wanna say probably I
worked with the vendor Levin I received
my first kite my first Katie's public
I'm not suggesting that the referring
other places out there but when the
vendor has chosen to run more fast test
cases through their entire
infrastructure repeatedly to clean out
all the places and bottom problems
that's ultimately their decision they
were pretty good in my summer at God's
and instead they probably did by
comparison with SSST it runs as a daily
user but it doesn't work with you our D
0 means if you
code execution you attention to have the
ability to pivot back this is a very
user so the use case would be there
emerged it is something terrible VAR IPC
I can still potentially get massively on
as I said because he runs on lots of
platforms it doesn't have the same depth
of hardening panicles doesn't have any
direct integration SELinux didn't tell a
half fix that last point are in the
sense of the life provided messy linux
policy that's appropriate for it the end
of tiny basics in github it's all a
personal repaint that works for the
company and so therefore you only likely
to find it it's not actually asking them
and telling them that they don't have
one site attack so if they say
essentially we're clarity was david
morrissey site again with some connected
interest again we've got some
hesitations and configuration again with
light you see that my piece can't quite
interesting because it uses exposed to
Louise's there's a level of security
control that's applied to it in the
sense that essentially when you connect
to it you pass in a file descriptor the
Arthurian files is the Urd energy ideas
the process is the file descriptor will
selectively allow operations of the IPS
at sea level depending on the UID and
GID of the Cajun music ah that looks
pretty effective in a sense that we
reduce the attack surface total producer
this IV functions that were exposed it
would be of interest that we do reduce
access and then of course we have the
Kerberos tickets ah
just by way of its all the different
knowing about how those things don't
really know Akash flashes
anyone not like overseas I can say Cobra
sticking through my I'm essentially
holding on access to one system to my
density such that when you try access
sort of businesses workflow system and
you don't have to go through a full
version without a facial you essentially
numbers at total absolutely associative
that says the the ID infrastructures are
elevated the identity of issues on
please continue to trust as usual is
fashion so being out of steal the
Proform
music by daily privileges with
substantially which other assistant
assistant those the visa so that's been
telling held up again we can still
prevention summary that she really
shouldn't really do that used anymore
but it sometimes is the middle point
Scully quite entertaining the number of
times you'll see web applications that
have SSL Italy and in addition to the
interface on the on the user interface
for accessing and then you're gonna
figure a shoe that's used to do the
syndication checks to the funds that is
not SS over the way through so if you
into certainly outbound it outlines one
of her own October is there's a
reasonable chance you might catch those
critters in across the line in it in it
we usable form best mates describe it
and again as with every application
where this look to t4 injection you will
find additional essentially at the
fundamental level curve office isn't
unique so active directory sign
interpreter says the worst you may we'll
follow prospectors antisocial aspect if
you look slightly look this way they
can't actually do as I said you need to
be privileged to use it as I said these
attacks are pretty long known and
windows world but from my perspective I
want to see more likely the same thing
on UNIX captures plaintext and say he's
also created
find get any of those three things that
I can probably do things were intended
so happens if you fall around mimic
house on typical Windows box you're
likely to get caught by mg on you're
likely to get caught by Ivy do likely to
be put in some fashion or rather I can
indeed you're it introducing any baggage
the system in order to do it in the case
of UNIX
perhaps she's there found this the
tickets that class but in this
particular hashes and was interested in
so the year I detect the allowed to take
the hashes title of one to your heart's
content
anyway but that's not quite as easy as
it may seem we probably guys did a
little bit reversing set ultimate being
iterative at this point in time I was
not smart I realized that I needed to
put a pass on the one reason I was
looking at class they always know what
it was doing with my dessert with the
traffic adventures they received a lot
database I'll do that but you look at
the time when you're going lacks a lot
of plain text possible what is age
northern Indiana often lazy so there's a
little bit of adversity to do that
finding the functions
I will try still held trace of the next
race if you will not solve you this
intimately comfortable to wear on gdb I
da le Frank's an education really good
place to start
so ash trace will essentially consistent
definite visibility of what process is
doing and traced us inside the library
level so the way to think about it is L
traces essentially your deed literacy
your individual life was promised about
application and traces what the the
kernel is doing in your spaces as well
as my vehicles that you make an
ultimately if you will in particular
perspective of how their Gators is
easily
hoppers a great place to spot ID is I've
seen the reference group and excitement
releases more astounding but offer is
pretty cheap accessible unfunctional
certainly for them for the major powers
you know i us RS x windows linux you can
you're going to better get home peoples
of the way we're just so that's how to
look at that and for me I used to be my
nice guys with do more reversing Box
dumping a binary essentially having a
text file in associate that was facing
this X mob
the fact that my main interest which was
why he's the batsman so that that
something any way to do it he's his
talent but essentially but they didn't
just sit mr. hopper ever since there is
relatively cheap to get and it is a
greater perspective the difference
between the tape is flat was intended to
be wrong and bothering injures is meant
to be more forceful illnesses
so anyway breaking the hashes SSST
it's as simple as that so if you look in
the top left alone
right I'll hold it away a little bit
from the base base platform at first
base base is the same as soundless
essentially a standard implementation of
our authentication for their interests
and see 500 different ecosystems SSD a
zone they take when I said you can dump
them but they say there isn't honest
Explorer - Sean 512 can be be dumped
they're lying - cool that is John the
Ripper knows about that format so
relatively easy ash even with assuming
that you've got any passwords in there
you've got a good dictionary for this
philosophy again after there soon as I
tell her then tell them is a bit more
difficult so I mentioned I have a sequin
like database and I said mr. piss plane
crash miracles the good news is when I
started to dive into the language into
the binary Steve Harvey symbols go past
this point about they're not passing
while so practice as defending their
their intellectual property and
defending their their attack surface we
have sins which meant that I can start
to figure out what the risk by capturing
algorithms look like the legacy one I
never found it in the wall so I haven't
got a huge agree on it about sha-256 or
sha-1 depends whether the lease the
moment attained or whether he believes
the implementation is sha-256 is
possible to reverse that militant
reasoning the fact we've done that we
made the Taylor bubbles do that based
the German grip that stuff and so
there's stuff to do the extraction I in
terms of timelines
it didn't take a huge around the side
pretty much a day so what does it look
like so that's more or less the
implementations use that caching caches
for for bintang and it's essentially a
case of hash the Irrawaddy - the
password and then essentially you shall
back and then you base64 it and
the sequel of Davis's interestingly that
potential guys in both directions how
much you see were funded that depends on
whether you can find other ways of
getting to theta into the database
tables obviously the standard way is to
move in as a given user
and if fertile to find the most of the
IPC laughs to inject berries
hypothetically there maybe you could
like the hashes of the opposite
direction to maybe press so I taught
binary ninjas
don't bring the ability to annotate this
is probably the best way this one so
yeah and ask me essentially aliceparish
fighting SMB for using binary dinger
you'll see this essentially I've got a
fully functional groups and the perhaps
values has been passed in next to each
of the assembly instructions so that
gave me an understanding pit is actually
happening but it's not standard
implementation so I had to go and I have
to figure out how scheduled ready to
crack it
those rules are not a public remember
will then teach over it one of the
things at the end of this deck is a food
writer but how you stopped my potions
because they're not necessary as
transparent but from my height I don't
necessarily know why we're at guest
house when I was top pushes a good price
out there and silent designer if you get
to talk to is pretty helpful tape person
to the initiative notices we've got a
bit of the software the services we
defined will be you title within the 69
acres 69 already existed there's an
expression acid essentially my wife I
was telling anyone was calling it which
which function definition 69 so actually
uses its age and therefore through
usability relative efficacy absurd
e-tron chromatic values and definition
and then essentially you have some
definition it's also you have only if in
that 32 price which is a flagons in have
a lot of flight which is the news lonely
the saltiest waffles that essentially
says this is how I'm expecting to
construct the plaintext value for which
actions of Bill
I then define a couple of constants
that's because that's part of the
plaintext value design actions will - in
there and I said that the first of the
soul mates is 36 then on the right-hand
side you only have the function calls
that you are stronger it for when it's
taken a plain text item either for this
dictionary this brute force in a
location and applying basic solver so
you see it starts off like that so
clearly you your dear this instance
thing in front of the plane takes value
that's the key and then you do the
functionality plastic scribbler
operation and there's a test case that
was the most simply said that maintainer
career professionals were deliberately
ruleset geysell's environment that says
it bus is really actually still does so
they change the implementation of the
sha-256
crypt final operation we will know that
this is still pops and curtain aside if
intel is a bit more interest to your
terms of plain text every SSD I didn't
find anything particularly one Boeing
the case of in town on the service of
sponsors you doing that the plain text
values being left in referral parrots on
so essentially if you could dump the
vasty procession impossible to which
used to login or the password so the
easily locate turns out that's because
essentially the memory management
routine was set the thread only runs on
a certain conditions it's not
essentially continuously running thread
it happens when the entire thinks that a
user has successfully logged in because
he holds that password so that if you
need to do a password reset because
you're demanding and also possible to
subscribe
instant youth rather than the password
enabled and do that initially school
consequently we can get plant X values
out instead easy D chord appealing the
string which I've done so that's why
it's worth like because if we don't look
at those kinds of things
we'll miss Martin true that we
three thousand saya
thank you thank you so fun so if you
guys think it as essential as far as it
is on the TMP you should probably answer
your survey artifact is identity based
on a possible network variety of ways to
do that the most reliable I found was
SMB client a lot you sleep last
assignment notation a figure like we
working this as ideas restructure don't
base huddle think they actually
performed the first of all I will
attacks against them the cryptographic
weaknesses in in an active Irish in in
ntlm armed memory house works quite
nicely if you if you can take that the
sake you fall off the UNIX system of the
window system ukulele in the newest
processor useless listen to that like
SSH is kind of that so in principle if
you put a Kerberos ticket you can you
can look at all the human systems tape
using the paragraph taking the problem
is most of those live recitations notion
configure to use coalescence atoll which
actually makes the Russian why is that
why you've actually issued Kerberos
tickets why you ask you the authority
tiny seeds in issue you care what
stickers doing in ways because you're
never ever a useful tool under community
box which I only told you would ever use
them if you were either connected to all
the boxes that supported addresses age
the configuration is rarely switched on
or if you were connecting back to ntlm
kerberos enabled web applications
well the chances if you open up the
browser source at the option environment
is your face while sharks kind of quite
fun so if you get the tickets and you've
not the ability to be the traffic for
Wireshark folks if you agree on the
system and one thing you can send to
start decrypting traffic's that won't be
of interest you
the modern deeper deeper attractive
other system state
Hannibal's fact if you more options it's
a plus extra LEP
depending on which blocking and you read
RDP the sports curb or so it doesn't
some suggest it's associates just that
identify identification of
distant whoosh effective visible system
suggestion versus rooted for syndication
I've never been it working while I since
I might spend more time so Ross tickets
that's how easy it is to change identity
if you get on the ice so in this in the
left-hand side of I've logged on to see
that missionary so I've got a secret
registration and great right hand side
I've got very made it up through a
vulnerability in an application maybe
this because I have seen you access use
it whenever I've got I've got access
those properly so I've copied the the
administrators ticket I then become a
lot another privileged user so in this
case user lnx I don't have to set the
appropriate variable to the thinking
about just stolen and I want a list on
the Senate administrator so that means
that any whether that ticket like a DC
that ideas and Tatian trusts the
identity was because the services
reoccur was nothing silent into the
administrator
Atholton learn about to he explores so
the purpose and then it can manage to
recognize this and make it an effective
tool from a tax perspective on what it
essentially does is harvest those
different credential sources so harvests
leave the hashes it has harvested a case
it halts the plaintext memory and
essentially means that you end up with
something that you want take 15-20
minutes to do otherwise taking two or
three minutes I'm potentially being
something you could do is if you don't
have a full shell addiction to it so
this is a new tact I didn't really want
to stop there because that only works if
you put a shell of some description and
it was slightly work to see if we did
get because they show us what executed
later run lots of times when we break
into UNIX systems or systems in general
we actually end up with probably a
message for that
so I figured as Carlos sá presider's
then I thought you know I've written
I've written that reverse-engineer the
price goes up reverse-engineer the
hashes would because to like those
publicly available so if people dump the
hashes then I ask use them so the
written rules are so valuable now
thought you know what I'm not just going
to put this out on a sign up it gets
give you these guys a chance to defend
themselves so other people's
instabilities defend against this
ability or even to detect this will
really happen I mean I thought wow I
probably meant putting out the research
notes and fathers and said track and we
are currently getting there so that's
the real face of data that's what it
currently contains a step up from that
the mythical framework stuff is going
through the whole process to go into
this world the big sticking point at the
moment is the best most beautiful idea
environment that they can reliably test
the mentors I've written and I cut I
said I've done one work of others in
celebration don't really want to spend
my summer administrative messes was that
good bad really
um so then they're busy building some
test cases so that they can they can
reliably test this and then it would be
a mess but my month all your doctor was
a nice little 2d stuff it's probably
easy to look at from a wider perspective
I can see remnants of those positions in
the partial attacks out before we came
but actually if you administer a UNIX
box
and you know where your crouches alone
needs to look like no matter what the
deal was
and the patron of tools very little star
attraction constrain some of them this
ones I've been working on I will discuss
that a little bit
so what the mitigations look like so
you've got generic hardening you've got
the restriction of UID 0 and that we
will you can you can log out and P trace
a number of different ways you can do
that you can protect the resources with
selinux and you can apply additional
asleep read the manual
I sent through some finest material each
of us has a slightly sign
by this by this section of the day but
instead of that let's move on to
recommendations or I'll show you why
so recommendations this is the
developers as much as anything please
hold me up wineries permissions for the
most part permissions all the stuff I
was looking at was pretty good but my
IPC interfaces so they really need every
user to care to have access to them and
to they necessarily need people have
access to increase in Essex price
through the memory management funds even
the faculty practice and prices actually
might be interesting with furthest to do
make sure we know memory management
share hot if you live I see a hunt and
cryptography ah the VIN teller cars were
really good survival he ripped out that
passion implementations I reversed my
stick with the Shelf be pitch solution
ah but if you're gonna choose a solution
to store sensitive information use the
right solution for the job strange man
carrot with reason why in this
validation k the errors or something
like that into the polymer girth so I
speak the responses Mashable thin
talented ironically by the time they
sent me their IPC failure I've already
figured out that I was black isn't
making things do all of them today but I
actually shared their internal SD
Congress that's pretty sweet
there's very few vendors out there that
guys are fought in extending an olive
branch with a security researcher comes
and says Harold's focus was what you've
been doing thinking thank you and come
listen to how she ran for their cash
infrastructure ah they acknowledge the
fact that plaintext memory was a problem
I've been working on that let me assume
that the native fashion their view is
essentially that the the memory would
only get cleared
waiting or freight my life acknowledges
some other certain additions that wasn't
things that I gave actually and they
pointed me their SELinux policies I
wonder how many vendors out there
couldn't even tell you about Nestle in
default and I like
right the very stuff in fact it wasn't
easy to fun but however these written
one all the vendors have been reasonable
when I write this deck before Christmas
they've had no issue for toddlers 30 40
days I didn't feel sad to mention how
she heard very much for since Christmas
so they're like it may well be that I
might be slightly more critical if
everyone missed it but for the most part
they've acknowledged the problem it's
it's one much I think of education as is
necessary of the implementations you've
husband has the people that are writing
the entire excess SD ultimately hole due
to the architectures is given to you I
talked about family knows it mostly
shrines to harden their one to make it
far harder for you to attack else us
realistically no ticket about those
kinds of changes other than Scoble hugs
the fact that was a pirate little
station one hat was a lot of the other
vendors was later say well actually do
think we can do similar things to what
whatever windows I said or Mishnah
Stickley yet if you could if you could
influence curb design not not likely to
happen unfortunately
so I conclusions we learn what are the
next steps will thanks and the next day
to me I think is kind of quite
interesting if you might apply all over
home at least say what we learn if you
get onto a UNIX box the might be ways
for you to get access directed direction
it well hospitals and hatchets need to
be protected wherever their stores more
just in the places that people are
versatile us ah a lot of noise trance
relationships just because the UNIX part
doesn't necessarily understands
active very doesn't make it any more
forgiving when they ventured under the
breach I'm probably at some stage rather
wondering yeah I seen say the rest box
is being used as words pivot internet
works so it's not beyond the realms
possibilities and Linux box will be
um if you're going to use Active
Directory please read the manual please
understand what your switchable they're
catching attaches is a good example
windows allows you to turn it off
actually say that the vendors of SSD
that Nutella pasty it's just not the
default next step I kind of want to keep
from kicking the IPC is I'm pretty sure
this winter's do pulses about it really
people the trunk continue working with
the vendors and I'd like to do some
focus research with these other things
because they commissioned the very start
of CID fiber if your policy to eat it
focuses you go be doing a series on
whether the orchestration our
illustrations will necessarily be
something that we should have some fun
with improving the best server to high
civilization modules that's improvement
pointers it's really shocking that
meterpreter mm how include mechanisms
the pumpkin process memory the Linux
UNIX infrastructure if you want a song
on projects
attentive messes for a day their solar
pipe this year but if you want some
apology if you all that project you want
some hair to do it easily switch it
board that would be a really sleek ultra
patient in their voice not as far as
next steps if you do fancy pile Intelli
or SSS be I'm gradually started bionic
eye toward only to do that ah DX softly
sort of things those pieces of the
publicly available that happen from
available for a while use sonic scare
that's okay but they didn't work
particularly well for this so you end up
developing stuff safe at the entire
there's a whole bunch of fossils that
saving science they get hot rate like
suggest that he found something they
might be a good place to start
broadly speaking the appreciate it was
to pump out the IPC practice from what
we see by mail in the locking and then
use that to craft a course of messages
and then
is secret so friendly they dip like
those messages and how many of you we
have a tiny bit of an associate is bum
foster 13 which is essentially for a
random percentage of of whites you
change that by by a particular operation
in my case I think I'll go fax or an
essential mineral packets that are
largely comply with the original
specification by have some minor tweaks
and I just read about the blackest or
crashed and things they crash and other
things did happen isn't very fun so
broader point perhaps if you're gonna
fluff stuff term I think really does
help you figure out what's actually I
don't if you can try to like a text on
filter for the phrase publish it of your
faucet great place to start
simply if you're lazy and Charlie
Melancon approach yeah I hope does a
wonderful job but you really don't need
to do the develop machine the shading
that has been done in some cases to get
over results that's commonly output from
the development side of things so
license if you are they to get involved
go to the under 30 would to start
looking at thanks
just a few of the people that help this
research silent design most probably a
good place to start without him John
would exist as a project many of things
other people have other thoughts and
things for our missing fingers because
able to get a meeting with Iraq in
terror identity folks with about
this without this I wouldn't you know
psych finally some useful links and I
think only I'm painting you guys are a
source or questions or you're not
working off scot-free sweet
you