A few weeks ago I started looking at Windows Software Restriction Policy (SRP) and using it to stop client side attacks. This is going to go over some of the options, setup and the results once enabled. 

SRP is easy to setup via Group Policy Object (GPO). Inside GPO editor create New Software Restriction Policy. Once create the default will be setup. You can look around to see basic options. Here is my tested setup.

Enforcement: Select "All Software files" and "All users except local administrators"

Under Designated File types: Remove type LNK - this will make sure that shortcuts placed outside of the designated execution directories will run. When I initially tested what I thought would work none of the shortcuts on the toolbar or desktop would launch an application and I found this to be the issue. 

 
Ignore trusted publishers, this is used if we are limiting applications based on the certificate authority.

Select "Additional Rules" 

The default execution directories will be selected. 

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir% 

Since mine is 64bit Windows I added

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)%

Security level for these are all going to be "Unrestricted" I want them to be able to execute as normal.

Now back under "Security Levels" the default setting is Unrestricted, since we are changing users over to defined execution directories I want to set anything not specifically allowed in the Additional Rules section to "Disallowed." So we change the default to Disallowed.

Save this and run gpupdate /force on the target machine. 

Now to test a client side attack using SET. I am going to use the java attack method. 1 -> Social-Engineering Attacks, 2 -> Website Attack Vectors, 1 -> Java Applet Attack Method, 1 -> Web Templates, 1 -> Java Required, 2 -> Windows Reverse_TCP Meterpreter, 16 -> Backdoored Executable - Enter port of listener (default 443)

Fire it up and wait till it starts the payload handler.

Once the handler is started you are ready to test the attack. Go ahead and run the unsafe java applet.

You will notice that the the site is responding but the java applet is unable to execute the payload.  

After attempting this and being successful, I tried running SET with PowerShell Injection and to my surprise the attack succeeded. I realized with PowerShell the payload was running from the C:\Windows\sysWOW64\WindowsPowerShell directory which by default is explicitly allowed. To defeat this attack I added the path to the list of Additional Rules and set it to "Basic User", retested the attack with PS Injection and the attack failed as expected. I tested this with multiple payloads and encoding methods and everyone of them did not result in a successful attack. 

I ran two other tests, the first was using EXE embedded PDF and an older version of Adobe Reader (9.3). SRP was able to successfully stop this attack.

Finally I tested a physical attack using a USB Rubber Ducky Human Interface Device (HID) from the folks over at hak5 (www.hak5.com). I used a great little payload generator found over on google code (https://code.google.com/p/simple-ducky-payload-generator/ ) It is pretty slick and simple, I used a meterpreter powershell injection payload that didn't attempt to elevate privileges. SRP was able to successfully stop this attack. If the user had admin privileges and entered in creds in the UAC window it would have worked since I allow Local Admins unrestricted access. 

In Production the are likely other directories where code needs to execute, those will need to be added to the allow list. As the config is done, administrators will be able to bypass these rules for installation of software etc. Administrators will also need to ensure that ACLs are properly set since a curious user could move executables into the approved directories and run them. While this is like a bit tough to implement in a very large organization this is a very effective method for stopping client side attacks.

To find other executable directories in use in your environment enable SRP with defaults (fully unrestricted) and set the following registry key: 

"HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers"
String Value: LogFileName, <path to log file> 

This will log the executable and the directory it was run from a little data mining can determine were applications need to execute from. Also Inventory Collector from Application Compatibility toolkit can assist in this task.

Update:

One PDC reader noted that the configuration would allow a PowerShell attack from SET to work on 32bit systems since the path on 32bit is C:\Windows\System32\WindowsPowerShell - Also this directory exists on 64bit machines as well, a modification to the SET Payload could allow the attack to succeed.

A fix for this is to also add "C:\Windows\System32\WindowsPowerShell" to the locked down policy under "Additional Rules"

This methods above would work for the given attack vector, there may be other vectors that need additional rules depending on the environment.

Join us for PaulDotCom Security Weekly Episode 332, With guest Brian Snow. Brian spent his first 20 years at NSA doing and directing research that developed cryptographic components and secure systems. Many cryptographic systems serving the U.S. government and military use his algorithms; they provide capabilities not previously available and span a range from nuclear command and control to tactical radios for the battlefield. He created and managed NSA's Secure Systems Design division in the 1980s. He has many patents, awards, and honors attesting to his creativity. Also, for our tech segment we are joined by Tim Conway. Tim is the Technical Director of the Industrial Control Systems and SCADA programs at SANS, where he is responsible for developing, reviewing, and implementing technical components of the ICS and SCADA product offerings. Tim was formerly the Director of Compliance and Operations Technology at the Northern Indiana Public Service Company (NIPSCO).

Sit back and enjoy the show live or participate in the live chat on our Ustream channel:

First, Paul admitted it was a stretch to bring this into a security context but he wanted to talk about an article that he found in The Economist (via Bruce Schneier) about one theory that if the US would simply be nicer to terrorists, release them from Guantanamo Bay, Cuba and stop hunting them down around the world, that they would in turn be nicer to us. Also, fewer would pop up around the world. The thinking is that jailing and killing them turns others into terrorists. So here's the leap. Can the same be said for black hat hackers? If law enforcement agencies stop prosecuting the hackers, will they be nicer and will there be fewer of them? I think we all came to the same conclusion. "Nah."

Paul also found an Adam Shostack article about how attention to the tiniest details can be important to the largest degree. The example given was the vulnerability to the Death Star in the original Star Wars movie was so small and the chances of it being exploited were so remote that the Empire overlooked it, Grand Moff Tarkin even showing his arrogance shortly before his own demise. The same can be said for our systems. It might be a tiny hole and maybe you think that no one would look for it and even if they do, what are the chances they both find it and exploit it? In some cases, it can have quite dire consequences. The Empire overlooked a small vulnerability that they shouldn't have. Are you doing the same with your systems?

Did we happen to mention that Security BSides Boston is May 18 at Microsoft NERD in Cambridge, MA and Security BSides Rhode Island is June 14th and 15th in Providence, RI. Good seats and good conference swag are still available. We all hope to see you there!

The Onion's Twitter account was breached by the Syrian Electronic Army and they handled it a way that only The Onion can, making light of both themselves and the SEA. Additionally, possibly for the first time ever, The Onion published a non-parody post about exactly how the breach occurred.

Additionally, the National Republican Congressional Committee (NRCC) web site got spam hacked/defaced with Viagra ads. The only thing we were wondering is, are we sure it was hacked and not just a convenient online pharmacy for their members?

A new whitepaper was released from MIT talking about "Honeywords". The problem being solved here is creating a way for server admins to know sooner when a passwords file has been breached on a server. In addition to the correct password, this new system would add a bunch of fake passwords as well. When the attacker starts trying usernames and passwords, if they use one of the fake passwords, the server admin would be notified that someone is doing that and it is very likely that the passwords file has been breached. It's an interesting concept to ponder.

Jack had an article from Dennis Fisher at Threatpost, asking the question about what's the point of blaming various people for cyberespionage if we don't have a plan to do something about it.

The NSA also has its own 643 page document telling its members how to use Google to find things like Excel documents in Russian that contain the word "login". Wait, I feel like I've heard of this somewhere before. Oh yeah, that's right. Johnny Long was talking about Google Hacking at least as far back as 2007. It's just interesting some times to see things that the media gets wind of and without the slightest bit of checking, thinks something is "new".

That's it for this week. As always, check in each Thursday night at 6 pm Eastern time to catch PaulDotCom Security Weekly!

Episode 331 Show Notes

Episode 331 (mp3)

Tune in to PaulDotCom Security Weekly TV, Hack Naked TV, and Hack Naked At Night episodes on our YouTube Channel or our Bliptv channel.

Episode 331 Show Notes

Kurt Baumgartner of Kaspersky Labs joins us to talk about Red October, a research paper that he co-authored, along with the other areas that he works on at Kaspersky.

Episode 331 (mp3)

Tune in to PaulDotCom Security Weekly TV, Hack Naked TV, and Hack Naked At Night episodes on our YouTube Channel or our Bliptv channel.

Rob Cheyne is a highly regarded technologist, trainer, security expert and serial entrepreneur.

He was the co-founder and CEO of Safelight Security, a leading provider of information security education programs. He has taught information security training classes to tens of thousands of developers, architects, and managers for industry-leading organizations. He has over 20 years of experience in the information technology field and has been working in information security since 1998.

Rob regularly speaks at security and training conferences, and frequently presents to the local chapters of various security organizations.

Episode 331 Show Notes

Episode 331 (mp3)

Tune in to PaulDotCom Security Weekly TV, Hack Naked TV, and Hack Naked At Night episodes on our YouTube Channel or our Bliptv channel.

Join us for PaulDotCom Security Weekly Episode 331 Rob Cheyne joins us from SafeLight Security. Prior to Safelight, Rob was a principal security instructor at Symantec, joining the company with the acquisition of @stake, a digital security consultancy, in 2004. Rob was a founding employee of @stake where he developed application security assessment methodologies and directed @stake's Application Security Center of Excellence. While at @stake, Rob led secure architecture and design reviews, secure code reviews, application penetration tests and a range of specialized security audits for Fortune 500 companies. He also worked on @stake's SmartRisk Analyzer team, which was spun off into Veracode, Inc. Rob is the author of LC4, a version of the award-winning L0phtCrack password auditing software. Also, for our tech segment we are joined by Kaspersky's Kurt Baumgartner to talk about the Red October Report: an Advanced Cyber-Espionage Campaign Targeting Diplomatic and Government Institutions Worldwide.

Sit back and enjoy the show live or participate in the live chat on our Ustream channel:

Don't forget to follow us on Twitter: Paul Asadoorian, Larry Pesce, Jack Daniel, Carlos Perez, John Strand, Allison Nixon and Mike Perez.

Tune in to PaulDotCom Security Weekly TV, Hack Naked TV, and Hack Naked At Night episodes on our YouTube Channel or our Bliptv channel.

We're finally back with the videos from PaulDotCom Security Weekly. We had some technical issues with the recording of the shows, so if you didn't hear them live, unfortunately, they're gone forever. But we think we've got a handle on it and we have episode 330 for you. First was an interview with Andrew Righter, and in the video below, Paul talks with Banasidhe, President of the Board for Security BSides Las Vegas. She's on this week to tell us about the mentor program they are using for first-time speakers at the Vegas conference. More mentors are still needed, so if you're interested, please get in touch with the BSides Vegas crew.

As part of Rapid7's research, they found they can track any ships, private or military while on the ocean and access a system that prevents collisions. It's not like these things can turn on a dime, or do the hallway dance when two people keep choosing the same side to walk on.

Not only are printers on the internet vulnerable, but now they're capable of being used to launch DDOS attacks. You can send a request over UDP and then the response is larger and even better, you can redirect the response elsewhere. So how exactly do we fix this sort of thing?

Larry also reports that Twitter is saying that "the hacks will continue!" however what should be cleared up is that that hacking isn't directly against Twitter. It's not an attack in the sense where the Twitter developers have written bad code getting compromised, it's the attack against what I like to call "Layer 8" the human. The problem is largely with spear phishing against users. There isn't much any system can do if someone asks you for your password and you give it to them. If you need to see what kinds of things that can happen with these attacks, check out the stock chart for the Dow Jones on April 23, 2013. Look at that one downward spike. That's when the AP News Twitter feed was hijacked and tweeted that the White House had been bombed and Obama was dead. I'm not sure which is really worse, that the AP gave up their password to this attack or that the traders on Wall Street based their stock strategy on a single tweet.

Would anyone want to offer a little startup capital for our new security venture called "Wickid Pissa Security"? Ok, maybe you have to be from Mass or Rhode Island to really get that one.

Paul talked about an article that tells of the seven elements of success for a security program. Or, as Larry sums it up, "1. Don't click on shit. 2. Refer to Rule 1." Easy. But the article refers to buy-in from everyone on board and using metrics to measure how efficient your program is. What good does it do to put in all this work and have no idea whether it even mattered or changed anything at all. Plus, those numbers can help at review time.

Apparently smart meters and blackouts are a problem in the UK. Or as the article mentions, "Smart meters are essentially crap computers in a crap box"

What were you doing at 14? As for me, I was sorting baseball cards and watching Brady Bunch re-runs ("Marcia, Marcia, Marcia!") Check out this 14 year old, Ali Hasan Gauri found an XSS vulnerability in a Cisco subdomain. Yeah, that's the kind of stuff that if he were to tell me about it at 14, my eyes would glaze over and ask if he wanted pizza. Meanwhile, he'll probably be retired-wealthy by 22.

When the guys simply keep talking about the same vulnerabilities showing up week after week, at what point does listening to PaulDotCom Security Weekly become required listening for developers? It almost seems we should have a special segment for the router vulnerability of the week!

Can the new Google Glass be hacked? Easy root access can lead to lots of spyware, but a couple other problems that Larry seems to be aware of is they don't have great battery life and it can be embarrassing when porn comes up during a staff meeting. As an aside, Saturday Nigh Live also did their own review of Google Glass.

There's all that and more, so listen in to get all the details. Don't miss this week's show on Thursday, May 9 at 6 pm with Kaspersky Lab's Kurt Baumgartner and Safelight Security's Rob Cheyne. Don't miss it!

After 5 years of diving into the Security world head first, Andrew has finally come up bruised, beaten and a little less stupid. Like most hackers, he has ripped apart, modified and rewritten every electron and every bit possible - and under proper supervision has even gotten to play with a few really expensive toys. He now spends his time bootstrapping his DARPA CFT project (Netoko), hacking automotive networks (GoodThopter), or playing with academics as a Visiting Scholar at the University of Pennsylvania.

Episode 330 Show Notes

Episode 330 (mp3)

Tune in to PaulDotCom Security Weekly TV, Hack Naked TV, and Hack Naked At Night episodes on our YouTube Channel or our Bliptv channel.

Join us for PaulDotCom Security Weekly Episode 330 After 5 years of diving into the Security world head first, Andrew has finally come up bruised, beaten and a little less stupid. Like most hackers, he has ripped apart, modified and rewritten every electron and every bit possible - and under proper supervision has even gotten to play with a few really expensive toys. He now spends his time bootstrapping his DARPA CFT project (Netoko), hacking automotive networks (GoodThopter), or playing with academics as a Visiting Scholar at the University of Pennsylvania. Banasidhe (pronounced ban-shee) is currently the volunteer Producer and President of the Board for Security BSides Las Vegas, Inc., (as well as 2IC for DCSkytalks and 2IC of PhySec for DerbyCon). With literally decades of Event Planning, Production, Logistics, Operations and Security experience, she stepped down as Safety & Security Director of BSidesLV two years ago and stepped-up into her current role as Producer, to ensure that BSidesLV continues to live up to the irreverant, uncommon, wake-up call to conventional InfoSec Conferences, that was conceived by her predecessor five years ago. Since taking the helm at BSidesLV, banasidhe has instituted several new tracks, including an OTR track, an AFK, community oriented track, and a Mentorship program for first time presenters. Banasidhe's actual day job is Director of Operations for the SECore.info division of the Open Security Foundation, where she's working on finding the funding to pull the site out of beta and into the stark, glaring light of day. She can be found on twitter @banasidhe . Sit back and enjoy the show live or participate in the live chat on our Ustream channel:

Don't forget to follow us on Twitter: Paul Asadoorian, Larry Pesce, Jack Daniel, Carlos Perez, John Strand, Allison Nixon and Mike Perez.

Tune in to PaulDotCom Security Weekly TV, Hack Naked TV, and Hack Naked At Night episodes on our YouTube Channel or our Bliptv channel.

In this episode we talk about Ronald McDonald style beat downs. Virus Total adding pcap analysis and Japan talking about shutting down TOR.

Links for this episode:

Offensive Countermeasures at Black Hat

-strandjs

Video Feeds: