Windows 7 and Cached Credentials

Recently, I provided some help in assessing the security of a Windows 7 image for a client. Quite fun, given that I'm not a windows specialist. As usual, I took that as a good opportunity to learn new stuff. All I was given was the laptop, the BitLocker PIN and the admin password. 


First approach: global and local policies. In order to do that, I used a spreadsheet from the National Checklist Program. This is very comprehensive and covers several domains. Some of them are not applicable in all cases, but the bulk is really interesting and things I wouldn't have thought of at first. I also used some resources from the SANS/CIS.


Second: let's test the beast. It was really tighten down, with lots of restrictions, a service that prevents running programs that are not white listed and things, and disabling that service was greeted with an "Access Denied". How rude. In addition, the firewall is up and running and Forefront protects the whole stuff. These two are pieces of cake: services, disable ...


What about the safe mode in which only the necessary services are started? Booting and pressing F8 like crazy doesn't help. But what about running "msconfig" and changing the boot option to "safe mode"? Ok, it complains that BitLocker will ask for the recovery token. So? Let's go to the BitLocker Manager and let's get it. Then, reboot, BitLocker PIN, BitLocker Recovery Token, and voila! Safe mode, the service is not started and I can disable it. Next ...

After a quick passage into msconfig to restore the boot options to normal, and another reboot, I'm free and I can run executables as I wish. One down.


My weapon of choice in this is usually Metasploit. First because it gives me a very convenient CLI to access the machine plus a bunch of scripts to extract information. So "psexec" and "meterpreter" it is. To find that the exploit runs into a wall.


By default, Windows 7 machines have the "ADMIN$" share disabled. Whatever, a quick trip to regedit to add a DWORD key (LocalAccountTokenFilterPolicy) with value 1 into  HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System and I'm good to go! psexec runs fine and I'm in.


Next stop: password and cache dumps. If the former works fine, the latter doesn't. Hmmm ... What about Cain&Abel? Same problem ... error. Another trip to the registry to find that HKLM\Security is empty. So no cached credentials there. Unfortunately, my knowledge of windows - and the time I could spend with the machine - didn't allow me to find whether these were stored somewhere else.

File entropy calculator

A long time ago ... I got a request from a colleague: how could we, given a bunch of files, sort out the ones that could be encrypted?

I remembered that encrypted files tend to exhibit an entropy that's higher than the usual file, so I wrote a quick python script - I was learning the language - and used it on our large dataset. This was really useful and we were able to quickly find all the encrypted files.

A few false positives were caught: mostly compressed files. Feel free to drop me a line if you find this useful or if you find any bug.

Git repository

IPv6 - playing with the stuff

As I got my shiny new Cisco 877 router, I started playing (again) with IPv6.  Setting an IPv6-in-IPv4 to a Hurricane Electric was real easy.

Also, I started taking their tests and I got:



:)

Google Chrome crashes on Fedora 15 when accessing a google document or calendar

I just had this: when opening a document in Google Docs or going to my calendar, Chrome would display the "Woops ..." page.

In /var/log/messages, a few lines point to SELinux:



Messages in /var/log/messages

Aug 21 18:59:02 jeff-fedora setroubleshoot: SELinux is preventing /opt/google/chrome/chrome from read access on the file /home/jeff/.config/google-chrome/Dictionaries/en-US-2-1.bdic. For complete SELinux messages. run sealert -l 56257509-1d9e-49a4-8b31-de14161c5c2c
Aug 21 18:59:04 jeff-fedora setroubleshoot: SELinux is preventing /opt/google/chrome/chrome from read access on the file /home/jeff/.config/google-chrome/Dictionaries/en-US-2-1.bdic. For complete SELinux messages. run sealert -l 56257509-1d9e-49a4-8b31-de14161c5c2c

I disabled SELinux and rebooted, no more crashes, proving its something with SELinux.

Looking Down on a Shooting Star

Looking Down on a Shooting Star

Incredible picture taken from the ISS. A shooting star from ... above!

Prime Minister Cameron to go after social networks in UK

This is all over the press: prime minister Cameron told the parliament that it might be useful to disrupt the usage of social networks if they are used to plot violence, disorder and criminality.

This is a slippery slope: why attack the communication channel? Is Mr. Cameron planning to go after phones (might be used by criminals to communicate with each other), emails (frequently used to carry threats), or stop the postal services (has been used to send anthrax and suspicious packages)?

This story reeks the censorship, and given the events that happened in Egypt not long ago, Mr. Cameron should be very cautious in what he says: this could easily be perceived as the first step towards a police state or to a lessening of people's rights, more specifically of their right to free speech.

There are reasons why these people are in the streets. Is it the unemployment rate? Is it the increasing costs?   The growing proportion of household getting into debt?

Mr. Cameron should listen to the people and remember that there is more in a democracy than just elections.

Just finished reading - Schneier on Security

 Who doesn't know Bruce Schneier? Living legend in security, author, theorist, inventor or co-inventor of encryption algorithms (among others) ...

This book is a collection of articles and newsletters he wrote over a period of years, and approaches subjects as varied as cyberwarfare and cybercrime, the economics of Security and preconceived and false ideas in Security.

My main intake from it is: we get it wrong most of the time: the users, the politicians, the policy-makers, the medias. From emotional reactions to hastily passed decisions, there are numerous ways of misleading ourselves into thinking we're doing security, when we're actually window-dressing.

In summary, this was a nice reading, I really appreciated it, and I got many food for my own thoughts. Thanks Mr. Schneier, as usual: two thumbs up!