Windows Package Manager (winget) it's amazing

Those coming from Linux have long used package managers, such as apt or rpm to install software. Package managers are great because you can install software from a trusted repository and simplifies the task of upgrading software to newer versions. 

For the longest time those on Windows did not have a built in OS package manager and have long relied 3rd party software such as Chocolatey or Ninite. In 2020, Microsoft released winget to help solve the problem of installing, upgrading, and removing 3rd party software on Windows.

Winget is great and hopefully will see more widespread adoption of this tool. I have also noticed that software installed through winget tends to not have PUP, or obnoxious add-ons. 

The Trust in Zero Trust

Opinions expressed are solely my own and do not express the views or opinions of my employer

Hafnium/UNC2452 used novel techniques that abused and took advantage of the adoption to cloud technologies without understanding the full implications and architecture.

Microsoft has made a push in recent years to Office 365 and as a result many organizations now have hybrid cloud environments, whether they know it or not.

How is this relevant to Zero-Trust? 

The spate of attacks has revealed weaknesses and tactics that pen-testers and adversaries can exploit against a hybrid cloud or zero trust environment. In a Zero trust environment there is still trust relationship between the Identity provider and Service provider. By attacking the cryptography protections in this trust relationship, UNC2452 was able to launch sophisticated attacks that often went undetected. Tokens generated by the Identity provider are trusted by the service provider. UNC2452 by forging tokens was able to abuse this trust relationship to bypass controls normally enforced when accessing Services. Through forged tokens they were able to short circuit the normal authentication piece by directly authenticating to the Service provide via tokens bypassing the Identity provider.

Great what does this mean? 

For defenders, it is important to get good AAA telemetry. This means getting good logging from your Identity provider, and Service provider. Logs to track authentication, authorization, and auditing. This is a lot easier said than done. 

Implementing zero trust can provide gains to an organization by lowering the overall risk by "reducing or removing implicit trust in networked systems by addressing network identity, endpoint health, and data flows." (NIST) However, it can also mean introducing a single point of failure. An attacker that can compromise the identity manager can gain access to multiple resources. If the identity provider is based in the cloud, how much trust do you place in them? What if your cloud identity provider was breached, what are the impacts to your organization? While I believe many cloud providers provide better patching and maintenance than organizations, the risk is non-zero.

References:

https://csrc.nist.gov/News/2022/planning-for-a-zero-trust-architecture-white-paper

Non-compete clauses

Recently the FTC has proposed a ban on most non-compete clauses. This is a great idea, if this ban gets enacted the US stands to benefits in multiple ways including, increased worker mobility, increased innovation, increased growth, and increased market competition.

Silicon Valley

The lack of enforcement of non-complete causes in California is one of the factors that have helped to create a vibrant technology sector in that state. Non-compete clauses are a method for employers to reduce the competition by making it hard to poach and recruit talent. Without non-competes start-ups in California are able to grow and thrive in the shadow of giant technology companies because they are able to better execute on their roadmaps and strategy. Organizations such as Zoom have been able to thrive in California by identifying a need in the market not met by larger technology companies. Large technology companies have been sued by the Federal government for illegally preventing employees from getting offers from competing firms. For example, Steve Jobs was sued by the Feds for a gentlemen's agreement with one of the founders at Google to stop the organization from poaching talent away from Apple.

Abuses of Non-complete clauses

Non-compete clauses have also been abused by employees by using overly broad language that prevents employees from leaving the firm, or going to the competition. For example, in healthcare non-complete clauses often will dictate a geographical radius. In dense metropolitans, such as New York or LA, a non-complete clause of 25 miles means you'll essentially need to find another job in another city. 25 miles can mean a 2 hour commuting radius in large crowded cities with traffic.

Non-complete clauses are un-American

Non-complete clauses go against the ideas of America. The US should be a nation that encourages competition, entrepreneurship, free markets, and the ability for employees to freely move if they find better opportunities elsewhere. The rise of non-complete clauses is allowing for many larger well-resourced organizations to reduce competition and continue their rent-seeking behavior. The continuation of this will reduce the economic growth of the country, and the limit opportunities of employees. 

References: 

https://money.cnn.com/2014/08/11/technology/silicon-valley-poaching-case/

Experience taking SANS SEC560 Network Penetration Testing and Ethical Hacking

 This is the first time I have taken an online SANS course. For motivated students, online learning can be just as effective as in-person courses. 

Overall, I enjoyed taking SEC560, the material was current and relevant to my job. Although I work blue team, there is a lot of value that could be gained by taking a pen testing course. There is tremendous overlap between the course material and the TTP's used by ransomware attackers. These include the following techniques I have read or observed attackers using. I particularly enjoyed the emphasis on targeting the NTDS.dit file. 

- Password attacks (password spraying, brute-force)

- NTDS.dit

- Domain attacks

    - Domain enumeration (bloodhound) 

    - Kerberos attacks (kerbroasting) 

Improvements to the course

I thought that the labs could have been more comprehensive. I would have enjoyed a bonus section that included more advanced topics in the course, including attacks against the domain such as kerbroasting, silver ticket, golden ticket attacks, AS-REP roasting, and AD CS attacks.

Remnux and VirtualBox Window Sizes

When importing the Remnux ova into VirtualBox you may notice that the window sizes are inappropriate in order to fix this you will need to install the VBox Guest additions.

In order to do this. Add an optical drive in VBox to the virtual machine. Then in the menu insert Vbox guest additions and install the software. 

Then you will need to follow the instructions on the website.

sudo mount /dev/sr0 /mnt/cdrom sudo /mnt/cdrom/VBoxLinuxAdditions.*

The TSP a magical unicorn

Thrift Savings Plan (TSP) is the defined contribution plan offered to Federal employees. It is very similar but slightly different to the 401(k) offered to non-federal employees. (The TSP is technically not a 401(k) since it was created under a different law)

What makes the TSP a magical unicorn

1. Ability to roll funds into TSP even after leaving Federal service. 401k plans usually only allow participants to roll funds in while they are active participants. The TSP is different because it allows participants to roll 401(k) and traditional IRA funds in after leaving the federal service. (TSP does not take Roth IRA rollovers) 
2. G fund. "Participants who invest in the G Fund are rewarded with a long-term rate on what is essentially a short-term security." In other words a free lunch, long-term rate with only short-term risk. Unlike the typical bond fund offered in 401k plans, the Federal Government is assuming much of the interest rate risk. 
3. TSP is considered part of the FERS pension plan. In New York State, public pension withdrawals such as TSP are exempt from taxes up to $20,000. It may be beneficial to contribute to a traditional plan since contributions are not taxed by the state and withdrawals might not be taxed on the way out. 
4. Extremely low fees in all funds including Target Date Funds. Funds charge approximately 4 basis points or 0.043%. This is partly because expenses are covered by those who leave the Federal service before their 1% agency automatic contributions vest. 

Cons of the TSP plan 

1. Decisions are made slowly. So modern features and changes to private sector plans slowly make their way into the TSP. 
2. Politics. Members of congress occasionally interfere with the TSP. However, the TSP board does a good job at fulfilling their fiduciary duty to participants.

Note: I am not an attorney or financial professional. So you may want to consult counsel or a financial professional for your specific circumstances. 

Experience taking SANS FOR508

FOR508 Advanced Incident Response and Threat Hunting

This is a review for a course I took back in 2018 so the materials may have changed since I took the class. The course is good for individuals that are involved in incident response and threat hunting within Windows environments. I have found many of the topics of discussion useful for those that regularly use EDR and/or memory analysis (ie volatility) in their daily roles. The course was centered around intrusions into Windows infrastructure. Those that are desire to learn more about Linux / Mac forensics would learn the fundamentals but many of the exercises won't apply.

The course structure starts by going into topics that are most useful and applicable then going into events that are rarer and more indicative of an advanced adversary such as timestomping, kernel device drivers, and attacks on the mbr.


Topics covered by FOR508

• Windows event IDs

• Volatility events
• Malware characteristics 
• Majority of malware is unsigned 

• Suspicious Processes
• legit svchost is launched by service
• system32 directory should be signed by microsoft

• Programs making unusual connections