Section 2.4-2.6: Social Engineering and Windows Security Practices

- constantly changing: you never know what they'll use next
- may involve multiple people and multiple orgs: there are ties connecting many organizations
- may be in person or electronic: phone calls from aggressive "customers", emailed funeral notifications of a friend or associate

- social engineering with a touch of spoofing: often delivered by email, text, etc
- don't be fooled: check the URL
- usually there's something not quite right: spelling, fonts, graphics
- vishing(voice phishing) is done over the phone or voicemail: caller ID spoofing is common, fake security checks or bank updates

- you have access to important info: many people want to see, curiosity, industrial espionage, competitive advantage
- this is surprisingly easy: airports/flights, hallway-facing monitors, coffee shops
- surf from afar: binoculars/telescopes, easy in the big city, webcam monitoring

- control your input: be aware of your surroundings
- use privacy filters: amazing how well they work
- keep your monitor out of sight: away from windows and hallways
- don't sit in front of me on your flight: I can't help myself

- targeted phishing with inside info: makes the attack more believable
- spear phishing the CEO is "whaling": targeted phishing with the possibility of a large catch, the CFO(Chief Financial Officer) is commonly speared
- these executives have direct access to the corporate bank account: attackers would love to have those credentials

- tailgating uses an authorized person to gain unauthorized access to a building: attacker does not have consent, sneaks through when nobody is looking
- piggybacking follows the same process, but the authorized person is giving consent: "hold the door, my hands are full of donut boxes", sometimes you shouldn't be polite
- once inside, theres little to stop you: most security stops at the border

- policy for visitors: you should be able to identify anyone
- one scan, one person: a matter of policy or mechanically required
- Access Control Vestribule/Airlock: you don't have a choice
- don't be afraid to ask: "who are you and why are you here?"

- pretend to be someone they aren't: halloween for the fraudsters
- use some of those details you got from the dumpster: "you can trust me, I'm with your help desk"
- attack the victim as someone higher in rank: "I'm part of the executive team"
- throw tons of technical details: catastrophic feedback due to the depolarization of the differential magnetometer
- be a buddy: know your coworkers "how about those cubs"

- mobile garbage bin: US brand name "dumpster", similar to a rubbish skip
- important information thrown out with the trash
- gather details that can be used for a different attack: impersonate names, use phone numbers
- timing is important: just after end of month, end of quarter, based on pickup schedule

- looks legitimate, but actually malicious: the wireless version of phishing
- configure an access point to look like an existing network: same(or similar) SSID and security 0 settings/captive portal
- overpower the existing access points: may not require the same physical location
- Wi-Fi hotspots(and users) are easy to fool: and they're wide open
- you encrypt your communication, right?: use HTTPS AND a VPN

- Denial of Service
- force a service to fail: overload the service
- take advantage of a design failure or vulnerability: keep your systems patched
- cause a system to be unavailable: competitive advantage
- create a smokescreen for some other exploit: precursor to a DNS spoofing attack
- doesn't have to be complicated: turn off the power

- unintentional DoSing
- network DoS: layer 2 loop without STP
- bandwidth DoS: downloading multi-GB Linux distributions over a DSL line
- the water line breaks: get a good shop vacuum

- Distributed DoS
- launch an army of computers to bring down a service: use all the bandwidth or resources, traffic spike
- this is why the bad guys have botnets: thousands or millions of computers at your command, at its peak, Zeus botnet infected over 3.6 million PCs, coordinated attack
- the attackers are zombies: many people have no idea they are participating in a botnet

- may be able to filter out traffic patterns: stop the traffic at your firewall
- internet service provider may have anti-DDoS systems: these can help "turn down" the DDoS volume
- third-party technologies: CloudFlare, etc

- many applications have vulnerabilities: we've just not found them yet
- someone is working hard to find the next big vulnerability: the good guys share these with devs
- attackers keep these yet-to-be-discovered holes to themselves: they want to use these vulnerabilities for personal gain
- zero-day: the vulnerability has not been detected or published, zero-day exploits are increasingly common
- Common Vulnerabilities and Exposures(CVE): https://cve.mitre.org/

- December 9, 2021: log4j remote code execution, java-based logging utility provided as an Apache service, installed on millions of servers, vulnerability introduced on September 14th, 2023
- base score: 10 being worst, this was 10.0 critical attack
- December 14th: fix is released, extensive patching
- December 17th: two new issues fixed, everyone is looking for bugs

- how can an attacker watch without you knowing: formerly known as man-in-the-middle
- redirects your traffic then passes it on to the destination: you never know your traffic was redirected
- Address Resolution Protocol(ARP) poisoning: on-path attack on the local IP subnet, ARP has no security

- what if the middleman was on the same computer as the victim: malware/trojan does all of the proxy work, formerly known as man-in-the-browser
- huge advantages for the attackers: relatively easy to proxy encrypted traffic, everything looks normal to the victim
- the malware in your browser waits for you to login to your bank and cleans you out

- some applications store passwords "in the clear": no encryption, you can read the stored password. This is very rare
- what to do if your application saves passwords as plaintext: get a better application

- hashes represent data as a fixed-length string of text: a message digest, or "fingerprint"
- will not have a collision(hopefully): different inputs will not have the same hash
- one-way trip: impossible to recover the original message from the digest, a common way to store passwords

- SHA-256 hash: used in many applications
- password ex: "12345", "qwerty" shown as "8d969eef6ecad3c29~~"

- different across OSes and applications: different hash algorithms

- try every possible password combination until the hash is matched
- this might take some time: a strong hashing algorithm slows things down
- the hash: "5e884898da28047151~~", start "aaaaa" then "aaaab"
- brute force attacks for online: keep trying the login process, very slow, most accounts will lockout after a number of failed attempts
- brute force the hash for offline: obtain the list of users and hashes, calculate a password hash and compare it to a stored hash, large computational resource requirement

- use a dictionary to find common words: passwords are created by humans
- many common wordlists available on the net: some are customized by language or line of work
- the password crackers can substitute letters: "p&ssw0rd"
- this takes time: distributed cracking and GPU cracking is common
- discover passwords for common words: this won't discover random character passwords

- more than just passwords on sticky notes, some insiders are out for no good
- sophistication may not be advanced but the insider has institutional knowledge: attacks can be directed at vulnerable systems, the insider knows what to hit
- extensive resources: eating away from the inside

- we're getting better with protecting the network perimeter: it's an ongoing race
- ransomware actors are targeting insiders: offering bitcoin in exchange for access, one ransomware infection can earn millions for an attacker
- keep aware: maintain good security fundamentals, always have backups

- code injection: adding your own information into a data stream
- enabled because of bad programming: the application should propertly handle input and output
- so many different data types: HTML, SQL, XML, LDAP, etc

- Structured Query Language: the most common relational database management system language
- SQL injection: modify SQL requests, your application shouldn't allow this
- if you manipulate the database then you control the application, a significant vulnerability

- XSS: CSS(Cascading Style Sheets) are something else entirely
- originally called cross-site because of browser security flaws: info from one site could be shared with another
- one of the most common web app dev errors: takes advantage of the trust a user has for a site, complex and varied
- malware that uses JS: disabling JS won't solve the issue

- website allows scripts to run in user input: search box is a common source
- attacker emails a link that takes advantage of this vulnerability: runs a script that sends credentials, session IDs, or cookies to the attacker
- script embedded in URL executes in the victim's browser as if it came from the server
- attacker uses credentials to steal victim's info without their knowledge

- attacker posts a message to a social network: includes a malicious payload
- it's now "persistent": everyone gets the payload
- no specific target: all viewers to the page
- for social networking this can spread quickly: everyone who views the message can have it posted to their page

- June 2017, Aaron Guzman: security researcher
- when authenticating with Subaru users get a token: this token never expires(bad)
- a valid token allowed any service request: even adding your email address to someone else's account. this allows you to have full access to someone else's car
- web front-end included an XSS vulnerability: a user clicks a malicious link and you have their token

- be careful when clicking untrusted links: never blindly click in your email inbox
- consider disabling JS or control with an extension: offers limited protection
- keep your browser and applications updated: avoid the nasty browser vulnerabilities
- validate input: don't allow users to add their own scripts to an input field

- a constant challenge, there are always changes and updates
- SOE(standard operating environments): set of tested and approved hardware/software systems, often a standard OS image
- OS and application updates: must have patches to be in compliance, OS updates, AV signatures, can be checked and verified before access is given

- OS control: apply policies that will prevent non-compliant software
- monitor the network for application traffic: next-generation firewalls with application visibility
- perform periodic scans: login systems can scan for non-compliance, require correction before the system is given access

- Microsoft Patch Tuesday: second tuesday of each month 10AM PST
- suddenly systems are vulnerable to security flaws: patch the OS and apps
- an org might have thousands of systems: some of those are major services
- one forgotten system may be the weakest link: happens often
- patch management is a critical practice: test, prioritize, and deploy

- security issues are often roadblocks: applications may not work properly without additional configurations
- some troubleshooting tasks can be insecure: disable AV and try again, disable the firewall and try again
- permanently disabling security isn't the answer: become an expert in app troubleshooting

- EOL(end of life) OSes: manufacturer stops selling an OS, may continue supporting the OS, important for security patches and updates
- EOSL(end of service life): manufacturer stops selling an OS, support is no longer available, no ongoing security patches or updates, may have a premium-cost support option
- technology EOSL is a significant concern: security patches are part of normal operation

- Bring Your Own Device: Bring Your Own Technology
- employee owns the device but also needs to meet the company's requirements: concerns for security
- difficult to secure: it's both a home device and work device
- questions arise: how is data protected? what happens to the data when a device is sold or traded in? an infected device could disclose proprietary company info

- built-in AV for Windows 10 and 11: no additional 3rd party products required
- included in the Windows Security app: virus and threat protection
- may not specfically display "Defender AV": name has changed over time to Windows Defender and Microsoft Defender AV

- don't disable your security protection: this is for temporary troubleshooting, know what you're doing
- Defender AV operates in real-time: enable or disable this feature
- Windows Security app: Virus & threat protection settings >> Manage settings >> Real-time protection

- login to the Windows desktop and access network resources
- local accounts: only associated with a specific Windows device
- Microsoft accounts: sync settings between devices, integrate apps(Skype, Office) with OneDrive, and more
- Windows Domain accounts: centrally managed from Active Directory

- users: admin(Windows super-user), Guest(limited access), standard users
- groups: power users, not much more control than a regular user, permissions removed in Windows Vista and later

- username/password: common authentication credentials
- PIN(Personal Identification Number): a local access code
- biometrics: fingerprint, facial recognition
- SSO(Single sign-on): Windows Domain credentials, sign in one time
- security key: sign in with a physical security key
- picture password

- NTFS permissions apply from local and network connections
- share permissions only apply to connections over the network: a "network share"
- the most restrictive setting wins: deny beats allow
- NTFS permissions are inherited from the parent object, unless you move to a different folder on the same volume. In this case, Windows changes a pointer to where that file was located and keeps the same permissions it already had

- explicit permissions: set default permissions for a share
- inherited permissions: propagated from the parent object to the child object, set a permission once and it applies to everything underneath
- explicit permissions take precedence over inherited permissions, even inherited deny permissions

- admins have special rights and permissions: editing system files, installing services
- use rights and permissions of the admin: dont get by default even if you're in the admin group

- User Account Control: limit software access, protect your computer
- standard users: use the network, change your password
- admins: install applications and Configure Remote Desktop
- secure desktop: limits automated access

- encrypt an entire volume: protects all of your data-including the OS, support for all Windows editions except Home
- data is always protected: even if the physical drive is moved to another computer
- Bitlocker To Go: encrypt removable USB flash drives

- Encrypting File System: requires the NTFS file system, built-in to NTFS
- OS support: support for all Windows editions except Home
- uses password and username to encrypt the key: administrative resets will cause EFS files to be inaccessible

- FDE(full-disk encryption): encrypt data-at-rest
- file system encryption: entire drive or individual files and folders
- removable media: protect those USB flash drives
- key backups are critical: always need to have a copy, may be integrated into Active Directory, keep the key handy

- make your password strong: resist guessing or brute-force attack
- increase password entropy: no single words, no obvious passwords, mix upper and lower case and use special characters
- stronger passwords are at least 8 characters: consider a phrase or set of words

- all passwords should expire: change every 30 days, 60 days, or 90 days, system remembers password history and requires unique passwords
- critical systems might change more frequently: every 15 days or every week
- the recovery process should not be trivial: some orgs have a very formal process

- changing default usernames and passwords: all devices have defaults, very easy to find for your access point or router - https://www.routerpasswords.com
- BIOS/UEFI passwords: supervisor/admin password - prevent BIOS changes, user password - prevent booting
- requiring passwords: always require passwords, no blank passwords, no automated logins

- require a screensaver password: integrate with login credentials, can be administratively enforced
- does not require user intervention: automatically locks after non-use or timeout
- secure critical hardware: laptops can easily walk away, lock them down

- Personally Identifiable Information: name, address, social security number, etc
- control your input: be aware of your surroundings
- use privacy filters: no one to your left or right can see your screen
- keep your monitor out of sight: away from windows and hallways

- user permissions: everyone isn't an admin, assign proper rights and permissions, this may be an involved audit
- assign rights based on groups: more difficult to manage per-user rights, becomes more useful as you grow
- login time restrictions: only login during working hours, restrict after-hours activites

- all OSes include other accounts: guest, root, mail, etc
- not all accounts are necessary: disable or remove the unnecessary, disable the guest account
- disable interactive logins: not all accounts need to login
- change the default usernames: User(admin) and Password(admin), helps with brute-force attacks

- failed password attempts: should lock the account and or reboot after a certain threshold, prevents online brute force attacks
- automatically lock the system: after a certain amount of inactivity or when you walk away

- disable AutoRun on older OSes: autorun.inf in Vista, no Autorun in Windows 7, 8/8.1, 10, or 11, disabled through the registry
- disable AutoPlay: Configure in Settings >> Bluetooth & Devices >> AutoPlay
- get the latest security patches: updates to autorun.inf and AutoPlay