Ing. Ondřej Ševeček | GOPAS a.s. | MCSM:Directory | MVP:Enterprise Security | CEH:Certified Ethical Hacker | CHFI:Computer Hacking Forensic Investigator | | | Infrastructure (in)security

Agenda  Where antimalware fails?  Where admin fails!

Custom code  Antimalware detects only well-known code signatures –heuristics?  PowerShell, C#, ASP, …  Take a look at this…

Limited user  Hardware keylogger *  Software keylogger * –  Never type sensitive passwords on insecure machines

What to do with a password?  Try if any other account does not have the same password * –  Never use the same password twice

UAC will keep me secure  No –  It works only locally –code started manually *  Do not work under sensitive accounts  Use personal limited accounts

That guys are local admins!  Hack local admin * –system partition unencrypted –  Any workstation is compromised  Encrypt system with BitLocker and TPM –users must not know the password

UAC will keep me secure  No  It works only locally –code injected through "autorun" *  Do not work under sensitive accounts on insecure machines

Audit tools?  Antimalware?  Autoruns? –does not verify PowerShell code * –trusts in what you yourself trust * –  Every tool can be fooled

Web servers  Third party suppliers  Local limited admins –impersonation * –basic delegation * –Kerberos delegation *  Never access applications with privileged accounts

RDP is plain-text authentication  Unfortunately –passwords can be extracted from LSASS memory * –  Use MMC, RPC, DCOM, WMI, C$, Admin$, REGEDIT or SCCM Remote Tools instead –authenticates with Kerberos

LSASS extraction made nice  Just let the admin access your web site –passwords can be extracted from LSASS memory *  Again, never access applications with privileged accounts

Stolen CA  NTAuth CAs issue logon certificates independently from DCs –never appears on CRL *  Do not let them take your CA

Thank you!  and also come to GOPAS: –GOC169 - Auditing ISO/IEC and –GOC171 - Active Directory Troubleshooting –GOC172 - Kerberos Troubleshooting –GOC173 - Enterprise Cryptography and PKI –GOC175 - Advanced Windows Security