Secure Digital Transformation

Protected Identities

Prasad Kishor Patil — Thu, 21 Jun 2018 15:13:31 GMT

Hello everyone, earlier we discussed about the Cyber Kill Chain and the various stages of Advanced Persistent Threats (APT’s).

Technet Link , LinkedIn Link

We also discussed on one way of protecting the delivery of the bad code to your systems by using Edge browser.

Technet Link , LinkedIn Link

We saw mechanisms to avoid execution of malicious code or exploitation of your OS or applications.

Technet Link , LinkedIn Link

I was in a well-known training center recently and was given a laptop for use. The laptop had an excel file named ORGPasswords and I assumed correctly that it had the list of usernames and passwords of multiple users for various resources in that organizations. I opened the browser and WOW, I was on the OWA page with credentials saved. If I were an adversary , I could have done many adverse actions and had an opportunity to steal the critical organizational data.

Credential harvesting can be done in many ways by the adversaries and leverage them to align with their objectives. A staggering 81% of hacking related breaches leveraged either stolen and/or used weak passwords.

Say for example, if one of your employee mistakenly enters his corporate credentials on a phishing website or his credentials were shoulder surfed while he tried to login from his mobile device while he was travelling in a public transport. The attacker can now use these credentials and gain access to what he should not be accessing. Some malware on the system has a key logger which captures your keystrokes and send it to the attacker sitting remotely or it hacks the Local Security Authority Cache and steals the NTLM hashes and passes this hash to do lateral movement in your organization (Pass the Hash Attacks)

Humans are the Weakest links in Information Security and there need to be strong technological countermeasures in place to protect your Identities, Devices and Data. With the change in perimeter of your data (more and more data moving outside the organizational premises), it is imperative for an enterprise to consider technology to additional layers of protection.

Microsoft M365 offer a set of solutions to offer a layered protection against various Identity thefts.

Azure AD Identity Protection helps in Protecting identities irrespective of their privilege level and prevent compromised identities from being misused. Identity Protection is more than a Monitoring and Reporting Tool. It uses adaptive machine learning to detect vulnerabilities and Risky accounts, Investigation of Risk accounts and Risk based conditional access.

Coming to the earlier scenario where the attacker has the credential of one of your employee and now he tries to access your resources from a remote location, untrusted PC or even through a TOR browser, the adaptive machine learning alert and block or prompt for multifactor authentication.

Azure Privilege Identity management allows an organization to reduce the number of people having access to the sensitive information or resources thus reducing the chances or the attack surface for an attacker getting access to those resources or a authorized user inadvertently messing with the integrity. It allows you to Enable on demand or just in time access to your resources, alerts and reporting on the privileged access. Consider a scenario where some credential in your organization are stolen. Adversary still won’t be able to access the sensitive information now.

Let us consider a typical security incident, where the user receives a document with a malicious code embedded into it and the user inadvertently executes the code. The code now initiates a Privileged Identity Attack. How if there is something native which can detect it and trigger conditional access based on this detection? That is what exactly Windows Defender Advanced Threat Protection’s integration with Microsoft Intune does. Based on the acceptable level of risk and policies configured in Intune and provide conditional access to the resources.

With the increased frequency and complexity of Cyberattacks, protection of credentials either on cloud or on premises is important. Azure Advance Threat Protection is a cloud service that parses Kerberos, DNS, RPC,NTLM, etc. traffic from multiple data sources and searches for attacks like Pass the ticket, Pass the Hash, Golden Ticket, Overpass the Hash and so on.

Finally let’s consider the scenario mentioned earlier where the attacker drops some malware on your computer and tries to hack the Local Security and Authority Service (LSAS) to steal the derived credentials. Once the succeed in doing so, they can use these derived credentials to do lateral movements in your environment (Pass the Hash Attacks). This kind of technique is used in many Advanced Persistent Threats. Windows Defender Credential Guard uses Virtualization based technology to isolate the LSAS service and protect or encrypt your derived credentials and mitigate such attacks.

Adaptive Machine Learning, AI, Cloud Powered solutions and resilient and hardened Windows 10 Operating System all offer a layered approach to protect your Identities, Devices and Data and thus reducing the attack surface protecting your IP and sensitive data.

Protected OS (Windows 10)- Malicious Execution/Exploitation

Prasad Kishor Patil — Wed, 28 Feb 2018 19:27:05 GMT

Hello everyone, earlier we discussed about the Cyber Kill Chain and the different stages of this Advanced Persistent Threats (APT’s). Technet Link , LinkedIn Link We also discussed on one way of protecting the delivery of the bad code to your systems by using Edge browser. Technet Link , LinkedIn Link We would need to still protect our Operating System and the Kernel as something will still enter your endpoint and will try to install, exploit, gain persistence, steal credentials do a post attack reconnaissance so on, so forth. We have been heavily relying on our Antivirus/Antispam solutions since ages and they have done their job nicely so far for known codes, signatures, known attacks (Indicators of Compromise, IOCs). These solutions have evolved over time as well and today they have become intelligent with the usage of Advanced Machine Learning and Analytics. Windows Defender Antivirus (WDAV) is a built-in antimalware solution that provides security and antimalware management for desktops, portable computers, and servers. In addition to the protection against the known malwares, Windows Defender AV has a Block at first Sight (BAFS) feature with cloud-delivered protection that provides a way to detect and block new malware within seconds.

Block at First Site (BAFS)

Window Defender AV works with Windows Defender Exploit Guard - Control Folder Access, Network Control and Attack Surface Reduction to protect the endpoint from various exploitation techniques that the attackers use to take control of your endpoints. While the traditional solutions like Antivirus and Antispam have been offering protection against the known versions of threats, given the current complexity and the scale of the attacks, these might be incidental or inadequate. Statistics from AV-Test suggests that they register 250,000 new malicious programs every day and it is increasing over the years.

https://www.av-test.org/en/statistics/malware/

Thus, a layered security approach is the need of the hour. Having it natively reduces the pain. While, WDAV protects against known malwares and to some extent unknown malwares using BAFS, Windows Defender Application Control (WDAC earlier a component of Device Guard) works on a Trust Nothing Model and blocks everything untrusted and executes only the trusted code on the endpoints. As I said earlier we need to protect our Kernel as well, WDAC also restricts the code that runs in the System Core (Kernel). WDAC uses the Virtualization Based Security concept (link), to protect its own process against tampering.

WDAC protecting against an untrusted executable

WDAC protecting against a untrusted malware that was hidden behind a Word document

Applocker is a less advanced form WDAC of which can be configured on your Windows 10 devices as well. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.

Let’s make the life more difficult now for the attacker now to even exploit Application vulnerabilities. Exploit protection can apply exploit mitigation techniques to your apps.

Protected Edge

Prasad Kishor Patil — Mon, 08 Jan 2018 16:27:19 GMT

Web Browser, the quickest gateway to access information across the globe, is often the easiest and the most used instrument to inject threat to your computer systems. In this age of Digital Transformation, not having a web presence is rare. Tricking users to download malicious content via your web browser is much simpler. The attack surface is huge with the number of API’s and plugins present in the web browsers. Adversaries not only exploit the vulnerabilities in the browsers to compromise your systems, but even for phishing, spear phishing or water holing techniques - entry vector will be the browser. Hence, having inherent strong security measures in the browser destroys the standard playbook of the attacker making it more expensive and difficult to seep in. With the number of millennial users increasing with time, it is unfair to restrict their web access and having strong mechanisms in place which make users feel least restrictive and organizations more secure is the need of the hour. Secured Browser Microsoft Edge was built to safeguard users against malicious intent in the web world and make it difficult for the adversary to exploit the vulnerabilities in the browser. Constantly learning SmartScreen is a cloud based anti-phishing and anti-malware component and is included in Microsoft Edge. It helps protect the users from non-reputed websites -- sites which have a history of phishing or malware hosting. The reputation of files downloaded by the user is checked by Smart Screen against the Microsoft Cloud Intelligence and the user is warned. Microsoft Edge is the first Browser which supports Windows Hello for authentication on the Web. One of the major reasons for breaches is compromised passwords. Compromised passwords can be used by the adversaries to gain access to Intellectual Property or Personal Identifiable Information or for financial frauds. Weak passwords, passwords stored on the servers or hashes protected by LSASS can be a source of compromise. Microsoft foresees a world with no passwords – It’s Windows Hello, combined with Web Authentication, that enables this vision with biometrics and asymmetric cryptography. Edge is built with Universal Windows Platform and is sandboxed by default. Edge and Flash only have access to 40% of the interfaces of win32k.sys which wasn’t the case earlier. Thereby, reducing attack surface substantially. In addition, Edge supports latest web security standards and capabilities to block common attacks and prevent impersonation.

Certificate Reputation – Detects fraudulent certificates offering protection against attackers that could have stolen a sites identity.
EdgeHTML Engine – A completely rewritten Engine which supports W3C Content Security Policy (offers protection to developers against cross site scripting attacks) and HTTP Strict Transport Security ensures that connections to sites holding sensitive information are always secured.
Address Space Layout Randomization (ASLR) on 64 bit systems - ASLR randomizes the memory layout for browser processes whereas the 64 bit processes makes the address space exponentially larger thus making it difficult for the attackers to play with memory based threats.
Memory Garbage Collector (MemGC) frees up the memory automatically if it has no references pointing to it.
Control Flow Guard (CFG) places stricter controls on where a code can be executed from thereby making it difficult for an attacker to run code through vulnerabilities like buffer overflow.

NSS lab report shows a comparative report on various browsers against Socially Engineered Malware. https://www.nsslabs.com/research-advisory/library/endpoint-protection/web-browser-security/web-browser-security-comparative-report-sem-protection/comparative-report-web-browser-security-socially-engineered-malware-protection/ Application Guard – Guarding the Gate! Attackers would initially try to deliver the malicious code to your endpoint. This malicious code could be a targeted code, general code or a zero day which might not be detected by your Antivirus/Antispam solution. Once they successfully deliver this code, they will try executing the subsequent stages of the Cyber Kill Chain or achieve the objective in isolation. (https://blogs.technet.microsoft.com/prasadpatil/2017/12/15/crippling-the-cyber-kill-chain/) Traditional approaches like whitelisting and blacklisting could be quite cumbersome and not scalable enough to cater to the security threat landscape prevalent today. Secondly, restricting access to the outer world of knowledge could hamper the productivity of the employees. What if users can browse without any restrictions whereas the organization are assured of safety? Windows Defender Application Guard lets you do just that. It will open the URL’s that are trustworthy in a normal mode allowing interaction with the OS and the disk whereas the URL’s that aren’t trustworthy will open in a separate non-persistent container. Anything trying to come in through this session would be blocked by Windows Defender Application Guard. https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview Demo: Windows Defender Application Guard against ransomware https://youtu.be/rJfC78dzGTk Sources of threats don’t end here. Vulnerabilities in published Web Applications is another channel for the attackers to get in. We will discuss secure development of web application in the next writeup. So, watch out for it.

Crippling the Cyber Kill Chain

Prasad Kishor Patil — Fri, 15 Dec 2017 14:54:53 GMT

While Digital Transformation is driving exponential growth for organizations, businesses are increasingly being exposed sophisticated cyber threat with complex codes that are hard to detect. The security landscape is changing very swiftly, with record leaks, bank accounts hacks, online frauds making headlines every morning. Clearly the mechanisms in place today aren’t strong enough to protect against these breaches. The security landscape is changing very fast and must deal with dynamic cyber wars and ‘’Advanced Persistent Threats (APT’s).’’Lockheed-Martin defines Advanced Persistent Threat (APT’s) as:

Advanced: Targeted, coordinated and purposeful
Persistent: Month after month, year after year
Threat: Person with intent, opportunity and capability

Attackers must complete the following stages of Cyber Kill Chain to achieve their objectives:

Endpoints: PROTECT, DETECT and RESPOND

Traditional solutions like Antivirus/AntiSpam aren’t equipped to combat modern day threats on the most vulnerable and valuable target for the intruders, the Endpoints. Let us discuss briefly how endpoints can be protected at each stage of the cyber kill chain and make it more expensive for intruders which destroys their standard playbook.

Reconnaissance/Weaponization

We have less control on pre-attack reconnaissance/weaponization where the adversary will use various techniques like phishing, spear-phishing, water-holing, social engineering, etc. to learn more about you and develop a weapon to target you. Some hygiene and awareness can be maintained to make the attacker sweat a little at an early stage itself. It may include keeping your ecosystem updated, employee training so that they do not fall prey to phishing and social engineering attacks.

Delivery

Once the weapon is developed, delivery to you will be attempted. The delivery vector can be an email, browser, USB/DVD or even a vulnerability in your application.

Protection against unsafe attachments and expanding protection against malicious links

0365 Advanced Threat Protection offers protection against unknown malwares and viruses, malicious URL’s and rich reporting and URL trace capabilities. It also complements the security features of Exchange Online Protection to provide better zero-day protection. This protection blocks the weapon from entering your endpoint via the email channel and the intruder must now rethink on another way to deliver it to you.

Protection while browsing the web

Windows Defender Application Guard (WDAG)helps isolate enterprise-defined untrusted sites, protecting organizations when their employees browse the Internet. If an employee goes to an untrusted site through either Microsoft Edge or Internet Explorer, Microsoft Edge opens the site in an isolated Hyper-V-enabled container, which is separate from the host operating system. This container isolation means that if the untrusted site turns out to be malicious, the host PC is protected, and the attacker can't get to your enterprise data. In addition, Edge is sandboxed by default, with inherent security features like Attack Surface Reduction, MEMGC and Control Flow Guard which makes it even more difficult to hack. Getting tough isn’t it, for the attacker of course!

Exploitation and Installation

Even if the adversary can still get in, execution and installation of the malicious code will be attempted to exploit the vulnerabilities. Once successful, they can still control your endpoint persistently via the command and Control Center(C&C)

Real Time Protection against known codes

Inbuilt Antivirus/AntiSpam solution (Windows Defender AV) in Windows 10 will block the execution of known malicious code. Advanced capabilities like Cloud Delivered Protection and Block at First Sight help add protection against New Malware within a few seconds.

Protection against installation of untrusted Applications

Windows Defender Application Control (WDAC) is a crucial line of defense for protecting enterprises given today’s threat landscape, and it has an inherent advantage over traditional antivirus solutions. Specifically, application control flips the model from one where all applications are assumed trustworthy by default to one where applications must earn trust to run. No space for any malware or ransomware to execute! You don’t trust them, right?

Protection against vulnerabilities in your Applications and Reduction of Attack Surface

Windows Defender Exploit Guard (WDEG) are a set of Host Intrusion Prevention capabilities which helps reduce the attack surface of the Applications you use. There are four set of capabilities that come along with Exploit Guard Exploit protection can apply exploit mitigation techniques to your apps. Attack Surface Reduction rules can reduce the attack surface of your applications with intelligent rules that stop the vectors used by Office, script and mail based malware Network Control extends the malware and social engineering protection offered by Windows Defender SmartScreen in Edge to cover network traffic and connectivity on your devices Controlled Folder Access helps protect files in key system folders from changes made by malicious and suspicious apps, including file-encrypting ransomware malware Exploitation? No more!

Privilege Escalation

Intruder might try using various techniques like social engineering, stealing the credentials from the LSASS (Pass the Hash Attacks) etc. steal credentials for performing lateral movements to move further in your network.

Protecting Stored Credentials

Windows Defender Credential Guard (WDCG) is a native capability in Windows 10 which prevents attacks against the credentials by protecting NTLM password hashes, Kerberos Ticket Granting Tickets, and credentials stored by applications as domain credentials.

Moving Towards a Password Less World

Just Imagine a world without passwords. What will the attackers use to get access to your values resources? Windows Hello for Business (WHfb) replaces passwords with strong two-factor authentication on Endpoints This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN.

Detection and Response at all Stages

We live in a world where we assume Breach and that’s where we see a lot of attacks materializing in large organizations despite the heavy investments they might have done on their Protection mechanisms. We need to detect these breaches early and initiate a timely response so that we can limit the damage caused. Windows Defender Advanced Threat Protection(WDATP) is an intelligent Endpoint Detection and Response capability in Windows 10 which provides preventative protection, detects attacks and zero-day exploits, and gives you centralized management for your end-to-end security lifecycle. This will give you timely insights so that the breach can be responded to in a timely manner. https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp Advanced Threat Analytics (ATA) is an on-premises platform that helps protect your enterprise from multiple types of advanced targeted cyber attacks and insider threats.

ATA technology detects multiple suspicious activities, focusing on several phases of the cyber-attack kill chain including:+

Reconnaissance, during which attackers gather information on how the environment is built, what the different assets are, and which entities exist. They generally building their plan for the next phases of the attack.
Lateral movement cycle, during which an attacker invests time and effort in spreading their attack surface inside your network.
Domain dominance (persistence), during which an attacker captures the information allowing them to resume their campaign using various sets of entry points, credentials, and techniques.

https://docs.microsoft.com/en-us/advanced-threat-analytics/what-is-ata

PUTTING IT ALL TOGETHER!

Windows 10 and Office 365 have built in native capabilities that help address threats at each stage of an attack lifecycle adding to less administrative, performance and cost overhead. These integrated capabilities work well with each other and are empowered with Intelligence through Microsoft Security Intelligence Graph (MISG). Microsoft's unique insights into the threat landscape, informed by trillions of signals from billions of sources, create an intelligent security graph(MISG) that we use to inform how we protect all endpoints, better detect attacks and accelerate our response.