start	end	text
25400	30660	My name is Darryl Highland. Today's presentation is the Insecure Workstation.
31040	34600	I had a lot of fun putting this together and I hope everyone enjoys it.
34720	37400	The Insecure Workstation, Bob Reloaded.
38540	43500	The information provided in this presentation is for educational purposes only.
43500	45260	Just use good judgment.
49010	51790	Today's presentation has two parts.
52130	55270	Rights escalation used in API call vulnerabilities.
55270	58810	This is kind of an old issue that just won't die.
58990	61030	So I thought it was important just to bring it out.
61030	63350	Maybe we can put it to bed eventually.
63690	67770	The second part of this is subverting Windows logon.
68810	72010	A few key takeaways in today's presentation.
72450	75210	A better understanding of desktop security.
75990	78530	Simple desktop console vulnerabilities.
78910	83690	And protecting information assets with layer defense or defense in depth principles.
83690	89930	And of course, since this is DEF CON, subverting desktop security for fun and entertainment.
93040	96820	What is a help API vulnerability?
97420	104600	It's a vulnerability that is exposed when an application running with system level rights makes an API call to the help viewer.
104600	109680	And does not drop any of those privileges before invoking that help viewer.
109680	117160	A user then, using the help viewer, can access other applications which will execute at system level, of course.
117600	123240	And as you can see with the bug track on this, 2003, this is nearly two years old.
123460	125420	So why is it still an issue?
127140	130320	The other question is, how widespread is this vulnerability?
131000	134780	To tell the truth, I'm really not sure how widespread this is.
135240	136860	But I do know one thing.
136860	146560	Over the last eight months, I've discovered one application during product testing that still had the help API vulnerability on it.
147580	155800	Two, I found another vulnerable application running on my company's network that had never been reported yet.
155920	165680	And third, I actually found an application that had been reported in bug track, but it was running on someone else's network unpatched.
165680	170400	So this is a reality, and this is an extremely simple vulnerability.
171240	175680	Now, why do vendors continue down this path? Of course, the issue is money.
175960	178360	They want to beat the competitors to market.
178360	184180	They're cutting corners and not properly security testing their applications prior to going to market.
184700	188420	Vendors also may presume that users are not abusing their products.
188780	191600	Obviously, they've never been to DEF CON.
193160	196940	Sell first, fix later, make you pay for it.
197400	209140	I don't know about you, but when I get to go back and patch 20,000 systems because of some lame vulnerability that should have never been in the product when it went to market, I'm upset.
211700	213880	Now for a quick demonstration.
222450	227190	The first one on this list, Spy Sweeper, anti-spyware enterprise version.
227190	229370	This was version 1.5.
229950	236110	Since I discovered this, the vendor did release version, I believe, 2.0 that fixed the vulnerability.
236750	240930	But of course, how many people are running 1.5 out there?
241150	243790	So let's take a quick look at how simple this is.
253620	259340	A user just needs to open up the standard Spy Sweeper GUI.
265600	267860	Launch the Help, the Help Viewer.
269360	274160	Within Help Viewer, there's many paths that he can take, but we'll take the simplest one.
289020	292120	Now let's take a look at Task Manager to see how this is running.
298720	303080	So if we look at Task Manager and look at Spy Sweeper, the main application,
304180	306500	we can see it's running at system level.
308280	314420	Obviously, when the viewers kicked off, it's running at system level also.
315600	321540	And of course, since we spawned Command-DXE from there, it's running at system level.
322060	327220	This is basically a textbook Help API vulnerability to the T.
331040	335760	So after I found this during product testing, we didn't buy the product.
341450	348710	I started looking at our network and taking a look at Novell's NetWare XenWorks Remote Desktop.
348710	352050	It puts a little icon in the lower right-hand corner of your screen.
352910	358730	Right here it is. I'm not going to run it because it's a textbook Help API vulnerability.
358730	363290	I contacted NetWare and they quickly released a patch.
363390	368230	But of course, how many people are running the unsecured version of it out there?
368730	371930	The third one in here, McAfee AV4051.
372370	380390	As you can see, the bug track was actually reported on this in September 15, 2004.
380390	383550	And McAfee quickly released a fix for this.
383550	389150	It's a fairly old version, but you run into many companies, you typically run older versions.
389150	393250	You can't afford to constantly upgrade every time the vendor comes out with something.
393390	395610	This one is a little different. I want to show it to you.
395610	400530	Because it doesn't have the Help API vulnerability, that was actually fixed in it.
416010	419270	If you go to the Help viewer from here, it's going to be fine.
419270	425470	But, interesting thing about this product, I was actually taking a security class.
425810	427450	A security class.
427470	431010	And in the class, at lunch time, I decided to have a little fun.
431010	436110	So I started playing around with their desktop systems in the security class.
436770	440530	And I found this vulnerability.
440530	443590	Of course, it had already been reported, but I didn't know it.
443590	447830	How many of us are capable of reading all bug tracks and remembering them all?
447830	453810	So, if you drill down in this thing and go to...
463250	468310	If we go to Reports, we get a nice little browser button.
468350	469610	These are always fun.
484820	486540	Of course, right click on it.
489920	491880	Go open, and there it is.
492100	495660	Now, if we look at Task Manager, this is going to be running at system level also.
509560	512020	So, how do you tell if your systems are vulnerable?
512020	514420	Just like I did there, just take a look at them.
514760	521800	Look at Task Manager, take a close look at all the services running in Task Manager with system level.
521820	524980	Do any of those interact with the desktop?
524980	530440	If they interact with the desktop, there is always a possibility that a vulnerability could exist in there.
530440	531640	Take a close look.
531640	534200	What icons are running in the system tray?
534200	538020	Do they launch applications that are running at system level also?
538020	543220	And of course, what applications need higher rights to function properly?
543840	553880	Antivirus, antispyware, remote management tools, auditing tools or auditing applications may need to run at higher rights.
553880	556700	So, scrutinize those applications a little closer.
557480	560980	How do I protect myself from help API vulnerability?
560980	562420	Group policies.
562700	567540	If you sat through my presentation last year, you may not think group policies is a good solution.
567540	574820	But I think it works in this scenario right here and has features that you can use to shut down some of these holes.
574840	576860	Remove the icon from the system tray.
576860	584840	A lot of these applications have the ability to go ahead and remove the icons from the system tray so the viewer can't do it.
584840	587620	Also, a lot of those features can be locked down.
587620	596460	If you install your applications right out of the box, a lot of times that's how these vulnerabilities get brought into your systems.
597780	600320	And of course, testing all new applications.
600320	604840	You need to go out there, look at all your applications and test them before you deploy them.
604840	607980	Better yet, test them before you purchase them.
608620	612340	Save yourself some money and headache because you're going to have to go back and patch them.
614940	617260	Okay, let's have a little bit of fun now.
617260	620180	This year's project, subverting Windows logon.
624270	626870	This year's research project and what we learned.
626870	632290	I'd like to give credit to some friends of mine that played a big part in helping me with this.
632290	634850	They did some of the coding, helped me with the coding.
634850	638730	I'm not a coder. I'm in the process of trying to learn it, but I'm not a coder.
638750	642730	So they assisted me in this part here, as part of this project, in their research.
642730	644430	I'd like to give them credit for that.
644750	647150	Three rules that drove this research project.
647150	648770	It must be simple.
648850	651270	I like simple exploits.
651730	652570	Simple hacks.
652570	656510	I like something I could actually go teach my grandmother how to do and she would understand it.
657950	660690	It needs to fit in my pocket, if not in my head.
660690	667070	I like things that, you know, it'll easily fit in a CD or a USB, if not fit in my head.
667070	672010	There's nothing worse than trying to do a proof of concept that somebody's came out with
672010	677110	when you've got to put in a 400 megabyte footprint onto a box to actually make it work.
679970	682890	And last, it must be easy to protect against.
682890	689450	If I'm going to go through this trouble to figure out these exploits and these issues and teach people,
689450	691970	I want to be able to teach them how to protect themselves also.
691970	693430	That's very important to me.
694310	695870	So let's get started.
697790	699810	Can Windows login be subverted?
700090	702150	Yes, it can. You'll see.
702650	704890	Curiosity? Just because it's there?
704890	706770	No, I didn't do this just for curiosity.
706770	710330	Of course, I did it to get a better understanding of the security vulnerabilities that exist
710330	714590	in the company's environment where I work and be able to protect them.
714590	716250	That's what I'm being paid to do.
717030	721830	Where? On XP, Windows 2003, this is where we've tested this at.
721830	729410	Of course, it's so simplistic, as you'll see, it'll easily be carried out on a Windows NT or a 2000 box.
729810	732670	When? Bob is back on the job.
732730	736730	If anyone's seen my presentation last year, I introduced Bob as a character.
736730	744430	Bob works for his uncle, and he is a hacker, and he likes to subvert desktop security for fun and entertainment
744430	747890	and torment his sysadmin in the process.
748850	753370	Now you ask how. Well, this exploit has two pieces.
753370	756930	There's a methodology, the attack process behind it.
756930	763450	And a programmatic attack, a simple program that we're going to use and deploy onto a system
763450	767590	that gives us the ability to bypass the Windows logon.
767850	770610	Neither one of them can do anything by themselves,
770610	774290	but when we bring these two concepts together, we accomplish this goal.
775630	776950	Okay, let's start.
776950	780010	Exploit Part 1, Utility Manager.
780150	782150	What is Utility Manager?
782150	786110	Well, let's take a close look at what Windows has to say about Utility Manager.
790940	798880	Utility Manager enables users to check an accessibility program status and start or stop an accessibility program.
798880	804800	So basically, Utility Manager is an application that you can use to start and stop other applications.
805780	806920	Let's read a little more.
808080	813160	Users can also start accessibility programs before logging onto the computer.
813980	819260	By pressing the Windows logo key and the plus at the welcome screen.
819320	828960	So basically, Utility Manager is an application that I can use to start and stop other applications before I ever log onto the system.
833790	836550	How does it work and how do we access it?
836970	844090	Well, what Windows help said, you hold down the Windows logo key and you hit the U key and up comes Utility Manager.
844090	848550	From within there, you can start and stop accessibility programs.
852090	854810	There you go. Pretty simple.
859660	861660	Why is it such a problem?
862360	867800	Well, obviously, as I mentioned, a user can start and stop applications before he ever logs on.
867880	876440	Once you are logged on and you use the accessibility program, it runs under your user ID and runs under your credentials. Not an issue.
876440	880880	But, if you are not logged on to the system, it runs as local system.
881000	888840	So, we can start and stop applications prior to ever logging on to Windows and we can get them to run at local system level rights.
893740	912700	So, when we started this, we thought, okay, well, does that mean if I can take example, let's say, command.exe, cmd.exe, and rename it osk.exe, which is the on-screen keyboard, would Windows let me launch this or would it give me an error?
912700	915720	Would it give me a security error to prevent me from running it?
915720	927920	So, we went ahead and we overwrote the osk.exe and we executed it and at first, before we logged on, and nothing seemed to happen.
927920	936980	Well, further investigation, we found out that it did execute with no errors, but it was running in a non-interactive mode. It was in the background.
936980	939080	We did not have access to it.
939080	948100	But, if you could hold some questions to the end, because we're going to be really tight to get through this presentation, I apologize.
948320	957180	And if I can't answer them at the end because we don't have time, we'll take it offline and I will try to answer your questions and if I don't have the answers, I will try to get those answers for you.
957180	958040	How's that sound?
960020	969360	So, we went ahead and did that and it didn't seem to work, but when we looked at it, we found out it was running at system level, but in the background in a non-interactive mode.
969360	974120	So, over the next couple of slides, we'll explain what we did.
975620	978500	Exploit part two, the log on screen.
978680	984080	User interface objects are managed using Windows stations and desktops.
984520	989080	Windows stations come in two flavors, interactive and non-interactive.
989100	995550	The only interactive Windows station that can be defined in an application is when stay zero.
996330	1001410	Also, Windows has what's known as multiple desktops.
1001590	1008110	The default desktop is the desktop after you log in where you do your work on a day-to-day basis on a Windows system.
1008530	1012410	The screen saver is also defined as a separate desktop.
1012570	1015350	Haven't really played with that yet, but we probably will.
1015790	1020790	The win log on screen also is a completely separate functioning desktop.
1020790	1036990	So, basically what we decided we needed to do, we need to get the program that we replaced the OSK EXE with, we need to get it to launch interactive mode and we need to get it to launch interactive mode on the win log on desktop.
1037390	1047390	So, basically we put together a simple program that would spawn command EXE under win stay zero win log on desktop.
1047830	1049510	So, let's move in that direction.
1050570	1052850	Exploit part three of the code.
1053170	1057270	This code we put together poses no security issues by itself.
1057510	1062610	Basically, we're just setting the create process thread to run under the win log on desktop.
1063770	1067330	The security breakdown is how we use it. It's the methodology.
1067330	1074190	Basically, we've discovered an architectural issue with the way utility managers run on the system.
1074330	1079530	And the ability to run it prior to ever logging on and get it to launch at system level.
1080490	1082110	And the code is extremely simple.
1082110	1084290	So, let's look at the entire code.
1085490	1086670	That's it.
1089930	1104410	And as you can see, if you go down through there, right above where it says create process, see Windows system 32, right above that line, is where we define the win stay zero, the interactive desktop, and the win log on as the desktop that we want to run this at.
1105870	1112850	If you go out and look at, I know there's plenty of coders in the room, I mean this is just a simple code snippet.
1113930	1116570	I've seen this in a hundred different applications.
1116670	1122750	The only thing is we're different is most of the applications I've seen define default instead of win log on.
1122750	1124630	That's the only thing different with this code.
1126770	1130370	So, we come to the final part of this, the delivery.
1131030	1137730	Now, when I first started this project and we got around to this point, I said, oh my gosh, how am I going to deliver this code to the system?
1137810	1140290	This has to be the most difficult part.
1140490	1144490	Well, it turned out to be the most trivial part.
1144490	1148810	And we're going to cover some high level concepts here.
1149130	1151810	Admin access, well you can overwrite it with admin access.
1151810	1153970	That's when we did our first test we did that.
1154030	1158350	But we already have admin access to the system, so that really accomplishes nothing.
1158670	1162950	We can use some of the help API vulnerabilities I showed you to overwrite the file.
1162950	1166910	But, you know, if I'm already system level and logged in, you know, what's the point?
1167870	1170330	Bit level modification of the hard drive.
1170330	1182670	We actually took a DOS boot disk and some old DOS utilities and identified the track sector where OSK was and overwrite the first part of the application and got that to work.
1183190	1189130	But somewhat complex and it goes against my theory moving forward of keeping it simple.
1189550	1192650	The one thing is maintenance boot disk.
1192970	1195530	This is a fairly broad category.
1196990	1200210	Linux is a possible solution moving forward.
1200330	1204310	There's a lot of work going on in writing to NTFS file systems.
1205490	1213050	Another solution, an attacker could actually have a stolen or pirated copy of Windows PE.
1213050	1216610	Windows pre-installation disk is a possible solution.
1217030	1226770	But also, if you go out and Google, you'll find out there are other PE or pre-installation available.
1226770	1229250	Which is basically an open source solution.
1229870	1231210	Maintenance disk type things.
1231210	1235030	And I did find a couple other solutions out there that look very viable.
1235190	1237770	So I'm going to say just kind of pick your own poison.
1237770	1240930	Go out to Google. Google for writing NTFS.
1240930	1244050	Google Linux NTFS.
1244050	1247290	Google Windows PE or pre-installation.
1247290	1249770	And you will find a multiple of solutions.
1250270	1252370	I sat down to try to figure this thing out.
1252370	1254290	I said, well, there's no sense in re-venting the wheel.
1254290	1257990	Let me go out on Google and see if anyone's already doing this.
1258250	1261890	Well, I searched for maintenance disk, maintenance boot disk.
1262650	1267190	And probably within 15 minutes I had a bunch of solutions.
1267190	1268730	I downloaded a couple of them.
1268730	1271350	Within an hour I had a fully functional solution.
1271950	1274910	So this is a no-brainer here.
1275430	1277930	So we're going to move on a little further from here.
1278490	1280390	Okay, Bob reloaded.
1280390	1285210	So now we're going to go ahead and look at this actual exploit and see how it works.
1295450	1297330	A little history on Bob.
1297330	1301890	As I mentioned, Bob works for his uncle.
1301890	1303810	And he is a hacker.
1303810	1305870	And he likes to subvert security.
1305970	1311110	Well, it turns out Bob's uncle has a competitor against his company.
1311630	1317630	And his competitor is getting ready to release some new products out there.
1317630	1319910	And Bob's uncle thinks, you know what?
1319950	1323990	It would be really good if I could steal that information off him.
1324310	1328970	So what he does is he gets Bob and the competitor happens to be looking for a janitor.
1328970	1333630	So they send Bob down there to apply for this janitorial job.
1333630	1336030	And Bob gets the janitorial job.
1336230	1338770	So Bob shows up to work the first night.
1339210	1341270	And he brings his cleaning tools.
1345340	1349560	Just to let you know, I did pre-stage the exploit on here.
1349560	1353060	Because the disk would obviously whirl for three minutes.
1353060	1355020	And you would just see a black screen.
1355020	1356680	So you really accomplished nothing.
1356680	1360480	If anyone actually wants to see me own a system that hasn't been owned yet,
1360480	1361960	just get with me after this.
1361960	1364640	And I will run the disk through there so you can see it happen.
1367020	1369780	So Bob goes through and he scopes out all the offices.
1369780	1370920	And he finds an office.
1370920	1373680	He finds John's office, as a matter of fact.
1374420	1377000	And what he does is he throws his disk in.
1377000	1378260	He boots John's system.
1378260	1379820	It spins for a few minutes.
1379840	1382480	And he pulls the disk out and he reboots it.
1382480	1383880	And he goes about his way.
1383880	1386020	The next day, John comes in.
1386500	1388420	He logs on to the computer.
1388420	1390760	And of course, he's not going to see anything there.
1390760	1393480	Because he doesn't know about Utility Manager.
1393480	1395400	He doesn't use Utility Manager.
1395400	1397520	There's no applications running in memory.
1397520	1400360	They have to be executed from somebody at the console.
1401060	1403280	So there's nothing to be detected there.
1404380	1406080	So John comes in.
1406080	1407500	Of course, he logs in.
1407540	1409420	He does his thing that day.
1409620	1413380	And when John's finished, what he does is he does what a lot of us do.
1413380	1415520	He doesn't log out.
1415520	1418560	He locks his screen and he goes his merry way.
1418560	1421960	Or he lets his screensaver kick on, which locks his screen.
1422600	1425940	So about 9 o'clock, Bob comes rolling.
1425940	1427560	And let's see what Bob's going to do.
1436380	1438840	Of course, the system's already been staged.
1438840	1440820	So set up by Bob.
1440820	1441860	So Bob comes in.
1441860	1443580	He goes to Utility Manager.
1443980	1445780	He brings up Utility Manager.
1445780	1448440	He goes to the on-screen keyboard.
1449020	1450620	And he launches it.
1470780	1473200	After we did this, we started playing around with this.
1473200	1477340	And the reason why I'm just running a command.exe versus the entire desktop is
1477340	1481500	we found out the resources on the WinLogin desktop are limited.
1481800	1484300	If you get Explorer up, which is a real hog,
1484300	1487560	the thing will start flaking out and applications won't run properly.
1487580	1490980	But from here, Bob can pretty much do what he wants.
1492440	1497700	One of the good things to run is Task Manager.
1498620	1502860	From Task Manager, you can pretty much stop and start processes.
1502860	1507500	As a matter of fact, you can see John's processes in there.
1508040	1509980	And we're running at system level.
1517220	1519900	Bob could go ahead and several things he could do.
1519900	1521420	He could use his USB.
1527170	1529110	Make his job easier.
1539430	1542010	He could just dump the hashes out, take them offline,
1542010	1544050	and crack the passwords on the system if he wanted to.
1544050	1545170	That's not a problem.
1552010	1557490	Another thing Bob could do, and I've had a lot of success testing it,
1557490	1562030	he could take a small memory tool like TinyHexer,
1562030	1565110	run this against all the running processes.
1565110	1572490	Scan all the running processes for the words password, passwd, pwd.
1572490	1576390	And I successfully and many times have been able to strip
1576390	1581790	the user's password plain text out of the running processes memory
1581790	1586090	on many occasions for multiple applications.
1586090	1588990	Specifically if the application requires authentication
1588990	1592230	and it's written in Java.
1596330	1602850	Now at this point, the reality is that he's trying to steal stuff
1602850	1603950	from this company.
1603950	1606690	The chances are that information is probably not going to be
1606690	1608710	on this local computer.
1608850	1611050	He's going to want to go to the network.
1612790	1615630	So if he looks to see what drives are mapped,
1615630	1617810	he can see there's nothing mapped.
1621300	1623080	But if we run netstat...
1624100	1626160	Oh, that stinks. Okay.
1627100	1629380	He can see that there's no mapped drives.
1629540	1632220	Apparently disconnected, but we can probably get that connected up
1632220	1633380	and then we'll see.
1634240	1637360	We found out that since we were running
1637360	1641660	in a completely separate desktop, running at system level,
1641660	1643160	we're not John.
1643160	1647060	We don't have John's network resources and can't get to him,
1647060	1648200	we found out.
1648700	1651120	So me and my friends started talking about this
1651120	1655160	and what was the possibility of getting the user,
1655160	1657120	John's security token.
1658220	1661680	So we did some research on this
1661680	1664680	and using standard Windows API calls,
1664680	1668400	we devised a way that we could actually impersonate John
1668720	1671540	and get all of his network resources.
1673700	1676800	And the way that would work was we wrote a small, simple program
1676800	1678400	which I am not going to release
1678400	1682440	because I think it could be misused.
1683060	1685460	But if we run this called impersonate
1685460	1688320	and we point at John's running processes,
1688320	1691720	and we'll pick the one for Explorer, 532,
1694590	1696310	it comes up as a success
1696310	1699850	and if you see, it switched over to John now.
1700610	1702630	One of the quirky things from here though,
1702630	1704950	that if I typed in a command, it would run as system.
1704950	1707690	The next time I typed in a command, it would run as John.
1707690	1708990	For some reason on this screen,
1708990	1710970	it would keep switching back and forth.
1710970	1712950	So to get away from that issue,
1714910	1718370	we'll exit out of the one running as system.
1718370	1721130	Now we are purely running as John
1725940	1728640	and now we can see his network drives.
1728780	1733220	We have full access to all of John's resources on the network.
1739890	1741570	It shows that it is disconnected.
1741570	1743190	Let's see if we can get it to reconnect.
1743190	1744310	There we go.
1745030	1746230	So they are reconnected.
1746230	1749610	We also found out if John has access to another system
1749610	1751330	that he is not mapped to,
1751830	1754050	we can actually make mappings to that system
1754050	1758090	and Windows would authenticate us as John to that system.
1765210	1766750	Now there is one thing I wanted to show you.
1766750	1768110	There is a couple of other things I wanted to show you.
1768110	1769470	There is one I wanted to show you.
1769790	1771770	Just to show you it is true.
1772310	1773330	There we go.
1773530	1775050	We can get a full desktop up.
1784770	1786530	Now if we log in as John,
1786530	1787870	let's go ahead and do that.
1788530	1790310	Hopefully it won't flake out on me.
1792650	1794110	It will switch over to his desktop
1794110	1795710	and then we can control-alt-delete
1795710	1797370	and switch back to the other desktop.
1797750	1799810	So you can see there are multiple desktops.
1801450	1802910	The one thing we did find out,
1802910	1805430	I did run this against a 2003 server,
1805430	1807430	there doesn't seem to be any resource issues
1807430	1809390	on the Windows logon screen.
1809390	1811890	So you can run full Explorer desktop from there
1811890	1813990	and run all the applications you want.
1814150	1816130	I think I had about a dozen up running
1816130	1817650	without any resource issues
1817650	1820070	without ever logging on to the system.
1824140	1826660	Okay, let me go ahead and shut these down.
1826720	1828780	There is one other thing I wanted to show you.
1831440	1834540	This can be used in kind of a different way.
1835500	1837040	Let's go ahead and log off here.
1837040	1839000	And we are going to log on as Mary.
1840720	1843360	Mary's system administrator doesn't like her doing anything
1843360	1846440	so he has her kind of running in restricted mode.
1847340	1848700	And we thought, you know,
1848700	1851580	if we set this application up to run on the WinLogon desktop,
1851580	1854340	what if we wrote the code to run on the default desktop
1854340	1856700	but executed it from the WinLogon desktop?
1856720	1860360	Would it spawn a shell on the user's desktop
1861100	1863200	and run it at system level?
1873790	1876050	So Mary tries to open up the clock.
1876050	1876870	He comes up and says,
1876870	1878670	you don't have privileges to do that.
1878670	1880230	So Mary staged the system.
1880230	1881990	She wants to break out of that.
1881990	1885170	So she switches over here without logging out.
1885170	1887370	It just switches to the WinLogon screen.
1887550	1888570	Windows U.
1888570	1890010	And she can use the magnifier,
1890010	1891690	which is where she wrote her code.
1891770	1894850	She can go start, cancel, cancel.
1896530	1900070	Now she has a command prompt at system level.
1902230	1906950	She can bring up task manager,
1906950	1910570	kill her Windows Explorer,
1913380	1916040	run another Windows Explorer.
1921660	1923700	Now she can do what she wants.
1938830	1941950	So how do I protect myself from this exploit?
1941950	1944370	Obviously group policies, maybe.
1944990	1948290	You could remove or disable utility manager.
1948290	1949750	Just take it off the system,
1949750	1953150	but Bob could probably put it back on there.
1954790	1957310	Disable booting from CD-ROM.
1958030	1959390	Disable booting from floppy.
1959390	1960390	Lock the BIOS.
1960390	1962210	That would obviously slow him down.
1963590	1966750	If you're worried about attack against a service system,
1966750	1969470	you can run a host IDS on that system.
1969470	1971930	That would detect if Bob went into your system
1971930	1974230	and overwrote some of the files.
1977070	1980430	So how do you prevent backdoor exploits by employees?
1980650	1981810	Someone like Mary.
1984170	1986030	Policies, that's always a solution.
1986030	1987630	If you catch it, you can always fire.
1988570	1990030	Separation of duties.
1990130	1993250	Application system verification and testing before deployment.
1993250	1994210	And the reason why I say that,
1994210	1995850	I want you to think about something.
1995870	1997110	I don't know how many people in here
1997110	1998970	work for fairly large companies.
1999010	2001790	Do you have base images of your desktops?
2003090	2004570	How do you control those?
2004570	2005510	Where are they at?
2005510	2006530	Who does it?
2006710	2010030	Do you have one person that actually builds your base images,
2010030	2011390	sets it all up?
2011430	2013510	He may keep it on his own hard drive.
2013510	2013890	I don't know.
2013890	2015630	He might keep it on a network server.
2015630	2017590	Do you secure those things?
2019750	2021090	Separation of duties.
2021850	2023330	Somebody who sets something up,
2023330	2024910	you don't want them doing the verification
2024910	2027470	and the testing of it, obviously, of course.
2027670	2029310	These are things you need to consider.
2029310	2032650	How do you prevent non-employee access?
2032970	2034750	Bob got into this company.
2034890	2036130	Who is that maintenance man
2036130	2038590	and what do you really know about the night janitor?
2039190	2042090	Using social engineering to gain physical access.
2042090	2044510	Do you do security awareness training to your employees,
2044510	2047850	dealing with people gaining physical access to your company?
2048870	2051170	Another big one, contractual agreements
2051170	2053450	with contractors and outsourcers,
2053450	2057010	whether it's janitorial or application development.
2057390	2058670	When I was doing this project,
2058670	2060230	these are the things I started thinking about
2060230	2062890	and started asking these questions at work.
2063450	2065770	We're real big on application development.
2065770	2068490	We hire an outsourcer to write code for us.
2068490	2070850	We don't let him test and verify it for us.
2070950	2073570	All at once we just put it into the system.
2073570	2074730	We don't do that.
2074790	2077050	We have these contractual agreements
2077050	2079050	to protect your company's assets
2079490	2081550	and hold that company liable.
2081610	2084530	But yet we turn around and hire janitorial service
2084530	2086490	that basically has full access
2086490	2088070	to every office in your building
2088670	2092690	and we have nothing to protect us from them.
2094630	2097430	Defense in depth is the only effective method
2097430	2099510	to defending your network.
2099950	2103890	It's a combination of people, processes, and technologies.
2103890	2105630	They're applied at each layer.
2105630	2107610	If one layer is compromised,
2107610	2111110	your entire organization is not compromised.
2111670	2114570	This consists of policies training,
2114570	2117630	physical access, parameter security,
2117630	2121610	internal networks, host, application, and data.
2121710	2123730	So let's think about this.
2125310	2127550	If we would have concerned ourselves
2127550	2129890	with physical access or policies
2130510	2133830	and required a background investigation of Bob,
2133830	2136570	we would have found out he was the nephew of our competitor
2136570	2138750	and probably wouldn't have hired him.
2140290	2142050	Okay, so that breaks down.
2142050	2143210	That layer fails.
2143210	2144990	We let Bob through the door.
2145570	2147610	The next phase is, let's say,
2148670	2150230	the host machines.
2150230	2151950	If we had set our host machines up
2151950	2154410	so they couldn't be booted from a floppy
2155510	2157630	or booted from a CD,
2158410	2160590	and we had set other restrictions on there
2160590	2162610	with group policies,
2162610	2164410	we would have caught Bob there
2164410	2166070	or at least slowed him down slow enough
2166070	2167770	that we may have caught him.
2168730	2170350	Defense in depth.
2170890	2173010	So let's say that layer fails.
2173810	2175390	Bob gets through.
2175390	2178530	Bob gets access to a host system.
2178850	2180630	Bob puts his code on there.
2182230	2185110	Now, obviously, the stuff he came in there to steal
2185110	2187790	was research and development stuff.
2188250	2190630	John had access to research and development.
2190630	2194310	If this was the heart and soul of that company,
2194310	2197090	how come two-factor authentication wasn't required
2197090	2199730	or the data stored in an encrypted manner?
2199850	2201830	Because if it had been,
2201830	2203310	Bob would have failed.
2205130	2208510	So this is the concepts of defense in depth.
2209890	2212650	Combination of people, processes, and technologies
2212650	2214550	applied at each layer.
2214550	2216290	If one layer is compromised,
2216290	2219230	your organization is not compromised.
2222610	2223790	Running early.
2226770	2228870	Questions, and hopefully I can answer them.
2228870	2232530	If I can't, I've got business cards here.
2233190	2235470	I've got my email address up there.
2235470	2237290	Shoot me the question.
2237290	2240030	I'd be more than glad to try to answer it for you.
2240050	2242490	And remember, as you're asking these questions,
2242490	2243890	I'm not a coder.
2243890	2245490	If it's a coding question,
2245490	2248370	send it to me in the email and I will answer it.
2248370	2249090	In red.
2256270	2258210	No, I do not believe so.
2258290	2260070	So, from a remote desktop,
2260070	2262310	you cannot pass that key combination
2262310	2264630	or will not recognize it or run.
2265650	2268410	The one thing we haven't tested, though,
2268410	2269950	the impersonation function
2269950	2271830	is one of the things I want to test.
2271830	2274590	What if I was on a Citrix system
2274590	2276390	with multiple users?
2276390	2277870	We did find out that
2277870	2279910	that function will not work
2279910	2283510	unless the exploiter is running at system level.
2283510	2285030	But if he's at system level,
2285030	2287510	gain system level on a Citrix box,
2287510	2289850	could he take over the identity
2289850	2291410	of the other users?
2291410	2292410	This is one of the things
2292410	2294230	we're going to be testing real soon.