start	end	text
1120	3280	Can you guys hear me now?
6500	17360	Alright, so hello everyone. I'm 800XL. As already mentioned, I'm with DEF CON group 619858, San Diego.
17880	20560	And just a few quick fun facts about me.
21640	29420	The first ever hacking movie they ever saw in the mid-80s was WarGames. If you haven't seen it, you should watch it.
29940	38420	My first computer, and also inspiration for my handle, was Atari 800XL, which I received at the age of 15.
38420	44320	And that was quite a life-changing event for me that shaped my interests and passions going forward.
45260	54300	Just a quick note about Atari 800XL, just to put things into perspective, it was an 8-bit computer with 64K of memory.
54500	56620	And that's how I learned how to program.
58100	66720	My first DEF CON, and it's been quite a while since then, was DEF CON 14, and that was at the Riviera Hotel and Casino.
66720	72400	I believe the casino is no longer around, it's been demolished. And that was back in 2006.
73780	82800	Now, the thing about DEF CON, the first DEF CON, I clearly remember driving back home with a bit of sadness that the event was over.
82800	91240	And dreading, you know, how many months it will be before I can come back to Las Vegas and attend the next DEF CON conference the following year.
91680	98720	And, you know, as it turned out, DEF CON Groups was a perfect remedy for that. And we'll get to that in a bit.
108500	110960	So, a little bit about San Diego.
112340	120960	For those of you who don't know much about San Diego, it's located in Southland, California, on the border of Mexico.
121540	127660	And it is the 8th largest city in the United States, with population approaching 1.5 million.
128680	132940	We are known for great microclimates, and it's, you know, beautiful beaches.
134620	140640	But, you know, to be honest, I only go to the beach like 5 times a year, even though it's close.
141700	146400	And, as you know, DEF CON Group names are designated by dialing area codes.
146400	155380	And in San Diego, the original dialing code was 619, and we also have 858 and 760, which is like a North County.
156360	169700	And another fun fact is that we are 534 kilometers from Las Vegas, which means that, you know, when DEF CON conference is on, it takes about 5 hours, you know, drive to get there.
169700	172160	Or you can fly, and that takes like 30 minutes.
177180	178920	Group history.
180440	185920	The DEF CON Group 858 was originally founded by Techlord.
185920	195060	I've actually never met him in person, but I did read about the group on DEF CON forums after I went to DEF CON first time in 2006.
195660	203940	And I was involved in DEF CON Group 619, which was founded by Renan01, Carl.
203940	210460	He founded the group in 2007. Unfortunately, that group fell apart.
211580	223420	In 2009 and 2012, there was no activity from DEF CON Groups, and I decided in December of 2013 that it was time to revive it from an activity.
223520	229040	And, you know, we've been going very strong since then. We are approaching our 7-year anniversary.
231800	253120	Our DEF CON Group leadership, you know, the responsibilities include organizing and running the meetings, organizing various events, a DEF CON party that we have annually, solicit people for talks, which is probably the hardest part, manage social media presence, order pizza for the meetings, etc.
254340	270900	The three key people and other organizers for our group is Mr. Bill. He specializes in our social media and Twitter and Twitch, Braxis, and Tokso. Shout out to you guys.
272120	285740	There was a pandemic... which is in the North County of San Diego.
285940	292980	And on average, we had approximately 30 attendees at each meeting, sometimes even approaching as many as 40.
293600	302380	Currently, because of social distancing guidelines, which we follow, we conduct our meetings on Zoom.
302560	305820	We also stream the meetings to Twitch.
307040	320360	Every week, Mr. Bill also organizes virtual happy hours. In between meetings, we collaborate on Slack. Our Slack has approximately 190 members.
321560	330240	Our team at VaporSec competes in various CTFs, and that's pretty much on a weekly basis. It's a very active group.
330240	343400	We have had occasional workshops. At least twice a year, we have Lockpicking Village. We also have done a wireless workshop in the past.
343960	350280	Now, one other fun thing to do for us is, usually around December, we have a crap meet.
350280	357520	This is when members bring books, electronics, any kind of cool unwanted items for exchange or just give away.
357520	361460	Usually, we come with more stuff than members.
363800	367900	It's a fun event, I recommend for other groups to also have it.
368940	376020	Once a year, we organize a party at DEF CON for group members and friends.
377200	383480	Hopefully, next year, when we have an in-person DEF CON, ping me, I'll get an invite.
386880	398480	Speaking of things that we do, I should mention that two years ago, we had our DC858 electronic badge.
399460	402760	The project was led by Elwood and Ager.
403100	409720	Thanks to the badge sale process, it was possible to fund the pizza for our monthly group meetings for the entire year.
409720	421940	I should also mention that Elwood and Ager made a significant donation on behalf of DC858 to the Women in Security and Privacy organization, which is very cool.
425580	429860	I should mention some of the cool talks that we've had in the last 12 months.
432760	436900	As you can see, talks cover a variety of topics.
436900	443300	We are lucky to have many active contributors in subject matters as members.
443300	453920	I should also point out that when we had the meetings in person, we had two to three talks at the same meeting, which is quite busy.
459120	466120	Thanks for starting and growing your DEF CON group. I think we are very successful and very active.
466120	470400	I recommend advertising on DEF CON forums, which is a good way.
472080	482720	However, the activity on DEF CON forums is cyclical. Usually, it's more active, more people visited right before DEF CON and not so much afterwards.
482780	484980	But it's a good place to start.
485580	493080	And obviously, utilizing social media and Twitter and hoping for DEF CON groups' retweets is a great way to get members to attend your meetings.
493640	501020	I also recommend to be very specific and have a topic for the meeting rather than just meet and greet or have beers.
501020	503660	I recommend to have a topic of some sort.
503780	508580	Don't be afraid to host introductory one-on-one talks. Your talks don't have to be advanced.
508720	518320	It's also okay to have a short lightning talk. Maybe bring an idea or a topic to your group or a project that you want to work on.
519240	535100	Invite guest speakers. I think now that we have all the groups engaged, it is possible for somebody from a different group to jump in on your Zoom and give a talk as a guest speaker.
535100	536760	So you should reach out.
537980	547080	You can get an invite to the unofficial DEF CON groups' Discord that we have and ask for guest speakers there.
549580	561120	I've already mentioned that having workshops such as lockpicking is a good way to get people interested in your meeting.
561500	569300	And also having a craft meet or something like a war driving contest. Simple things that get people interested.
570680	572360	Where to meet?
572360	583780	We've chosen a local pizzeria which has a private room and a couple TVs where we can project presentations, which is very convenient and also gives us a little bit of privacy.
584040	592220	Because we have our own room and I think that particular Wednesday of the month would probably be the biggest revenue for that pizza place.
592220	597780	Obviously, that's not possible now since we are following social distancing guidelines and we are doing virtual talks.
597780	601260	But when things get back to normal, most likely we'll go back there.
602460	606360	Frequency of your meetings. I guess it depends on how much content you have.
606360	613080	If you are in a really large group with a lot of talks and a lot of volunteers to give talks, you may want to do it twice a month.
613080	619500	But if you have fewer people, maybe quarterly, doing those meetings quarterly is more appropriate.
621620	631940	It's very important to keep the momentum going, so definitely set up a chat, Discord or Slack, so your team members can communicate and collaborate in between meetings.
633300	644660	Also, don't go at it alone. That will most likely lead to a burnout. Build your leadership team. Distribute responsibilities. Delegate tasks as much as you can.
644740	653860	Sometimes real life will take over. You may not be able to participate and you want to keep your group going. It's important that you have other people to fall back on.
654800	664840	If you'd like to connect with DEF CON San Diego, you can reach out to us on Twitter, Facebook, watch our Twitch streams, or email us.
667580	681720	And that covers the introduction to DEF CON San Diego. Up next, we have a DC-858 member, Smoochie, who will give his talk, so let's welcome him.
681720	695840	Hey, Dr. Axelsen. I'm from the San Diego DEF CON group and I'll be giving a presentation on Microsoft, how to save yourself from their Active Directory and Identity and Access Management design.
696840	712060	So, with most of my talks, I always like to remind everybody that we are definitely in a privileged group that may get a little numb to the phishing campaigns and the jokes out there.
712060	724000	For example, the Nigerian Prince and the IRS calling you. Those are stuff that we make fun of, but people fall victim to it.
724000	734520	I personally had to deal with that with my in-laws. Microsoft called them directly and wanted to fix a problem of theirs, and that ultimately caused an issue that I had to help resolve.
735920	747720	These things that we're aware of, just speak out about obvious things. Make sure your in-laws, your family that are non-technical, that this isn't something that happens in the real world.
747720	757700	Microsoft is not going to reach out to you because you're a valued member. And the IRS is not going to call you and tell you that they're going to sue you if you don't send $100 this very instant.
757900	765080	And of course, no main business does any type of commerce in Apple gift cards, so that should be a dead giveaway.
773090	794750	In broad strokes, what we're going to talk about is what's wrong with Microsoft, good or bad, and how you can design a system, secure your system, protect your system against these by default settings and design decisions by Microsoft.
794750	801770	One of the biggest ones that you need to take into account as you design any system is to always assume a breach.
801830	812890	There are no safe zones anymore. With the rapid change of software and hardware that's out there, there are going to be bugs.
812890	822930	There are going to be unintended backdoors, there are going to be unintended consequences that no person is going to be able to keep track of.
822930	829850	So as you design any system or as you upgrade any system or as you review any system, always assume compromise.
829850	835510	Assume that at some point, the thing that you're touching is going to have somebody on it that you don't want to have on it.
835510	849190	So how can you help mitigate that concern when it does happen and limit the impact and success that that attacker or anybody who's just making mistakes could have on your environment?
849190	855030	And again, it's not an if but a when of when you're going to have some issues.
855490	861090	You know, the old adage that script kitties are just out there poking around having fun. That's still the case, right?
861290	869670	It doesn't take much to go find tools that are out there. Cali Linux is well advertised.
870010	878610	You do a couple of keyword searches into Google and you can find yourself going down a rabbit hole and identifying tools that will just do this for you, right?
879190	886130	People are out there unaware of the ethical challenges of banging on the front door of someone's network, right?
886130	892850	You can look at the Twitter compromise that just happened. This 17-year-old kid, right?
892850	902170	How many years before that was he just playing around before he actually got deep into the SE and the actual phishing aspect?
902170	913050	And then separation of duties. So, I know it's very easy to just say, hey, I'm your admin. I need full God rights on everything.
913150	919590	Well, that's not how things should be operating, right? You should have very specific controls.
919590	923410	You should have separation of those responsibilities.
923410	931210	You know, for example, your exchange or email administrator probably shouldn't be the same person as your domain administrator, right?
931210	935530	Because the impact that person could have is significant.
935530	942510	Now, in smaller shops that you're unable to do this, you can start to separate those duties with accounts.
942510	957750	So, you can have an exchange administrator account, your domain administrator account, and your user account just to make sure that any one account or any one person can be audited and does not have that wide blast radius if something does go bad.
958750	967230	And when installing anything on your network at home or at work, take into account the install permissions.
967230	974130	It's far too easy to say, hey, I need root rights or hey, I need domain admin rights and the installs just go great.
974130	986190	But there are unintended consequences with service accounts being created or permissions on files being set up in that process that may cause harm in the future.
989980	1002840	So, on average, it takes about 24 to 48 hours from the first hour being compromised before someone's able to escalate their privilege to domain administrator or root rights.
1003140	1011060	Now, once that person has domain administrator rights on your network, your network is essentially theirs.
1011830	1018120	For those that are not used to Microsoft and Active Directory, that's full God rights.
1018120	1027580	That's modifying accounts, that's changing passwords, that's removing computers from the domain, that's modifying files, that's anything and everything that they would want to do within the kingdom.
1028320	1053150	And the persistence of a user once they have those... notified or able to identify them normally with tools that are out there in network land today.
1053450	1058350	So, a lot of these things have to have outside help to come identify those.
1058350	1068770	FBI has been reaching out when they've identified traffic from the nation state actors, Russia, Iran, all of those guys.
1069010	1072150	So, a lot of these companies don't even know that they're there.
1072150	1076710	And it's these third parties that come in and say, hey, we've seen this traffic, can you validate that this is valid for your company?
1076710	1080650	Or they confirm that they have actually been compromised.
1081750	1098520	And once those credentials are compromised, they're exfilling data, they're modifying data.
1098520	1104460	So, it's very important that we get a tight rein on those elevated permissions.
1106320	1113040	So, the way that Microsoft does password hashing is not unique to every domain.
1113040	1118720	So, you have a user, the username is user, their password is password1.
1118740	1127200	Well, Microsoft will take that combination of username and password, create a hash based on their algorithm.
1127400	1135480	Either for Landman, which is the old way of authenticating, or NTLM, which is the new land manager.
1135480	1137020	And you get a hash.
1137140	1145280	Now, the great thing is that no matter what domain you're on, that combination will always have the same hash.
1145280	1159600	So, if you're at alt space domain and you put in user1, password1, that hash that you get in NTLM will be the exact same when you go to Microsoft and put in user and password1.
1160030	1171160	Which is an issue in itself, right, because you can start to build this domain knowledge of standard usernames and start to create those passwords.
1171160	1181320	And because Microsoft doesn't solve the passwords, does not create that blank data in it, again, it's not unique across people's domains.
1183020	1190220	So, what can be done and what is available is you can start to calculate these hashes, right?
1190220	1196480	So, for username administrator, password1, that creates a unique hash, password2, password3, password4.
1196480	1204240	And then you can also pull hashes and start to look up within that database or the rainbow table and know what the password is.
1204260	1209640	So, it's not a lot of effort. And again, there are tools out there that do this for you.
1209860	1217700	And basic process for a lot of people, you know, they use the administrator account with the administrator name.
1217700	1221560	They don't change the name itself, right? There's still the guest account.
1221560	1226460	There's still a lot of built-in stuff that they don't change that are pretty consistent across the board.
1226480	1231960	And we're actually going to get into that with one specific account and why that's important.
1237430	1245290	So, taking the passwords and the hashes. So, where can you find outside of having those hashes?
1245290	1257050	So, within group policy objects, people hard code in username and passwords for ease of use, for installation of capabilities, or just out of pure laziness.
1257050	1261910	So, map network drives within those group policy objects.
1263670	1266670	Creating local users, right?
1266670	1271990	Create a local service account on the box that's running a specific application.
1271990	1277250	Well, that password is in clear text most of the time for those accounts.
1277250	1282610	Data sources, printer configurations, update services, schedule tasks.
1282610	1288490	All those require authentication and that password and username have to be stored somewhere.
1288590	1293290	And nine times out of ten, it's going to be stored in clear text within group policy objects.
1293870	1306470	SysVol for batch files. So, if you're able to create a custom batch file to delete a file on logon or to create a folder structure on logoff, that's going to take some credentials.
1306670	1311470	Those passwords are probably within that batch file itself to run.
1311470	1321090	On the domain controller, so you can use volume shadow copy and create a copy of the actual domain database itself, the ntds.dip.
1321210	1330190	And on that same domain controller that you pull that dip file off, the decrypt key is actually in the registry.
1330310	1336450	Now, the good thing is that the decrypt key is tied to the actual machine itself.
1336450	1350390	So, it's not one universal decrypt key for every domain. It's for domain controller one has one decrypt key, domain controller two has a separate one, and they are unique in that regard.
1350550	1355870	And then you can run tools out there. So, hopefully you all are aware of these ones.
1355870	1362790	So, Mimikatz is one of the holy grail tools out there. It kind of does everything. It's a Swiss Army knife for how to take over a domain.
1362990	1366430	That's created and deployed by a general way.
1367490	1371850	There's Cryptman, a powerful script that's pulled by Microsoft.
1374770	1382270	And DCSync, which is a capability for you to basically synchronize data from a domain.
1391610	1398750	So, authentication within Active Directory is pretty straightforward. Kerberos has been around for quite some time.
1398890	1404250	But in broad strokes, you have a view here that says, hey, I need access to something.
1404390	1411290	Here is who I am. The domain controller validates that and says, yep, here's a ticket. You are who you say you are.
1411430	1419270	Workstation says, cool, I want to go do this, get access to this server, go check out this website, whatever is Kerberos enabled.
1419270	1424050	Server says, cool, yep, you are authorized to do that based off your groups and your rights.
1424050	1431650	Send this over to the server, your application server, and you just have that back and forth like TCP packets.
1433170	1437150	Sounds good, right? You have separation of duties within the authentication.
1437150	1440170	You don't have one machine saying who they are or who they say they are.
1440170	1443590	Everybody validates who they are. It's a circle of trust. Everything is great.
1443590	1452090	But those tickets that are created by the domain controller are assigned by a specific account.
1452350	1458970	And that account is the Kerberos ticket granting ticket account.
1458970	1471330	And the hash that it uses for encryption is the hash of that username and password just like Microsoft does for every single account that I talked about before.
1471330	1486110	So, using tools like Mimikatz, you are able to impersonate whoever you want to impersonate once you have that hash of the Kerberos ticket granting ticket.
1486110	1494770	So essentially, you use Mimikatz, you read the domain, which is read-only to every single account on the domain.
1494770	1498050	So as long as you are on the domain, you can read that information.
1498050	1503390	You use Mimikatz. It's a very simple command to pull that hash.
1503390	1507370	Once you have that hash, you use Mimikatz to create that golden ticket.
1507370	1511750	At that point, you are able to sign and create any ticket that you want.
1511910	1522350	So the ticket that would normally go from user station to domain controller saying, hey, I'm an admin. Here's my hash. Give me a ticket that says I can do what I want.
1522470	1524190	That's essentially gone.
1524190	1531650	As the user, you're passing that ticket that says, I'm already authenticated as an administrator. Let me do what I want to do.
1533710	1538790	So, how would this kind of all work in the grand scheme of things?
1538790	1543190	So, starting on the left as patient zero, we'll go through the black.
1543810	1550590	Patient zero is infected. You've clicked on a bad link. You've installed some malware.
1550590	1555630	You're subject to a phishing campaign, whatever the case may be.
1556090	1564520	What are the ramifications of that happening?
1564520	1569280	So, starting in black on the left, they have access to that machine.
1569420	1572160	Well, any good attacker is going to set up a C2.
1572160	1579680	So, they're going to beacon back using some type of remote console, most likely Netcat.
1579680	1587040	But essentially, the traffic is going to initiate from that host out to your command and control center.
1587540	1595460	Once they have that foothold within the machine, on the machine itself, again, it can read all of Active Directory because it's read-only by default.
1595900	1601060	They can start to install keyloggers and look what data is on that local machine.
1601520	1609060	They can also grab the credentials with the LSAT service, which is the service that stores the hashes on every machine.
1612220	1618780	So, what I was saying was, as I talked about in the beginning slides, we're going to design for compromise.
1618780	1634140	We're going to understand that the endpoint is going to be compromised at some point because of zero days, because of phishing, because of all of the multitude of vulnerabilities that are out there that could be used to take over that host.
1636480	1641700	At the very least, somebody shares their username and password, or they put it underneath their keyboard.
1641700	1644600	Whatever the case may be, there's a patient zero.
1644940	1655460	Now, that patient zero machine on your network, that person, any attacker, is going to try and set up a command and control setup.
1655460	1657720	And it's going to be a remote console.
1657720	1666640	So, the communication is going to initiate from that host out to the command and control system, out into the internet.
1666640	1675700	So, most firewalls out there are ports and protocol firewalls, and it's saying, hey, anything initiating from the internet, do not come into my network.
1675700	1692850	Anybody that's saying, hey, I'm 443, going out on 443, 9 times out of 10, that's already permitted.
1692850	1704670	And you're not going to know the difference between them going to Google HTTPS or some other server HTTPS, because there's no break-and-inspect.
1704670	1709090	We're not looking at the traffic, any encryption that happens between the host and server.
1709490	1717250	Once we have that foothold within that host, you're able to pull all of the Active Directory credentials.
1717510	1722530	Sorry, you're able to pull all of the Active Directory information, because Active Directory is read-only.
1722850	1731850	So, you can pull those GPOs, you can pull the usernames, you can understand structures, you can pull your organizational units, your OU structure,
1731850	1737970	and start to build that greater recon on that domain that you're on.
1738210	1744670	And then, of course, actually on the hosts themselves, you can put on key loggers, you can look at the data that's stored on there, and you can pull those credentials.
1744670	1758890	Now, using any type of privilege escalation path, so a vulnerability or an exploit, or that user's already logged in as an administrator, you're able to get admin rights on that box.
1759570	1770730	And so, from there, you're able to pull hashes, you're able to look at active credentials, you can change passwords on the host, you can do anything you want to do on that single host.
1770730	1780810	Now, the money's where you're able to reach out and gain access as a privileged user within the domain.
1780810	1787630	And so, everything that's within the yellow at this point is assumed local user or non-privileged user.
1787930	1798650	When you pass the hash on the host out to another server or system, again, that hash is your username and your password in a single string.
1798650	1810770	And so, the other servers can adjust that and say, yep, give me that hash, great. Pass the hash attacks are well documented out there, and you're able to get access as impersonating that user.
1811070	1818490	Now, the trick for escalation is really nuts and bolts in the separation of duties, right?
1818490	1827850	So, we don't want people logging into their daily driver machines, the machines that they check their email with, the machines that they go to the internet on as a domain admin.
1828810	1837610	Sad to say, that's still very much happening, and I understand why, good or bad, as a domain admin, you can do whatever you want.
1837610	1844250	There's nothing restricting you. You don't have to act for access. Everything's presented to you.
1844990	1855510	From there, you can use tools like Mimikatz to grab credentials, to grab the hashes, and then you can start to create your golden ticket.
1855510	1861210	And at that point, you can impersonate anybody that you want, and your persistence is pretty much guaranteed.
1862630	1869770	So, what do you do about this, right? This is built-in Microsoft capability. They're all about collaboration and integration.
1869770	1881510	So, these are the trade-offs that they've made as a solution to say, we want this to move fast, and we want things to work together quickly, over security.
1881510	1901190	So, as an individual, you can implement break-and-select to get the ability that, say, when you go to https.google.com, you're swapping certificates with that server that says,
1901190	1908970	I am google.com, here's my public key, send me data, we will encrypt this communication.
1909230	1919210	When you pass that through any of your next-generation firewalls, they can't see anything but encrypted HTTPS.
1920590	1935820	This allows for that communication from a host that uses an F5 device to essentially terminate the encryption, so your F5 device essentially impersonates Google.
1936060	1945820	You can see that HTTPS traffic and then move on to encrypting that with the end server that you're communicating with.
1945820	1948040	And that way, you can look at the payload.
1948880	1966000	Now, this is different. Break-and-inspect and TLS offload is different from your normal load balancing, where your load balancing, your host comes in and makes a connection with the F5 device, and then traffic isn't cleared back to your server.
1966000	1977740	So, it's really about what you're looking to protect. Are you protecting your data, users connecting to your stuff, or are you trying to connect your users connecting out to other servers?
1978040	1988250	It's a trade-off that you're going to have to make. There's obviously implications on speed and throughput, and devices like F5 are notoriously expensive.
1989410	1995550	The other thing that can be implemented if you are Windows 8 or above is Credential Guard.
1995550	2003830	And Credential Guard is taking that LSAS capability that stores those hashes and virtualizing it.
2003830	2010970	So, if they take over that host, they're unable to pull any hashes that have been used on that machine.
2010970	2021150	And that's very, very important because if a domain administrator has logged into that machine, that may not be the user that's currently logged in.
2021150	2023930	The hash is still stored in LSAS.
2024690	2034710	And that's very important because a lot of times domain admins or people with escalated privilege log into machines to fix a problem or to install software.
2034710	2043430	Using Credential Guard allows you to virtualize that and keep that isolated from somebody who has compromised that local machine.
2044930	2048710	And this fundamentally breaks Mimikatz.
2048710	2054430	And like I said before, Mimikatz is the bread and butter for taking over Active Directory.
2055270	2058110	You can also do AD segmentation.
2058130	2064130	So, partitioning out where that information is going to live.
2064130	2072910	Having domain controllers live within a completely separate domain, this completely separate force from where the data lives.
2072930	2081990	So that way, when a user is ultimately compromised, what they're able to access and what they're able to view and what they're able to pull is extremely limited.
2082190	2093750	Because again, designed for compromise, with all the threats that are out there and the change in the software, it's very hard, if not impossible, to keep up on everything and have everything patched.
2094130	2099370	To a level that accounts for all of the new stuff that's out there.
2100850	2115230	And so, what you effectively do is that you take your privileged accounts, your enterprise admins, your domain admins, and they live in a completely separate domain.
2115230	2121990	Meaning that isolated domain controllers, isolated servers, isolated virtual environments.
2121990	2134970	Because you can backdoor into Windows domain through, if you're using VMware, you can use VMware capability to get escalated rights within your domain control if it's virtualized and then take over the domain itself.
2134970	2145210	So, you're really trying to draw a clear line between what your users can access and what can be accessed in a nefarious manner.
2148190	2160010	And then, using Microsoft's suggested terminology, so they have their tiers where Tier 0 is your highest level, your forest domains, your enterprise domains.
2160010	2170650	And those live separate and they can communicate within, but you don't talk down, right? So, you don't log in as a forest domain into a resource within a Tier 0.
2170650	2182890	You can always escalate up, you never escalate down. And that's to keep those credentials isolated from any of those hosts that ultimately may become compromised, right?
2183330	2194270	So, again, that idea that an enterprise domain or domain controller wouldn't log into an endpoint because that's going to be the first line of attack.
2196640	2206040	And what are some of the standard stuff that ultimately lead to compromise is your access control list.
2206040	2213680	So, users out there, your group membership, your help desk persons, never going to need to take over accounts, right?
2213680	2220020	They may need to reset the password. Best practice would be to put something in between that, right?
2220020	2226640	A service account that you would have heavily monitored that whenever it's used, it needs to be tied to a help desk ticket.
2226640	2234720	Something that you can start to draw those parallels in your logging so you can understand anomalies that are happening.
2234720	2244020	This one happens a lot where you have good isolation, you have a domain admin account, you have your exchange account, you have your user account.
2244180	2251700	And there may be joe.admin, joe.exchange, joe.user, but the password's all password1.
2252140	2258620	So, that one's going to get you. And again, it's all about not salting, so it's the same hash.
2258620	2268220	So, if they have an administrator account with password1, it's going to be easily found because every other domain that has the same username and same password has the same exact hash.
2268380	2279040	Service accounts. So, service accounts are meant to be targeted quote-unquote user accounts that you would create that execute a specific purpose.
2279040	2282520	And that specific purpose needs to be locked down.
2290070	2295730	Service accounts are created for a specific capability and it's just set it, forget it.
2295730	2306770	And sometimes those passwords are shared among other service accounts, sometimes those passwords are written down, sometimes those passwords are default from the vendor.
2307030	2309330	And elevated permissions on the workstation.
2309330	2316310	So, again, that user logging into the machine with the elevated permissions, that goes to the internet, that checks their email.
2316310	2325050	If they go to a nefariously crafted link or they download a bad file, that file is being ran under that user's permission.
2325050	2335450	So, you really want to isolate that account to just what it should be doing, meaning that if it's a user, it's user rights.
2335450	2343570	They have enough rights to log into the machine, to boot up whatever applications they need to boot up and nothing more.
2343570	2353790	Anything that they need to do on top of that, say developers or whatnot, they should be elevating to another account to do that specific capability.
2354210	2362010	And then application-wide listing. So, most of the time, your secretary's machine, never going to need to run PowerShell.
2362010	2366230	You see PowerShell running on that box, it's a dead giveaway that something's wrong.
2366230	2370770	Maybe on your developers, you have a little bit of leeway because they're doing other things.
2370770	2380430	But you really need to understand who's out there, what are they doing on their machines, and only allowing the specific applications that you want them to allow.
2380430	2390310	And in that instance, if they do download an application, let's just say they think they're downloading Spotify or Zoom and it's not what it's supposed to be.
2390310	2399010	They execute that, it's not authorized to run, that binary never kicks off.
2399450	2410510	And LAN hash. So, like I spoke to earlier in the presentation, LAN manager is an old way of hashing username and passwords.
2410510	2414310	And it's very, very easy to crack. It takes really no processing time at all.
2415050	2419630	It's only in place today for legacy applications.
2419630	2425310	So, if you do have a legacy application out on your network, that thing probably has some issues as well.
2425310	2429530	So, you really should identify why you need that enabled.
2429670	2436550	If you do, identify why that thing still needs to be on the network, why that application still needs to be on the network.
2436550	2446270	And probably look at some type of deployment plan to getting that on to a newer operating system or a different capability.
2446270	2454410	Or maybe even a software as a service solution, so that way you really start to lower your risk to your network.
2454790	2459130	And enumeration is understanding what's out there.
2459750	2470770	If somebody who stood up that network put every single user in the domain admin rights group because that was the easiest thing to do, your risk is off the charts.
2470770	2478290	So, you need to look at your groups, you need to look at your users on a pretty regular basis to make sure that nothing's changing.
2478330	2496730	If you're in a position to be able to deploy new solutions or maybe even procure stuff, there's a lot of products out there that you could download open source or buy that can heavily monitor group membership and notify you of any changes.
2496730	2499750	In some instances, they can even block it based on business rules.
2500770	2503610	Volume shadow copy on domain controllers.
2504050	2507090	You know, domain controllers themselves replicate within themselves.
2507090	2514950	You don't need to do volume shadow copies of a file structure on your domain controller to another server.
2515110	2517010	You just need to disable that.
2517010	2522470	And if you do have a scenario which you need volume shadow copy, please reach out to me.
2522470	2525930	I would love to understand that problem.
2525930	2535750	What you're supposed to do with this whole file is essentially a shared member product that has your path files on it, that has some of your computer files on it.
2535890	2540930	Understand who's reading that, who's pulling the information, and who has access.
2540930	2548650	And monitor that with any type of logging capability and send you alerts as soon as something's out of the norm is done on that.
2550070	2554130	If you can block peer-to-peer communication.
2554130	2557870	End-user machine to end-user machine, you should.
2558370	2564990	I understand that there's a lot of solutions out there that would require peer-to-peer capability.
2565270	2577170	But if you can block the adversary from leapfrogging to other hosts, your peers that are generally less secure, you should do that.
2577210	2581290	And then, of course, log, whitelist, and block if you can PowerShell.
2581290	2583810	PowerShell is extremely powerful.
2584130	2585810	You can do a lot of things with that.
2586090	2590210	And again, I don't think the secretary would ever need to run a PowerShell script.
2590570	2600030	And any of your developers that might, you would look to see what access they truly need and give them an account to do that in a very specific scenario.
2601530	2605190	Alright, with that, that is my presentation. Thank you very much.