Security Leftovers
-
Living off the land, AD CS style | Pen Test Partners
Unless you have been living under a rock for the last year or so, Active Directory Certificate Services (AD CS) abuse continues to be a hot topic in offensive security, ever since the excellent research released by Will Schroeder (@harmj0y) and Lee Christensen (@tifkin_). I, like many, have enjoyed the fruits of Will and Lee’s research since its release last year.
Up until now exploitation of these AD CS misconfigurations typically requires tools like Certify directly over C2, or Oliver Lyak’s excellent certipy tool over SOCKS into the target environment.
Recently, my genius and handsome colleague Nick (guess who tech QA’d this post?) and I got into a conversation around living off the land techniques for AD CS abuse. The environment he was targeting at the time was brutal from a red teamer perspective, with a high functioning SOC and excellent detection capability. In situations such as this, living of the land is a much more effective way of remaining undetected and blending in with legitimate traffic.
[...]
There are several ways to enrol for certificates using traditional Windows features and tools. The certutil command line tool and the web enrolment endpoint that is sometimes exposed, to name a few. But we wanted to avoid the command line if possible and not rely on the web enrolment endpoint as often this is not available.
-
Security updates for Friday [LWN.net]
Security updates have been issued by Debian (zlib), Fedora (dotnet3.1, firefox, java-1.8.0-openjdk-aarch32, thunderbird, and zlib), Mageia (canna, chromium-browser-stable, dovecot, firefox/nss, freeciv, freetype2, gnutls, kernel, kernel-linus, kicad, ldb/samba/sssd, libgsasl, microcode, nodejs, rsync, thunderbird, and unbound), Oracle (php:7.4 and systemd), Scientific Linux (firefox, rsync, systemd, and thunderbird), Slackware (vim), and SUSE (bluez, gstreamer-plugins-good, java-1_7_1-ibm, java-1_8_0-ibm, kernel, libcroco, postgresql10, postgresql13, python-lxml, and webkit2gtk3).
-
Security and Cheap Complexity - Schneier on Security
I’ve been saying that complexity is the worst enemy of security for a long time now. (Here’s me in 1999.) And it’s been true for a long time.
-
The anomaly of cheap complexity
So, computers are insecure because they have so many complex layers.
-
Day in the life of a package maintainer: Reproducible Go packages
In this new blog series, I would like to introduce you to the daily adventures of an Arch Linux package maintainer.
This time, we will have a look at reproducible package builds. Reproducible package builds are very important for us, as package maintainers, because reproducible package builds create an independently-verifiable path from source to the final package. This means, every Arch Linux user can verify that noone tampered with the Arch Linux package build process. Technically spoken, this means that we can build the same package on different systems and get an exact identical package (identical as in: they share the same SHA256 checksum).