Do you need to do an internal pen test when the CDE is in the Cloud?

Client: 
We have a Cloud based, virtual data center that we access and manage using a 2-factor, on-demand VPN to a remote jump-box from anywhere in the world. As a result, our corporate network and admin machines are considered out-of-scope for PCI. Do we still need to do an internal penetration test?


Answer: 
Our experience is that these tests are limited and quick, however they must be done.  While it’s true that in this case the in-scope systems could just as easily be administered from a Starbucks, the administrator’s workstation in a Starbucks cannot easily be compromised by exploiting other systems in the coffee shop, whereas in the corporate network the administrator's system is often joined to a domain and can be affected by other systems in the domain. The environment where users routinely access in scope systems will present an attacker with a unique opportunity to steal those credentials or manipulate that traffic.  Such an opportunity would not be afforded to an attacker in a Starbucks. The interrelationship of systems inside the corporate network creates a unique set a threat vectors that must be tested.


So for PCI Pen Testing, a corporate network is defined as having a common network connect AND localized common resources such as file shares and authentication mechanisms.

SharePoint Resource Monitoring

Testing a SharePoint application? Worried that your tests could knock the server over? (Want to knock the server over? This applies to you too.)

One of the new features of SharePoint 2010+ is resource throttling when the system is a bit busy handling requests. This can be tuned on at Web Application level in Central Admin. That throttling uses the health score value. If the value becomes 10 or above it will go into throttling mode. At that point it will give GET requests a lower priority than other types like POST. So people can finish the form they are filling in, but new request will be denied.

Enter the X-SharePointHealthScore HTTP Header.

It's a header that returns the systems health based on 3 performance counters:

Memory - Available MBytes

ASP.NET - Requests Queued

ASP.NET - Request Wait Time

Monitoring the headers of the SharePoint application can tell you if you're hammering the server too much or if it needs that little push more to go dark. http://yuriburger.net/2012/04/03/get-sharepoint-health-score-using-powershell/

Discuss:

Just seem like a really bad idea for an Internet facing app. 

Random Example:

HTTP/1.1 401 Unauthorized

Content-Length: 16

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

SPRequestGuid: 6dcb9a95-61a8-4817-bfd8-65ad55b5d1fa

X-SharePointHealthScore: 4

WWW-Authenticate: Negotiate

WWW-Authenticate: NTLM

X-Powered-By: ASP.NET

MicrosoftSharePointTeamServices: 14.0.0.6120

X-MS-InvokeApp: 1; RequireReadOnly

Date: Sun, 19 Jan 2014 18:40:11 GMT

Example of SharePoint application used by the PCI Council:

curl -k https://committees.pcisecuritystandards.org -I

HTTP/1.1 403 FORBIDDEN

Content-Length: 13

Content-Type: text/html; charset=utf-8

Server: Microsoft-IIS/7.5

SPRequestGuid: 1569c27d-f2cd-4c58-a299-07116dff3154

X-SharePointHealthScore: 0

X-Forms_Based_Auth_Required: https://committees.pcisecuritystandards.org/_layouts/CustomLogin.Application/Pages/Login.aspx?ReturnUrl=/_layouts/Error.aspx

X-Forms_Based_Auth_Return_Url: https://committees.pcisecuritystandards.org/_layouts/Error.aspx

X-MSDAVEXT_Error: 917656; Access denied. Before opening files in this location, you must first browse to the web site and select the option to login automatically.

X-Powered-By: ASP.NET

MicrosoftSharePointTeamServices: 14.0.0.6029

Shodan search:

http://www.shodanhq.com/search?q=X-SharePointHealthScore%3A+

Further details:

http://msdn.microsoft.com/en-us/library/jj162162(v=office.12).aspx

Secure the Headers:

http://www.marc-lognoul.me/itblog-en/sharepoint-removing-http-headers-for-security-reasons/

http://sharepoint.stackexchange.com/questions/87927/what-is-the-correct-way-to-block-all-http-headers-asp-net-and-sharepoint-from

http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html

Update to the NMAP Pass the Hash script

I've had a lot of questions about this, so let's see if this helps. When I score a password or a hash, I use an nmap script to quickly determine if this gives me local admin rights to the workstations and servers:

nmap --script=smb-enum-shares.nse --script-args=smbuser=[ADMIN],smbpass=[PASSWORD],smbdomain=[DOMAIN],smbbasic=1,smbtype=v1  -p445 --open -vv -Pn [IP RANGE TO TEST] -oA [FILENAME].txt 

smbuser=[ADMIN] = Shared administrator account name

smbpass=[PASSWORD] = The shared account password

Alternatively you can Pass-the-Hash using:

smbhash=LMLMLMLMLMLMLMLMLM:NTLMNTLMNTLMNTLMNTLM

smbdomain=[DOMAIN] = WORKGROUP or AD

[FILENAME] = The filename for the results output

[IP RANGE TO TEST] = The IP ranges in CIDR notation. 

Alternatively, you could make a list of all IPs and IP ranges and pass them to the scan using:

 "–iL [INPUT LIST TO SCAN].txt" 

smbbasic=1

Forces the authentication to use basic security, as opposed to "extended security". 

--          Against most modern systems, extended security should work, but there may be cases

--          where you want to force basic. There's a chance that you'll get better results for 

--          enumerating users if you turn on basic authentication.

smbtype=v1

The type of SMB authentication to use. These are the possible options:

-- * <code>v1</code>:     Sends LMv1 and NTLMv1.

-- * <code>LMv1</code>:   Sends LMv1 only.

-- * <code>NTLMv1</code>: Sends NTLMv1 only (default).

-- * <code>v2</code>:     Sends LMv2 and NTLMv2.

-- * <code>LMv2</code>:   Sends LMv2 only.

-- * <code>NTLMv2</code>: Doesn't exist; the protocol doesn't support NTLMv2 alone.

If you have local administrator rights, the scan will show READ/WRITE access to the SMB shares:

Starting Nmap 5.51 ( http://nmap.org ) at 2012-12-22 15:41 PDT

Nmap scan report for 172.0.0.1

Host is up (0.00069s latency).

PORT    STATE SERVICE

445/tcp open  microsoft-ds

Host script results:

| smb-enum-shares: 

|   ADMIN$

|     Type: STYPE_DISKTREE_HIDDEN

|     Comment: Remote Admin

|     Users: 0, Max: <unlimited>

|     Path: C:\Windows

|     Anonymous access: <none>

|     Current user ('admin') access: READ/WRITE

|   C$

|     Type: STYPE_DISKTREE_HIDDEN

|     Comment: Default share

|     Users: 0, Max: <unlimited>

|     Path: C:\

|     Anonymous access: <none>

|     Current user ('admin') access: READ/WRITE

|   D$

|     Type: STYPE_DISKTREE_HIDDEN

|     Comment: Default share

|     Users: 0, Max: <unlimited>

|     Path: D:\

|     Anonymous access: <none>

|     Current user ('admin') access: READ/WRITE

|   IPC$

|     Type: STYPE_IPC_HIDDEN

|     Comment: Remote IPC

|     Users: 2, Max: <unlimited>

|     Path: 

|     Anonymous access: READ <not a file share>

|     Current user ('sysadmin') access: READ <not a file share>

|   SQLBACKUP

|     Type: STYPE_DISKTREE

|     Comment: 

|     Users: 1, Max: <unlimited>

|     Path: D:\SQLBACKUP

|     Anonymous access: <none>

|_    Current user ('admin') access: READ/WRITE

Hacking Microsoft SQL Dedicated Admin Connection (DAC)

Microsoft SQL Dedicated Admin Connection (DAC)

DESCRIPTION:
Microsoft SQL Server 2005/2008/2012 provides a dedicated administrator connection (DAC). The DAC lets an administrator access a running server to execute diagnostic functions or Transact-SQL statements, or to troubleshoot problems on the server, even when the server is locked or running in an abnormal state and not responding to a SQL Server Database Engine connection. This feature requires pre-allocating dedicated resources during server startup like additional memory ~3.5 megs.  Because of this extra resource, in SQL Express scenarios the DAC feature is disabled. You can enable it by starting SQL Server service with a trace flag. By default, the DAC is only available from a client on the server. To enable client applications on remote computers to use the DAC, use the remote admin connections option of sp_configure.

SQL Server listens for the DAC on TCP port 1434 if available or a TCP port dynamically assigned upon Database Engine startup. The error log contains the port number the DAC is listening on. By default the DAC listener accepts connection on only the local port. To activate remote administration connections, see the remote admin connections Server Configuration Option below.

The following example enables the DAC from a remote computer.

sp_configure 'remote admin connections', 1;
GO
RECONFIGURE;
GO

EXAMPLE:
In this example, an administrator notices that server 172.16.x.x is not responding and wants to diagnose the problem. To do this, the user activates the sqlcmd command prompt utility and connects to server 172.16.x.x using -A to indicate the DAC.

C:\Users\Win7>sqlcmd -A -S 172.16.x.x -U sa -P Bob$yourUncl3

RISK:
DAC with remote admin connections permitted may allow an attacker to bypass access controls, logon triggers, perform brute force attacks or run unauthorized queries.

RECOMMENDATION:
Ensure DAC is configured per your Microsoft SQL Server Build and Hardening Documentation and Policies.

To determine the state of the DAC:

sp_configure 'remote admin connections'

0: Indicates only local connections are allowed by using the DAC.
1: Indicates remote connections are allowed by using the DAC.

DETERMINE IF DAC IS ENABLED AND AVAILABLE ON THE NETWORK:
Detecting DAC using NMap:

bash-3.2$ nmap 172.16.1-3.1-254 -p1434 -vv --open -Pn -n

Starting Nmap 5.51 ( http://nmap.org ) at 2012-06-28 09:56 PDT
Initiating Connect Scan at 09:56
Scanning 762 hosts [1 port/host]
Discovered open port 1434/tcp on 172.16.x.1
Discovered open port 1434/tcp on 172.16.x.2

MONITORING FOR ATTACKS AGAINST DAC:
Failed Logons will appear in the Windows Application Event Log:

Windows Event Log:

Event Type:    Failure Audit
Event Source:    MSSQLSERVER
Event Category:    (4)
Event ID:    18456
Date:        6/28/2012
Time:        10:08:18 AM
User:        N/A
Computer:    SQL01PRD
Description:
Login failed for user 'sa'. [CLIENT: 10.16.x.x]



Additional DAC related messages to monitor for:

17199

Dedicated administrator connection support was not started because it is disabled on this edition of SQL Server. If you want to use a dedicated administrator connection, restart SQL Server using the trace flag %d. This is an informational message only. No user action is required.

17200

Changing the remote access settings for the Dedicated Admin Connection failed with error 0x%lx, status code 0x%lx.

17202

Dedicated admin connection support was established for listening remotely on port %d.

17810

Could not connect because the maximum number of '%ld' dedicated administrator connections already exists. Before a new connection can be made, the existing dedicated administrator connection must be dropped, either by logging off or ending the process.%.*ls

SQL Server Management Studio Tips

How do I indicate a different port number when connecting to the server using SQL management Studio?

127.0.0.1,6283 add a comma between the ip and port

How do I Connect To A Database Using Windows Authentication With Different Credentials Using SQL Server Management Studio?

runas /netonly /user:domain\name "C:\Program Files\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\Ssms.exe"

Hotel Front Desk Systems Targeted with Malware

Recent reports highlight the growing threat of malware specialization. Rather than taking a shotgun approach, malware designers are targeting specific situations for greatest impact. Web Browser security developer Trusteer found an advertisement on a black market forum for a custom malware designed to infect hotel front desk computers and steal customer credit cards.

Hello all, I’m offering Hotel RATs. In other words: A virtual skimmer.

Benefits of a Hotel (Remote Access Trojan Connection) is an infected front desk computers on which the hotel has its software that reads the number on the cc and spits out the information on the screen and it’s keyloggable if you keylog every stroke. 

I’m offering this method for $280, guaranteed US/Canada/UK connections and a method on how to obtain them on your own. From showing you how to setup your RAT (which includes a free crypt – fully undetectable to all Antiviruses) along with selling you the tutorial on how to Social Engineer/Manipulate the front desk manager on the phone via VoIP. 

I can prove my legitimacy and the accuracy of this method. PM me if you are interested.

http://www.trusteer.com/blog/no-reservations-%E2%80%93-remote-access-trojan-pilfers-credit-cards-hotels

My view:

Much has been made of the author's claim to be able to bypass all Anti-viruses, as if this was a new and alarming chapter in the ongoing cyberwar. Truth is,  bypassing AV isn't new or particularly difficult. PSC regularly makes use of the ability to bypass all modern AV engines in the course of our pen tests. Anti-virus and malware detection should be considered only one part of a multi-layered approach to system hardening and protection.

Ideally, Point of Sale (POS) systems should be dedicated, with no additional functionality. It's critical to reduce the attack surface and adding web browsing, email, and other software only increases the number of vectors and risk to customer data. If it's critical for the systems to have multiple uses, consider using the following controls to limit your exposure:

Application Whitelisting, such as with Bit9's Parity (http://www.bit9.com/products/index.php), will limit what software can execute on the POS systems. If web browsing is critical, the Browser Sandboxing/Virtualization from Vendors such as invincea (http://www.invincea.com/the-comprehensive-solution/) or Trusteer (http://www.trusteer.com/product/trusteer-rapport) can prevent malware from executing at the operating system level. Finally, Full Disk Encryption is a necessary to prevent local users from disabling the other controls put in place. McAfee Endpoint Protection (http://www.mcafee.com/us/products/data-protection/endpoint-encryption.aspx) for the Enterprise or TrueCrypt (http://www.truecrypt.org/docs/?s=system-encryption) for smaller environments are possible solutions.

The final, and perhaps the most critical security control, is User Education. The malware author makes a point to sell a tutorial on social engineering, because without it his software is useless. Malware takes advantage of a user's inattention and lack of education. Properly train your end-users to be suspicious and require verification from whom they're receiving emails and files.

Apple OSX is finally encroaching on well established Windows territory: Viruses

Hot on the heels of Flashback, reports are circulating of another Mac-specific trojan. The new Trojan, called ‘Backdoor.OSX.SabPub.a’ uses a similar Java exploit as Flashback to infect the Mac computers via Microsoft Office docs. This new threat is a custom OS X backdoor, that once activated, connects to a remote website in command and control fashion to fetch instructions. The backdoor contains functionality to make screenshots of the user’s current session, download files and execute commands on the infected machine.

http://www.securelist.com/en/blog/208193470/New_Version_of_OSX_SabPub_Confirmed_Mac_APT_attacks

IMHO

Mac users have enjoyed a prolonged period of relative safety, but as the Cupertino operating system gains traction in the workplace, hackers begin to see it as a viable alternative to hacking Windows. However, the last few established attacks have taken advantage of ancillary software, such as Java, Adobe Reader and Microsoft Office, not the base OS. This means that in addition to operating system patches, all other applications should be included in your regular patching cycle. Products like Secunia's Corporate Software Inspector (http://secunia.com/vulnerability_scanning/) and VMWare's System Center Configuration Manager (http://shavlik.com/start-now.aspx) support, Windows, Linux and OSX and provide patch management for all installed software.

Adding anti-virus to a Mac has been historically an unneeded processor overhead but is now a necessity. Standalone products like Avast! (http://www.avast.com/free-antivirus-mac) and ClamxAV (http://www.clamxav.com/) are good solutions for small offices and home users, but lack the tracking and reporting capabilities necessary for the Enterprise. McAfee Virus Scan for Mac (http://www.mcafee.com/us/products/virusscan-for-mac.asp) integrates into their System Center Configuration Manager McAfee ePolicy Orchestrator (ePO) platform for full accountability and risk management. The Symantec AntiVirus for Macintosh Corporate Edition has similar capabilities.

In summary, Apple OSX has grabbed a greater share of both the corporate and hacking worlds and must now be fully integrated into your Patch Management policies and procedures.