Hello and welcome to
another application of the minor
attack framework discussion
today we're going to be looking at
accessibility features, so
let's jump right into our
objectives.
So today's objectives are pretty
straightforward. We're going to look
at what accessibility features
are discussed, some common attack
methods.
We're going to discuss the key keys.
And so we're going to look at a
specific example where
accessibility features are used to
maintain persistence in the
environment.
We're going to discuss the
mitigation techniques and we're
going to discuss some detection
techniques as well.
So with that, let's jump in and look
at what accessibility
features means.
So in Minor Windows
contains features that can be
launched with key combinations
before a user logs into a system.
So threat actors have the capability
to modify the way these
accessibility features launch
to get a command prompt her back
door without having to log into a
system.
And so what
we're looking at in our next
example, as far as the
Sticky Keys feature, is
where a threat actor, when you press
shift five times instead of getting
the sticky key function.
You get a command prompt,
and so this can be used
to replace that executable and
then provide you with a command
prompt that has system level access.
Now, before we jump into that
example, let's look at some common
attack methods with
this particular vector.
So using sticky keys,
again, you can obtain unauthorized,
unauthenticated, privileged console
access. So that's pretty big.
But there's a few things that have
to be done ahead of time.
Remember, I said that the
executable for sticky keys
has to be replaced with the
command XY executable.
So it's not something that they can
just do right out the gate.
A change has to be made.
Threat actors have replaced binaries
associated with the
CI to establish persistance
sticky keys replacement
within our sessions to obtain
persistance again.
This can also be used to
bypass the login screen on
remote systems.
WMI debugging has been used
to remotely replace binaries like
the same one mentioned above you
Tillmann and Magnify
XY, which are all utilities
within the
accessibility features with
the command XY
executable.
So again, part of this
is going to be understanding how
these could impact is persistence
and how if they're not scanned or
looked at regularly, Ethernet actor
could possibly go unnoticed.
So let's take a quick look at the
sticky keys on our
example here.
So it's beneficial
that we break this down.
These are essentially the steps at a
high level and we're not going
to get into nitty gritty detail on
the actual manipulation of the
registry keys to make this change.
But at a glance through, an actor
would have to replace the
sticky keys executable
despond, the command that instead
of running this. And so essentially
this is being replaced
with command that.
So this means even if the account is
removed, as far as how
this an actor initially gain access,
remember earlier in our first
discussion we said that
a threat actor may need to
do multiple things once they gain
access to a system to maintain
persistence. And so they may not
just install a back door because
that could get caught.
They may not just change the service
because that could be found out as
well. So they may do a multitude
of things to attempt to keep access
to a system.
And that includes ways that they can
get back into the system, even if
the account they initially
compromise is removed.
And so this is the same here.
So even if the account is removed,
the system allows you to spawn a
command prompt a system which
is a high level of privilege
for that particular command
prompt. And so then the threat actor
opens an already session to the
server and uses an
invalid user account to stay on that
screen. So they keep that open
through just an invalid user not
logging in.
And then the threat actor would
essentially hit shift five times.
And this would spawn a system level
command prompt because these
utilities are accessible
prior to logging into a system.
And so because that utility
has been manipulated to spawn a
command prompt instead of the sticky
key features, it would
give the command prompt instead
after hitting those keys five times.
And so that's something that we want
to be aware of within the
accessibility features.
And this has been recently patched
and updated and addressed.
And as usual, if you're running
directly to the Internet and logging
into it directly, there's probably
VPN or gateways that you'd want to
implement to further
mitigate the ability of the actors
to do these things.
So with that, let's go ahead and
talk about some mitigation
techniques.
So use of some form of execution
prevention like antivirus, white
listing tools, et cetera, having
those things in place that block
known malicious entities, known
malicious attacks is going
to be a given limited access to
resources over the network.
And if remote connections are
allowed, access to internal
networks should be even more
limited. So again, we had talked
about VPN access
early on in our discussions
and that if a user logs in over
a VPN connection, their
access to the network and to
resources should be limited to
just what is necessary to function
and do their job.
They shouldn't be able to see the
entire network from a logical
standpoint. They shouldn't be able
to access other systems.
They shouldn't be able to ping other
systems.
And again, there are things such as
vilan hopping and things that are
thrown at or could do to try and
break out of this.
But again,
the goal is to slow them down to
prevent the rapid spread of
infection and changes to systems
and give a blue team members
or security operation members
time to get notifications
on those activities and potentially
stop that threat before it
becomes more widespread.
And then another thing that can be
done is the utilization of network
level authentication prior to
giving a user the session
to log into the network.
So, again, this is important with
as the user must provide legitimate
credentials prior to
being given access
to a session to log into.
So they'll get the prompt
have to provide credentials before
they ever get to that initial login
screen. And so this could help to
mitigate some of those sticky key
capabilities that
they would be able to take advantage
of if they were just directly given
the login at the session.
So this is just a few
examples here.
You could implement things like
gateways, you can implement a VPN
along with Gateways.
I mean, there's just a number of
ways that you could work to make
it that much harder for threat
actors to take advantage of things
like sticky keys or some
of these accessibility features.
Now, when
we get into detection techniques,
we don't have a huge list here,
but essentially, again, focusing
on accessibility features,
any changes made
to accessibility, utility
binaries should be reviewed
in users.
And administrators really shouldn't
be making changes to these areas.
And there's nothing really that I
could think of that would be normal
business process unless you're
writing applications to enhance
these features. But most of us
aren't doing that type of work.
And so if we are doing some form
of network monitoring when
these activities take place,
we definitely want to take the time
to review them and then changes
to the paths of these utilities
should be reviewed as well.
So, again, rarely should we
be manipulating file paths for these
accessibility features as well
as system tools and built in tools
and things of that nature.
And again, we have
business software that
is designed to manipulate these
areas for specific purposes.
But if we don't have any reasons to
be doing so, then we should
be evaluating that.
Is those issues come up or those
things come up.
So with that in mind, let's go ahead
and look at a quick check on
learning.
True or false, sticky
keys is activated by pressing
the shift key five times.
All right, well, if you need some
additional time to review the
question, please pause the video and
do so. So Sticky Keys
again is an accessibility feature.
And as we indicated in the
review area, you have to press
the shift key five times
in order to activate the key keys.
And so in this case, that would be
a true statement.
So with that, let's
go ahead and jump over to our
summary.
All right, so today's summary, we
discussed accessibility features
again, these are things like the
sexy sticky keys,
any of those utilities that a threat
actor could manipulate
and use to pose as a legitimate
function to provide them system
level access or to
allow them to bypass other controls
or authentication measures?
We discussed some common attack
methods.
We looked at sticky keys on
again, having to change
registry keys and information
prior to this being a viable attack
method or persistance
mechanism has to be done.
So there has to be some other form
of compromise prior to
getting to this point.
But if you've got already open to
the world, I suggest you review your
systems and add additional controls
to protect those systems.
We discussed some mitigation
techniques, such as monitoring for
binary I'm sorry, blockin
changes to Moneris and blocking
software is using things like
antivirus and other controls and
then detection techniques where we
monitor binary changes and
changes to the accessibility
utilities.
So with that in mind, I want to
thank you for your time today
and I look forward to seeing you
again soon.