Hello and welcome to another
application of the minor attack
framework discussion
today we're going to be looking at
exploitation for privilege,
escalation.
So let's go ahead and jump over to
our objectives.
So today we're going to
describe for you what exploitation
for privilege escalation is
within the minor attack
framework.
We're also going to look at how
has exploitation for privilege
escalation been used as far as the
CBD or something of that nature?
We're going to look at some
mitigation techniques and then we're
going to look at some detection
techniques as well.
So with that, let's go ahead and
jump right in to our definition.
So exploitation for privilege,
escalation.
When a threat actor takes advantage
of a software vulnerability
through things such as programing
errors, service, er
operating system error.
And Colonel, er now there are
probably other examples not
mentioned here, but these are some
primary ones that were brought up.
And so the reason for these types of
exploits is to allow
the threat actor to conduct a
technique of course known as
privileged escalation.
And in this case we are escalating
privilege and circumventing controls
or restrictions put on us through
operations such as
liste privilege.
So in practice, this is when a
threat actor can essentially take an
unprivileged or user level account
and work to gain system or
level permissions.
And so.
We as standard users
don't look to try to
elevate our positions outside of
the scope of what we should, because
in most cases that would be against
company policy and it would be abuse
of our position, trust
and those systems.
But a threat actor isn't bound to
those same things.
And so when a threat actor gets onto
a system, they're looking
to gain access to as much
information as possible
in as little time as possible.
So they will take advantage of any
method they can in order
to get what they want or
achieve their own goals.
And so some examples of
privilege, escalation
vulnerabilities in
this case, we've got CV
20, 15, 17 one.
And so this particular CV
is an elevation of privilege,
vulnerability that exists in the
wind 30 to colonel mode.
And it and this is when this
particular area does
not properly handle objects
in memory.
And so it is a local
privilege, escalation,
vulnerability. So threat actors
would need to access the system
prior to being able to exploit the
vulnerability. And so this is just
an example of some systems that are
impacted by this particular
vulnerability. Now, it's been around
since twenty fifteen, which is
what this part of the CV tells us.
And then in most cases these numbers
are arbitrary.
But we at least know
that this has been around since
twenty fifteen. And so we should
have patched or updated
our systems so that we're no longer
impacted by this
local privilege, escalation,
vulnerability. Now the other side to
this again, is that word
locals. So a threat actor
would have to circumvent
layers of controls, hopefully,
in order to get to the system.
Now, we have talked about
time and time again that
users are
the weakest link.
We have a tendency to trust.
We have a tendency to want to
click on things.
We can be curious.
And so if the user population in
this case is not properly trained
and they execute a link or execute
a payload with their current user
level privilege that allows
a threat actor access to the system,
then they would circumvent all other
controls. Now, hopefully we have
antivirus and things of that nature
in place.
It could catch known bad variants,
but if they're using a link
or some type of command line
type script or something of that
nature that runs or executes,
when the user interacts with the
payload, that may circumvent
those controls as well.
But what are some mitigating
techniques that we can use in this
case that are specific to
privilege, escalation, exploitation
so we can implement application
isolation and sandboxing and
essentially virtualization and
application segmentation may
further mitigate this as well.
So when a user goes to execute
something or
do something with a particular
application, maybe that is
vulnerable or is not, it
can be isolated and in
a position where even if a threat
actor were able to take advantage
of it or do something to that
nature, it would mitigate
the risk and reduce the impact of
that particular vulnerability
on that system.
We could also update software and
apply patches, which is kind of an
age old remedy regularly,
especially to those that are known
to be vulnerable. So this
vulnerability has been out since
twenty fifteen or been
the community's been aware of it
since twenty fifteen.
So it makes sense
that at this point we should be
patched. And now with Windows seven
becoming dust
in the wind and Microsoft
won't be applying security patches
and things of that nature to it any
longer, it makes sense
that when we
get rid of those systems that we're
now running current operating
systems and these should be taken
care of. But
they with newer operating
systems comes new vulnerabilities
and things we don't know yet.
So doing some of this isolation,
reducing privileges for end users,
training end users, updating
systems as vendor
notices and releases become
available makes sense
in helping to mitigate some of the
risk associated with privilege
escalation.
Now, what are some potential
detection techniques?
Well, we can evaluate systems that
are performing in a manner that
indicates potential tampering with
components.
So if your system crashes regularly,
if there are other stability issues,
maybe we need to take a deeper
dove and look for modifications
or changes. It could be related to
privilege, escalation or the
exploitation of the system.
In addition, we can implement
monitoring that looks for a normal
user behavior or behavior in
general, an abnormal
process behavior by
alerting on those things
individually.
May not be an indicator of
compromise, but if we can tie
that behavior together and kind
of weave a bigger picture,
we may be able to detect
a malicious threat act or something
of that nature that we can then
get off that system.
Now, let's do a quick check on
learning. True or false?
False. While exploitation
for privilege, escalation is when a
threat actor takes advantage of a
vulnerability in a system that
can be exploited to potentially
provide system level access.
All right, well, if you need some
additional time, please pause this
video.
So exploitation for privilege
escalation is in fact a threat.
Actor takes advantage of a
vulnerability in a system that
can be exploited to potentially
provide system level access.
And so this is a
true statement within the context of
this discussion.
So in summary,
today, we described exploitation
for privileged escalation.
And essentially this is when
vulnerable software services are
taken advantage of
and provide the user with escalated
privilege.
We looked at the particular TV
associated with
an issue in how calls are handled
in the wind 30 to
piece.
And we noted
that an update has been provided
to the systems impacted and should
have been applied at this point in
time.
We looked at mitigation techniques
and we discussed detection
techniques as well.
Again, it's all
about defense in depth at this
point. So privilege escalation
in most cases requires some form
of local access.
There may be some remote
manipulation that can be done prior
to a user actually
being on the system
that would escalate their privilege.
But in a few
of the vulnerabilities that I've
looked at associated with privilege,
escalation, the majority
of them include a need to
have local access
and do some form of further
manipulation. And so
you would probably be looking at a
pretty sophisticated individual, or
at least someone who's targeting
specific systems that
are known for these types of
vulnerabilities.
To take that in mind,
as you continue through
researching your systems and looking
for ways to mitigate risk,
definitely keeping them up to date
is probably one of the easier ways
to help mitigate some of the
privileged escalation
vulnerabilities that are out there.
So with that in mind, I want
to thank you for your time today,
and I look forward to seeing you
again soon.