Hello and welcome to
another application of the minor
attack framework discussion
today we're going to be looking at
SUNO.
So at that, let's go ahead and
jump right in to the objectives.
So today's objectives are
as follows. We're going to describe
what Souto is.
How can Pseudo be used?
What are some mitigation techniques
and what are some detection
techniques?
So pseudo,
as laid out in the moderated
framework, makes use of
members of the Pseudolus file
and the ETECSA dealers
directory or folder.
The command allows users
to temporarily escalate their
privilege when it is necessary
for administrative purposes.
And so I should say that there's a
file where these members are laid
out. So not so much a directory, but
a particular
file where the members are listed.
And so the file can be manipulated
to not prompt users for a
password by modifying the
seducers file in a manner such as
the given command here or
give in line that would be modified.
So user one all and
no password all.
And so in this case, it
would not prompt a user for
credentials when the pseudo
command is used.
So, however, it would be somewhat
counterintuitive as the function
could potentially slow a threat
actor down or alert the user
on malicious activity.
And so by default,
when I'm playing around in my
distribution's and I try
to enter pseudo and I accidentally
enter the wrong password,
it logs that particular
error or that failure as
an incident and it logs it
in a file that
you could essentially go back and
look to see when a user attempted to
use the privilege and
when they failed to do so.
So that can be beneficial.
Now, how can Pseudo
be used from the threat actor
standpoint? Well, as we know, it's
kind of like running as
administrator threat or
can compromise the standard user
who's a member of the Souters group.
And in some cases, there may not be
a need to enter credentials.
And then the third actor can operate
with escalated privilege.
And so I know that I've seen before
in some peer testing labs and things
like that where
you get into a standard user
account and then you do
pseudo or something of that nature
that pulls from the seducers group.
And that user is a member of the
group. And suddenly you've got
escalated privileges and you can
kind of do whatever you want at that
point.
There's also a CV that I like to
mention, CV twenty nineteen
pseudo before one point eight
point two eight.
So in this case, the threat actor
or standard user can
craft a user ID
that allows them to pass
to bypass the route
configuration.
And so in those
cases where you've
got the older versions here,
you would just want to make sure
that everything is up to date and
that you're not using anything that
is inherently vulnerable.
So let's go ahead and talk about
some mitigation techniques.
So do not allow pseudo to be
executed without providing a
password.
Kind of a given you'd figure.
Yeah, that makes sense.
Why would I do something
counterintuitive to this?
But people do things all
the time that can be a little bit
counterintuitive when it comes to
computers or end users,
or if you've constantly got
somebody nagging you about something
and you just want to make them stop.
Sometimes we do things that would
not be in the best interests
of our security standing.
The seducers file should be
controlled and users should not be
allowed to spy on risky processes.
So kind of
two separate things there.
But really, you know, you shouldn't
allow manipulation of the settlers
file and you should not manipulate
the file lightly.
That should be very controlled
and protected to ensure that
users can't just come in and do
what they want to to it, which could
result in a threat actor having
some form of unauthorized
access to the system.
Now, as far as detection techniques
are concerned, Linux provides an
alert any time a user's actual
ID and effective ID are different.
So that could be kind of like an
indicator of something suspicious is
going on here.
Sudo incidents or pseudo incidents
should be reviewed regularly
to detect potential potential
manipulation or
privilege escalation attempts.
So in those cases,
looking at that file, as we
discussed, could be beneficial in
detecting a threat actor
now, true or false,
the pseudo command is specific
to Linux based systems and does
not work on
Windows based systems.
All right, well, if you need any
additional time, please go ahead and
pass this video and then
pick it back up from there.
So in this case, the Central
Command is specific to Linux
and Mac and things of that nature,
but it does not work on
Windows based system.
So this command for
this particular statement is
true.
So with that, let's go ahead and
jump over to our summary.
So in summary, we described
what Sudo is.
Again, this is a way for you
to take a standard user and
elevate their privileges to
an administrative level.
We've described how this could be
used. And so looking at
either a getting in where a user
doesn't have
their credentials set up or
they don't need to put a password
in, there are also some
vulnerabilities that can take
advantage of deprecated
versions where.
Essentially, the
control can be bypassed,
describes some mitigation techniques
as far as looking at
making sure that you have to enter a
password and of course, not adding
miscellaneous users to the seducers
file and then
some detection techniques.
As we said, incidents are logged
within that pseudo file, that log
file.
And so in those cases, you can
review that information and
that should cue you into potential
manipulation.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.