Hello and welcome to another
application of the moderate tech
framework discussion today
we're going to be looking at hidden
users.
So the objectives are pretty
straightforward.
We're going to describe what hidden
users are, especially within
the Mac OS and essentially
how you can create one, what
are some mitigation techniques and
then some detection techniques.
So let's go ahead and jump right in.
So in meter,
it discusses Mac OS and a user
ID essentially is associated with
every account.
So when a user's made, you can
specify the user ID for the account.
So in preferences
there's a directory
where there's a property value and
then calm down.
Apple not long in window.
It's cold, hard.
Five hundred users and this
keeps user IDs.
Five hundred and lower hidden.
So you can create an account using
this technique and put it under
five hundred.
The user ID
with that property enabled it will
hide the user account.
And so the command syntax looks like
this. So you would do pseudo
dcl, not
dash create users and then the
user name and provide a unique
ID that is under
five hundred.
So in this case that's my five
under five hundred and it will hide
the account.
Now there are some mitigation
techniques that we can apply here.
So if this system is domain join,
then you can use group policy to
restrict the ability to create or
hide users.
You can also prevent modification
of the hide five hundred users
value.
Now, let's say that you don't do
those things, though, but you want
to know if a hidden user is
on a system.
Well, if the user account logs in,
even though it may be hidden, it
still creates a home directory
and will appear in authentication
logs. And so even though the user
account is on the surface
not visible, they wouldn't be
visible to a standard in user if
they were trying to.
You know, if they weren't looking
for it, then they probably won't see
it at all.
But if they did see it, they may not
put two and two together.
So essentially, you can look in
these locations to see if there may
be hidden users in your network.
Now, a quick check on morning.
True or false, hidden users cannot
be detected on a system.
All right, well, if you need some
additional time, please pause the
video. Now, this is
a false statement, as we just said
again, and users can
be detected on a system they're just
not seen from
the long end screen or from a point
where an end user might be able to
see but their home directories and
things of that nature are still
created.
So in summary of this particular
piece, we described
hidden users. There are essentially
users that are not visible
when you're logging in or getting on
a system, but you can have other
areas, such as home directories
where they can be seen, mitigation
techniques that included limiting
the availability of users to create
accounts or hidden accounts, and
the ability to manipulate the hard
five hundred users value.
And then we reviewed some detection
techniques, such as looking for the
home directory and authentication
logs associated with user accounts
that maybe aren't readily visible.
So with that in mind, I want to
thank you for your time today,
and I look forward to seeing you
again soon.