Hello and welcome to another
application of the MicroTech
framework discussion today
we're going to be looking at Basche
history.
So with that, let's go ahead and
look at our objectives for this
discussion.
So today we're going to be
describing what Basche history is
within the context of credential
gathering or for a threat
actor to be able to take credentials
from history.
What are some mitigation techniques
and what are some detection
techniques? So let's go ahead and
do a quick look at their history.
So it's a pretty simple thing
that keeps track of the commands
users type using
the command line with the history
utility.
And so when a user logs
out.
It is flushed, the history is
into Basche underscore
history file, and so
the file resides at the same
location and it is
Basche history here.
So it's a hidden file.
And so typically this is limited
to about five hundred commands
and anything beyond that just rolls
off the history file.
Now, the reason why this
is so important to kind
of keep track of and understand,
you know, you may not have thought
that this existed for some reason or
you just may not be aware.
So when users enter credentials
via the Basche
terminal or the terminal in general,
it has the ability to get
flushed or will get flushed into
this history file.
And so it's important
to remember that if
you're not using a mechanism that
encrypts a connection or
does anything to
obscure the password,
then that password is simply going
to be dumped into the history file
in a plain text manner.
And so if a threat actor
were able to gain access to this
file, they would be able to use
its content to maybe log
on to additional systems or
to further delve into the system
that they have compromised.
Now, there are a few mitigating
techniques that we can take with
respect to bash history.
So the first thing that we can do
is sit in the
history file two plus
zero or oh, in
this case.
And what this does is,
is prevents users from doing things
to that file.
And then we can answer the highest
file and add
to a user's DOT badge or so
this is added to the user's dot dash
underscore our C file.
And so essentially
this these steps will keep
a user from flushing to
the history file.
So not flushing it out in itself,
but from flushing to the history
files. So meaning that if I do
things in the terminal and I log
out, then that information will
not get flushed into the history
file.
Now, as far as detection techniques,
really the only thing we could look
at here is maybe when a user
attempts to read
their history file.
And so what we can do is we can
alert on that
capability or the user attempting
to do so.
And from that point, we can then
investigate that and see if there
was legitimate activity tied to
trying to read the history file.
Now, with that said, let's do a
quick check on learning.
True or false, the users bassist
remains in the terminal even after
the users logs off
the system
so the users bash history remains
in the terminal even after the users
logs off of the system.
So in this case, this is false.
Any time a user logs off
of a system, the best history
is lost or the best information
is flushed into the history file.
So it does not
remain in the terminal.
It gets flushed to the history file.
All right, so in summary,
we describe best history today
and why that's important with
respect to gathering credentials.
We describe some mitigation
techniques and we looked at
detection techniques.
So with that, I want to thank you
for your time today, and I look
forward to seeing you again soon.