Hello and welcome to
another application of the minor
attack framework discussion
today we're going to talk about
browser bookmark discovery.
So let's go ahead and jump right in.
So today's objectives for this
particular discussion are to
describe browser bookmark discovery
and what that looks like at a high
level, we're going to look at some
mitigation techniques, we'll talk
detection techniques.
And in between here, I'll give you a
quick example of
what an export looks like for
bookmarks.
Now, browser bookmark discovery
with respect to the MicroTech
framework is when a threat actor
uses bookmarks to reveal personal
information about a target.
It could also be possible that there
are internal details about
the organization and its
infrastructure.
So consider this.
If you're anything like me, I don't
remember. Unfortunately,
all of the IP addresses that
correlate to things like these
sphere servers or network
infrastructure or internal
pages that may just be IP based.
So I tend to use
bookmarks to help me on my my
company device,
use those bookmarks to help me to
keep track of the things that I know
I need to get into the things that I
know that I work with on a regular
basis because I can't remember
all of the URLs and
the subspace spaces that I need to
get into and everything that I need
to put into it to get to the page
that I'm looking for.
And so in order to be
expedient and to get to things
quickly, I just use bookmarks
in chrome.
Well, that's fine.
But the thing about that is, is that
when threat actors get on the system
or potentially get on a system,
they may look for those types of
things. And so they can say, oh,
look, there's an IP address that
this person is going to quite often
there's a Web page that they're
going to quite often look.
There's something product specific
that they're always using and
looking at. So they must use Cisco
or Dell or they must use one
of these types of things.
And so, again, it
gives a threat actor the potential
ability to kind of know
what's going on in your
infrastructure, what you're using
day to day.
And if you autofill credentials,
which we do not
allow in our organization, you
shouldn't be doing that.
If you log on to log into
a page upon clicking a bookmark
or something of that nature that
makes it through an actor's job that
much easier.
And that can be really, really bad
if you want to log into, like your
hypervisor management portal or
something of that nature.
And now they can see all of your
virtual infrastructure, they can
log in to anything that could
be a very cumbersome day and
very troublesome thing to have to
clean up.
So just a quick example.
This is from my personal system.
So there's nothing work related,
say, here.
But you'll notice
this is just a snippet.
So I went into Chrome and actually
just did an export of the bookmarks
and it kind of late everything out
for me in this nice, neat sheet.
And so everything that I have here,
you can see is pretty much related
to when I was going through some OCP
prep and working
on that. But you've got your cheat
sheets and everything.
So this person might be able to get
this information to know, hey, this
person may have access
to systems that have
tools on them use for exploitation.
This person may have,
you know, elevated privilege.
Maybe they've got a separate account
somewhere. Maybe they've got access
to sites or tools or things of that
nature. That could be to my benefit.
So there are some things here
that as an actor may be able to look
through and go, oh, this seems to be
a likely target.
Or they may go, oh, this doesn't
seem to be very beneficial.
But then they can attempt to do
other things on the system as well,
or use the system as
a point for them to then move
either further into the network or
do additional research.
So let's talk about mitigation
techniques here. Really,
we're looking at end user awareness
training and making sure
that we're informing
users on the appropriate way
to save information on the
things that they shouldn't be doing,
like autofill in passwords
on separation of work
and personal accounts, making sure
that we don't go to banking sites
and things of that nature run on the
company's systems just because,
one, it's not really
healthy for you as
an end user to utilize
company equipment to go to banking
sites. In most cases, organizations
indicate and company policies that
you have no privacy on the
systems that you know you
shouldn't use systems for personal
use.
There is some give and take there,
they say healthy use as far as not
interfering with work and things of
that nature is good and OK.
But still, you never
want to
put your personal information
and your personal accounts
on a corporate asset.
It's just not good practice because
that asset could be picked
up one day, wiped and reloaded, and
you lose things or,
you know, you never know who else in
the organization could get access
to that system and see information
that should otherwise be kept
confidential.
So be mindful
of that and ensure that users
are well trained on the expectations
of the organization for handling
that kind of data.
So some detection techniques.
Again, looking kind of like the
previous ones here.
We're monitoring for commands that
provide arguments that could be used
to gather browser, bookmark
information.
So most of what we're going to be
looking at in the next
discussion sets where we get into
talking about remote
access of other applications,
lateral movement, discovery, things
of that nature and all kind of
compounds here. We get from
blocking applications per say
and looking for hashes and looking
for payloads to
looking for activity patterns that
are indicative of a person
that is trying to gather information
or trying to move through systems.
And so we're getting more and more
into a need to have individuals
who are able to evaluate system
activity and tell us where we may
have threat actor present.
So let's go ahead and do a quick
check on learning true
or false bookmarks or typically
what an end user puts in between
printed pages to save their place.
All right, well, if you need
additional time, please pass the
video.
So this particular statement with
respect to bookmarks and
printed pages is false.
I don't even know if people still
use bookmarks.
I've been using business cards and
things of that nature to keep my
place in books
and things of that nature.
I can't actually remember the last
time I picked up an actual bookmark
to use in a book.
But some of you may have bookmarks,
but in this case, this is not
true with respect to
the context of our discussion.
So let's go ahead and jump over to
our summary.
So today's summary is pretty
straightforward. We described what
browser bookmark discovery is.
We talked about and looked at an
example we
describe mitigation techniques is
primarily being in use awareness
training and providing good
separation of personal and business
information on those accounts, not
auto filling credentials, things
of that nature. So in user
awareness, training is going to be
big here.
And then we looked at detection
techniques again, really falling
back into making sure that
we're monitoring system activity for
known malicious behavior or
things that may be suspect that we
would need to evaluate further.
So with that in mind, I want to
thank you for your time today, and I
look forward to seeing you again
soon.