Hello and welcome to another
application of the modern framework
discussion today we're
looking at the exploitation of
remote services, so let's
go ahead and jump in to our
objectives.
So today's objectives are as
follows. We're going to describe
exploitation of remote services.
We're going to look at some examples
of mitigation techniques.
We're going to look at some
detection techniques.
And we'll also look at a particular
type of service that can be
exploited on various systems.
So with that, let's go ahead and
look at what Mynott says.
Exploitation of remote services is
so exploitation of remote
services is when a threat actor
takes advantage of a programing
error and a program service or
within the operating system,
software or kernel to
execute adversary controlled code.
It kind of get out of line.
Their systems
are identified using network
service, scanning, identifying
commonly vulnerable softwares.
We're doing patching gaps that leave
a system open to attack.
And so as a threat actor,
we can find different
things using either IMAP
or usually in is where we start.
But if we can identify that software
is running off a port and we can
identify its version and
that version is vulnerable,
we can take advantage of it.
So let's look at Windows SMB
Server Remote Code execution.
And so this is a
particular
Seeb that is associated
with a number of systems.
And so, as you can see here, we
really shouldn't run into too many
instances of two thousand, three and
XP. But they exist.
I've seen them.
We've got code twenty, twelve
and twenty eight.
We've got Windows Server 2008,
the twenty twelve to twenty sixteen.
And then we've got everything from
Windows seven to Windows 10.
And so in this
particular area we're looking at
CVS that are to be
associated primarily
with SBB one.
And so there
was a big kick back when this
hit the mainstream
where we were working to essentially
look at client systems and
determine if SMB v one
was being used for anything.
And if not, we work to globally
disable that on systems to
prevent this particular
exploit from happening.
So essentially, an unauthenticated
attacker could send a specially
crafted packet to a target of some
B.V. one server.
Successful exploitation of
the most severe of these
vulnerabilities could result in an
attacker gaining the same privileges
as the Longdon user.
And so this was concerning because
at the time SMB v one was being used
in pretty much all
of the systems that we were looking
at.
And so we essentially worked
with everybody to figure out where
systems could
use SMB V one if they had
to, and how we could circumvent this
particular exploit from happening.
And if there was nothing we could
do, then we worked to make sure that
it was shut down and they were
only using newer versions that were
not vulnerable.
And so this is just one example
of a service that could be
exploited.
There are plenty of other examples
out there. It's not just limited to
SMB now some
mitigation techniques that we could
use here so we can disable
or remove features that are not
necessary. I mean, this is
reoccurring. You're going to see
this over and over again, whether
it's here or in CISSP
material, CISM material, anything
where we look at a system, we're
evaluating the system against best
practice.
Have you removed functions that are
not necessary, that don't not need
to be enabled?
And if the answer is no,
that's not a wrong answer per say,
but it's just a matter of what
you're able to do and
what your resource limitations
are. Keeping software up to
date, again,
making sure that we apply current
patches, do those kinds of things,
never goes out of style, identifying
vulnerabilities with vulnerability
scanning to remediate findings.
Now, for me, this
bordered on the edge of
detection.
But when we're talking about
minor detection is
where we find the threat actor
doing the Nottie or doing the bad
things that they shouldn't be doing.
Mitigation in this case is
keeping the threat actor from doing
something. And so in this case, by
identifying the vulnerability up
front and then getting rid
of that vulnerability or mitigating
the underlying factors, we have in
fact, kept that threat actor
out. So don't let that confuse you
by thinking, wait a minute, scanning
is a detection.
We're detecting something.
How is that mitigating?
OK, don't don't get confused by
terminology here.
Mitigation, finding
and preventing a threat actor from
getting in detection
threat actor has gotten.
And how do we know that they are
there? How do we get them out?
Network segmentation to reduce the
ability for a threat actor to easily
reach critical systems.
Again, we've said this in other
areas, but
if you cannot see it, you cannot
get to it.
Right. Way, then you can't
compromise it now, there are ways
that they could get around that, but
again, this just makes the job
harder and it gives us more time for
those detection components
that we put in place to work
effectively and help us to find
a threat actor.
Now, some detection techniques
monitor for behavior on point
systems that could be an indicator
of compromise.
So in this case, we could be looking
for suspicious files in the systems
process, injection attempts
or success.
Again, if you're an accounting firm,
not a software dev firm, you're not
making security tools.
You shouldn't see process injection
really happening in the environment
unless you have something that
is known for doing that.
Otherwise, it is suspicious.
It should be considered malicious
and you're looking into it again.
This is going to continue to be a
pattern for detection across
many of the remaining areas
in the framework.
Now let's do a quick check on
learning. True or false exploitation
of remote services only involves the
manipulation for our of
our.
All right, well, in this case, this
is a false statement, the
exploitation of remote services
involves many, many, many,
many, many different service areas.
It could be anything that
would allow a threat actor to
exploit the service.
If they can get a
or any number of things,
that would be a manipulation there.
So let's go ahead and turn over
to our summary.
So in summary, we looked at and
described exploitation of remote
services. We looked at an example
with that whole SMB
remote exploitation affecting
every one of that.
We looked at and described
mitigation techniques and we
continued to reiterate some
detection techniques that we have
seen in other areas.
But again, this just goes to
show you, if you hear us mention.
A particular detection
technique, and it seems to
overlay with a number of areas, if
you seem to hear a mitigation
technique that overlays
with multiple areas, that's
kind of a great thing, because that
means that by implementing that one
control, we could
potentially help to mitigate
the risk of several different attack
vectors from being successful.
So it doesn't cover all of them, but
it can help cover a majority of
them. So keep that in mind.
If you hear a say and use your
awareness training over and over
again. If you hear monitoring for
normal activity, if you hear
patching, if you hear segmentation
of the network, least privilege,
these are things that ultimately
help us to reduce risk and reduce
the ability of a threat actor to get
into systems.
So with that in mind, I want to
thank you for your time today,
and I look forward to seeing you
again soon.