safeguarding your business assets through understanding of the win32 api
TRANSCRIPT
Safeguarding your Business Safeguarding your Business Assets through Understanding of Assets through Understanding of
the Win32 APIthe Win32 API
Introduction
• David J. Goldman– CSA, Velosecure LLC– Managing the Windows Security Practice of
PricewaterhouseCoopers’ Global Risk Management Solutions
– [email protected]– 212-596-5682
Introduction
• Todd M Feinman– Candidate for MBA at Harvard Business
School, 2002– CEO, Velosecure LLC– Manager within PricewaterhouseCoopers’
Global Risk Management Solutions– [email protected]– 212-596-7299
Objective
• Explain some of the vulnerabilities inherent to the Win32 API
• Talk through some examples of how these could affect real companies
• Discuss how to protect against such security breaches
Windows Management
• User– Users, groups, account policy…
• Resource– File, directory, service permissions…
• System– Services, registry, hotfixes…
• Network– Shares, trusts, remote access…
• Auditing– Audit policy, event logs, directory auditing…
Security Assertions
• Confidentiality– Sensitive information will not be read by unauthorized
individuals
• Integrity– Reliable information will not be modified by
unauthorized individuals
• Availability– Information will be accessible by authorized
individuals in a timely manner.
A Malicious Plan of Attack
• Can I connect with NULL – Yes? Procure any and all information
• Connect to shares, get a username, guess a password, run brute force attacks…
• Can I connect with Guest or User access – Yes? Get Service information, Registry access,
exploit daemons.• Connect to service control manager, HKLM, ftp or
web...
Case 1: Enterprise-Wide Employee Directory
• Background:– Pharmaceuticals company– 60,000 employees’ information defined within a directory– Two dozen domains
• Concerns:– Primary: Availability– Secondary: Confidentiality and Integrity
• Why:– Numerous directors and managers require access– Complex hierarchical corporate authority
Primary Assessment
• To ensure that:– All domain controllers available for
authentication (not using random sample)– Users can search directory for information
about each other, including office number and email address
– No one is trying to compromise availability of the servers
– Printers accessible by doctors and researchers
User Security Methodology
• List all Users and their properties– NetUserEnum NetUserGetInfo
• List all Groups, their properties, and members– NetGroupEnum NetGroupGetInfo
NetGroupGetUsers– NetLocalGroupEnum
NetLocalGroupGetMembers
Resource Security Methodology
• List all Printers and their properties
• Retrieve the permissions for each printer– EnumPrinters GetNamedSecurityInfo
System Security Methodology
• Retrieve the network information– NetWkstaGetInfo– NetWkstaTransportEnum
• Determine it’s domain membership– LsaQueryInformationPolicy
• Retrieve OS level and other Windows information– NetServerGetInfo
Network Security Methodology
• Enumerate the trusts between domain– Trusting
• NetUserEnum(FILTER_INTERDOMAIN_TRUST_ACCOUNT) NetUserGetInfo
– Trusted• LsaEnumerateTrustedDomains
Network Security Methodology
• Enumerate the trusts between domain– Trusting
• NetUserEnum(FILTER_INTERDOMAIN_TRUST_ACCOUNT) NetUserGetInfo
– Trusted• LsaEnumerateTrustedDomains
Auditing Security Methodology
• Event Log Settings– Registry Data
• HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Security
• Event Log Data– ReadEventLog (529, 539, 531, 517, 612)
Null Credentials
• NetUserEnum• NetUserGetInfo• NetGroupEnum• NetGroupGetInfo• NetGroupGetUsers• NetLocalGroupEnum• NetLocalGroupGetMembers• NetWkstaGetInfo (not in NT4)• NetWkstaTransportEnum• NetServerGetInfo
Case 2: Data Warehouse Security
• Background:– Yellow Page Publishing company– 100,000 customers’ account information and data– Over 100 file servers nationally
• Concerns:– Primary: Confidentiality– Secondary: Integrity and Availability
• Why:– Customers’ advertisements are competitive advantage– Need for authorized direct modification of data 24x7
Primary Assessment
• To ensure that:– File Server directory access controls are appropriate
(using random sample)
– Agents can update only their authorized companies’ data and only authorized projects within such companies.
– Unauthorized reading of other companies’ information is prohibited
– Raw data files are not accessible by anyone but programs
User Security Methodology
• Enumerate each individual’s user rights and access privileges– LsaEnumerateAccountsWithUserRight
Resource Security Methodology
• Retrieve the permissions for directories
• Retrieve the permissions for file executables that run as a service (localSystem)
• Retrieve the permissions for services– GetNamedSecurityInfo, GetAce,
LookupAccountSid
System Security Methodology
• Enumerate scheduled jobs (backups)– NetScheduleJobEnum
Network Security Methodology
• Retrieve list of shares– NetShareEnum
• Check permissions on shares
• Check permissions on directories that are shared– GetNamedSecurityInfo, GetAce,
LookupAccountSid
Auditing Security Methodology
• Retrieve Directory Auditing Lists (SACLs)– GetNamedSecurityInfo, GetAce,
LookupAccountSid
Null Credentials
• NetShareEnum
Case 3: Securities Trading
• Background:– Company trading securities on the Internet– Multiple vendor network segments + Internet customers– Entry points on dozens of servers
• Concerns:– Primary: Integrity– Secondary: Confidentiality and Availability
• Why:– Transactions must be accurate, timely, and complete– Non-repudiation
Primary Assessment
• To ensure that:– No one can modify the data on machines used
for trading securities– Services cannot be exploited to compromise the
domain or local machine– A brute force attack will not succeed or go
undetected
User Security Methodology
• Identify the parameters used for the password restrictions and account lockout– NetUserModalsGet
• Grab the password hashes and perform strength assessment– samdump
Resource Security Methodology
• Retrieve the information for each drive and ensure NTFS is running– GetVolInfo
System Security Methodology
• Enumerate registry values and permissions– RegConnectRegistry RegOpenKeyEx
RegQueryInfoKey RegEnumKey RegEnumValue
– RegGetKeySecurity GetSecurityDescriptorDacl
• Enumerate Services and Device Drivers– EnumServicesStatus QueryServiceStatus
QueryServiceConfig
Network Security Methodology
• Check if the built-in administrator can be locked out remotely– LsaOpenPolicy LsaQueryInformationPolicy
SamConnect SamOpenDomain SamQueryInformationDomain
• Assess dial-in settings– RasAdminPortEnum RasAdminPortGetInfo
Auditing Security Methodology
• Retrieve Audit Policy Information– OpenPolicy LsaQueryInformationPolicy
Null Credentials
• NetUserModalsGet