1 1 00:00:00,330 --> 00:00:02,520 Unauthorized privilege. 2 2 00:00:02,520 --> 00:00:03,450 In this lesson, 3 3 00:00:03,450 --> 00:00:06,060 we are going to talk about unauthorized privileges 4 4 00:00:06,060 --> 00:00:08,190 which is something that an attacker tries to do 5 5 00:00:08,190 --> 00:00:10,320 once they exploit your system. 6 6 00:00:10,320 --> 00:00:12,480 Now, one of the most common things an attacker will do 7 7 00:00:12,480 --> 00:00:14,310 once they get into a system is try 8 8 00:00:14,310 --> 00:00:15,810 to escalate their privileges, 9 9 00:00:15,810 --> 00:00:18,300 and this is known as privilege escalation. 10 10 00:00:18,300 --> 00:00:21,120 Now, simply put, privilege escalation is the practice 11 11 00:00:21,120 --> 00:00:23,550 of exploiting flaws in an operating system 12 12 00:00:23,550 --> 00:00:25,920 or other application to gain a greater level 13 13 00:00:25,920 --> 00:00:29,520 of access than was intended for the user application. 14 14 00:00:29,520 --> 00:00:30,600 Now, this is important 15 15 00:00:30,600 --> 00:00:33,360 because often the initial intrusion vector is something 16 16 00:00:33,360 --> 00:00:35,220 like a phishing campaign. 17 17 00:00:35,220 --> 00:00:37,020 If I can get a user to click on a link 18 18 00:00:37,020 --> 00:00:39,570 in my phishing campaign, they can let me in 19 19 00:00:39,570 --> 00:00:41,730 and I can actually take over their account, 20 20 00:00:41,730 --> 00:00:44,280 but that's only a regular user account; 21 21 00:00:44,280 --> 00:00:45,390 it's not going to be strong enough 22 22 00:00:45,390 --> 00:00:47,280 for me to do some of the things I want to do. 23 23 00:00:47,280 --> 00:00:48,780 And so as an attacker, 24 24 00:00:48,780 --> 00:00:51,480 I want to be able to escalate my privileges and get to root 25 25 00:00:51,480 --> 00:00:54,810 on a Linux system or admin on a Windows system. 26 26 00:00:54,810 --> 00:00:56,940 So the question becomes: As an analyst, 27 27 00:00:56,940 --> 00:00:59,370 how do you detect privilege escalation? 28 28 00:00:59,370 --> 00:01:00,570 And that's what we're going to focus on 29 29 00:01:00,570 --> 00:01:01,980 in this lesson because we're going to be looking 30 30 00:01:01,980 --> 00:01:04,440 at the indicators of compromise for that. 31 31 00:01:04,440 --> 00:01:05,880 Now, as a security team, 32 32 00:01:05,880 --> 00:01:07,950 one of the ways you can detect this is 33 33 00:01:07,950 --> 00:01:11,460 by monitoring authentication and authorization systems. 34 34 00:01:11,460 --> 00:01:12,810 Now, this is really important 35 35 00:01:12,810 --> 00:01:15,510 and there are five key things you need to look at. 36 36 00:01:15,510 --> 00:01:17,880 First, you need to look at unauthorized sessions. 37 37 00:01:17,880 --> 00:01:20,370 Then you need to look at failed log-ons. 38 38 00:01:20,370 --> 00:01:23,010 After that, you should be looking for new accounts. 39 39 00:01:23,010 --> 00:01:25,890 After that, you should be looking for guest account usage. 40 40 00:01:25,890 --> 00:01:28,800 And finally, you should be looking at off-hours usage. 41 41 00:01:28,800 --> 00:01:30,690 Let's take a closer look at each of these. 42 42 00:01:30,690 --> 00:01:32,820 First, unauthorized sessions. 43 43 00:01:32,820 --> 00:01:35,460 When you're looking at unauthorized sessions, you're looking 44 44 00:01:35,460 --> 00:01:38,250 at what's occurring when certain accounts access devices 45 45 00:01:38,250 --> 00:01:40,560 or services that they should not be authorized 46 46 00:01:40,560 --> 00:01:41,970 to have access to. 47 47 00:01:41,970 --> 00:01:44,370 For example, if I'm a regular user 48 48 00:01:44,370 --> 00:01:47,040 and I work in human resources, should I have access 49 49 00:01:47,040 --> 00:01:48,960 to anything in the accounting department? 50 50 00:01:48,960 --> 00:01:50,070 Probably not. 51 51 00:01:50,070 --> 00:01:51,510 And if you start seeing some kind 52 52 00:01:51,510 --> 00:01:53,520 of a session going from my user account 53 53 00:01:53,520 --> 00:01:55,890 which is attached to the human resources area 54 54 00:01:55,890 --> 00:01:58,200 and it's connecting into the accounting area, 55 55 00:01:58,200 --> 00:01:59,580 that would be something you should flag 56 56 00:01:59,580 --> 00:02:02,700 as an unauthorized session and look into further. 57 57 00:02:02,700 --> 00:02:03,540 The second type of thing 58 58 00:02:03,540 --> 00:02:05,730 we want to look for is failed log-ons. 59 59 00:02:05,730 --> 00:02:08,130 A failed log-on is any attempt to authenticate 60 60 00:02:08,130 --> 00:02:10,230 to the system using the incorrect username 61 61 00:02:10,230 --> 00:02:13,080 and password combination or other credentials. 62 62 00:02:13,080 --> 00:02:15,060 Essentially, somebody's tried to log-on 63 63 00:02:15,060 --> 00:02:17,790 and they have the wrong username or wrong password. 64 64 00:02:17,790 --> 00:02:20,250 Now, just because there's a failed log-on doesn't mean 65 65 00:02:20,250 --> 00:02:21,930 you're under attack. 66 66 00:02:21,930 --> 00:02:24,390 Oftentimes it's somebody putting in the wrong password 67 67 00:02:24,390 --> 00:02:26,430 because they forgot it or they mistyped it 68 68 00:02:26,430 --> 00:02:28,410 and that can be perfectly normal. 69 69 00:02:28,410 --> 00:02:31,230 But if you see multiple attempts with the wrong username 70 70 00:02:31,230 --> 00:02:33,810 and password over and over again, that could be 71 71 00:02:33,810 --> 00:02:36,270 an indication of somebody trying to do password guessing 72 72 00:02:36,270 --> 00:02:38,130 or brute-force attack. 73 73 00:02:38,130 --> 00:02:40,560 Next, we want to look for any new accounts. 74 74 00:02:40,560 --> 00:02:42,960 Now, as an attacker, they want to try to be able 75 75 00:02:42,960 --> 00:02:44,880 to create new accounts on a system, 76 76 00:02:44,880 --> 00:02:47,310 and if they can do this, this can be really dangerous 77 77 00:02:47,310 --> 00:02:48,990 because they can create a new account 78 78 00:02:48,990 --> 00:02:50,700 such as an administrator account 79 79 00:02:50,700 --> 00:02:54,150 and then have unbridled access to all of your systems. 80 80 00:02:54,150 --> 00:02:56,400 One of the things you need to do as an analyst 81 81 00:02:56,400 --> 00:02:58,800 is go through often and check your accounts 82 82 00:02:58,800 --> 00:03:00,510 and see if there's any new accounts 83 83 00:03:00,510 --> 00:03:01,800 and who created them; 84 84 00:03:01,800 --> 00:03:02,790 Were they authorized 85 85 00:03:02,790 --> 00:03:06,060 or was it the product of some kind of an attack? 86 86 00:03:06,060 --> 00:03:09,090 After that, we want to consider any guest account usage. 87 87 00:03:09,090 --> 00:03:10,980 Now, guest accounts can be dangerous 88 88 00:03:10,980 --> 00:03:13,920 because they can enable an attacker to log on to a domain 89 89 00:03:13,920 --> 00:03:15,720 and begin footprinting the network 90 90 00:03:15,720 --> 00:03:17,460 and start figuring out who's on the network, 91 91 00:03:17,460 --> 00:03:19,110 what type of devices are on the network, 92 92 00:03:19,110 --> 00:03:20,790 what type of software is on the network, 93 93 00:03:20,790 --> 00:03:22,020 and all of that is information 94 94 00:03:22,020 --> 00:03:24,600 they can use in further attacks. 95 95 00:03:24,600 --> 00:03:27,960 And finally, we want to look out for any off-hours usage. 96 96 00:03:27,960 --> 00:03:30,690 Off-hours usage occurs when an account is being used 97 97 00:03:30,690 --> 00:03:32,190 in off hours. 98 98 00:03:32,190 --> 00:03:33,990 This may indicate an attacker is attempting 99 99 00:03:33,990 --> 00:03:36,240 to catch the organization unaware. 100 100 00:03:36,240 --> 00:03:38,850 For example, if your company's employees normally work 101 101 00:03:38,850 --> 00:03:41,430 from 9:00 in the morning till 5:00 in the afternoon 102 102 00:03:41,430 --> 00:03:43,050 and you start seeing somebody logged on 103 103 00:03:43,050 --> 00:03:43,950 at 1:00 in the morning 104 104 00:03:43,950 --> 00:03:46,860 or 2:00 in the morning, that is off-hours usage. 105 105 00:03:46,860 --> 00:03:49,080 And you need to look into do they have valid reason 106 106 00:03:49,080 --> 00:03:49,913 to do that? 107 107 00:03:49,913 --> 00:03:52,860 And if not, were they really the ones who were doing it? 108 108 00:03:52,860 --> 00:03:54,570 Or is there somebody on the other side 109 109 00:03:54,570 --> 00:03:55,710 of the world who has hacked 110 110 00:03:55,710 --> 00:03:59,343 into your machine and is now logging in as that user? 111 111 00:03:59,343 --> 00:04:01,320 Now, the last thing we need to talk about 112 112 00:04:01,320 --> 00:04:04,080 in this lesson is unauthorized privileges. 113 113 00:04:04,080 --> 00:04:06,240 Now, one of the things we as analysts need to look 114 114 00:04:06,240 --> 00:04:08,760 for is looking at our security policies 115 115 00:04:08,760 --> 00:04:10,680 and our system policies and making sure 116 116 00:04:10,680 --> 00:04:13,500 they're properly enforced to provide the right access 117 117 00:04:13,500 --> 00:04:16,140 to the right users and to block access 118 118 00:04:16,140 --> 00:04:18,990 to those users who shouldn't be on our systems. 119 119 00:04:18,990 --> 00:04:21,540 This should result in access denied. 120 120 00:04:21,540 --> 00:04:23,340 Now as we do this, there are a couple 121 121 00:04:23,340 --> 00:04:26,310 of tools that we can use to check our policies. 122 122 00:04:26,310 --> 00:04:29,370 The first one is the Microsoft Policy Analyzer. 123 123 00:04:29,370 --> 00:04:30,203 This can identify 124 124 00:04:30,203 --> 00:04:33,570 whether a policy deviates from a configuration baseline. 125 125 00:04:33,570 --> 00:04:36,060 So once you know what your security baseline should be, 126 126 00:04:36,060 --> 00:04:37,740 you can create your policies in that 127 127 00:04:37,740 --> 00:04:39,870 and then use the Policy Analyzer 128 128 00:04:39,870 --> 00:04:41,760 to make sure those policies are 129 129 00:04:41,760 --> 00:04:44,370 in effect across all of your systems. 130 130 00:04:44,370 --> 00:04:47,070 Another tool you can use to track your privileges 131 131 00:04:47,070 --> 00:04:51,150 and any privilege changes is AccessChk and AccessEnum. 132 132 00:04:51,150 --> 00:04:52,920 These are part of the Sysinternals suite 133 133 00:04:52,920 --> 00:04:54,780 and they can analyze privileges applied 134 134 00:04:54,780 --> 00:04:56,490 to a resource or file. 135 135 00:04:56,490 --> 00:04:59,610 This will allow you to verify based on their audit log 136 136 00:04:59,610 --> 00:05:01,650 and make sure that the right privileges are 137 137 00:05:01,650 --> 00:05:03,000 on the right file still 138 138 00:05:03,000 --> 00:05:05,460 and that an attacker has not changed that for you. 139 139 00:05:05,460 --> 00:05:06,600 This will make sure 140 140 00:05:06,600 --> 00:05:08,370 that you have the right authorized privileges 141 141 00:05:08,370 --> 00:05:09,203 and you aren't getting 142 142 00:05:09,203 --> 00:05:11,223 into the realm of unauthorized privileges.