Instructor: Unauthorized privilege. 2 2
In this lesson, 3 3
we are going to talk about unauthorized privileges 4 4
which is something that an attacker tries to do 5 5
once they exploit your system. 6 6
Now, one of the most common things an attacker will do 7 7
once they get into a system is try 8 8
to escalate their privileges, 9 9
and this is known as privilege escalation. 10 10
Now, simply put, privilege escalation is the practice 11 11
of exploiting flaws in an operating system 12 12
or other application to gain a greater level 13 13
of access than was intended for the user application. 14 14
Now, this is important 15 15
because often the initial intrusion vector is something 16 16
like a phishing campaign. 17 17
If I can get a user to click on a link 18 18
in my phishing campaign, they can let me in 19 19
and I can actually take over their account, 20 20
but that's only a regular user account; 21 21
it's not going to be strong enough 22 22
for me to do some of the things I want to do. 23 23
And so as an attacker, 24 24
I want to be able to escalate my privileges and get to root 25 25
on a Linux system or admin on a Windows system. 26 26
So the question becomes: As an analyst, 27 27
how do you detect privilege escalation? 28 28
And that's what we're going to focus on 29 29
in this lesson because we're going to be looking 30 30
at the indicators of compromise for that. 31 31
Now, as a security team, 32 32
one of the ways you can detect this is 33 33
by monitoring authentication and authorization systems. 34 34
Now, this is really important 35 35
and there are five key things you need to look at. 36 36
First, you need to look at unauthorized sessions. 37 37
Then you need to look at failed log-ons. 38 38
After that, you should be looking for new accounts. 39 39
After that, you should be looking for guest account usage. 40 40
And finally, you should be looking at off-hours usage. 41 41
Let's take a closer look at each of these. 42 42
First, unauthorized sessions. 43 43
When you're looking at unauthorized sessions, you're looking 44 44
at what's occurring when certain accounts access devices 45 45
or services that they should not be authorized 46 46
to have access to. 47 47
For example, if I'm a regular user 48 48
and I work in human resources, should I have access 49 49
to anything in the accounting department? 50 50
Probably not. 51 51
And if you start seeing some kind 52 52
of a session going from my user account 53 53
which is attached to the human resources area 54 54
and it's connecting into the accounting area, 55 55
that would be something you should flag 56 56
as an unauthorized session and look into further. 57 57
The second type of thing 58 58
we want to look for is failed log-ons. 59 59
A failed log-on is any attempt to authenticate 60 60
to the system using the incorrect username 61 61
and password combination or other credentials. 62 62
Essentially, somebody's tried to log-on 63 63
and they have the wrong username or wrong password. 64 64
Now, just because there's a failed log-on doesn't mean 65 65
you're under attack. 66 66
Oftentimes it's somebody putting in the wrong password 67 67
because they forgot it or they mistyped it 68 68
and that can be perfectly normal. 69 69
But if you see multiple attempts with the wrong username 70 70
and password over and over again, that could be 71 71
an indication of somebody trying to do password guessing 72 72
or brute-force attack. 73 73
Next, we want to look for any new accounts. 74 74
Now, as an attacker, they want to try to be able 75 75
to create new accounts on a system, 76 76
and if they can do this, this can be really dangerous 77 77
because they can create a new account 78 78
such as an administrator account 79 79
and then have unbridled access to all of your systems. 80 80
One of the things you need to do as an analyst 81 81
is go through often and check your accounts 82 82
and see if there's any new accounts 83 83
and who created them; 84 84
Were they authorized 85 85
or was it the product of some kind of an attack? 86 86
After that, we want to consider any guest account usage. 87 87
Now, guest accounts can be dangerous 88 88
because they can enable an attacker to log on to a domain 89 89
and begin footprinting the network 90 90
and start figuring out who's on the network, 91 91
what type of devices are on the network, 92 92
what type of software is on the network, 93 93
and all of that is information 94 94
they can use in further attacks. 95 95
And finally, we want to look out for any off-hours usage. 96 96
Off-hours usage occurs when an account is being used 97 97
in off hours. 98 98
This may indicate an attacker is attempting 99 99
to catch the organization unaware. 100 100
For example, if your company's employees normally work 101 101
from 9:00 in the morning till 5:00 in the afternoon 102 102
and you start seeing somebody logged on 103 103
at 1:00 in the morning 104 104
or 2:00 in the morning, that is off-hours usage. 105 105
And you need to look into do they have valid reason 106 106
to do that? 107 107
And if not, were they really the ones who were doing it? 108 108
Or is there somebody on the other side 109 109
of the world who has hacked 110 110
into your machine and is now logging in as that user? 111 111
Now, the last thing we need to talk about 112 112
in this lesson is unauthorized privileges. 113 113
Now, one of the things we as analysts need to look 114 114
for is looking at our security policies 115 115
and our system policies and making sure 116 116
they're properly enforced to provide the right access 117 117
to the right users and to block access 118 118
to those users who shouldn't be on our systems. 119 119
This should result in access denied. 120 120
Now as we do this, there are a couple 121 121
of tools that we can use to check our policies. 122 122
The first one is the Microsoft Policy Analyzer. 123 123
This can identify 124 124
whether a policy deviates from a configuration baseline. 125 125
So once you know what your security baseline should be, 126 126
you can create your policies in that 127 127
and then use the Policy Analyzer 128 128
to make sure those policies are 129 129
in effect across all of your systems. 130 130
Another tool you can use to track your privileges 131 131
and any privilege changes is AccessChk and AccessEnum. 132 132
These are part of the Sysinternals suite 133 133
and they can analyze privileges applied 134 134
to a resource or file. 135 135
This will allow you to verify based on their audit log 136 136
and make sure that the right privileges are 137 137
on the right file still 138 138
and that an attacker has not changed that for you. 139 139
This will make sure 140 140
that you have the right authorized privileges 141 141
and you aren't getting 142 142
into the realm of unauthorized privileges.