Gig05 Pen Test War Stories Why my job is so easy and how you can make it harder Aaron Herndon

[@jacobebrock]

Best security talk I've watched in a LOOOONNNGGG time.

[@andremilanimartin3338]

"pls make my job harder its too easy im boooooored"

[@pencir5737]

I watch all my videos at 1.5x Not this dude though.

[@cybercat1531]

He already speaks at 1.5X rate

[@tag180rotax]

I watched at 1.75 lol

[@simplified_101]

i am watching it 0.75x. issues of non english 🙄

[@ferret7508]

@@simplified_101 Iranian hacker moment

[@aaronherndon5445]

Yeah, was my first talk at an infosec conference.. was a little nervous, definitely talked way too fast. Though I also had a lot of content to cram into my given talk window.

[@HouseJunk1e]

I can listen to you talk all day! super well spoken and entertaining. thank you!!!

[@morgulbrut]

Holy fuck, that's probably the first video on youtube I had to set to 75%. that dude had way too much Club Mate in the morning.

[@v4rial921]

you know what, ill be the first to admit i have no idea about hacking. i dont what the hell Metasploit is, i had to look up what a shell was, and by golly what the fuck is a hash. But ill also be the first to admit that i can enjoy as least slightly humorous defcon talks anyway. Its interesting, even if i dont get it, and this guy did this pretty well!

[@hyronharrison8127]

If you want to understand keep attending talks; keep looking things up - the key to gaining knowledge in this field is exposure!

[@Jrez]

So Hunter2 is not a good password?

[@JustPlainRob]

You can't just use ******* as a password. Some don't let you use asterisks and it's just all the same character.

[@Handlessuck1]

Hunter221

[@ShawnRomines]

Very good presentation. Good advice.

[@freman]

AES is a symmetric algorithm, so it does not have public and private keys - only a shared secret

[@AdolphusOfBlood]

It's not a secret, it's a NSA backdoor key.

[@morshlop]

@@AdolphusOfBlood ok thanks for that valuable information

[@AdolphusOfBlood]

@@morshlop The NSA has asked them to keep security flaws unpatched before for their own use, only to have hackers use them before. The NSA's tools have been leaked before as well. It should not shock you or anyone else. The NSA also has a back door into HTTPS. So frankly, never be shocked the NSA does this. They do it as they can get away with it, that's why open source software is key, you can't internally make this an issue with open source software.

[@montanawestphotography6671]

This is the best advertisement for Linux.

[@PaulieShortcuts]

WOW! Good video. I had Summer2017 as a password for at least 2 years lol

[@valehero3140]

Bro you are crazy. Its not possible to make a secure system when you are around.. LOL :D This is 1 of the best security talks I have seen! Keep on good work :)

[@dafoex]

KZbin: community guidelines update, you can't teach people hacking! Also KZbin: advert for ethical hacking courses before this video

[@MrTywheezy]

🤣🤣🤣

[@scrambledag6577]

is this ntlm vulnerability still a thing?

[@revenevan11]

25:11 Great point that the principle of least privilege should go both ways. I think thats less obvious to many people. The DA account shouldn't sign in on a bunch of workstations and risk compromising the keys to the kingdom.

[@Anonymouspock]

Disabling PowerShell is not a security control! If anything it makes it hard to do legitimate administration and prevents advanced users from automating their own jobs. Restricted language mode (though terrible for many reasons) helps. Also try the new Microsoft thing that detects malicious looking PowerShell and blocks it, as well as logging every PowerShell command run.

[@jasonfletcher1638]

If only more people would actually understand this, I setup a network not that long ago for a company where we started going down that path of disabling powershell and command prompt. The problem with disabling this stuff is that 1, it make your life harder as an administrator. 2, the general user doesnt even try to use it (they probably dont even know its there). 3, regardless if it is disabled or not an attacker is always going to find away around it. There are so many ways in windows to get access to a command prompt or power shell even if it is disabled.

[@bene5431]

@@jasonfletcher1638 can confirm, in school we had a 5 line bat file that did exactly the same as cmd except the Copyright Information

[@bene5431]

Today I learned that Google is still a homegrown Website

[@kek_9]

i still got email acc with 3 small letters in password... it's ~20y old account, and i have there collection of all ads since 2007 - 70k ads :) what can i do with that? 😂

[@MrAntiKnowledge]

Seriously. If you respond to wrong login credentials with anything that gives more information than just "invalid credentials" you're an idiot. Not responding in the same time for valid and invalid usernames is equally bad, but can be forgiven as it's a less obvious security hole (you should still try to fix it ofc).

[@JustTechGuyThings]

My biggest peeve are signup forms that say the username is taken... fuck that noise... send them a 'We've created your account (if it was valid), check your email'

[@JasperJanssen]

WriteCodeEveryday so your failure mode is not to tell the user trying to create an account anything about why, you just don’t send them an email? Lol. Try growing *that* online service.

[@MrAntiKnowledge]

[deleted] I shouldnt respond while still half asleep

[@roguishpaladin]

I disagree to the "idiot" part. There is a user friendliness aspect to be taken into account here. Now, in the case of a company and access to its intranet, I would agree - they should know their format and if they don't they should abase themselves adequately to the IT admin to get the correct information. When dealing with an enterprise-level application, though, you have to distinguish between password failure and username failure. A person might not have logged into the service for a while, after all, so they might have a few different possible usernames they could have used. Opaque failures in this case is just going to generate frustration with your service as well as a lot of customer service traffic - basically, it will cost the company money. The real goal here should be to maximizing the user experience while minimizing the security risk.

[@JasperJanssen]

roguishpaladin and for services that are general public facing on the internet - your gmails, dropboxes, etc... - not telling people that their preferred username is taken during account creation is pretty idiotic.

[@HenryLoenwind]

"local subnet"? When will companies finally notice that workstations don't need to talk to each other? Actually, nobody needs to initiate a connection to a workstation. Same in a server network---it is a bit time consuming but very easy to find out which server needs to connect to which server on which port. Why do people still put all that stuff in free-for-all subnets? And even worse, why are there still public-facing servers that can connect to the internet? All that stuff makes it so much easier for attackers...

[@rolfs2165]

>public-facing servers that can connect to the internet Uuh ... isn't that the whole point of them?

[@HenryLoenwind]

@@rolfs2165 Let me phrase that a bit simpler: A web server should answer requests, not surf on P*hub itself.

[@VortechBand]

Replace passwords with a combination of facial feature scanner + fingerprint scanner. And all connection requests to production services require approval by a coworker.

[@AdolphusOfBlood]

Lol, it's not like those can be faked with ease or anything.

[@rkane31174b]

We've detected possible unauthorized access to your account. Please change your fingers as soon as possible. For security reasons, we recommend changing your biometrics every 120 days and not using the same physical body on multiple services.

[@blankblank9042]

On password spraying: Isn't this similar to a "flood attack". Couldn't the software sense it's being probed from a single IP, or a set of IPs, and simply refuse connection or response after "x" number of attempts? Seems like an easy way to prevent the hack. He's saying numbers like "10,000" (attempts). I'd think after the 5th attempt, the software could figure out this isn't some legitimate user that simply forgot their password and/or username.

[@johncameron1935]

Bear in mind when this video was released, when this talk happened. Security continues improving some two years after the fact.

[@buzzkrieger3913]

Except I was locking out sprays a decade ago. This video is full of weak sauce "exploits" against VERY poorly setup security. There are multiple off-the-shelf solutions that shut him down with default settings.

[@kanucks9]

@@buzzkrieger3913 he mentions this in the talk. Two things, 1. Botnets, 2. Testing for this on VPNs and attacking unsecured points preferentially.

[@michaelrichter6911]

@@buzzkrieger3913 The video is titled "why my job is so easy". It's about very simple exploits that he still constantly sees.

[@ryansaadat9095]

@@buzzkrieger3913 thats the entire point of this talk

[@justingauche6475]

Wtf was that ad I just saw.

[@JasperJanssen]

Boxcarcifer you’re still using non-mobile devices? How out of touch you are.

[@JasperJanssen]

Boxcarcifer sorry, no. Haven’t been outside Europe since 2002. But both my names are pretty common in NL, so I’m very much not the only one out there.

[@TheLukemcdaniel]

This is a case study on why not to use Windows...

[@chaosmagican]

Which is why quite a few companies ban the use of it unless it's required. Google for example.

[@setnaffa]

If you think lazy security habits only affect M$, I've got a bridge I can let you have for cheap...

[@TheLukemcdaniel]

@@setnaffa No, but Microsoft encourages it.

[@setnaffa]

@@TheLukemcdaniel Shockwave? Heartbleed? D-Link? There are too many CVEs to list...

[@Frater1Perdurabo]

17+76+30 != (n = 124)...

[@MobCat_]

6:25 That moment where with about 10 seconds of googling i just found the same doc... Still online.. Nothing has changed... i.imgur.com/26G8e45.png

[@amyx231]

FoxJumpLogWinter20192020

[@LostArchivist]

Admin