Applying the Lesson Learned: The Ultimate Guide to Incident Response and Forensics for 2022

~ January 18, 2022 ~

Forensics and Incident Handling are constantly evolving, as well as crucial topics in the area of cybersecurity. In order to stay on top of the attackers, the knowledge of Individuals and Teams responsible for collecting digital evidence and handling the incidents has to be constantly enhanced and updated. This Module covers multiple skills necessary to find, collect and preserve data in a correct manner, analyze it and get to know as much about the incident as possible.
During this AWSC session, the students will be guided through a general approach to forensics and incident handling and network forensics, important aspects of Windows internals, memory and storage analysis and detecting indicators of compromise. Paula will also cover advanced subjects such as malware analysis – including guiding the students through a live analysis of the infamous Coinvault ransomware.”

Active Directory Persistence Techniques

~ January 20, 2022 ~

During this Module, Michael Grafnetter, Microsoft MVP and Black Hat Briefings Speaker,
will show several attack vectors that might lead to privilege escalation and/or persistence.
He will present his most important discovery called NGC Key Injection (AKA Shadow Credentials) which is a new type of persistent Active Directory backdoor.
He will also go through Hidden Accounts, DCSync, DCShadow, SSH Key Injection, RID Hijacking, Golden Ticket Attack, Golden SAML, Skeleton Key, and more!

During this module, you will learn not only how these identity-related attacks work but also how to mitigate these risks in your organization. Once hackers manage to compromise Active Directory, they typically want to maintain administrative access even after passwords of privileged accounts get changed.
In this session, we will be discussing various techniques of achieving and detecting such persistence in Active Directory, including Shadow Credentials, Hidden Accounts, UnPAC-the-Hash, NTAuth Abuse, Golden Ticket, SID History Injection, or ACL Backdoors like DCSync and Server (Un)Trust Accounts.

Hacker’s Perspective on Cloud Security and its Mistakes: Can Cloud Manage Security Better?

~ January 25, 2022 ~

In the past, one of the reasons for not using the public cloud was security concerns. Today, a properly managed cloud environment is just as secure as any other type of well-maintained environment. Yet we need to remember that no security operation is perfect. Even the best-managed cloud environment is at risk of security failures—especially if security is undermined at the tenant level by cloud tenants who fail to properly secure the cloud resources that they are using. As organizations migrate to cloud services, decision-makers have to prioritize a new security strategy according to the cloud assets. This means that identity and privileged access management have become the new security key objects of interest along with a strong zero trust mindset that continuously verifies authentication and authorization requests.

During this Module, we take a look at the improper configurations that could compromise the cloud and discuss the security solutions and features to mitigate the existing risk. The goal is not to embarrass the cloud but to highlight easy-to-make errors that can have very big security repercussions. A very practical look at various cloud services is guaranteed!

Public Key Infrastructure Under Revision: The Perspective for 2022

~ January 27, 2022 ~

Public Key Infrastructure (PKI) is a vital part of a modern organizations’ security. Since its boom, internal PKI systems has not changed a lot, but as well the problems that we observe during almost all pentests In general, the set of use cases, challenges, standards related to PKI has changed over the years. . It’s time to revise your knowledge about one of the cornerstones of enterprise security and learn few tricks that attackers are using to spoof any identity. What are common pitfalls and mistakes that can lead to a full breach of trust and your systems? Where are hidden certificates in Windows infrastructure and who and how can use them? How do Azure Information Protection, Windows Hello for Business and other modern technologies rely on Certificates and their security?
Brace yourself, this Module will be demo intense! Mike will show you hackers’ points of interest based on real-life scenarios and elaborate the pitfalls!

Implementing Principle of Least Privilege

~ February 1, 2022 ~

In the new world of Zero Trust most companies are now aiming to get rid of local administrative rights for their end-users. Sami Laiho has specialized in this field since 2002 and is the world-leading specialist in his field.
Even the NT 3.1 User Guide states, that in Windows, there is no security if you give people local admin rights. Local admin rights give you the ability to bypass all company Group Policy / MDM -settings, take any logged on users’ identity, read/delete any files on the computer even with Deny ACLs, and probably the worst – the ability to breach the rest of the company systems.
Taking away end-user admin rights can lower the number of Helpdesk tickets by 75%! Most people say that: “if I don’t have admin rights I can’t fix my computer” – No, in reality, it’s: “if you don’t have admin rights you can’t break your computer!”.
Most people think this hinders usability and is not possible for certain old apps, laptop users, or devs.
Sami has successfully taken away admin rights from all of these, in companies ranking from a single-person to a company with more than half a million users.

Implementing Privileged Access Workstations

~ February 3, 2022 ~

Learn how you build a secure way of managing enterprise services. Since the year 2000, you were not supposed to logon to servers with RDP, but most people still do. This is not the way to manage Windows! This session offers you three different ways/levels of managing servers from what’s known as a “Privileged Access Workstation.” Believe Jeffrey Snover when he says you should not treat your servers like pets, treat them like cattle. Don’t pet your servers one by one with RDP but with RSAT, WAC and PowerShell. In a modern well-managed environment with all the threats like Pass The Hash, Pass The Ticket etc. you have to limit the attack surface by reducing the number of endpoints that can take down the enterprise. If you can connect to a server or a jump server with RDP from a secretaries computer, you’re doing it wrong.

File upload in .NET application

~ February 8, 2022 ~

“As organizations move to remote and distanced workspaces, it becomes increasingly critical to ensure the security of file uploads, since leaving file uploads unrestricted creates an attack vector for malicious files. While file upload is useful in many situations, the security implications of hosting a file-upload facility are significant.

During this Module, we will play with C# to implement an application that allows users to upload different files. We will pretend to be an attacker or someone curious enough to test the function and check the vectors for possible malicious actions.

Attendees will become familiar with the tools and techniques that can be utilized to stay safe. After this Module, it will be easier to protect our applications from compromise!”

IIS under attack – file upload

~ February 10, 2022 ~

So, they have done it – a vulnerability has been discovered in Microsoft IIS and finally exploited! It could allow an attacker to upload arbitrary and malicious files to an affected system. Time is of the essence here – so act fast.

We will investigate what has happened and what is wrong with (no longer) our server. Finally, a little clean-up and hardening will take place.

After this Module, you will become more familiar with detecting and responding to a security incident. We will try to harden our server to prevent this from happening ever again.

Deploying Smart Card Authentication in Windows

~ February 15, 2022 ~

In this session, our Expert, Michael Grafnetter will dive deep into the smart card logon capability of Windows, a feature that had been available in Active Directory years before Passwordless became cool.
He will specifically look at different ways of protecting certificate private keys using TPM chips, which have become a standard in Windows PCs, eliminating the inherent hardware costs of deploying certificate-based authentication.
Michael will also be covering the configuration of smart card-based authentication for Active Directory Federation Services (ADFS), Internet Information Services (IIS), and RADIUS (VPN and Wi-Fi).
Last but not least, we will be discussing some configuration mistakes that could have a negative impact on Active Directory security.

Reverse Engineering malware to hunt for zero-days

~ February 17, 2022 ~

There are many things we can discover by using dynamic analysis, but in order to gain full understanding on what’s going on – we often need to dive deep into the binary’s secrets. This is where Reverse Engineering becomes very useful. Sophisticated malware may employ zero-day vulnerabilities – but execute them only if certain conditions are satisfied. We can learn or modify all those conditions as long as we can access the code itself. We will show you how to use Ghidra in order to analyze logic, discover hidden secrets, and even patch binaries to change their behavior. The true power of Ghidra lays within its free decompiler so we don’t have to speak fluent assembler.

Insecure web authentication as part of Red Teaming assessments

~ February 22, 2022 ~

o Web authentication is a common entry point to company systems, hence skilful Red Teamers know how to look for vulnerabilities in this area. We will present various web attacks and explain issues’ root-cause in handling JWT, cookies, and other sensitive secrets. You can count on corner cases, unexpected cryptographic attacks, and really weird behaviour of innocent code..

Containerization and Kubernetes

~ February 24, 2022 ~

In this module, we will dive into Azure Kubernetes Service architecture!
Secure deployment of AKS.
Time goes by faster and faster. Easy to use and quickly implementable solutions are the most-wanted option on the market. Azure Kubernetes Service (AKS) allows you to quickly deploy a production-ready Kubernetes cluster in Azure. But fast cannot mean too hasty.

During this module, you will learn how to safely deploy AKS. We will study together Azure Policies for AKS. After that, you will know what to use and how. That’s not everything, you have to know your enemy, learn five ways how to kill the cluster.