August 2015 - USHE-assess - lists.utahtech.edu

I go chop your dollar
by Chuck Kimber 04 Sep '15

04 Sep '15

Well ladies and gentleman, and whatever Dustin is, I'm writing in to let you all know I have thoroughly enjoyed my time working with you on these assessments. You have all become some of my closest friends. I know there have been a couple of times where it felt like I was a no-show (sorry UVU, I had big plans for you till I broke the leg) and didn't find much, but I always learned something and tried to bring at least one new trick to each assessment and you were all so nice indulging me with them. As you all know I've been looking for something that was more of a full-time security gig. An opportunity to do that has finally presented itself and I'll be taking it, starting Sept 8th. It'll be much more Blue Team oriented, but I hope to talk them into some in-house Red Team audits as well. Just know that I will miss our little gatherings and chats, while Dave does all the work. As for USU's contribution to the team, I'll be making some recommendations and they should be acting on it very quickly, with the Weber audit coming up. Should you feel so inclined to stay in-touch, and I really hope you do, you can reach me at the following: email/IM: chuckarama(a)kimbers.us You all should have my phone number, but if you don't and want it, just let me know and I'll send it along. I tend to use Google+ more than Facebook, and follow a few of you there, so if the rest of you join up, let me know. Jake: The blue will always be strong with you. Dustin: The Goblin, we'll always have our time on the SLCC stairs together. Dave: Just keep doing what you're doing. ...leveraging UVU raises at the U's expense. Jon: Thank your wife for me. ...her pastries are delicious. Mark: Stay hepatitis free down there, my friend. Andrew: Don't you EVER hack my server again! Not being able to live with the shame might be the whole reason I'm leaving... Don't cry. Instead, in my absence, enjoy the Nigerian scammer song. https://www.youtube.com/watch?v=cG57mPMiJvw My favorite part is the subtitle translation where "disappear" is misspelled as 'despair'. What else would you expect from a Nigerian Scammer?! Chuck

5 12

Pentest Heels
by Chuck Kimber 25 Aug '15

25 Aug '15

Was totally going to print a pair of these for the next pentest. Someone else will have to take up the challenge. Dave? I could see you in a pair of these. http://www.theregister.co.uk/2015/08/24/heeled_hacker_turns_wedges_into_con…

2 1

Re: [USHE-assess] Universities being targeted by jm511
by Chuck Kimber 24 Aug '15

24 Aug '15

Sorry. Not saying they came in through Banner, I just recognize all of those as big schools that use Banner. I have interfaced directly with Northern Illinois DBA's. It's only a matter of time till they find a server that is connected back to Banner, is what I'm thinking. On Mon, Aug 24, 2015 at 7:55 AM, Mark Walton <walton(a)suu.edu> wrote: > Why do you say "All Banner schools"? From how I read the article, the > "banner: '5.0.22-log'" is just the banner returned from a certain service, > not necessarily that they are running Banner. Or am I totally missing > something? Admittedly, the details of Banner are a mystery to me. > > Mark > > > On Sun, Aug 23, 2015 at 2:22 PM, Chuck Kimber <chuck.kimber(a)usu.edu> > wrote: > >> All Banner schools. Including WGU. >> http://www.databreaches.net/more-american-universities-hacked-by-jm511/ >> >> _______________________________________________ >> USHE-assess mailing list >> USHE-assess(a)lists.dixie.edu >> http://lists.dixie.edu/cgi-bin/mailman/listinfo/ushe-assess >> >> >

1 0

Universities being targeted by jm511
by Chuck Kimber 23 Aug '15

23 Aug '15

All Banner schools. Including WGU. http://www.databreaches.net/more-american-universities-hacked-by-jm511/

1 0

Windows Containers are coming
by Dustin Udy 21 Aug '15

21 Aug '15

hxxps://redmondmag.com/blogs/the-schwartz-report/2015/08/windows-containers…

3 3

Nostalgic Hacks now backed up with research
by Chuck Kimber 13 Aug '15

13 Aug '15

So over the last couple of years we've found several of these in audits we've done. I remember warning Nate at Weber, when I found the exposed MongoDB and gained access, that those things need to be secured and watched as they are new tech that nobody is thinking about securing yet. He rolled his eyes a bit. Then the memcached dump there as well (Jake's find?). Looks like we finally have some legit research to point our reports at now when we find those things on an audit: http://blog.binaryedge.io/2015/08/10/data-technologies-and-security-part-1/ I want to compile all the news stories about the Utah schools that have dealt with students keylogging and gaining access for fraud and grade changing activities as well, to compile into the report so we can show the physical attacks are real world as well and threaten the data integrity of the institutions records or worse. So if you have some good links about that, put those out there on this thread as well, please.

2 1

USU Target List
by Chuck Kimber 12 Aug '15

12 Aug '15

So this just happened on our internal chat system. I think we can add Lorimer to the hit list. Matt Lorimer <https://usu.slack.com/team/matt.lorimer> *[*11:15 AM <https://usu.slack.com/archives/slackoff/p1439399735000084>*]* When the USHE audit team says they are "here to help" https://i.imgur.com/0ObkG6s.gif :hankey:2 I think that gif and caption should lead the presentation at USU's next audit.

2 1

CredCrack
by Chuck Kimber 12 Aug '15

12 Aug '15

I think someone mentioned this, Jon if I recall correctly, about the invoke-mimikatz.ps1 script that uses powershell to run mimikatz in memory. Anyways, this guy has built a python script to speed the process up and do all the memory cred dumps on the network, automagically. ...My guess is Dave has already run this, but I'll go ahead run it too. ;) http://blog.gojhonny.com/2015/08/domain-administrator-in-17-seconds.html

2 1

WSU Assessment
by Andrew Goble 11 Aug '15

11 Aug '15

Hey all, Weber has confirmed September 21 - 25 for their assessment. I'll get a call scheduled with them soon to get things kicked off and a 'start date' set for external testing before we go on-site. UofU: I'm assuming that Dustin will come on this one since Jake was at SUU, let me know. UVU: Let me know which one of you will be coming up. If there are any other issues with the dates, please let me know ASAP. More to come. Thanks, Andrew

3 2

worth watching
by Dustin Udy 09 Aug '15

09 Aug '15

Hey fellas – "IF" you get bored and want something fun and slightly educational over the long weekend, check out the SANS webcast about using Docker as malware analyst tool. Pretty sweet and valid for our audits. hxxps://www.sans.org/webcasts/run-linux-malware-analysis-apps-docker-contai… What you will want: A hypervisor and a Linux ISO. An hour or two for playing around and watching the video Dustin

2 1