- USHE-assess - lists.utahtech.edu

Windows Containers are coming
by Dustin Udy 21 Aug '15

21 Aug '15

hxxps://redmondmag.com/blogs/the-schwartz-report/2015/08/windows-containers…

3 3

Nostalgic Hacks now backed up with research
by Chuck Kimber 13 Aug '15

13 Aug '15

So over the last couple of years we've found several of these in audits we've done. I remember warning Nate at Weber, when I found the exposed MongoDB and gained access, that those things need to be secured and watched as they are new tech that nobody is thinking about securing yet. He rolled his eyes a bit. Then the memcached dump there as well (Jake's find?). Looks like we finally have some legit research to point our reports at now when we find those things on an audit: http://blog.binaryedge.io/2015/08/10/data-technologies-and-security-part-1/ I want to compile all the news stories about the Utah schools that have dealt with students keylogging and gaining access for fraud and grade changing activities as well, to compile into the report so we can show the physical attacks are real world as well and threaten the data integrity of the institutions records or worse. So if you have some good links about that, put those out there on this thread as well, please.

2 1

USU Target List
by Chuck Kimber 12 Aug '15

12 Aug '15

So this just happened on our internal chat system. I think we can add Lorimer to the hit list. Matt Lorimer <https://usu.slack.com/team/matt.lorimer> *[*11:15 AM <https://usu.slack.com/archives/slackoff/p1439399735000084>*]* When the USHE audit team says they are "here to help" https://i.imgur.com/0ObkG6s.gif :hankey:2 I think that gif and caption should lead the presentation at USU's next audit.

2 1

CredCrack
by Chuck Kimber 12 Aug '15

12 Aug '15

I think someone mentioned this, Jon if I recall correctly, about the invoke-mimikatz.ps1 script that uses powershell to run mimikatz in memory. Anyways, this guy has built a python script to speed the process up and do all the memory cred dumps on the network, automagically. ...My guess is Dave has already run this, but I'll go ahead run it too. ;) http://blog.gojhonny.com/2015/08/domain-administrator-in-17-seconds.html

2 1

WSU Assessment
by Andrew Goble 11 Aug '15

11 Aug '15

Hey all, Weber has confirmed September 21 - 25 for their assessment. I'll get a call scheduled with them soon to get things kicked off and a 'start date' set for external testing before we go on-site. UofU: I'm assuming that Dustin will come on this one since Jake was at SUU, let me know. UVU: Let me know which one of you will be coming up. If there are any other issues with the dates, please let me know ASAP. More to come. Thanks, Andrew

3 2

worth watching
by Dustin Udy 09 Aug '15

09 Aug '15

Hey fellas – "IF" you get bored and want something fun and slightly educational over the long weekend, check out the SANS webcast about using Docker as malware analyst tool. Pretty sweet and valid for our audits. hxxps://www.sans.org/webcasts/run-linux-malware-analysis-apps-docker-contai… What you will want: A hypervisor and a Linux ISO. An hour or two for playing around and watching the video Dustin

2 1

Updates
by Andrew Goble 03 Aug '15

03 Aug '15

strikegate is back up down here. strikegate.usat.dixie.edu and basegate.usat.dixie.edu resolve now. You can replace the IP addresses in your openvpn configs if you want to and it should work. When we go on-site somewhere I'll do a DNS update for strikegate, the TTL is set to 10 minutes so it won't take long to start working. I attached the latest openvpn profiles. (These ones use the DNS names). The ESX environment is upgraded and moved to the new vlan on the base side. You can reach it at 172.18.10.10 and it's tied to LDAP so your accounts should log you into it. If you set any VMs up over there, make sure to use Internal-new or DMZ-new for the networking. I'll be removing the old vlans soon. Thanks, Andrew

1 0

run hascat from home dir
by Jon Barclay 29 Jul '15

29 Jul '15

sudo /opt/hashcat/cudaHashcat64.bin -t 32 -a 7 /opt/hashcat/example0.hash ?a?a?a?a /opt/hashcat/example.dict

1 0

openvpn
by Jon Barclay 29 Jul '15

29 Jul '15

1 0

Assessment Team Meeting Tomorrow
by Andrew Goble 28 Jul '15

28 Jul '15

Details on tomorrow's meeting: Will be held in the same conference room in the Library that we did the assessment in. If you come in a state car, you can park outside in the state spots. If you are coming in your own car, let Jon know ASAP so he can get you a code for the parking garage. I have hotel rooms reserved for Wednesday night for Chuck, Mark, and myself. (Travel will be covered by the System) So far I know that: Jon, Dave, Shane, Chuck, Mark, Me, the Green Goblin are coming for all or part of the time. Anybody else (Nate, Jake, Corey) is still very welcome to come down if you want to be involved and can get free. We can still get another hotel room if need be. We're all traveling Wednesday morning, I expect to get started around 10 - 10:30. Thursday I figure we'll go till 3 - 4ish or we get done, which ever comes first. Stuff I'd like to work on: CIO Meeting stuff New Strike Package Tools (i.e. Nessus, Kvasir, etc) - new and existing Tactics - Pen Test / SANS Anything else we need/want before first assessment in September. See you tomorrow. Thanks, Andrew

3 2