- USHE-assess - lists.utahtech.edu

hashview
by Jon Barclay 19 Oct '16

19 Oct '16

I mentioned this project to Andrew while at saintcon, but the rest of you guys may also want to also take a look. http://www.hashview.io/ Think it could make our cracking on the assessments more productive. I'm going to see about getting it going on my mini cracker. If it works well we can put it on the Krakken. -----Original Message----- From: USHE-assess [mailto:ushe-assess-bounces@lists.dixie.edu] On Behalf Of Matt Lorimer Sent: Wednesday, October 19, 2016 4:13 PM To: ushe-assess(a)lists.dixie.edu Subject: Re: [USHE-assess] Team IRC / Chat I've looked at it, but never installed it. Cool product. I am willing to setup/install a box with it if nobody else is jumping to do it. Matt Matt Lorimer IT - Systems Administrations Operations Utah State University 435-797-4242 Matt.Lorimer(a)usu.edu On 10/19/2016 03:43 PM, Goble, Andrew wrote: > Was just tipped off to the existence of this by a conversation on the > UtahSAINT list. > > https://www.mattermost.org/ > > Might be useful for a collaboration tool for the team on assessments > and certainly better than the IRC server I set up. I'll look into it a > little more. Anybody had any experience with it? > > _______________________________________________ > USHE-assess mailing list > USHE-assess(a)lists.dixie.edu > http://lists.dixie.edu/cgi-bin/mailman/listinfo/ushe-assess _______________________________________________ USHE-assess mailing list USHE-assess(a)lists.dixie.edu http://lists.dixie.edu/cgi-bin/mailman/listinfo/ushe-assess

1 0

Re: [USHE-assess] [Ext] Hash Cracking Challenge
by Jake Johansen 18 Oct '16

18 Oct '16

Steak Sauce? https://www.amazon.com/Heinz-Tomato-Ketchup-32-Ounce/dp/B000WHXN3C/ref=sr_1… On 10/17/16, 10:02 AM, "USHE-assess on behalf of Goble, Andrew" <ushe-assess-bounces(a)lists.dixie.edu on behalf of Goble(a)dixie.edu> wrote: So we scored a $50 amazon gift card and some pancake mix with our 2nd place finish at the SaintCon hash cracking challenge. What tools or cool stuff for the strike package do you all want to spend the $50 bucks on? Send some ideas out to the list so we can decide what to do with it. Thanks, Andrew _______________________________________________ USHE-assess mailing list USHE-assess(a)lists.dixie.edu http://lists.dixie.edu/cgi-bin/mailman/listinfo/ushe-assess

3 2

Hash Cracking Challenge
by Goble, Andrew 17 Oct '16

17 Oct '16

So we scored a $50 amazon gift card and some pancake mix with our 2nd place finish at the SaintCon hash cracking challenge. What tools or cool stuff for the strike package do you all want to spend the $50 bucks on? Send some ideas out to the list so we can decide what to do with it. Thanks, Andrew

1 0

Interesting adaptation of responder
by Matt Lorimer 06 Sep '16

06 Sep '16

Going to see if I can get this going with USB ethernet+Pi for the next assessment. The DHCP proxy bit is a nice touch. https://room362.com/post/2016/snagging-creds-from-locked-machines/ Matt -- Matt Lorimer IT - Systems Administrations Operations Utah State University 435-797-4242 Matt.Lorimer(a)usu.edu

2 1

Re: [USHE-assess] [Ext] Pokemans
by Jake Johansen 17 Aug '16

17 Aug '16

We use many lures. Though I would bet the majority of the players that came would be students. On 7/14/16, 11:42 PM, "USHE-assess on behalf of Goble, Andrew" <ushe-assess-bounces(a)lists.dixie.edu on behalf of Goble(a)dixie.edu> wrote: So Matt sent me this cool picture today: https://goo.gl/photos/qFy2XJ7onHFvTssV8 Then I been thinking about things and figured that we could take the the twins and go find the Pokeman[sic] Go pokestops to collect creds on assessments... there are hundreds of people wandering around my campus looking for pokemans. Maybe we could Jake to make a lure for us so the people and pokemans will come to us. http://starecat.com/how-to-kidnap-a-28-year-old-in-2016-rare-pokemon-in side-sprayed-written-on-a-truck-pokemon-go/ Also, if you were on the USU assessment, kindly do the needful and get me your report materials if you haven't already. Thanks, Andrew _______________________________________________ USHE-assess mailing list USHE-assess(a)lists.dixie.edu http://lists.dixie.edu/cgi-bin/mailman/listinfo/ushe-assess

3 2

Question about the keylogger use at USU
by Allen Hill 17 Aug '16

17 Aug '16

Hey Jake or anybody else that may know, One of our DBAs is going through the keylogger data from the USU assessment to make sure they clean up from any of the damage. He’s surprised that there doesn’t appear to be “that much” data in the keylogger files. I wanted to tell him to queue the “office space” soundtrack, but said I’d ask you guys instead. Do you know if the keylogger file is truncated at all, is there a limit to the amount of data it can store and if there could have been more logged than there was on both of the days it was used? In other words, do you think that logs contain the full sessions on the days they were used? Thanks, -Allen

4 4

[Fwd: Re: [Ext] [Fwd: RE: [Fwd: Re: UofU USHE Security Assessment]]]
by Goble, Andrew 15 Aug '16

15 Aug '16

Corey sent me this. For those of you who expect to come of the UofU assessment, any preference? The October week is slightly better for me, but I can do either. Thanks, Andrew -------- Forwarded Message -------- From: Corey Roach (ISO) <Corey.Roach(a)utah.edu> To: Andrew Goble <Goble(a)dixie.edu> Subject: Re: [Ext] [Fwd: RE: [Fwd: Re: UofU USHE Security Assessment]] Date: Mon, 15 Aug 2016 17:37:17 +0000 > Based on vacations, holidays, academic calendar and such, the > following two weeks would work the best: > > October 24 - 28 OK > November 14 - 18 OK > > > > > > > On Aug 11, 2016, at 8:52 AM, Goble, Andrew <Goble(a)dixie.edu> wrote: > > > > Updated info: > > > > The week of October 3 - 7 is probably out as well. Oct 31 - Nov > > 4th > > would be tricky, but doable if needed. > > > > So maybe listing what does work is better than listing what > > doesn't. > > > > I can field a team at the U these weeks: > > > > October 17 - 21 > > October 24 - 28 > > November 7 - 11 > > November 14 - 18 > > November 28 - Dec. 2 > > > > Let me know if one of those will work out. > > > > Thanks, > > Andrew > > > > > > On Thu, 2016-08-11 at 08:33 -0600, Goble, Andrew wrote: > > > > > > Hey Corey, > > > > > > Dan sent me your way to work out when to do the UofU assessment > > > this > > > fall. > > > > > > I just want to get a week on the calendar, don't need to > > > coordinate > > > much else till we are about a month out. > > > > > > I believe we can field a team most any week in October or > > > November, > > > except for: > > > > > > Oct 10 - 14 - SAINTcon > > > Nov 21 - 25 - Thanksgiving > > > > > > Is there a week that would work? > > > > > > Thanks, > > > Andrew > > > > > > > > > > > > -------- Forwarded Message -------- > > > From: Daniel Bowden <dan.bowden(a)utah.edu> > > > To: "Goble, Andrew" <Goble(a)dixie.edu> > > > Subject: RE: [Fwd: Re: UofU USHE Security Assessment] > > > Date: Tue, 9 Aug 2016 14:38:06 +0000 > > > > > > > > > > > > > > > Hi Andrew -- > > > > Yes, please work with Corey. > > > > > > > > Thanks! > > > > Dan > > > > > > > > > > > > -----Original Message----- > > > > From: Goble, Andrew [mailto:Goble@dixie.edu] > > > > Sent: Tuesday, August 9, 2016 8:06 AM > > > > To: Daniel Bowden <dan.bowden(a)utah.edu> > > > > Subject: [Ext] [Fwd: Re: UofU USHE Security Assessment] > > > > > > > > Hey Dan, > > > > > > > > Who should I coordinate with going forward? Corey? > > > > > > > > Thanks, > > > > Andrew > > > > -------- Forwarded Message -------- > > > > From: Stephen Hess (CIO) <stephen.hess(a)utah.edu> > > > > To: "Goble, Andrew" <Goble(a)dixie.edu>, Daniel Bowden <dan.bowde > > > > n@ut > > > > ah > > > > .e > > > > du> > > > > Subject: Re: UofU USHE Security Assessment > > > > Date: Tue, 9 Aug 2016 14:00:52 +0000 > > > > > > > > > > > > > > > > > > > > > > > > Andrew, > > > > > > > > > > Yes this is still feasible. Go ahead with your planned > > > > > assessment. > > > > > > > > > > Thanks, > > > > > > > > > > Steve > > > > > > > > > > On 8/8/16, 4:09 PM, "Goble, Andrew" <Goble(a)dixie.edu> wrote: > > > > > > > > > > Hi Dan, Steve, > > > > > > > > > > I wanted to reach out to you concerning the USHE > > > > > security > > > > > assessment > > > > > for the University of Utah. I spoke briefly to you both > > > > > about > > > > > it > > > > > at > > > > > the CIO retreat, but that was before Dan's departure was > > > > > announced. > > > > > > > > > > We had planned to engage the U for an assessment in the > > > > > October > > > > > - > > > > > November timeframe. Is this still feasible? > > > > > > > > > > Thanks, > > > > > Andrew > > > > > > > > > > Andrew Goble > > > > > Information Security Officer > > > > > Dixie State University > > > > > goble(a)dixie.edu > > > > > 435.652.7963 >

1 0

Security tools
by Matt Lorimer 27 Jul '16

27 Jul '16

At SAINTcon this year, I am responsible for all the villages. We plan to add a labs section with security tools to give people hands-on time with gear they have heard about but never played with (or not played enough with). Does anybody have ideas/suggestions/etc on what tools should be included in this village? So far my list is mostly focused on red team hardware, but I'd take suggestions for anything security related. Feel free to suggest classes of tools, or links to specific products. Matt -- Matt Lorimer IT - Systems Administrations Operations Utah State University 435-797-4242 Matt.Lorimer(a)usu.edu

1 0

UofU Assessment Planning
by Goble, Andrew 21 Jul '16

21 Jul '16

Hey all, For the UofU assessment: I talked to Dan at the CIO meeting yesterday. We are shooting for a fall time frame. For those of you who expect to come on the UofU assessment, whats going on this fall between mid-September and mid-November that won't work? SAINTcon is the week of Oct 11th, so that week is out. I know this is a bit early but we need to get on the calendar at the U and it takes time. Let me know what major conflicts are going on in the fall so we can work around them. Thanks, Andrew

1 0

CIO Retreat
by Goble, Andrew 19 Jul '16

19 Jul '16

Hey all, I have a few minutes with the CIOs this Wednesday, if there are any assessment related issues or thoughts you want me to bring up with them, let me know ASAP. Sorry for those of you who got cross-posted on the USHE-ISO list. Also, for any of you on the USU assessment, stop playing pokemans long enough to send me your USU report materials if you haven't already. ;) Thanks, Andrew

1 0

Pokemans
by Goble, Andrew 15 Jul '16

15 Jul '16

So Matt sent me this cool picture today: https://goo.gl/photos/qFy2XJ7onHFvTssV8 Then I been thinking about things and figured that we could take the the twins and go find the Pokeman[sic] Go pokestops to collect creds on assessments... there are hundreds of people wandering around my campus looking for pokemans. Maybe we could Jake to make a lure for us so the people and pokemans will come to us. http://starecat.com/how-to-kidnap-a-28-year-old-in-2016-rare-pokemon-in side-sprayed-written-on-a-truck-pokemon-go/ Also, if you were on the USU assessment, kindly do the needful and get me your report materials if you haven't already. Thanks, Andrew

3 2

MimiKittenz
by Jon Barclay 08 Jul '16

08 Jul '16

https://github.com/putterpanda/mimikittenz/blob/master/README.md

1 0

Windows Priv Escalation
by Jon Barclay 04 Jul '16

04 Jul '16

Check this one out, read all the way to the bottom. https://blog.ahmednabeel.com/from-zero-to-system-on-full-disk-encrypted-win…

1 0

LinkedIn Dump?
by Jon Barclay 01 Jun '16

01 Jun '16

Did anyone grab a copy of the new linked in password dump?

1 0

PCI 3.2 Released
by Jon Barclay 07 May '16

07 May '16

https://www.pcisecuritystandards.org/pdfs/PCI_DSS_3.2_Press_Release.pdf Requires two factor auth for all administrative access, not just remote access. Cashiers should be exempt, but store managers would need to use Duo. Jon

2 1

USU Assessment
by Goble, Andrew 06 May '16

06 May '16

Hey guys, For those of you who expect to come on the USU assessment in June, we have two weeks available with USU: June 6 - 10 June 20 - 24 What works best for you all? The week of the 20th is better for me, but I could do the 6th under duress too. Thanks, Andrew

3 5

Re: [USHE-assess] [Ext] Re: USU Assessment
by Jake Johansen 02 May '16

02 May '16

I would prefer the 6th-10th but can work with the 20-24th if needed. Sorry to be a contrarian :( Jake On 5/2/16, 4:02 PM, "Goble, Andrew" <Goble(a)dixie.edu> wrote: >Jake, did you have a preference on which week we do?On Mon, 2016-05-02 at 13:09 -0600, Mark Walton wrote: >> For Shaun and I, either week will work. Whatever is best for the >> others. >> >> Mark >> >> >> On Thu, Apr 28, 2016 at 10:46 PM, Jon Barclay <Jon.Barclay(a)uvu.edu> >> wrote: >> > The 6th - 10th would be better, but the 20th will work for me too. >> > >> > Thanks, >> > >> > Jon >> > >> > >> > >> > On Thu, Apr 28, 2016 at 9:40 PM -0700, "Goble, Andrew" <Goble@dixie >> > .edu> wrote: >> > >> > Hey guys, >> > >> > For those of you who expect to come on the USU assessment in June, >> > we >> > have two weeks available with USU: >> > >> > June 6 - 10 >> > >> > June 20 - 24 >> > >> > What works best for you all? The week of the 20th is better for >> > me, >> > but I could do the 6th under duress too. >> > >> > Thanks, >> > Andrew >> > _______________________________________________ >> > USHE-assess mailing list >> > USHE-assess(a)lists.dixie.edu >> > http://lists.dixie.edu/cgi-bin/mailman/listinfo/ushe-assess >> > >> > _______________________________________________ >> > USHE-assess mailing list >> > USHE-assess(a)lists.dixie.edu >> > http://lists.dixie.edu/cgi-bin/mailman/listinfo/ushe-assess >> > >> >> _______________________________________________ >> USHE-assess mailing list >> USHE-assess(a)lists.dixie.edu >> http://lists.dixie.edu/cgi-bin/mailman/listinfo/ushe-assess

1 0

phish
by Dustin Udy 07 Apr '16

07 Apr '16

I have a great phish for SLCC. In the attachment we could put in a lovely payload. Hello, My name is Bachus Abernathy and I am in the Office of Public Affairs. We are launching a new employee advocacy and sharing tool called Bruin Health Share. We are trying to get it into the hands of as many health care and health sciences employees as possible. To that end, would you please send the attached email to members of your staff? We would like to get it the email out as soon as possible as we have an incentive giveaway happening now that ends on the 15th of April. Thank you so much for your help. We think this program will help increase the reach of information about all the great things going on at SLCC by encouraging employees to become brand advocates. If you have any questions, please feel free to contact me. Best, Bachus Abernathy Office of Public Affairs

1 0

testing
by Dustin Udy 04 Apr '16

04 Apr '16

Please ignore

1 0

Dixie Draft on Dump
by Jon Barclay 02 Apr '16

02 Apr '16

Hey guys, The draft of the Dixie report is up on the dump. Check it out and make sure I didn’t screw up your sections. ;-) We need to still spend a little time on the summary section where we point out what Dixie does well, and what could be improved. I’ll work on that tomorrow, but wanted to have you guys check out the rest. Jon

1 0

Re: [USHE-assess] HID Vulnerabulity
by Dustin Udy 31 Mar '16

31 Mar '16

I see your vulnerability and raise you one. http://arstechnica.com/security/2016/03/maryland-hospital-group-hit-by-rans… From: <ushe-assess-bounces(a)lists.dixie.edu<mailto:ushe-assess-bounces@lists.dixie.edu>> on behalf of Jon Barclay <Jon.Barclay(a)uvu.edu<mailto:Jon.Barclay@uvu.edu>> Date: ThursdayMarch-2016-31 at 11:25 AM To: "ushe-assess(a)lists.dixie.edu<mailto:ushe-assess@lists.dixie.edu>" <ushe-assess(a)lists.dixie.edu<mailto:ushe-assess@lists.dixie.edu>> Subject: [USHE-assess] HID Vulnerabulity http://blog.trendmicro.com/let-get-door-remote-root-vulnerability-hid-door-…

1 0

HID Vulnerabulity
by Jon Barclay 31 Mar '16

31 Mar '16

http://blog.trendmicro.com/let-get-door-remote-root-vulnerability-hid-door-…

1 0

Before SLCC
by Dustin Udy 28 Mar '16

28 Mar '16

The latest BHS video would be worth watching before the SLCC audit in a month. Internal Pivot Pentest Go Kit https://www.youtube.com/watch?v=gBxwYHIWePA

1 0

SLCC Assessment
by Goble, Andrew 25 Mar '16

25 Mar '16

I'm meeting with SLCC tomorrow to kick off the SLCC assessment. On- site April 25 - 29. I'll keep you guys in the loop, I expect that they will green-light us for some off-campus testing starting April 1 - 5th- ish. Last I knew: SUU - Mark and potentially SUU new guy USU - Matt UVU - Not sure, Dave is that you? UofU - Dustin Dixie - Me Are doing SLCC. Let me know if I've got it wrong. I'll be getting hotel rooms soon, will likely be at the Springhill Suites on 4500 South again. Dustin and Dave, I will NOT be getting you hotels unless you tell me to. Thanks, Andrew

3 4

Dixie Report
by Jon Barclay 03 Mar '16

03 Mar '16

Hey Guys, We need to get going on the report for Dixie. Let me know when you have your sections done and I'll get to work on compiling them. Thanks, Jon

2 1