Why Malicious Employees LOVE Active Directory

Hello everybody. Welcome to Top Secret where we talk all things about insider threats. Today's discussion is why malicious employees love Active Directory. So today we have Shona Fear, Jim Cook for Kiva Network and myself, Boss Fisher. So before I introduce Jim, Sean, I want you to take it away and give us a little bit of a background round.

Thank you Bar. Thank you and thanks everybody for joining the session. So let's set up the scene. It's not surprising statistic that nearly half of all the data breaches occur because of insiders. Such breaches can lead to catastrophic financial and reputational damages. Now inside the breaches vary from unintentional such as human error, errors or lack of knowledge, lack of awareness, carelessness or even malicious intent. But how much damage can insider inflict? An organization rely on the volume and quality of data they can put their hands on. Now, 90% of the world enterprises organizations use Active Directory as the primary method for authentication and authorization. So it makes sense that this would be the first place an attacker would look to compromise right now. Where else they're going to get able to get their hands on such a myriad of both company and employee information this episode. Question is how secure Active Directory from insiders attacks.

Right, Excellent scene. Today's guest is Jim Cook from Activo Networks. Jim, just give us a bit of your back background and your role did you play within Ativo?

Yeah, thanks Bo. Thanks Sean. Hello everybody. So yes, I look after Ativo Networks for Australia and New Zealand. Ativo is a US based technology vendor focused on detecting and responding to privilege escalation and lateral movement. And the central thing around those is Active Directory because almost all attackers go after it. So I was very excited when you guys asked me to be on this because it's a subject close to my heart.

Thank you. So let's dive in straight away. So how can an employee, let alone be malicious, how can an employee take advantage of Active Directory?

Yeah, so I suppose there's a few different sort of ways that employees can get involved. I think the first thing to remember is that AD itself was built in the 1990s and it's been in many organizations therefore for two decades. And it grows organically. So you know, as organizations buy other organizations, open offices, people leave, join applications, get built and tear down torn down. AD has an input into all of that because it's like, it's like the beating heart of the organization. And so over time you just get this sort of sprawl of information and it's really hard to control. And it was never really designed to do what it's doing today. So because of that, as an insider, as an employee in a company, you can ask AD anything you want and it will just tell you. So if you're technically savvy, you can ask it. You need this information. You can ask, where are the critical users, who are the domain administrators, which are the people that look after ad? And we'll just tell you. And then from an attacker perspective, because of the complexity, it's often easy to find ways through security by using Active Directory. So it kind of depends if you, as an insider, what you're really, what you're really intending to do as to how detailed you need to be. So what I mean by that is you can go and get a transfer to a different part of the organization which has got the information you want. But if you're technical, you don't need to do that. You just need to find someone that works in that part of the organization and then get to their credentials.

Okay, so how would that attack sort of progress from start to finish? Just give us the scenario, for example.

Yeah. Okay, so let's maybe just quickly talk about what credentials mean in this sort of context. Because everything's connected to the IT systems are connected together with ad. To get into an IT system, you need credentials, and that's what's stored in Active directory. So as an attacker, you sit down at your desk and you say, I need to get some information from the finance team, because that's my objective is to maybe exfiltrate some financial documents. And so what you would do is you would find out who works in the finance team, and then you would try and either trick someone through social engineering into giving you useful credentials, or if you're technically savvy, you can deploy technology to do that for you. So one way of doing it, for example, would be to phone the help desk and say, hey, I've got a problem with my computer. Can you come and take a look? And then when the help desk person logs into your computer, you steal their credentials, which are of course a higher level, a privileged level of credential, and then you can then use those credentials to log into the other person's computer and take it over.

Okay, so basically taking those credentials and then what? So, so is it just as easy? Okay, they've got the credentials now, they've got access to the financial records that they have been trying to get their hands on.

Yeah, if they've got the. If they found the right person who has access, then they can absolutely do that many attacks though, actually go after Active Directory because if you control Ad, what's called being a domain admin for ad, then you can literally. It's like having the, you know, the skeleton key. You can get anywhere in the organization, absolutely anywhere. So excuse my background dog alarm going off there. So if that, so if that happens, this is part of the problem. So it's really important to make sure you cut down the level of exposure that AD has, because that's how attackers can get to domain administration. So red teams will generally, will generally go after AD and they'll do certain sort of tests, they'll ask AD questions and find out information. But what they're really looking for is things like a user who has been given a special level of access and then it hasn't been taken away again. So someone goes on holiday, they give Jim, their second in command, access to whatever they should have access to. They come back from holiday and it just stays there. So there's this sort of hidden access that people can start to use once they understand how AD works.

Excellent. I assume that when it comes to Active Directory, the privileges are not given just for individuals, they're also given for specific roles. So there are virtual users that are being created and users can get allocated with these accounts. So even though these are AD accounts, but these are not individual human accounts, but they have the privilege. And that's the problem when these roles are switching from one to another. Inheritance.

Yeah, absolutely. And groups as well. So in ad it's called groups. So Sean's a member of the admin group for this particular system. But then you get this problem called nested groups, which is part of the problem with evolution of the way ads evolved is that there may be a subgroup that's part of a group that nobody really knows about that still has the same level of access. And so it's kind of unpicking that and bringing visibility to it. That is what. When we talk about reducing the footprint or the attack surface for Active Directory, that's what we're really getting at, is sort of unpicking those hidden privileges that exist in almost every organization. Well, actually every organization, I'll go so far as to say yep.

So how. Where are the technology people or the networking people about this challenge that they have about this problem in terms of Active Directory being such a juicy target?

Yeah, well, look, I think everyone knows it's a problem, but it's been, if I change my analogy from the beating heart to the plumbing of the organization, it's just been there For a while it's hidden in the walls. People don't really think about it. And so I think everyone's aware there's a problem with ad, and certainly the conversations we have, of course, are all around that. But exactly how to fix it is the issue. Because often, organizationally, the security team and the end user compute team are different. The end user compute team sometimes, often owns the Active Directory component. So it's not as if it's part of the security. Part of their job is to secure it, but it's more important that they give people the right level of access to things.

Correct. Correct.

Sometimes. Although you may do an audit on ad, and I say, right, here's a whole lot of things to fix. The reality is by the time a month's gone past, there's higher priorities again and you wait till the next audit before you start fixing things again. So, yeah, there's a visibility problem, I would say, rather than everyone knows there's a problem.

Yeah, everyone, yeah. So I was going to add. So how does, for example, The Cloud or Office365 or remote access add to the complexity of the problem?

Yeah, that's a good question. So as, yeah, most organizations are starting to use public Cloud now or Microsoft's 365Cloud, or a combination of both. And so that adds another level of complexity. So most organizations have an on prem AD from the 90s and then Azure AD, which is the. Which is a much more secure version of Active Directory which will control access to things like Office 365. However, there's also the public cloud to consider. So to get out to the public cloud, you may use Amazon, you may use Azure or Oracle. There's quite a few clouds around nowadays and they all have different levels of entitlement. So. And they talk about things slightly differently. So if you're a user and you're an administrator and you may have access to the Amazon cloud, the Azure cloud and Active Directory and all of those, that adds yet another level of risk. And so being able to unpick that and understand who has access to what and whether they have too much privilege is an important part of modern security from this perspective.

Okay, so for my. Go ahead.

To add to that complexity, many organizations buy different systems, they buy different solutions, and most of these solutions and systems ask access to that full access to the Active Directory so they can communicate with the users and the users can actually be integrated into those systems. And those systems are, once they are.

Installed.

It'S a third party that basically provide you with ask an access. Sometimes these are cloud solutions that asking access to your active directory which I guess it makes it more complicated. Complicated, right, yeah, absolutely.

I mean if we look at this SolarWinds attack, probably one of the more well known ones recently, they didn't come in through an end user, they came in through a third party. And so, and they still leverage Active Directory as part of their, as part of the attack cycle they did something called a DC sync attack. So they found someone whose privilege allowed them to sync Active directory onto their own computer. They performed that, exfiltrated it, found out the information they needed, created their own key to allow them out into the public cloud. So yeah, ad even then, even though the information all sat in the public cloud, the way to it was through the on prem active directory.

Okay, so Jim, what are our organizations. Yes, what are our organizations doing today? Looking at this problem. So we know, we talked about the networking people, whether they're aware, but what about the information security side of things? How do they approach the problem?

Yeah, so the trick is not to disrupt the users who are actually trying to do their job.

Correct.

And so, and that I think has been a bane of being a security person for some time. It's having to work behind the scenes. So we think at ativo that the first, first thing you need to do is be aware of the problem. And so our particular approach on that is to create a dashboard by which you can see all the vulnerabilities, misconfigurations and security levels that exist across your ad. Because once you can see it then you can go and talk to people and say, hey, does Burrs need this level of access to this system that he hasn't accessed for five years? And you can start to sort of wind back those potential holes that, that exist.

All right, Sean, did you want to ask something or.

No, no, go on, go on, I'm listening.

At this stage. Yeah, so I was going to take to the next stage. How does the TiVo network then says okay, we can give you visibility. Where do you take it to the next stage.

Yeah, so the first thing is visibility and allowing, you know, getting that whole control, reducing to say it again, but reducing down the attack surface of Active Directory makes a huge difference. The second thing is because, because of the age of ad, even if you've got the most tightly managed perfect AD in history, you can, an attacker can still ask ad anything. So you can still ask who are the domain admins, who's in the CEO group, who's got access to critical Systems AD will just tell you. So we think that the next layer on top of that is to actually hide active directory from attackers. So because there's no reason why, you know, Dave in Accounts needs to know who the domain admins are, we think that you can hide that information from Dave in Accounts without disrupting his job and create a much stronger level of security. So you know, when Dave and Accounts does ask who are the domain admins, he'll still get a response but you'll have a really high, but it will be a false response. So it'll be some made up names that sound real and you'll have a really high fidelity alert that hey Dave and Accounts is asking for domain admin people. Why is that? You can go and have a conversation. We'll find out whether he's, he himself is trying to find out or whether his computer's been taken over by someone outside the organization.

Yeah, good point. And that becomes by far more effective and should I say proactive measure to prevent someone from snooping around. What about, I mean we've seen now the situation online just recently where hackers or cyber criminals are asking for administration credentials to get in and compromise an organization. Is that something that, that ActiveT network can also help prevent such attacks?

Yeah, yes it is, I think so. Getting credentials or escalating privileges, which generally means getting someone, someone with a better level of credential is a key part of most attacks. And so yeah, part of our goal is to again hide those credentials and present decoy credentials instead. So we can do it out on the Internet as we do for many advanced organizations or more importantly inside the organization on that first point of compromise. So from an insider perspective, someone may, if they're motivated, actually apply for and get a job in your organization just for nefarious purposes. But they're still going to use their computer and they're still going to try. If they're, if they're using a cyber attack, they're still going to try and get information. So they're still going to get the, try and get credentials off the computer. And so, and so we can hide those. We can, we can put decoy credentials instead. So you can, you can't ask AD you can't get the credentials. That's, that really, really restricts your ability to move around inside the network. Okay, so something else that might be relevant to this though is if you're an attacker and you can't trust AD anymore and you can't trust the credentials that you found, if there's some Reason someone hasn't come and tapped you on the shoulder, which by now they pretty much should have done. You may then do a bit of network scanning, so you may sort of look around, see if there's any computers nearby that you can get into by using RDP Remote Desktop Protocol or something like that. And so something else that we can do is actually accept connections to RDP and forward them on to a realistic looking Windows machine that's actually a decoy machine. So the attacker, again, they think they've made a connection, they think they've got to a new computer and they're slowly moving forward in their attack, but actually they're not. And again, you're just wasting their time derailing their attack and, and getting some really good information about what they're doing.

Is that method basically to identify the vulnerabilities or obviously deceiving the attackers? It's a great methodology to prevent real attacks. But what a client, for example, can learn from these virtual or non.

The.

Non real attacks, what can they learn from that?

Yeah, quite a lot, because you've got a clean environment. So if you manage to get an attacker, so they compromise an endpoint, they fall for some of the decoy information and they end up in a decoy machine which by the way should look and feel exactly like your customer's soe. It's a completely clean environment. So you can see absolutely everything that they do from that moment onwards. So from a, from an incident response perspective, if it's an advanced organization and they have an instant response team, which is different from the detection team and really getting quite serious about it, this means you can actually look for the indicators of compromise that the attacker is producing. You can see what they're downloading, you can see what keystrokes they're using, which will mean that because it's, it's possible or sometimes even likely that this is not their first time in your organization. So the goal in this case is to find out what other machines they have access to, what other entry points they've got, maybe what sort of malware they're downloading. So you can then go and do a scan of your network to find out what other, where else that that indicator of compromise might exist.

Alrighty. Now, Jim, I know that your organization provides a sort of a very, very valuable assessment. Can you explain on that?

The AD assessment? Yes. Yeah. Yes. So in order to prove the value of getting this visibility in ad, it's really easy to install. We don't need privileged user credentials, we just need standard access to a single PC in your network that's joined to the domain. We can then either use our cloud based console to produce you. The visibility of what's happening in your organization takes about half an hour or if you don't want your data going offshore, then we can use an, use a VM in your organization and do it that way as well. And that's something we'll do for free to prove the value of the technology that we have. So as a customer or potential customer, you get, you get full access, you can get a real view and yeah, we know it'll demonstrate the value of what we're offering.

Excellent, excellent. So what is the best way for viewers to reach out to you? Just you know, if they wanted to, to do such an assessment?

Yeah, so talk to you guys or talk to me, I suppose, catch me on LinkedIn or. Yeah, or send me an email. Yep, whatever works. Good. I'm in Sydney so I'm not doing much. I'm just.

The challenges with lockdown. So Sean, one last word from you or key takeaway that you found about this conversation Important?

Yeah, sure. Look, from what I hear, Jim, it looks like that ad, which is it's been for quite a long time is one of the basic foundations of any network today. But still it's some kind of taken for granted. So it is something that works on the background, it doesn't get too much attention, it is the door to your network but it's not sexy topic to discuss and to maintain. So it looks like that a lot of vulnerabilities are quite forgotten there because they're not quite managed. And that's why when organization get hit that, that is one of the main doors that insiders will use and take over. So that's why it's important to, to protect it. And I think the, your approach, the TiVo approach is quite very interesting. So thank you for that.

Yeah, it sure is, yeah. Now Jim, is there, is there a question that I've. I should have asked you but I haven't asked you at this stage.

That's a good one.

Not that I can think of. I think the one thing I would like to say though is if you ask any of your pen testers that you use how long it takes them to get domain Admin, when they come and pen test your network, the answer will be half an hour which really just demonstrates how vulnerable this is. So yeah, just a good question to ask to see, to see whether there's value in hardening this.

Yeah, much appreciate the opportunity so what I'm going to do is I'm going to put all the details down below so you'll have access to. Jim, you'll have access to. If you're interested in doing this assessment, which I highly recommend. Sean, any last words that you want to.

Everything will be recorded. Please comment and subscribe to our channel. And all the details will appear just below.

Yeah.

So, Jim, look again, thank you very much for coming along on as a guest. I've really learned quite a bit about it. Sean, thank you as well. And we will see you next time.

Thank you.

Thank you.