Security Archives - Flemming Riis's System Center Blog

May

Building a secure workstation one step at a time Part1

Categories: Device Guard, Security, Windows 10

Comments Off

Been trying to spend more time on device security and have been using device guard to lock down a admin workstation and servers

I am follow the examples from Matt’s post on merging baseline with new policy’s

http://www.exploit-monday.com/2016/12/updating-device-guard-code-integrity.html

If you dont follow @mattifestation Matt Graeber start now his work published on device guard is gold

Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\explorer.exe) attempted to load \Device\HarddiskVolume4\Source\PUTTY.EXE that did not meet the Enterprise signing level requirements.

So i wanted to add putty to my base policy

$Putty = Get-SystemDriver -ScanPath ‘C:\Source’ –UserPEs

New-CIPolicy -FilePath Putty.xml -DriverFiles $Putty -Level HASH -UserPEs

$MasterRuleXml = ‘FinalPolicy.xml’

$PuttyRules = New-CIPolicyRule -DriverFiles $Putty -Level Publisher

Merge-CIPolicy -OutputFilePath FinalPolicy_Merged.xml -PolicyPaths $MasterRuleXml -Rules $PuttyRules

ConvertFrom-CIPolicy -XmlFilePath .\FinalPolicy_Merged.xml -BinaryFilePath SIPolicy.p7b

Following the example on Matt’s blog post i wanted to try to add putty just on a file hash level , this will lock the policy down to this version only adding overhead when new released are out , but since putty isnt updated that often i will continue with file hash

It seems that going forward config manager can help with this , going to be exiting to see

This end up with the following xml that can will be merged into our policy file and applied at next reboot

<?xml version=”1.0″ encoding=”utf-8″?>
<SiPolicy xmlns=”urn:schemas-microsoft-com:sipolicy”>
   <VersionEx>10.0.0.0</VersionEx>
   <PolicyTypeID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyTypeID>
   <PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
   <Rules>
     <Rule>
       <Option>Enabled:Unsigned System Integrity Policy</Option>
     </Rule>
     <Rule>
       <Option>Enabled:Audit Mode</Option>
     </Rule>
     <Rule>
       <Option>Enabled:Advanced Boot Options Menu</Option>
     </Rule>
     <Rule>
       <Option>Required:Enforce Store Applications</Option>
     </Rule>
     <Rule>
       <Option>Enabled:UMCI</Option>
     </Rule>
   </Rules>
   <!–EKUS–>
   <EKUs />
   <!–File Rules–>
   <FileRules>
     <Allow ID=”ID_ALLOW_A_1″ FriendlyName=”C:\Source\PUTTY.EXE Hash Sha1″ Hash=”AB51FE77E5DB6A1979EEB6DFA6957613945F5562″ />
     <Allow ID=”ID_ALLOW_A_2″ FriendlyName=”C:\Source\PUTTY.EXE Hash Sha256″ Hash=”03EE66107D104F8ACA6E376D8B274ADF0D671A4D44F0549B6D83B775C0B21AAB” />
     <Allow ID=”ID_ALLOW_A_3″ FriendlyName=”C:\Source\PUTTY.EXE Hash Page Sha1″ Hash=”736A707BFBB80DFE3EE4259DF8BCD078B505BB4A” />
     <Allow ID=”ID_ALLOW_A_4″ FriendlyName=”C:\Source\PUTTY.EXE Hash Page Sha256″ Hash=”0843BA10DA94FC68065EA9B1FD53857106194E458FBF203948628A0EB3C539E3″ />
   </FileRules>
   <!–Signers–>
   <Signers />
   <!–Driver Signing Scenarios–>
   <SigningScenarios>
     <SigningScenario Value=”131″ ID=”ID_SIGNINGSCENARIO_DRIVERS_1″ FriendlyName=”Auto generated policy on 05-07-2017″>
       <ProductSigners />
     </SigningScenario>
     <SigningScenario Value=”12″ ID=”ID_SIGNINGSCENARIO_WINDOWS” FriendlyName=”Auto generated policy on 05-07-2017″>
       <ProductSigners>
         <FileRulesRef>
           <FileRuleRef RuleID=”ID_ALLOW_A_1″ />
           <FileRuleRef RuleID=”ID_ALLOW_A_2″ />
           <FileRuleRef RuleID=”ID_ALLOW_A_3″ />
           <FileRuleRef RuleID=”ID_ALLOW_A_4″ />
         </FileRulesRef>
       </ProductSigners>
     </SigningScenario>
   </SigningScenarios>
   <UpdatePolicySigners />
   <CiSigners />
   <HvciOptions>0</HvciOptions>
</SiPolicy>

So after reboot and policy applied

We now have a working putty

But since the author certificate wasnt whitelisted we cant run other tools , this was meant as a example on filehash vs certificate not due to lack of trust from Simon Tatham

May

Protecting your assets with Windows Server 2016 Device Guard Part1

Categories: AppLocker, Backup, Device Guard, Hyper-V, Security, Veeam

Comments Off

With Windows Server 2016 we get device guard https://www.microsoft.com/en-us/cloud-platform/windows-server-security

Enhance the protection of your applications on-premises or running in the cloud. Help ensure only trusted software runs on the server with Device Guard.

This means that we can now create policies on what are allowed to run on our servers in a more secure way than we know from applocker on desktops

In this example we have a Windows Server 2016 with Veeam installed and we want to protect against rouge applications / ransomware (this is not a veeam problem but just used as a example)

First off we block SMB in the firewall so don’t have a risk from a compromised workstation.

To get started with device guard i highly suggest the blogs from Matt Graeber @mattifestation / http://www.exploit-monday.com

A big thank you to Matt for posting his amazing content online

Windows Device Guard Code Integrity Policy Reference

http://www.exploit-monday.com/2016/12/updating-device-guard-code-integrity.html

Device Guard Code Integrity Policy Auditing Methodology

I have been following his guidelines on merging different policy’s to allow Veeam to function under the lockdown of the host

This post will show the start and the end result of the policy and additional post will show anything in between , its not a five minute now everything is working plan , there are mutiple issues with application spawning scripts and dynamic unsigned applications , but for many workloads this is very fast to get start with and give a very high return on time used

Following the procedure for whitelisting , i found that all of Veeam’s own binarys was signed with a few different certificates to they was easy to add to the policy

That left some files that looks to be from 3rd parties that wasn’t signed they have been added to the allow list on a file hash level , this means when there is new update our for veeam we need to add any updated files to the policy and reapply it

On the server running veeam we enabled device guard

Select a policy file that will be generated from the xml file with rules , from a security point of view anyone locally on the box can change the policy file so ACL needs to apply if logged on the box , or move to default system32 and for added security the policy can be signed

So with our policy applied and server rebooted , we have a functioning veeam and windows install

Now imagine a few the steps you have to go though to loose your data

1 , Logon on the veeam server

2, Open outlook is installed of some odd reason / Open webmail (if the server have internet acess for some off reason)

Download the odd worded email , click on the hml link that downloads a zip file and have a java script inside

Ignore the warning and click once more

and a few seconds later we have encrypted all our files including the backup data (bypassing both local defender client and firewall scanning)

Again the numbers of crazy decisions you have to go though to get this far is crazy, and still we see it

So what happends on our device guard protected server

We do the same as before

But with a different result

And we can see that device guard prevented the script from running and saving the day

Aug

Updating ATA to version 1.7

Categories: Active Directory, ATA, Security

Comments Off

Microsoft is keeping the fast pace with update to the star of their “classic” AD security solution

So we saw version 1.7 drop yesterday

New Major Features are

· Role based access control.

· Windows Server core support.

· Reconnaissance using Directory Services Enumeration detection.

· Pass-the-Ticket detections enhancements.

Unusual Protocol Implementation detection enhancements

Link : https://support.microsoft.com/en-us/kb/3185481

Personally we are looking fwd to RBAC its a major improvement for the majority of our customers and highly requested

Starting the install , we are upgrading fra 1.6.1 , we have a few enviroments on 1.4 and there is NO direct upgrade to 1.7

At upgrade we can either upgrade the whole database or do a partial migration , we opted for partial as having ATA offline for a longer duration wasnt a option , the database is placed on SSD so its unlikely it will take a day but we will test that in another enviroment