The DMZ

Rory Alsop

00:50

@Iszi Hopefully more folks will come along - got a load of folks chatting at B-Sides

packs

@Iszi Whenever Rory decides to show up, lazy bastard.

Oh, hi

For the record, I was nearly finished with that when your message came through :)

Rory Alsop

@packs - hosted a good talk from a guy who had to destroy a load of hard drives for the british army in Afghanistan. Shredded into .25 cm pieces :-)

@packs - hi

LOL

packs

@RoryAlsop YUS!

While operating the crusher was pretty cool, I would have lost control of myself if they could have gotten a shredder instead.

As it was, the crusher was a budget stretch.

Rory Alsop

Hahahaha - yeah, these guys had 4 shredders running almost continuously for 4 weeks (except when they overheated)

The photos were excellent

heh - hard drive shredded pr0n

packs

jeebus

This is a small, a single drive unit with a push-button operation.

Rory Alsop

00:53

their big problem was tracking the devices accurately enough to confirm all destroyed

many hundreds of drives

packs

I can see that

Rory Alsop

and data of a significantly high level

:-)

packs

Well, you threw out a few magic words that indicate rather high levels of..uh...sensitivity.

Rory Alsop

the talk was interesting - especially the things he couldn't tell us but hinted about

packs

I'll bet.

Military guys are a lot of fun like that.

Rory Alsop

00:56

Well he is a contractor but with a military background, so may have been rubbing it in a bit for us poor civvies

:-)

packs

A couple of years ago at our local conference I ran a working session that was supposed to be about log review.

The time it took before we got to the "And this is where you call your security guys" was fairly short, so we ended up doing a full on compromise analysis.

Rory Alsop

nice

packs

I had a fistful of IT guys from an Air Force base in the crowd. They were loads of fun

Their answer to the "What do you do when you figure out the source?" was 'hack them back'

Rory Alsop

MMmm - I wish

Richard Bejtlich (@taosecurity) was along those lines at BSides

Very into treating it as out and out war

packs

I'm a little torn on that. At first blush it feels a bit too become the enemy to defeat them. Granted, I'm still new to the field so maybe as I get older it'll change.

Rory Alsop

01:07

I kind of feel we have to stay within the rules otherwise chaos :-)

packs

What separates us from the animals and all that? :)

Rory Alsop

aye

packs

And by animals, I mean the metaphorical meat things we eat. Not you guys that are out to get us. I am not calling you animals.

coughs

Rory Alsop

LOL - met some very interesting people in SF.

Very interesting

Defcon interesting

note to self - do not do an HB Gary Federal ... ever

packs

Free "security" con in SF? I'll bet.

Rory Alsop

01:09

:-)

packs

About how many attendees?

Rory Alsop

I think it was only around 300 max at any one time, but with BSides being literally on top of the RSA conference I think we got a lot of walk ins

oh - I did some write up on blog.7elements.co.uk ... the last 3 posts are all about the con. Links to photos too.

packs

I really need to add that to my feed

Rory Alsop

normally we just put stuff on security we find interesting up on there, but use our personal blogs for associated stuff (eg Rory M blogs on ruby and database security)

But for conferences, it made sense to use the central one

packs

That's cool. I have follow enough things now that a low velocity feed is not necessarily a bad thing.

Rory Alsop

01:14

yeah generally one a week or less

sometimes one a month :-)

packs

LinuxHater posts way less than that

So is being named Rory a condition of employment?

Rory Alsop

Well, we are still in startup mode, so need to do all the good things to keep interest up

LOL - we tried to persuade Dave to change his name, to avoid confusion, but he wasn't having any of it

...Michael Baldwin, Bruce. Michael Baldwin, Bruce. Michael Baldwin, Bruce.

packs

He looks like those kind of guys.

Yeah...I get the feeling that's a TV reference that never made it this far west

Rory Alsop

ahhh - Monty Python

intriguing.com/mp/_scripts/bruces.php

packs

Hells Bells! That was done at the Bowl!

That's the page I was just looking at. Thank you google.

Rory Alsop

01:17

google ftw

packs

I'm young enough that I've not seen the majority of their stuff, mostly just the movies.

Rory Alsop

Me too really. I vaguely remember some of the TV series but I was too young for it, so caught it next time round

packs

Hm, I just looked at that question about how to best hide files.

Rory Alsop

Don't tell me you have a much better way...

damn

packs

As written, that sure as hell looks like a burgeoning black hatter trying to get better.

Rory Alsop

01:20

Akkk - you are right

packs

I haven't fully grocked either the question or your answer yet, sorry.

Rory Alsop

don't think I gave the game away

packs

I desperately want to provide a better answer than you, though.

Rory Alsop

If they are new they won't have decent rootkit skillz

:-)

packs

At first blush, no.

Oh noes! You told them that rootkits can hide things!

Rory Alsop

01:20

LOLZ

packs

Whelp, the little one's asleep, the wife's down, so it's time for wine and movie.

Have a lovely early morning.

Rory Alsop

Have a good one - I have all kids asleep, wife nearly asleep, houseguest asleep, and I'm still slightly on SF time so catching up on emails, and docs and learning a bit of Fortify:-)

packs

With any luck, I'll have time to get back to work on the parsenessus script of de Beaupre's. I haven't even fiddled with it since November, and I think I have some more commits to make.

ta

Rory Alsop

That does sound more exciting than my evening

Iszi

01:35

@packs Glad I wasn't the only one who thought that, at first sight.

Rory Alsop

hey @Iszi

shows how tired I am, it was not the first thing that occurred to me :-(

packs

02:28

Hey @RoryAlsop, you walked down and saw the O'Brien. I got to tour that ship when they had the engine running. What fun.

AviD

21:06

@RoryAlsop woot! got my [Fanatic] badge, first gold one :)

@RoryAlsop kudos on the bsides, hope it will bring a crowd...

but at least you had fun :)

@packs we turning this convo into a food discussion again?? ;)

Iszi

21:20

Howdy @AviD

AviD

evenin' @Iszi

howarya?

Iszi

Mildly frustrated. Cable guy is over 1 hour overdue.

AviD

"CAAAABLE GUUYYY!!!"

count yourself lucky...

The Cable Guy

The Cable Guy is a 1996 film, directed by Ben Stiller, and starring Jim Carrey and Matthew Broderick. The film also features Leslie Mann, Jack Black, and Owen Wilson. It was released in North America on Friday, June 14, 1996 by Columbia Pictures. Plot A TV-obsessed cable installer, who gives his name as Ernie "Chip" Douglas (Jim Carrey), installs Steven Kovacs' (Matthew Broderick) cable television service after Steven moves out of the apartment he shared with his girlfriend Robin (Leslie Mann). After he illegally gives Steven free pay channels, Chip believes he and Steven have struck up ...

Iszi

@AviD Never realized Ben Stiller had anything to do with that.

AviD

neither did i.... but it makes sense.

Iszi

21:23

@AviD Oh certainly

Wow. I'm glad @GrahamLee brought down the mod hammer on this one. Would have had a really hard time deciding which reason to choose for closing.

0

Q: Does anyone have thoughts/experiences on the IT division of Accenture? I just got a job offer from them.

Hi everyone, this is my first post here. As the title says, I just got a job offer for an entry level Technology Analyst role at Accenture, which is a very large consulting company. I'm a recent college graduate, and this would be my first "real" job out of school. I'm wondering if any of you gu...

security-theater

AviD

@Iszi ayup

Iszi

Let's see... Subjective/Argumentative? Off-Topic? Not a real question?

AviD

AOB

and that choice of tag - wtf?

Iszi

Oh, it fits Too Localized, too.

AviD

is that a subtle way of saying that accenture does mainly security theater...?

Iszi

21:26

@AviD Yeah, boggled me a bit too.

If I had a delete vote, I'd use it.

AviD

hmm.... I think you're right, but I'd leave it a few days - just so the newbie can get a clue as to whats going on.

Iszi

Not that anyone will likely read it, but perhaps we need to make a tag wiki for security theater, for those unfamiliar with it.

AviD

sucks to ask a question on a new site, then come back couple days later and not find the question...

Iszi

@AviD Can't vote delete until two days after closure anyway.

AviD

@Iszi yeah, I've been meaning to start doing more tag wikis (twikis), just never have enough time for it

@Iszi dint know that, inneresting

howdy @maker

Iszi

21:29

@AviD Diamond mods can kill anything anytime AFAIK, but voters have to wait a couple days.

AviD

gonna wait anyway

for the reason I said

makerofthings7

Hey AviD, just scrolling through

Iszi

@AviD Not in disagreement with that at all - just clarifying.

AviD

@makerofthings7 let us know if you see any steak

makerofthings7

@Avid I love steak; CA is hosting an event next week. RSVPers get free Mortons.

@Avid - Was that random, or did I miss out on a (juicy) conversation

AviD

21:33

@makerofthings7 mortons?

the potato chip, or the salt?

makerofthings7

A nice spot in NYC... although the event is world wide.

Iszi

@makerofthings7 Hehe... "juicy"... "steak"... Mmmmm...

AviD

@makerofthings7 semi-random, these guys are always talking about food in one form or another...

makerofthings7

I love good food. Hate bad food.

AviD

@makerofthings7 that's a very controversial statement, there.

makerofthings7

21:36

Yea, I live on the edge...

My first time using SE chat... seems like I need to learn a few things.

AviD

heh, yeah, it's actually pretty cool, though

definitely read the faw

Iszi

Persistency is nice.

makerofthings7

Am to hungry to learn. Dough!

AviD

hehe, @RoryAlsop I meant to type faq, and it (subconsciously?) came out faw....

makerofthings7

NY Bagel, or Pastrami sandwich... hmmm

AviD

21:39

pastrami on bagel!

btw, NJ have better bagels

makerofthings7

OMG, need to go AFK to get some

NJ, where's that? ;)

I'm in Jackson Heights. Best Indian, Columbian, and Italian food in NYC

AviD

heh

where you put your garbage....

and where you get your lawyers from.

so, to sum up, where you keep your garbage.....

makerofthings7

Well that must be the secret ingredient.

to make the bagels to good

AviD

so, not so far from NJ....

hehe

makerofthings7

... or the ingredient that makes you believe it

AviD

21:42

hehe

makerofthings7

Time to get food for my bus trip to Doylestown Pa!

ttyl!

Iszi

@makerofthings7 Cya

AviD

laters

Iszi

@AviD So, is there anything we can do to save the TOCTTOU question or should I just let it die since there seems to be no actual solution out there for it?

AviD

lol.... forgot about it....

wait, lemme look at it again

btw, why do you call it tocttou? I've only ever seen it toctou (single T in the middle...)

Iszi

21:47

@AviD Wasn't sure which it was, and that was the first one I found when I looked it up.

AviD

heh. really? inneresting...

Iszi

My main problem is, most people were answering the question wrong - addressing the specific case example instead of the broader question.

But at the same time, it really looks like there might not be an actual fix for the problem.

AviD

okay, lemme break it down, the way I read the question now:

1. How do we fix the general class of TOCTOU vulns?
2. how can we mitigate (i.e. workaround) for OS-level vulns?
3. I want to change the way Windows permissions and ticketing works, so I'm going to call it a bug...
4. I have a specific situation - temporary administrators - that does not work the way I expect, or want, because of the way Windows works. How can I work around this?

which way did you mean it - one of the above? all of the above? some of the above? none of the above? something else?

Iszi

It's somewhere between 1-3.

AviD

obviously, I was answering 4. @GrahamLee was answering 2, I think

ah, see...

Iszi

21:52

Probably 2 is closest, if you specify Windows as the OS.

AviD

I would see 3 as close to a rant... and if it was more clear cut I'd probably want to close.

2 is more in general - not even specifically TOCTOU, as @Graham answered at first.

Iszi

Not meant to be a rant at all.

AviD

well, I know that now....

Iszi

Really, here's how the situation breaks down.

AviD

but thats how Windows works, its by design and not even slightly a bug, not if you use it right.

Iszi

21:55

1.) I discovered the TOCTTOU vuln in relation to Admin rights in Windows via personal experience.
2.) As a result, I want to know if there's a configuration option in Windows that I've missed which will close this hole, or if there's anything else I can do to mitigate the vulnerability. (Vulnerability meant not to be specifically regarding Admin rights.)

AviD

I'm confused.

Iszi

@AviD And here I was trying to clarify. :-(

AviD

a. why do you think this is a vulnerability?

b. how could there be some way to configure a way to close "vulnerability" in general, not specifically this one?

Iszi

@AviD For a user to have any form of inappropriate permissions at any given time? How is that not?

AviD

only because you define it that way, possibly without understanding how windows permissions work

Iszi

21:58

@AviD The TOCTTOU issue affects more than just Admin rights, I'm sure. It probably covers folder permissions, User Rights Assignments, etc.

AviD

"that way" == "inappropriate"

@Iszi yes and no

i.e. some of this does, some of it is different

but yes, not just admin - any OS-level permission is granted, until the user's token is refreshed.

but this is only really an issue for Admin-level privs, which is not an issue.

i.e. dont grant admin, to someone who is not trusted

admin rights is gameover

Iszi

@AviD That includes folder/file permissions, right?

AviD

kinda

it works a bit differently, but in essence it has the same effect, as far as this discussion goes

Iszi

So then, how is that "only an issue for Admin-level privs"? Is there not the threat of users reading/writing files that they should no longer have access to?

AviD

so, again, I dont think it makes sense to discuss "the TOCTOU vulnerability" in general, without the specific instance....

you already gave them the right to read it, did you not? how do you know that he didnt make a local copy of the file, in the 5 minutes you wanted him to have access?

that goes back to what makes DLP so darn hard

you dont want someone to misuse your data - dont give them access to it in the first place.

yes, of course there are situations where that can be an issue...

but with ACLs its different, and there are easier solutions.

Iszi

22:05

@AviD Just as with the others, this is discussing what might have already happened - I'm trying to find a way to prevent what might still happen.

AviD

@Iszi so dont give him access....

or, remove whatever ACE gave him access in the first place

Iszi

@AviD What about transfers?

AviD

what transfers @Iszi?

Iszi

And not all access is given intentionally - although that is a bigger problem.

AviD

@Iszi yeah, well... access management is hard.

Iszi

22:07

@AviD Such as transfers between departments, where a user should lose his old access rights?

AviD

I'm staking my work on that ;)

ah, so he should lose access to that ACE

or however your ACL is configured

but, thats not TOCTOU - nor is it the same as the other question

Iszi

@AviD I'm getting lost. Haven't heard ACE before.

AviD

ahh, okay

lets hop back a few paces.... quick NTFS permissions primer... :)

ACL you know?

access control list

Iszi

Yes

AviD

basically a list of access control entries (ACE)

Iszi

22:09

Okay...

AviD

(sorry, just wanna make sure we're both on the same page - dint mean to come off condescending...)

Iszi

It's all good.

AviD

so ACE is basically that row of user allow/deny

Iszi

Or groups, right?

AviD

right

Iszi

22:10

(Preferably groups, as I understand it?)

AviD

typically, in large fileshares, youll have simple ACEs of user groups

so a user has access to a file/folder, based on his membership in one of the groups in one of the ACEs

Iszi

Right.

AviD

right

so, if his user had his own ACE - you remove the ACE, you remove the permission.

Iszi

I'm still not seeing the solution here, though.

AviD

same thing with his group

Iszi

22:11

The removal still doesn't take effect until his token refreshes though.

AviD

well, you simply take his ACE out of the ACL - boom, he has no permission

thats not TOCTOU

well, not exactly...

ACLs are not stored in his token.

his group memberships are, as are his OS privileges.

the problem you'd still have, though, is if you don't want to take the group ACE out of the ACL. right?

because the group is still in his token.

Iszi

Right.

AviD

so, several part answer....

and, this is assuming he never had "Full Control" of the file/folder in the first place, either

Iszi

@AviD Like I said, I'm not concerned about past actions in this solution.

AviD

you can add his user with a DENY ACE, that would override any granted permission anyway...

Iszi

22:14

Though it is something to be mindful of, otherwise.

AviD

@Iszi that's not a simple assumption, past action can influence future abilities

Iszi

@AviD Sounds messy in the long run.

AviD

in the long run, the user's token will get refreshed - either he'll log off, or the token will refresh itself.

Iszi

@AviD Right, but what I'm trying to prevent is future action via authorized in-place mechanism.

AviD

I'm not sure how often... I seem to remember 12 hours, but I might be confusing with AD's Kerberos implementation...

Iszi

22:18

Example: I have Administrator permissions via membership in the Administrators group which was authorized at one point. I've been a good boy and haven't installed any malicious software or enabled any other back-door escalation methods for myself. One day, my authorization for Administrator rights gets revoked and I am removed from the Administrators group.

What (preferably automated) mechanisms can be implemented to prevent me from re-adding myself before my token gets refreshed?

AviD

are we talking domain admin, local admin?

Iszi

Local

AviD

then I can force-logout you, no?

since we're on the same machine

Iszi

Okay, further specification here...

We're in the middle of the workday, and you're doing it remotely. So far, I've not been notified of the pending change and can be presumed to be in the middle of important work stuff on the computer.

AviD

but something I dont understand....

you assume that the user did nothing malicious, or anything like that till now...

basis for the assumption aside, why do you think that alluva sudden he'll turn around and get busy?

Iszi

22:25

@AviD 'Cause he really likes local Admin rights.

AviD

yeah? so mebbe he "took care of things" to make sure he keeps 'em...

my point is, as @nealmcb likes to ask, whats your threat model?

I dont see why this wasnt a problem before, but now it is...

Iszi

@AviD ?

AviD

him being able to give himself admin privs

it sounds like you trust him as long as he's an admin, but stop trusting him when he stops being one :)

Iszi

@AviD In the case of a department transfer, it would be more of a "separation of duties" issue.

And, let's go ahead and say that "him" is "me".

'Cause yeah... it was.

AviD

hmm

@Iszi lol, wait, what?

you're asking how to make sure you dont give yourself admin privileges?

umm.... watch yourself very carefully?

;)

Iszi

22:30

ROFLMAO

I'm asking how do I prevent someone like me from doing what I've done in the exact way I've done it.

AviD

actually, I think I'm getting it now....

you accidentally happened to notice that you still have your privileges, even after they were supposed to be removed, and this bothered you. Because it's just plain wrong. Right?

Iszi

@AviD Yeah, that's good.

AviD

okay, so let me have a first shot at rewriting your question.... :

"Is it possible to change the expiration time, or caching policy, for Windows Access Tokens?"

because I think that's what you're really asking...

Iszi

@AviD That's a good mitigation measure, I suppose.

But unless you can practically reduce that time to a matter of a few minutes or less, I don't think it quite fully resolves the issue.

AviD

IMO, you see it as TOCTOU because you're not overly familiar with the internals of how it works (and why it was designed that way)...?

okay, 2nd try: "Is it possible to disable caching for Windows Access Tokens?"

Iszi

22:35

@AviD It's possible.

@AviD And the rider question would be "is it practical"?

AviD

@Iszi ah, therein's the rub, innit?

my guess would be: "Probably not".

Iszi

@AviD More ideal would be a mechanism to force a background refresh of the token.

(Without requiring user logoff)

AviD

@Iszi agreed, maybe that's even a better question

and for THAT, I'm pretty sure there is a good answer

I'm sure there are scripts 'n' tools for that....

for the record, do you see linux etc behave substantially differently on this?

process id doesnt change whilst running....

Iszi

@AviD Oh, and just to be clear: I know the privileges were supposed to be removed. My name was actually no longer in the Administrators group, and I know I was not a member of any of the groups that were.

@AviD I don't have enough experience outside Windows to attest to that.

AviD

okay then, open question to the group: (and I'll name some names so you dont just skip over this... @RoryAlsop @makerofthings7 @GrahamLee @packs @nealmcb)

do linux processes change their uid/gid mid-process? And if not, that could mean that after you start a process, your privileges change, and yet your process could still have access you're not permitted to anymore?

AFAIK, that is the case...

@Iszi my point is just that this seems to be a commonly accepted tradeoff, in OS-design....

Iszi

22:47

@AviD I see

AviD

BUT going back to your final question - "How can I force another user's Access Token to be refreshed on demand?"

I think thats a very different question from the original :)

but a very good one, nonetheless

Iszi

@AviD Yeah, that's pretty much what I'm looking for - and preferably without logging the user off.

AviD

also note that it is different for domain account and local windows account

Iszi

Could you perhaps write/post that one for me, so I don't get everyone confused this time?

AviD

lol

no, I think we made sense out of it together...

Iszi

22:52

@AviD I think in this regard, we could keep it more general - it would be nice to see answers for both scenarios.

AviD

@Iszi fair enough - but perhaps point out the difference anyway....

one big important point is that if you're talking about one machine only, it's relatively simpler than worrying about refreshing tokens across network servers...

i mean, its still in the same process (on the one machine), but you have to worry about more than the one token

Iszi

@AviD I think I get what you're talking about. I'm just unsure at this point if I could re-write the proper question myself, without having it devolve into the mess that the original has.

AviD

awright, if you insist.... I'll give it a shot, then have you make sure I didnt selectively skip anything

or better yet, you put it up now, and I'll edit it straight?

cmoooon, clickbait!

Transcript for