An example of a new employee, initially thought to be a kind helper shoveling snow, actually having their network administrator privileges stolen.
The Register has reported an incident where, on a snowy day, a person claiming to be the new IT staff member and stating that their employee ID was not yet usable appeared at the company entrance and helped with snow removal. After being allowed into the building, the intruder stole the company's domain administrator privileges. Fortunately, the intruder was not a criminal, but a member of a red team—a team of experts hired by the company to search for vulnerabilities and conduct unauthorized penetration testing.
Hackers shoveled snow for company, were rewarded with network admin access
Christopher Johnson and his colleague Michael, security consultants who conduct security testing from an attacker's perspective, entered a client's building through an administrative door that was left open for snow removal in order to test the client's security.
A maintenance worker stopped the two men, who explained that they were the new IT staff but their employee IDs weren't working yet. They also offered to help shovel snow because they had slipped and almost fallen. While Michael was helping shovel snow, Johnson asked if he could go upstairs to set up Michael's laptop, and the maintenance worker let Johnson into the building. Once inside, Johnson began searching for a place to connect to the company network.
Johnson used a palm-sized computer called a Raspberry Pi. If the Raspberry Pi could be connected to a wired LAN port within the company, the attacker could remotely control the Raspberry Pi from outside the building to investigate the company network. Johnson tried to connect the Raspberry Pi to a storage space for AV equipment, but he was unable to do so because the company had enabled network access control that blocks connections of unauthorized devices.
However, network access control was not enabled on another network port in the conference room. Johnson placed the Raspberry Pi near the center of the conference room and hid it in a trash can to make it harder to find.
The day after the intrusion, the company realized that the two 'new employees' were suspicious. A maintenance worker visited the IT department to thank Michael for helping with snow removal, but the IT department had no record of any new employees named Michael or Christopher. Suspicious, the company reviewed the video footage and even tried to find the license plate number of the rental car. However, throughout this investigation, the Raspberry Pi in the conference room was not found and remained connected to the company network for two weeks.
Over a two-week period, Johnson and his team connected to Active Directory, which manages employee accounts and permissions on Windows, located domain controllers, and launched a password spraying attack. Password spraying attacks involve trying a single, common password on a large number of accounts. In this case, they were able to log into 50 to 60 accounts using the password 'winter2023!'.
Furthermore, Johnson and his team examined the settings of Active Directory Certificate Services (ADCS), which issues certificates within the company's internal system and verifies the legitimacy of devices and users. The red team found multiple vulnerabilities in the ADCS template and certificate authority, and ultimately succeeded in obtaining domain administrator privileges. Domain administrator privileges are powerful rights that allow the attacker to manipulate the entire internal network, and if they are seized by an actual attacker, the damage will be severe.
The Register cited the following lessons learned from this incident: the importance of training employees not to easily allow outsiders without employee IDs into their offices, the need for strict access control to network ports such as meeting rooms, policies to prevent weak passwords, and the implementation of multi-factor authentication. Multi-factor authentication combines passwords with notifications to smartphones or codes from authentication apps, making it easier to prevent unauthorized logins even if the password is guessed.
David Schloss, who coached the Red Team, said, 'What many people think of as a crime is not what a crime actually looks like. It's a Hollywood movie-like misconception.' He called the tendency not to realize you're a victim until a person in a ski mask and gun bursts in shouting 'ski mask bias.' The company also said that a seemingly kind person with a snow shovel could open the door to network administrator privileges, so they will need to include training on how to deal with people who don't appear malicious in the future.
Related Posts:
in Security, Posted by log1d_ts