Nick Mullen

#Cyber Incident Response Planning Tips week 1 is done. In case you missed my first 4 tips for better IRP, here is the recap video. 👉 Comment below on what is holding you back from incident response planning in your organization and I will help you out with the process. 👈

28

4 Comments

EMOTIONAL INTELLIGENCE

1

So much for SPF... Got a pretty reasonable phishing email from paypal.com saying the usual: Someone wants me to pay $2k invoice, yada ya. But when I look at the headers I see a: spf=pass (sender IP is 173.0.84.232) smtp.mailfrom=paypal.com; dkim=pass (signature was verified) header.d=paypal.com;dmarc=pass action=none header.from=paypal.com; Pass (protection.outlook.com: domain of paypal.com designates 173.0.84.232 as permitted sender) receiver=protection.outlook.com; client-ip=173.0.84.232; helo=mx8.slc.paypal.com; pr=C Which means either Paypal is using the generic sending addresses of outlook.com as "authorized" or someone had a really lucky hit. Either way this points out something interesting: If you set your spf to permit an ISP's IP address as "good" then anyone using that ISP can spoof your email. Sorry, you need a unique IP address block or address to send your mail. Weird. Will look into this one more later. Too much stuff to do today.

9

1 Comment

For anyone still dealing with the fallout of the Crowdstrike/Windows issue; I wanted to give a tip that we are using with some success to automatically and centrally remediate systems that match a certain set of characteristics. This isn't a "silver bullet" to fix all systems everywhere, but where it works it doesn't require bitlocker keys, safe mode, or preboot environments. The system has to be boot looping or restarted. The opportunity that allows this to work: we identified that most systems which are crashing actually get far enough into the boot process that the network stack and Windows Server service are starting, briefly. We see a few second window when the system is available on the network before Crowdstrike fully loads and the system crashes. This also why some systems "self-heal." During the brief period before the crash, Crowdstrike may have enough time to download the fixed channel update before the system crashes, This small network availability window has given us a way to delete the channel file using a delete command from another system on a UNC path to the impacted system. There are a number of caveats that limit the success of this approach: 1. Host must using a wired network connection (wireless may work, but we haven't been able to definitively test) 2. The host IP must be known or resolvable via DNS (the system is "on" the network for less than 12 seconds, so this is often a problem). 3. The script must be run from a fully functional system, in the context of a credential that has previously established (before the Crowdstrike channel update) local workstation administrator level privilege 4. Executing against a single host one at a time has shown a higher rate of success than executing against a large number of hosts or an entire network range in parallel. In other words, this isn't a guaranteed fix. Said another way, this seem to have the highest success against wired hosts that are continually boot looping. Please comment if you find other constraints or errors in my list. A system can be tested to see if this approach will possibly work by continually pinging the IP address of a system that is crashing, while its crashing. There will be a string ping failures followed by a few replies then failures. While the system is able to reply to the ping, the delete command can be run. We originally triggered the script once we saw an ICMP reply, but are having better success just executing the delete against the UNC path against whole subnets repeatedly. In a "healthy" system, executing the delete against a UNC path will result in a delete failure as Crowdstrike appears to have the (fixed) channel file in use/locked. If the 'delete \\[hostip/hostname]\[UNC path to CS channel file]' command succeeds, the system boots normally into windows. If it doesn't, the system will BSOD again.

202

19 Comments

It is well documented that being a leader can be a lonely experience. If you've ever lead a project, a team, a department, or a company you know how the weight of the mantel of responsibility for outcomes and decisions can lead to isolation. But, in those moments of crisis when teams must be formed, guided, and motivated to rise to a challenge that leadership takes on a new dimension. This is the case I found myself in during the morning of July 19, 2024. By the time I was involved, the emergency management function was well engaged, understating the scope and impact of the problem and developing remediation steps and planning for how to best use the small army of volunteer "technologists" who would serve as the backbone for the on-site, hands-on recovery work. I jumped in and helped where I could, but there was already significant momentum. Then an opportunity presented itself: someone automated a fix. I tracked down Jeremiah Heyt (JR) and confirmed he was having success recovering systems centrally. Was this was a chance to fix many systems without having to touch them? It was worth exploring. JR didn't work for me, I had never talked to JR before that moment, but he was ready and willing to jump into a bigger effort. We pulled in a few other people and before long we had formed a "script swat team" to look into automating and expanding the idea of centralized recovery. By the end there were 12 people working on various aspects of the script and supporting tech. This team also spear headed the development of telemetry to confirm when systems had been fixed, a key element for the hands-on teams as well. In the end, it is estimated that the script resolved between 6% and 8% of impacted systems. That doesn't sound like much, but it meant that the amazing army of over 500 in-field volunteers didn't have to touch almost 2,500 systems and those 2,500 systems were put back into the hands of users faster than they might otherwise have been. Of the 12 people on the team, I was the "upline" of only three. The common cause was greater than hierarchy and positional authority. It was a privilege to be a part of this great team: Jeremiah Heyt, Dan Boik, Eric Craddock, Kenny Daldine, Joshua Hineline, Travis Hughes, Adam C. Johnson, Jeremy Jordan, Jason Lehman, Alex Meyer, Jeremy Reynolds,John Schiffman. Thank you Scott Dresen for your support and participation! Jerry Matt and Nina Padavil, thank you for being there every step of the way! This view is but small part of the work that went into recovering. The untold part of this story is that the Corewell Health team was in the go-live of a multi-year project to consolidate the EMR when the Crowdstrike outage occurred. Our CIDO, Jason Joseph, described it as "launching a rocket in a hurricane." This could only be possible because of a team dedicated to a mission greater than oneself. Awesome job team, I'm proud to be a small part of this amazing group of dedicated professionals!

32

3 Comments

We really need to stop using FTP servers, especially for sensitive data 🛡️ Sensitive data on nearly 1 million Medicare beneficiaries in Wisconsin was compromised in 2023 due to a ransomware attack exploiting Progress Software’s MOVEit file-transfer service flaw. On September 6, The Centers for Medicare & Medicaid Services (CMS) announced that its contractor, Wisconsin Physicians Service Insurance Corp., was impacted by the MOVEit flaw. The compromised data includes names, Social Security numbers, dates of birth, addresses, hospital account numbers, Medicare beneficiary identifiers, and health insurance claim numbers. CMS began notifying nearly 950,000 affected individuals last week, following Wisconsin Physicians Service’s notification of the breach on July 8. The data breach is part of a larger wave of attacks in May 2023 targeting the MOVEit vulnerability. Organizations like the Texas Dow Employees Credit Union have also recently disclosed breaches related to the MOVEit vulnerability. https://lnkd.in/gP8t4E3C

3

For those of you in the Cincinnati area and interested in Cybersecurity and Forensics (#KCFC), I'm giving a talk tomorrow at 9:30am on the Risks and Rewards of AI in Cybersecurity at Northern Kentucky University! I hope to see you there! #CISO #cybersecurity #forensics #AI #risk

10

1 Comment

Breaking into cybersecurity.... I saw a post today where it said there was a person charging people a fee to watch their webinar on how to break into cybersecurity. I thought that was sad and not helpful to the community. I saw several other people bashing that person as well. Here's my "TED" talk for free. If you want to break into cybersecurity you have to acquire the skills, even if it means doing it on your own time or taking on additional unpaid duties at work. I have seen plenty of people come through interviews and when I ask them to tell me what they have done around using offensive or defensive cybersecurity tools, they often give me the response of "I haven't been given those duties yet at work..." OK, but have you sought them out on your own time???? Last I checked Kali Linux was free, Virtual Box was free, etc. Have you built your own home lab? Have you asked at work for extra duties (without demanding you get paid for those duties first?). Sometimes the wheels of HR turn slowly and they want to pay you for what you have done not for what you are promising them you will do. Would you take on these new duties at work if it meant no additional pay? What if took HR 2-3 years to redefine job duties and adjust the pay? What if they never rewrote your job duties? Would it be worth it to you? If you say no, then it will probably be hard for you to break in to cybersecurity. If you have the mentality of "The company is using me to do these jobs without paying me!" then it will be harder for you to break in. How about having this mentality instead? I am using the company to improve my skills which will be worth more in the future, whether that is here or at another company. When you take on new skills, the reward is often improvement in yourself and your future abilities, not your bank account. The reward is often delayed. I coached sports for 15 years. The starters were always the ones who listened to the coaching staff, went the hardest at practice, and, most importantly, put in effort outside the practice. So look for opportunities to improve your cyber skills. Another tip. Don't do a skill once and then put that you are an expert in that skill on your resume. Really take the time to learn that skill.

83

17 Comments

5:36AM thoughts on a Saturday. This weekend is all about Active Directory Certificate Services. Shout out to SpecterOps. I use BloodHound pretty much everyday at this point. I obsessively review a lot of things. How many things you want to know? A lot of things. SpecterOps spoon-feeds you great queries in their docs too. A lot of value. Big fan over here! I saw an AD CS problem on Friday. And for anyone who wants to get cute, yes it was fixed on Friday, but it made me think. Can I speak intelligently on ESC1-ESC14? Or better yet ESC15? The answer is no. No I can't. Did you see that, batman, dude said he doesn't know everything on LinkedIn. My goodness. I know 4 popular escalation paths. I was creeping in the BH slack when someone dropped a link for the newish ESC15 (someone correct me but it came out early October?) Shout out to TrustedSec. They have great articles. I love reading their stuff. I came upon this article about ESC15 from them: https://lnkd.in/erVBVxUs Alrighty so I need to understand them all. 1. Start with Will Shroeder's article from back in 2021: https://lnkd.in/eRYmZE_h (hey man, better later than never) (all the Credit goes to Will and SpecterOps!) 2. Read the white paper by Will Shroeder and Lee Christensen: https://lnkd.in/eCqAUVgK 3. Run Certipy: https://lnkd.in/e888Y2CX 4. Run Jake's locksmith tool: https://lnkd.in/ePTGacyp (Shout out to Trimarc & Jake Hildreth, CISSP) Once again, I'm not some dude trying to ransom your domain so I don't need to come up with custom tooling in C++ or obfuscate it to get it past your EDR. You know how you have multiplication tables memorized? BRo$efio, what is 12 X 12? I want to have those escalation paths basically memorized. Sure, I won't have the commands memorized, but I will have a much better understanding. It's time to stand on the shoulder of giants and burn these escalation moves into my head. BTW, if you work in healthcare, chances are folks don't appreciate or understand good security so hit me in the DMs if you're dealing with that nonsense too. #blueteam #redteam #purpleteam #infosec #bitcointeam #hospitals #healthcare

5

Who is my ideal client? In case you're wondering, I do train all sized companies. Tiny, medium, large, but my ideal client is a bigger company that cares about cyber risk, and isn't quite big enough to get their own dedicated awareness role. So I come in, measure to get a baseline, run workshops to give every staff member good basic knowledge, deliver my weekly "Cyberbytes" videos, and then run more workshops throughout the year (e.g. cyber investigator, quiz, links masterclass). Keep measuring (metrics that the business cares about), and get feedback on the workshops and content to ensure it's working for them. As I become familiar with the people and the culture, I can suggest different things to try as well. My workshops are face to face or live online, easy to setup, simple, and effective! I can take on one or two more big clients like this (yes, my capacity is limited!) If you're interested in having me on your team, get in touch. If you know of a company that could use my services, please let me know! And I am not limited to Australian companies, I do train internationally. #myidealclient #cybersecurityawareness #websafestaff

8

I would like to inform you about an increase of phishing attacks using DocuSign legitimate email address and infrastructure in order to steal your corporate credentials. Following the attack chain:   1) The malicious actor sends an email using DocuSign sender’s address [email protected].   2) After clicking on the link in the email, a pdf document opens in the DocuSign infrastructure. 3) The PDF file contains a link to a malicious website that asks for your corporate credentials in order to steal them. Please see the image below.

34

1 Comment

Impact Advisors Being prepared costs much less than picking up the pieces after the incident. It saves more than money when practiced regularly. #impactful #thatsimpact #businessresilience

2

It is with great concern that Western Governors University will continue using the Guardian browser via Meazure Learning ProctorU. The fact a remote access with admin rights is necessary for a proctored exam is quite alarming to me. To add, the Guardian browser requires your proctor to run a script during remote session and download an extension for full function compatibility. The numerous security concerns and history of past data breaches are requiring me to make a very difficult and unexpected decision. Whether to continue my education with WGU and risk potential malware, data loss or unauthorized access to PII. Or look for an alternate institution that uses reputable third-party testing vendors. https://lnkd.in/dp7t_j27 #wgu #nightowls #westerngovernorsuniversity

2

I rarely pre-order things, but I preordered this book months ago and it showed up on my door step today. Vulnerability management is easy to do poorly while wasting valuable time and resources. Doing it well and doing it effectively are much harder. I’m looking forward to digging into Effective Vulnerability Management.

37

8 Comments

🚨 Security Lessons from the Disney Insider Threat Incident 🚨 A former Disney employee was recently charged with unauthorized access and sabotage, highlighting serious risks tied to insider threats. This case emphasizes the importance of robust post-termination protocols and vigilant monitoring. 🔑 Key Takeaways: 1. Access Control: Immediately revoke system access for terminated employees. Rapid deactivation is essential to protect against malicious actions. 2. Monitoring & Audit Trails: Track system access and unusual activity post-termination. Early detection of insider threats can prevent or mitigate damage. 3. Multi-layered Defense: Implement multiple layers of defense (e.g., VPN usage alerts, IP tracking) to identify any unauthorized attempts to circumvent security measures. The Disney case underscores how critical it is to strengthen insider threat defenses and incident response. #InsiderThreat #Cybersecurity #AccessControl #IncidentResponse #RiskManagement https://lnkd.in/eYHi5hJU

2

We're here to help you succeed. We specialize in JSIG Risk Management Framework Security Training. For a full list of our events, or to download our guide, check out our training page. #riskmanagementframework #infosec #datadefenders #cybersecurity #rmf

4

4 reasons why veterans thrive as cybersecurity professionals

6

2 Comments