Root CA from unknown origin on Dell Inspiron 3847

I've found another suspicious rogue CA's sitting on a Dell Inspiron. I currently have one Dell Inspiron 3847.

It's unmodified so that small daily tasks can be performed on it. I've since wiped it clean after this article showed up yesterday. 

http://www.forbes.com/sites/thomasbrewster/2015/11/24/dell-superfish-certificate-fail-malware-threat-on-laptops/

The Rogue CA's are a little different than the ones mentioned in the article. 

This is a rogue Root CA that had my machine ID in it with the private key. It's validity occurred right when the machine was purchased and given a name. A little weird.

Encrypting file system has not been installed on this PC. All that was loaded on it was a browser and Office.

Never trust an OEM it's better just to wipe to eliminate these issues. 

So why was this NYT article pulled?

This NYT article was pulled and some are wondering why.
http://www.nytimes.com/2015/11/16/world/europe/paris-attackers-communicated-with-isis-officials-say.html

A brief clip of how the article started.

I would say the article was pulled or asked to be pulled because the possible briefing in question is a NATSEC issue. 

Some say ISIS terrorists are communicating over PlayStation 4 networks:

http://www.politico.eu/article/why-terrorists-love-playstation-4/

I am still convinced that some are passing messages on pastebin such as this screenshot below:

However they are communicating. People tend to get caught.

I am still praying for Paris. I hope everyone responsible for this stupid senseless act is caught.

Update1:
As @krypt3ia pointed out and I can't emphasize this enough. The PS4 article and any other encryption methods are unsubstantiated claims. The public will more than likely not find out the true methods that were used because of surveillance reasons. 

@krypt3ia has an great post on some Daesh Darknet boards that were put up recently. It's worth the read as well as any updates. 

Update 2:
A reporting error linked the Playstation 4 to Paris attacks
http://www.theverge.com/2015/11/16/9745216/playstation-4-paris-attacks-reporting-error

Server and Domain Isolation

For those interested in this topic. A wealth of resources.

https://technet.microsoft.com/en-us/network/bb545651.aspx

Cryptowall 3 defense and mitigation tactics

This seems to be a popular subject lately. Especially with the latest report on how cryptowall is possibly tied to one threat actor group. The first defense you need to take on not becoming a victim of cryptowall is understand the methods of infection that leads to the compromise.

Below is one of the most common ways a cryptowall infection starts. It starts with a zip file.

When working with email it's important to understand that you should never open attachments from people you don't know. More importantly you should be cautious opening attachments from people you do know.

Common files attachments you should avoid in email.
.zip
.exe
.scr
.docxm
.xlsm
.scr
.pdf
.docx
.xlsx
.doc
.xls
.ppt
.pptx

If you receive an email from anyone with the following extensions immediately delete it and do not open.

Angler is probably the number one crime kit to distribute cryptowall 3. Angler works by injecting its payload directly in memory and doesn't write malware to the disk. In memory exploits are very tricky in terms of detection but they can also be prevented. If you have a vulnerable browser that is not patched and running third party plugins such as Java, Silverlight, or flash. It can lead to compromise very quickly. Infected ads using flash are a pretty popular method to distribute.

So how should you prevent? If you are running Windows 7, 8 or 10. Uninstall Silverlight and Java. So what about flash? You can uninstall on Win7. Unfortunately Win 8 and 10 it's baked into the OS. However there is an easy setting change to prevent running flash content in IE. It's called Active X filtering and one day it may save you from a serious compromise:

1. Open Internet Explorer by clicking the Start button Picture of the Start button. In the search box, type Internet Explorer, and then, in the list of results, click Internet Explorer.

2. Click the Tools button Tools button, point to Safety, and then click ActiveX Filtering.

What else should you do on top of these simple countermeasures?
Run a Microsoft tool called EMET. You can download it here.

EMET is an enhanced mitigation utility designed to hook into processes and prevent to exploitation. Most of the time the defaults will work out ok for everyone. You may have to manually tweak depending what all types of add-ins you are running in IE.

Another countermeasure to do is limit your browsing activity to an unprivileged account. You should be browsing under an account that does not have administrator privileges.

Always...always make backups of your data. Offsite...... Cloud storage often gets a bad name. Cloud storage is not a bad thing if you know how to protect your data before you send to a cloud storage location. I use Microsoft's One Drive. It's baked into Windows 8.1 and Windows 10. I used pkware product called viivo to encrypt my data before it gets sent to the microsoft cloud. I also two factor my Microsoft account for added protection. I don't really browse to websites or do much with my windows box. I store data and bounce it to the cloud. That's about it.

I do stuff mostly on Linux virtual machines or Chrome OS. Chrome OS on a chromebook has been my go to choice lately for about everything.

Pass the hash security templates

If you haven't done so and want some quick wins for a Win 8.1 or 7 environment. Head over here to download the Windows 8.1 security baseline zip file and extract the contents.

http://blogs.technet.com/b/secguide/archive/2014/08/13/security-baselines-for-windows-8-1-windows-server-2012-r2-and-internet-explorer-11-final.aspx

After Extracting navigate to the following area. (I extracted the contents to temp)

C:\temp\Desktop\Win81-WS2012R2-IE11-Baselines-FINAL\Win81-WS2012R2-IE11-Baselines\Administrative Template\PolicyDefinitions

Copy the pth.admx and the pth.adm file in the en-US folder to their respective locations in the policy definitions on the domain controller. When you go into your group policy editor on your domain controller you will notice some Pass the hash mitigations available.

Set 'Apply UAC restrictions to local accounts on network logons' to 'Enabled'

This setting controls whether local accounts can be used for remote administration via network logon (e.g., NET USE, connecting to C$, etc.). Local accounts are at high risk for credential theft when the same account and password is configured on multiple systems. Enabling this policy significantly reduces that risk.

Set 'WDigest Authentication' to 'Disabled'

When WDigest authentication is enabled, Lsass.exe retains a copy of the user's plaintext password in memory, where it can be at risk of theft. If this setting is not configured, WDigest authentication is disabled in Windows 8.1 and in Windows Server 2012 R2; it is enabled by default in earlier versions of Windows and Windows Server.

Enjoy.

Windows 10 Security Baselines

For those that use Microsoft Security Compliance manager as a baseline tool. There is now DRAFT security guidance for Windows 10.

http://blogs.technet.com/b/secguide/archive/2015/10/08/security-baseline-for-windows-10-draft.aspx

Download the zip. Extract it... and you are good to go.


There is also a folder called Local_Script if you want to do this on your computer without the need for a domain controller. Run the script and reboot. Test it with a non admin account.

Enjoy.

Hardening Windows Virtual Machine OS Clients

This is just a running list of how I harden my Microsoft virtual OS's.

1. Stand up a Windows 2012 R2 domain controller that is on a internal network only vnic. 

2. Stand up a Windows 8.1 OS client on a internal network only vnic. Inside the OS set up Microsoft security compliance manager. Once you download all security baselines. Upload the following baselines to the domain controller or use RSAT and import the baselines in group policy management.

Some important policies to import. 

Windows 8.1 computer security compliance

Windows 8.1 user security compliance

Windows 8.1 bitlocker policies

IE 11 Security policies. 

Change the bitlocker policy around where it supports clients without TPM chips. Since your virtual machine doesn't have a TPM chip it's not necessary to have. All virtual OS's should be encrypted. Even the domain controller you set up. 

3. Encrypt all your virtual OS's with pre-boot authentication. 

4. Setup another Windows 8.1 client and move it to an area in active directory that has your computer and IE 11 policies. 

5. Create a standard user in your domain and give them the user security compliance to Win 8.1. 

6. Your standard user should not have admin rights to your Windows 8.1 client. 

7. Make sure EMET is set up as well. Enable the defaults and test all your applications to ensure they work properly after words. 

8. Disconnect your Windows 8.1 client from the internal network and set it to NAT or Bridge so its gets an IP to the internet. 

9. Fully patch your Windows 8.1 device. 

10. Install an AV client on it. I recommend panda av cloud. It has some excellent ratings in av-test.org website. 

This is pretty much my process when I make a Microsoft based virtual os in my lab environments.

Some may ask why Windows 8.1 and not Windows 10. Until an official security compliance guide is out for that OS I'd avoid hardening one on your own without some guidance.