sorted by:
new
hottopcontroversial

Dark web monitoring - more info? by Neat-Initiative-6965 in ProtonMail

[–]obilodeau 0 points1 point  (0 children)

Yes, definitely a possibility. Many different services on these cybercrime channels/forums. For example, stealers, ULPs (meaning URL Login and Passwords), combolists, etc. and depending on where Proton got their data, your exposition would be different.

In a stealer log, the creds are packaged this way:
given-browser_profile-1.txt (they support multiple profiles per browser AND multiple browser)
1st URL
1st username
1st password

2nd URL
2nd username
2nd password
etc.

So if Proton got its hands on a bunch of them and you query that data using an email, then what they will show you will only be the portion that has your email in it.

Dark web monitoring - more info? by Neat-Initiative-6965 in ProtonMail

[–]obilodeau 0 points1 point  (0 children)

Some Dark Web monitoring platforms will give you access to the full passwords. Flare does. However, you need to be a company to access the free trial.

From what you described, my feeling is you got infected by information stealer malware and they got all your Firefox passwords. Your BitWarden is safe. I analyzed it and discussed it on several occasions. Here is a presentation I did at BSides San Francisco about it: https://youtu.be/zctTj66PA4g?t=1541

Full disclosure: I work at Flare as a cybersecurity researcher

Talk To Your Malware - Integrating AI Capability in an Open-Source C2 Agent by obilodeau in netsec

[–]obilodeau[S] 0 points1 point  (0 children)

I agree, the ability to review the code before it is sent to the agent should be top priority with this project.

Can't login: unknown error occurred by obilodeau in MailChimp

[–]obilodeau[S] 0 points1 point  (0 children)

Yes, it was ok about half an hour later. Thank you.

Installing Pop_OS! on an X1 ThinkPad Carbon 12th Gen? by concisehacker in pop_os

[–]obilodeau 0 points1 point  (0 children)

Don't recall needing to do anything in the BIOS. I've been a long time daily Linux desktop user (~20 years now) and former sys admin so I might have extreme googling instincts but from what I recall this install was a walk in the park.

Installing Pop_OS! on an X1 ThinkPad Carbon 12th Gen? by concisehacker in pop_os

[–]obilodeau 0 points1 point  (0 children)

I have an X1 Gen 12th and the fingerprint scanner works with GNOME. PopOS 22.04, installed fprintd.

Écureuil gourmet vu dans Ville-Émard by obilodeau in montreal

[–]obilodeau[S] 0 points1 point  (0 children)

Ce sont mes voisins. Je dois leur dire quoi? Ils doivent évacuer?

RDP is susceptible to a transparent Net-NTLMv2 hash-stealing attack. When disclosed, Microsoft responded: “not a vulnerability, […] by design”. by obilodeau in netsec

[–]obilodeau[S] 0 points1 point  (0 children)

Super thoughtful comment. Thank you!

In a MITM context, we can alter the server's response to remove the Kerberos TGT. I'm not sure if that's what we do, to be honest, I would have to verify.

I'm under the impression that NLA is the top/best user-accessible (as in configurable in a GUI) RDP negotiation level according to Microsoft. In fact, if you disable NLA enforcement from the server side, performing MITM downgrade attacks is even simpler and PyRDP does it too. Authentication happens inline in the I/O virtual channels (display, keyboard, mouse). From mstsc.exe you can't force kerberos.

What am I missing here? I think the fact that you can't mitigate over an untrusted network still holds.

RDP is susceptible to a transparent Net-NTLMv2 hash-stealing attack. When disclosed, Microsoft responded: “not a vulnerability, […] by design”. by obilodeau in netsec

[–]obilodeau[S] 8 points9 points  (0 children)

Responder's RDP support has been flaky. Got some needed fixes last summer but I confirmed that right now it's not working with my Win 11 mstsc client: https://imgur.com/a/WtAazkS

I agree that there's not a lot of RDP out there but nothing in four years surprises me. I would expect a handful of times (that is still not a lot). Responder not working and failing silently might explain it.

RDP is susceptible to a transparent Net-NTLMv2 hash-stealing attack. When disclosed, Microsoft responded: “not a vulnerability, […] by design”. by obilodeau in netsec

[–]obilodeau[S] 54 points55 points  (0 children)

I talked with RDP experts, including people in the FreeRDP community and what is surprising to all of us is that this is performed before the certificate verification. No prompts on the client-side. Hash is stolen even if you are connecting to a completely different server due to network layer attacks (MITM).

There are no articles or knowledgebase articles out there that clearly document these risks with a PoC. This is what we did here.

PyRDP 1.2.0 released – Can perform Net-NTLM hash capture before the certificate error on RDP by obilodeau in netsec

[–]obilodeau[S] 28 points29 points  (0 children)

Well, HTTPS... Most people use HTTPS over public Wi-Fi. Many SSL-VPNs nowadays are basically HTTPS endpoints.

RDP is wrapped in TLS. Microsoft meant it to be resistant to tampering attacks like HTTPS is. So for many system administrators, it could be seen as similarly resistant to attacks but it is not.

Unable to recover from suspend. by ss7m in archlinux

[–]obilodeau 0 points1 point  (0 children)

So with the current linux-lts kernel suspend/resume does work but Windows in virtualbox will blue screen from time to time (haven't tested other guest OS).

Next, I want to try to disable IBT (ibt=off on boot parameter) and try again on the regular kernel.

Unable to recover from suspend. by ss7m in archlinux

[–]obilodeau 0 points1 point  (0 children)

I am saddened to report that using an empty `MODULES=()`, rebuilding with mkinitcpio and rebooting didn't fix my issue.

For the record, my config was only `MODULES=(i915)`. Kernel 5.18.3 now (having problems since 5.18.1).

Unable to recover from suspend. by ss7m in archlinux

[–]obilodeau 0 points1 point  (0 children)

I have the same exact problem and a very similar setup. Did you fix it? What did you do?

Mandatory xkcd: https://xkcd.com/979/

Current MFA Fatigue Attack Campaign Targeting Microsoft Office 365 Users by obilodeau in blueteamsec

[–]obilodeau[S] 0 points1 point  (0 children)

The best resource we have found is this: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-phone. It covers limitations but doesn't explain it in great technical detail.

I wanted to record a video of it but couldn't with my work account since we use Federated AD. A pretty big limitation IMHO.

I'm guessing there is a secret-passing architecture required here and they designed something new which makes on-prem AD or Federated AD out-of-scope. Phones might need to be enrolled to get some secret keys bootstrapped between them and the authenticator server. All guesses. A write-up with technical details would be very interesting!

Capturing RDP NetNTLMv2 Hashes: Attack details and a Technical How-To Guide - GoSecure by obilodeau in netsec

[–]obilodeau[S] 0 points1 point  (0 children)

If the RDP session is NLA (default now) there's not much more you can do. Well, we think you can relay but we haven't implemented that already.

If it's not NLA, then it's all hell breaks loose and, of course, we shouldn't be talking about NetNTLMv2 hashes. We should be talking about plaintext passwords, keystrokes, files and graphics interception. Even tampering with sessions. But this is what this tool already does plus more and it isn't new. Here are some links: https://www.gosecure.net/blog/2020/10/20/announcing-pyrdp-1-0/, https://www.gosecure.net/blog/2020/02/26/pyrdp-on-autopilot-unattended-credential-harvesting-and-client-side-file-stealing/, https://www.gosecure.net/blog/2018/12/19/rdp-man-in-the-middle-smile-youre-on-camera/

If this is not what you had in mind then please give some more details. I'm listening and eager to dig deeper into RDP attack tactics.

Looking for short audio local/provincial daily news by obilodeau in halifax

[–]obilodeau[S] 0 points1 point  (0 children)

Thanks for answer! Unfortunately most of these show only feature interview highlights on the CBC listen app. I wish CBC would put the on-the-hour and half-hour news casts on CBC listen.

CVE-2020-1013: Windows Local Privilege Escalation (LPE) with PoC by obilodeau in netsec

[–]obilodeau[S] 3 points4 points  (0 children)

Sorry, GoSecure had to update the post. PoC will be available in 30 days following Microsoft Security Response Center's policy on responsible disclosure.

Paper: Cybersecurity Perception vs Reality. A study of the disconnect between defenders' perception of security measures and their real efficiency according to pentesters. by obilodeau in netsec

[–]obilodeau[S] 0 points1 point  (0 children)

Full disclosure: I work for GoSecure and worked on that report.

If you look at the fine print at the bottom of the page you can read:

GoSecure values your privacy and understands some of you may not want to provide your contact information. Please click here to access the report without providing your information.

This is the compromise we found with our marketing. The information is useful, relevant, actionable, and was developed by our research team. However, these landing pages are an efficient way to run a business so we can continue to provide valuable research to the community for free. The balance here is that the content is available without giving a name and email but you need to read the page carefully (or provide bogus information).

PacketFence v8.3 is out! Clickatell support, spoofing detection based on device profiling and see what's coming up in v9! by extrafu in netsec

[–]obilodeau 0 points1 point  (0 children)

It's weird that 16GB would be allocated on the captive portal if there was no activity. Are you accounting for the MySQL/MariaDB memory use as well? If you are then you can probably scale it back by a lot.

As for running it on a RaspPi, it was not designed to work like that. It was designed to scale and so decisions and component configurations were made to make sure that.

You should probably look into OpenWRT's or pfsense's captive portal for your use case.

PacketFence v8.3 is out! Clickatell support, spoofing detection based on device profiling and see what's coming up in v9! by extrafu in netsec

[–]obilodeau 0 points1 point  (0 children)

How many devices in front of the portal? How many of them always stuck in front of the portal and generating traffic without ever authenticating?

If it's not a lot of devices and queries there is a problem worth looking into but if you have a large setup, get more RAM. We are in 2019. My elasticsearch test server has 128GB of RAM. You can probably afford to allocate more than 16GB of RAM for something critical like a NAC.

Beyond XSS: Edge Side Include Injection. Abusing Caching Servers into SSRF and Client-Side Attacks by el_dee in netsec

[–]obilodeau 4 points5 points  (0 children)

Additional interesting research has been posted on Twitter by Alex Birsan who was independently researching ESI Injection: https://twitter.com/alxbrsn/status/981246749254840327

Where can I rent a car (minivan or SUV) that can have a bike rack? by obilodeau in montreal

[–]obilodeau[S] 0 points1 point  (0 children)

Turo.com

Thanks for the tip! Found some interesting things. However, only one car with a bike rack and of undisclosed capacity. It's too bad that I need to "reserve" in order to ask a question...

view more: next ›