Attack Computer Wiz

Starting with Windows Server 2016 and also in 2019, an out of the box build will often display the following error when trying to initial a Remote Desktop Connection.

"The connection cannot proceed because authentication is not enabled and the remote computer requires that authentication be enabled to connect."

To make this error go away, perform the following steps:

1. Open "regedit"
2. Go to: 
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

3. Set “SecurityLayer” to a "zero"

Posted by Mike Wright

While building my first Domain Joined Windows 10 RTM system I discovered that the System Center Configuration Manager 2012 R2 client would not install. After reviewing the installation log, I discovered that the error code was "0x80070307". After a little research I discovered that this is due to SCCM trying to install the Windows Update Agent on the Windows 10 machine that is either already there or is older than the one on Windows 10 out of the box. The work around was simple, but it did not address Group Policy Deployments which, in the past, were not Operating System specific, rather they were just a blanket policy that covered everything.

The answer, copy my existing SCCM deployment GPO, modify the installation command, create WMI filters for the Operating Systems and apply the WMI filters to the GPO's.

Here is the step by step:

1. In GPMC, navigate to "Group Policy Objects" and locate your SCCM deployment GPO.
2. Right click your existing SCCM deployment GPO and choose "Copy".
3. Move back up to the "Group Policy Objects" folder object and right click it, then chose "Paste".
4. Find your "Copy of..." and rename it appropriately.
5. Right click the new GPO and choose "Edit".
6. Navigate to: "Computer Configuration > Policies > Administrative Templates ... > Classic Administrative Templates (ADM) > Configuration Manger 2012 > Configuration Manger 2012 Client > Configure Configuration Manger 2012 Client Deployment Settings.
7. Under "Options", copy your existing string to notepad. It may look something like this: 


CCMSetup.exe SMSSITECODE=**** FSP=****.net MP=****.net


8. Modify your string so that is now looks like the below:


CCMSetup.exe /skipprereq:windowsupdateagent30-x64.exe SMSSITECODE=**** FSP=****.net MP=****.net


9. Close the editor.
10. In GPMC, navigate to "WMI Filters".
11. In the right pane, right click and choose "New".
12. Name your WMI Filter "Windows 10 OS" and click the "Add" button.
13. Leave the "Namespace" as it is (root\CIMv2).
14. In the Query box type: 

select * from Win32_OperatingSystem where Version like "10.%"


15. Click "OK".
16. In the right pane, right click and choose "New".
17. Name your WMI Filter "Windows OS pre 10" and click the "Add" button.
18. Leave the "Namespace" as it is (root\CIMv2).
19. In the Query box type: 


select * from Win32_OperatingSystem where Version like "6.%" or Version like "5.%" 

*note: this will get Vista-8.1 and 2003-2012R2


20. Click "OK", you should now see your two new WMI filters.
21. Go back to "Group Policy Objects" and locate both your old and your new SCCM GPO's.
22. Left click each GPO and on the very bottom of the "Scope" tab, choose your WMI filter for the appropriate Operating System, repeat for both GPO's.
23. Lastly, assign your new Windows 10 GPO to the appropriate OU(s).

Next you can confirm that your WMI settings are working on each OS type:

1. Shift+Right click CMD and chose "Run and Administrator"
2. Type "gpupdate / force"
3. Type "gpresult /z >> c:\temp\log.log
4. Review the logs on each to make sure, they should look something like the below:

Now that you have confirmed that your new GPO with WMI filter is applied, simply reboot your Windows 10 computer and re-check your ccmsetup status.You should see "Configuration Manger" in control panel within a few second of your reboot. If not, review logs.

Thanks!

Posted by Mike Wright

Without IIS it is not as straight forward as one would like, but it is still pretty simple with this walk through.

1. Launch "MMC" and add the Certificates Snap-in specifying "Local Computer".
2. Open the "Personal > Certificates" and right click your existing certificate, choose "Delete from the options.
3. Right click any open space where your old certificate was and choose "Import".
4. Navigate to your new certificate, specify the certificate password and continue through the prompts.
5. Once you see the new certificate in the MMC, double click it and choose the "Details" tab. Scroll down to "Thumb Print" and click it one time. You will see a series of letters and numbers in the bottom window. Copy those numbers and paste them into a blank Notepad document. Move Notepad aside but do not close it.
6. Close the Certificates MMC.
7. Open AD FS Management and navigate to AD FS > Service > Certificates.
8. On the right side, click "Set Service Communications Certificate" and chose your new certificate.
9. Close AD FS Management.
10. Back to NotePad, Delete all the spaces from your pasted text. 
11. Copy the thumb print (CTRL+C).
12. Launch PowerShell as Administrator.
13. In Powershell, type: Set-AdfsSslCertificate
14. When prompted for the Thumb Print, press CTRL+V to paste your certificate thumb print into PowerShell and press enter.
15. Close PowerShell.
16. Open Services and restart the ADFS Service.
17. Launch your ADFS portal and confirm your new certificate is being used.

Thanks for reading, I hope this helped!

Posted by Mike Wright

From their website:

"The EC-Council CCISO Body of Knowledge covers all five the CCISO Information Security Management Domains in depth and was written by seasoned CISOs for current and aspiring CISOs. Domain 1 covers the Policy, Legal, and Compliance aspects of Governance. Domain 2 delves into the all-important topic of audit management from the CISO’s perspective and also covers IS controls. Domain 3 covers the Role of the CISO from a Project and Operations Management perspective. Domain 4 summarizes the technical aspects that CISOs manage in their day-to-day jobs, but from an executive standpoint. Domain 5 is all about Strategic Planning and Finance – crucial areas for C-Level executives to understand in order to succeed and drive information security throughout their organizations."

A discounted training voucher can be found at the below link, limited time only:

SaveLocal.com

http://ciso.eccouncil.org/

Posted by Mike Wright

In some cases users in an Active Directory environment may see repeated lockouts after a recent password change. This is commonly associated with forgetting their new password, forgetting that they are logged onto another machine or server somewhere, or their old credentials are cached.

If after you have rebooted the machine, checked domain logs to try to figure out where accounts may be logged in, deleted Temporary Internet Files and you are at your whits end, cached credentials may likely be your culprit.

On your affected machine, run the blow command and delete any cached credentials that appear. This would especially be relevant if you are using a Proxy server.

rundll32.exe keymgr.dll, KRShowKeyMgr

Posted by Mike Wright

System Center Endpoint Protection (SPEC) may not install via SCCM policy if a conflicting application exists and cannot be uninstalled. This is commonly associated with an existing Antivirus application.

In order to find what the conflict is;

1. Open regedit 
2. Navigate to \HKLM\SOFTWARE\Microsoft\CCM\EPAgent 
3. Look at “StateEventMessage” where you will find a message similar to the below:

System Center Endpoint Protection installation error. The System Center Endpoint Protection Setup wizard was unable to remove one or more programs that conflict with System Center Endpoint Protection. To install System Center Endpoint Protection you must manually uninstall the following programs and then run the wizard again. Error code:0x80041108. Programs: Trend Micro OfficeScan Client

In this example, the Trend Micro OfficeScan Client was installed and for whatever reason, SCEP could not remove it. At this point you will need to manually remove the conflicting application and re-initiate a policy refresh to the SCCM server.

Navigate to Control Panel, open the Configuration Manager client, clicked on the Actions tab, and force each action to run.

After a while the new SCEP icon will appears as expected.

Posted by Mike Wright

Posted by Mike Wright

Here is the registration link: https://ae.rsaconference.com/US14/portal/newreg.ww

Use one of the codes below to get your free Expo only pass. Be sure to visit the vendor whose code you used.

I will be updating them as I get them.

Duo Security - Booth #2518 - EC4DURY
F5 Networks - Booth #1801 - EC4F5NET
Proofpoint - Booth #1527 #520 and #3615 - SC4PROOFB or EC4PROOFE
APCOM - Booth # 632 - EC4APCON
OPSWAT - Booth #2531 - EC4PSWT

Posted by Mike Wright

While trying to demote an existing Windows Server 2008 R2 Domain Controllers I ran into quite the headache. After running "dcpromo" and following the first few steps of the demotion it seems to start and run just fine. But within a few seconds I was promoted for credentials with the below "access is denied" message.

I searched and searched but was not able to find a good solution so finally I gave up and ran "dcpromo /forceremoval". I then did the metadata cleanup and moved on. I then tried to remove the old DC computer object from the Domain Controllers OU and I was denied access again. I scratched my head and realized that the object was protected. Could this whole problem be that simple!? The answer is YES, it was that simple.

On my next DC demotion I re-created the same errors. I cancelled the dcpromo, went into ADUC and unchecked the "Protect object from accidental deletion" box, ran dcpromo and and everything went smooth without error!


  

Posted by Mike Wright

Here is the registration link: https://ae.rsaconference.com/US13/portal/login.ww

Use one of the codes below to get your free Expo only pass. Be sure to visit the vendor whose code you used.

AhnLab - FXE13AHN
APCON - FXE13APC
OneLogin - FXE13LOGIN
Proofpoint - FXE13PRF
Symantec - FXE13SYM

Posted by Mike Wright

I have been fortunate enough to once again be selected as a speaker for the RSA Conference in San Francisco. This years conference (2013) will be held at the Moscone Center from February 24 though March 1. I will be hosting a Peer2Peer (P2P) session entitled "To Report, or Not To Report, Will My Job Be At Risk? That is the Question" on Wednesday February 27, in Room 110, at 10:40. I am one of only 9 P2P sessions and attendance is restricted to only 25 people. If you want to participate be sure to get there early.

During this hour long session we will discuss ways to encourage our users to report policy violations and security incidents that they wittiness. If we can be informed of issues that arise early, before they get out of control, we can deal with them and mitigate further risk.

When was your last virus outbreak? Wouldn't it have been great if the very first user called and reported it before it spread? Do you have some war stories to share? Do you have some suggestions to bring? Is there something that does/does not work for your agency?

If you have any ideas please post them to comments or email me with them. I would love to hear your ideas and to see you there!

Posted by Mike Wright

For reasons unknown to me, during the installation of Windows 8 Enterprise (from Technet), you are not prompted to enter in your Windows Key. This may be on other versions too, I do not have other versions to test. Once Windows 8 is installed you are prompted to Activate Windows and you see the nag text in the lower right corner. There does not seem to be an easy "click here" way to enter in your correct product key. But, if you follow the below steps, you will be able to enter your key easy enough and active your Windows 8 installation. 

1. Press the "Windows Key" on your keyboard which will bring you to the "Modern" menu. 
2. Type "cmd" and you will see "Command Prompt" displayed on the left side of your screen. 
3. "Right Click" "Command Prompt" and on the bottom of your screen choose "Run as Administrator". 
4. Click "Yes" on the User Access Control warning screen. 
5. At the command prompt screen type "slmgr.vbs -ipk PRODUCT KEY". It should look something like "slmgr.vbs -ipk 11111-22222-33333-44444-55555". Press "Enter" 
6. You should now be prompted that the product key was installed successfully, if not your key is invalid, you typed it wrong, or you forgot to include the dashes. I suggest you copy and paste. 
7. Next, still at the command prompt, typ "slmgr.vbs -ato" and press "Enter". 
8. You should now be prompted that Windows was successfully activated.

Posted by Mike Wright

As security practitioners we understand that prompt and accurate reporting of a security incident can save time, money, and can minimize damage. But when a user clicks a malicious link, replies to a spear phishing email, or gets a virus warning; they may confuse the need to report as an RGE (Resume Generating Event). How can we encourage users to report incidents without the fear of repercussion? There is nothing more frustrating then getting a phone call reporting an incident that occurred days, weeks, or months in the past.

Did the user really not notice for a month that their computer was gone and the cables were left dangling off their desk? Did they think it would just re-appear? What about a cell phone that is missing, was it just misplaced? How long should the user look for it before they report it missing? When is too long, too long? How can management create an environment that users are willing to come forward when the realize that a security incident has occurred? What can be done to encourage, or reward reporting?

These are the questions; what are the answers? Maybe my topic will be accepted at RSA 2012 San Francisco Peer2Peer and we will find out!

Posted by Mike Wright

I just finished watching Yahoo's Cybergeddon. It is about 1 1/2 hours long and follows Chloe Jocelyn, a hacker turned FBI agent, who is trying to stop a cyber terrorist bent on revenge. It is very entertaining and mentions some real life tools and virus's. While of course it is fiction and a lot of the dramatization seem to be right of of the 1995 movie "Hackers", it is very entertaining and, believe it or not semi-plausible.

Check it out: Cybergeddon

Posted by Mike Wright

I talk and write about it often. It was the subject of my final project during my Masters studies. I even spoke about the topic at the RSA Conference in 2012. For years one of my many hobbies has been to acquire storage media devices that people have disposed of and review them to find out what they left behind. I find devices at yard sales, laying on the ground, auctions, storage units that have been sold at auction, and pretty much anywhere you can think of. They are not always the old 256mb worthless drives either, recently I found a very nice 16gb SanDisk for 50 cents at a yard sale. Below is a very small sampling of my collection.

I seem to be able to find two or three drives every couple weeks. Often these finds come with financial information, family photos, documents, bank statements, and of course nude personal photos. Unless you are living in a cave some where, in which case you are not reading this, you cannot turn your head without hearing about an identity theft or loss of data somewhere. Heck, I just saw a trailer for a movie called Identity Thief staring Jason Bateman and Melissa McCarthy, which looks hilarious by the way!

One would think with mainstream media and even Hollywood educating us everyday of the risks of identity theft, that everyone would be securing their devices or at best not keep sensitive data on them at all! Alas, this is not the case and in nearly every device I review I am able to find sensitive documents and images. In most cases simply by viewing it, rarely do I need to run any recovery tools to find them.

So until people figure out that they cannot simply toss or sell these items without proper sanitation, or encrypt them, or even better smashing them into little pieces rather then trying to get 50 cents, their precious documents and data will be used in ways they do not intend.

And Ashley, thanks for the naked pics.

Want to see more? Click here >>> Just kidding ;)

Posted by Mike Wright

I am not able to confirm this but it sounds good and if it is true this is great for iPhone 5 owners that have the need to unlock their new phone without the normal head ache. Check out the below link for details, great job Romain!

TechCrunch

Posted by Mike Wright

Facebook began purging massive numbers of Likes that were believed to be from fake and fraudulent sources. According to the Facebook Security Page "on average, less than 1% of Likes on any given Page will be removed, providing they and their affiliates have been abiding by our terms. These newly improved automated efforts will remove those Likes gained by malware, compromised accounts, deceived users, or purchased bulk Likes."

Further they state that "users will continue to connect to the Pages and Profiles they authentically want to subscribe to, and Pages will have a more accurate measurement of fan count and demographics. This improvement will allow Pages to produce ever more relevant and interesting content, and brands will see an increase in the true engagement around their content."

As you can see in the image below from PageData, some fan pages have lost a large number of fans.

Source: PageData

Posted by Mike Wright

I have installed and am currently evaluating Windows 8 Enterprise RTM. In my test domain I discovered right away a glaring item was missing. No I don't mean the start menu, though the lack of a start menu is going to thoroughly confuse most users. What I noticed was missing, as compared to all previous versions of Windows, is the CTRL+ALT+DEL key press to logon to the domain. In all previous versions of Windows after the computer starts up, before the user is allowed to type in their username and password, they are required to press CTRL+ALT+DEL. This key press has been historically tied to ending any unauthorized processes. But in theory, it also requires a human interaction before the logon. This extra key press can show that a user intended to logon. Should they violate corporate policy it may be shown that they did press the keys, they did logon, they were displayed a policy banner, and so on. Alas, in Windows 8 this requirement seems to have become optional.

Now domain administrators need a way to enable this requirement with as little work and as little impact as possible. What I discovered in my testing, and confirmed by a review by others in the same position, a Global Policy Object modification can accomplish this.

To require CTRL+ALT+DEL during logon of WIndows 8 Domain member system follow the below steps.

1. Navigate to the following GPO setting: "Computer > Policies > Windows Settings > Security Settings > Local Policies > Security Options"
2. Locate the following key: "Interactive logon: Do not require CTRL+ALT+DEL"
3. Change the setting to: "Disabled"
4. Reboot the computer or preform a "gpupdate /force" from the command prompt.

On your next logon you will be required to press CTRL+ALT+DEL to logon to the domain member Windows 8 system. This can be applied at the top level of your domain to apply to all child objects.

Posted by Mike Wright

1. Download and install the latest version of TrueCrypt. (7.1a at the time of this post) http://www.truecrypt.org/.
2. Launch TrueCrypt and click on “System”, then “Encrypt System Partition/Drive...”.
3. Choose a “Normal” or a "Hidden” system encryption, for this guide I am choosing “Normal”, click “Next”.
4. Choose to “Encrypt the Windows system partition” or “Encrypt the whole drive”, for this guide I am choose whole drive, click “Next” *Choosing whole drive will take a considerable amount of time however all of your data on the drive will be secure, not just the Windows system.
5. If prompted, acknowledge the 'User Account Control' by clicking “Yes”.
6. Choose your option on whether or not to encrypt the “Host Protected Area”. *The host protected area may have drivers, such as RAID drivers, that need to be accessed ‘pre-boot’.
7. Choose whether you have a single OS installed or are booting between multiple OS’s, click “Next”.
8. Choose the 'Encryption Algorithm' and the 'Hash Algorithm' you want to use. Read each description and select the one that you feel is best for you. By clicking the “Benchmark” button you can estimate how many megabytes per second your encryption task may take. Click “Next”.
9. Create your encryption password, the bigger the better, recommended is 20 characters, click “Next”. *Here is a link to check the strength of your password http://howsecureismypassword.net/.
10. On the next screen you will see moving text. Simply move your mouse around your screen for a while to create a random data pool. Do this for as long or as little as you like, but you should give it a few seconds at the very least. Click “Next”.
11. The next screen will show you the generated keys. You do not need to do anything here, just click “Next”.
12. On the 'Rescue Disk' screen you need to specify a path for an ISO file to be created. You will need this ISO file in the event you need to boot your system from a disk. So “Browse” to a location and save your rescue disk. Click “Next”.
13. Acknowledge the action and insert a blank CD into your CD burner. Choose your CD burner from the drop down box and click “Burn”.
14. Now, before you continue, navigate to the location of the ISO file that you created in the last step. Copy that ISO file to an external location such as a thumb drive. If your disk is lost or broken you can use this ISO file to create a new one.
15. Click “Close”, then click “Next” to verify that your cd is good, click “Next” again.
16. Remove the burned disk, label it, and store it in a safe location.
17. On the next screen you are asked if you want to wipe unused space on your disk. This can be important if you need to securely erase any data that can possibly be recovered. Choose your wipe mode (3 pass is sufficient) or choose “None” if this is not a concern to you. Click “Next”.
18. Next you are asked to perform a 'Pretest'. Be sure that all of your applications are closed and your work is saved. Next click “Next”, agree to the terms, then click “Yes” to reboot your computer and begin the pretest.
19. Assuming there are no issues, your computer will reboot normally and after the POST screen you are asked for your TrueCrypt password. Type the password that you created earlier and press “Enter” on your keyboard.
20. Assuming there are no issues, your computer will start into Windows as it always does. Logon if needed and click on the “Desktop” button from your new start screen. Once on the desktop Trucrypt should be waiting for you. Simply press the “Encrypt” button to begin the whole disk encryption process. You may need to agree to the terms again and User Account Control may prompt you for permission again.
21. At this point just sit back and wait.

Posted by Mike Wright

RSA Conference 2013 registration is now open. Register before November 16, 2012 and receive a substantial discount. I have attended this conference for many years and was a speaker once. It is a great event with tons of training, networking, social opportunities.

This years event will be held on February 25 through March 1 at the Moscone Center in San Francisco California.

Main site is here
Register here
Tools to help justify your trip are here

Posted by Mike Wright