In a recent assessment, we had to evaluate how Microsoft’s System Management
Server (SMS) certificate management solution (CMS) stores and handles
certificates. This question came up because sensitive, encrypted user
certificates were to be stored in the SMS CMS. Due to the sensitivity of the
handled certificates, we assessed the protection capabilities of the certificate
management solution against extraction attempts from a local attacker with
administrative privileges.
How did we do it?
We determined a five steps approach to gain access to the certificates and be
able to decrypt the accessed certificate material:
Usually I’m not the kind of guy who talks about such economic topics. Because
I’m an engineer / security researcher who is exclusively concerned with
understanding technical problems and if possible, solving them accordingly. My
whole education is based on this and contains predominantly technical aspects of
information security. This sometimes makes it difficult to understand what the
market cares about (and why some products are being developed / exist on the
market 😉 ). Nevertheless, a current engagement for one of our customers made me
stumble upon such a product.
I am currently at the 25th
Virus Bulletin International Conference in
Prague. The VB2015 is hosted by the Virus Bulletin portal and provides three
full days of learning opportunities and networking.
VB2015 focuses on the key themes:
Malware & botnets
Anti-malware tools & techniques
Mobile devices
Hacking & vulnerabilities
Spam & social networks
Network security
General Observations:
What I liked about VB2015 was the very friendly and always helpful staff. The
good conference location, it never felt overcrowded or to empty and the very
good catering during the conference.
Internet Information Services (IIS) contains several components that perform
important functions for the application and Web server roles in Windows Server.
As it is designed to be used in an enterprise environment, the security of this
system must be kept at a high level.
By default IIS implements a lot of basic security measures, but are these the
relevant ones to protect your business?
In order to answer this question for one of our customers, we have compiled the
most relevant security settings in an IIS 7.5 Hardening Guide for you. In this
guide we define a baseline security level, which is to be used for so called
“crash and burn systems” (systems with non-critical data, systems whose
availability have no business relevant impact) and a security level high, which
includes all other systems. The mitigations in the baseline section are
non-critical and therefore no further test are necessary. The mitigation in the
section high, are critical in terms of availability and need to be tested
extensively. The system owner must decide, which security level is the right one
for their system, and which mitigation from section high are mandatory for their
system.
On Saturday, April 26 Microsoft announced that Internet Explorer version 6 until
version 11 is under potential risk against drive-by attacks from malicious
websites, regardless of the underlying Microsoft operating system and the
associated memory protection features integrated with the operating system.
Microsoft has assigned CVE-2014-1776 to this unknown use-after-free
vulnerability, which in the worst case could allow remote code execution if a
user views a specially crafted website. If an attacker successfully exploits
this vulnerability, s/he will gain the same rights and privileges as the current
user (once again, activated User Account Control [UAC] helps keeping
privileges of the user low).