Microsoft has released a set of
privacy settings
for Office, one of which enables users to configure the type and amount of
diagnostic (i.e., telemetry) data that Office may send to Microsoft. When
deployed, it is available in the form of a group policy setting. It allows users
to configure one of the following diagnostic data levels: required,
optional, or neither. The report we produced:
The Windows Insight repository now
hosts the
Windows Telemetry ETW Monitor
framework. The framework monitors and reports on Windows Telemetry ETW (Event
Tracing for Windows) activities – ETW activities for providing data to Windows
Telemetry. It consists of two components:
the Windbg Framework: a set of scripts for monitoring Windows Telemetry ETW
activities. The scripts are fed to a running windbg instance, connected to the
Windows instance whose Windows Telemetry ETW activities are monitored.
the Telemetry Information Visualization (TIV) framework for visualization of
information and statistics. The TIV framework is a set of Python scripts that
visualize information and statistics based on the data produced by the Windbg
Framework. The output of the TIV framework is a report in the form of a web
page.
Windows 10 is one of the most commonly deployed operating systems at this time.
Knowledge about its components and internal working principles is highly
beneficial. Among other things, such a knowledge enables:
in-depth studies of undocumented, or poorly documented, system
functionalities;
development of performant and compatible software to monitor or extend the
activities of the operating system itself; and
analysis of security-related issues, such as persistent malware.
The “Insight into Windows Internals” training offered at TROOPERS20 delivers
knowledge on the core components and inner working principles of Windows 10. For
example, the training provides knowledge on how Windows 10 uses virtualization
to isolate security-critical functionalities from attackers that have managed to
compromise the system. The training includes a variety of practical exercises
allowing attendees to observe first-hand the operation of Windows 10.
The Windows Insight repository now
hosts three articles on Windows code integrity and WDAC (Windows Defender
Application Control):
Device Guard Image Integrity: Architecture Overview (Aleksandar
Milenkoski, Dominik Phillips): In this work, we present the high-level
architecture of the code integrity mechanism implemented as part of
Windows 10.
Windows Defender Application Control: Initialization (Dominik Phillips,
Aleksandar Milenkoski): This work describes the process for initializing
WDAC performed by the Windows loader and the kernel when Windows 10 is booted.
Windows Defender Application Control: Image verification (Aleksandar
Milenkoski): This work discusses the workflow of WDAC for verifying images.
The Windows Insight repository
currently hosts four articles on VSM (Virtual Secure Mode):
Virtual Secure Mode: Architecture Overview (Aleksandar Milenkoski): In
this work, we discuss the architecture of a virtualized Windows environment.
**Virtual Secure Mode: Communication Interfaces **(Aleksandar Milenkoski):
In this work, we discuss the communication interfaces that VSM implements:
Isolated User Mode (IUM) system calls, normal-mode services, secure services,
and hypercalls.
Virtual Secure Mode: Protections of Communication Interfaces (Aleksandar
Milenkoski): This work discusses implemented mechanisms for securing the
above VSM communication interfaces. This includes restrictions on issuing
hypercalls, data marshalling and sanitization, and secure data sharing.
Virtual Secure Mode: Initialization (Dominik Phillips, Aleksandar
Milenkoski): This work describes the process for VSM initialization
activities performed by the Windows loader and the Windows kernel when Windows
10 is booted.
The Windows Insight repository
currently hosts three articles on the TPM (Trusted Platform Module):
The TPM: Communication Interfaces (Aleksandar Milenkoski): In this work,
we discuss how the different components of the Windows 10 operating system
deployed in user-land and in kernel-land, use the TPM. We focus on the
communication interfaces between Windows 10 and the TPM. In addition, we
discuss the construction of TPM usage profiles, that is, information on system
entities communicating with the TPM as well as on communication patterns and
frequencies;
The TPM: Integrity Measurement (Aleksandar Milenkoski): In this work, we
discuss the integrity measurement mechanism of Windows 10 and the role that
the TPM plays
as part of it. This mechanism, among other things, implements the production
of measurement data. This involves calculation of hashes of relevant
executable files or of code sequences at every system startup. It also
involves the storage of these hashes and relevant related data in log files
for later analysis;
We are glad to announce the
Windows Insight repository. The
content of this repository aims to assist efforts on analysing inner working
principles, functionalities, and properties of the Microsoft Windows operating
system. This repository stores relevant documentation as well as executable
files needed for conducting analysis studies.
Some of the content of this repository has been created in the course of a
project named ‘Studie zu Systemaufbau, Protokollierung, Härtung und
Sicherheitsfunktionen in Windows 10 (SiSyPHuS Win10)’ (ger.) – ‘Study of system
design, logging, hardening, and security functions in Windows 10’ (eng.). This
project has been contracted by the
German Federal Office for Information Security
(ger., Bundesamt für Sicherheit in der Informationstechnik – BSI). The work
planned as part of the project is conducted by ERNW GmbH, starting in May 2017.
As promised in my
previous post, I am back
for an overview of the Troopers19 – Active Directory related talks… Videos
have been published and it’s popcorn time… So if you are into stories about
Kingdoms and Crown Jewels, grab your loved one [or a drink…] and turn the
lights down low, ’cause tonight it’s “Troopers & Chill…”
Warning: Don’t watch it all in one go… or you will start to feel some anxiety
and pain…
and then the Flying Dutchman will move to the cloud… And at that point we are
not insured anymore.
Windows 10 is one of the most commonly deployed operating systems at this time.
Knowledge about its components and internal working principles is highly
beneficial. Among other things, such a knowledge enables:
in-depth studies of undocumented, or poorly documented, system
functionalities;
development of performant and compatible software to monitor or extend the
activities of the operating system itself; and
analysis of security-related issues, such as persistent malware.
The “Insight into Windows Internals” training offered at TROOPERS’19 delivers
knowledge on the core components and inner working principles of Windows 10. For
example, the training provides knowledge on how Windows 10 uses virtualization
to isolate security-critical functionalities from attackers that have managed to
compromise the system. The training includes a variety of practical exercises
allowing attendees to observe first-hand the operation of Windows 10.
Generally speaking, I’m more of a Cat type of guy, but I have to say I really
love BloodHound. And if you do too, you are in for a treat…
Last week, the ERNW InsightActive
Directory Security Summit took place in Heidelberg.
(More Info)
For
this occasion, @Enno_Insinuator asked me
if I would like to deliver a BloodHound Workshop, and of course I accepted
the challenge…
We had a full class, I had a blast training it, and I hope the trainees enjoyed
it as much as I did.
But that’s not all…
Another part of the deal was that I had to write a Training Guide that we
would then share with the Community (aka you).
So here it is, fresh from the Heidelberg press and available for download:
