Anyone Use AV at home?

Last edited:
Dooksy said:
Which passwords? CESG actually recommend that passwords aren't rotated/expired now.

https://www.cesg.gov.uk/articles/problems-forcing-regular-password-expiry
Click to expand...

Admin passwords. Attackers don't really care about standard user passwords, and besides for most cases some sort of 2FA should be possible for user credentials.

Admin passwords should be rotated regularly, ideally after every session, to protect them from being captured by malware and so that, on Windows machines, password hashes are invalidated as soon as possible.
 
visibleman said:
Out of interest, have you got a source or standard that backs that statement up?

Can't say i've heard of that before and would assume that's impractically in a lot of situations.
Click to expand...

I said 'ideally' - it's not a defined standard by any of the usual bodies.

Yes, it's impractical, unless you have a tool that manages your admin sessions and enforces the rotation - there are plenty out there that can do just this. Manually changing passwords after each would be an almost impossible task, especially if multiple admins are using the same access.
 
visibleman said:
Out of interest, have you got a source or standard that backs that statement up?

Can't say i've heard of that before and would assume that's impractically in a lot of situations.
Click to expand...

As mentioned above there are tools that do this.

I worked somewhere whereby admin credentials were checked out when you wanted to use them (and needed two people to put in their halves of the password that allowed you to do so), then when you logged out it changed the password with a new one it had generated.
 
for AV I use a pfsense box between WAN and LAN - setup squid as transparent proxy scanning content and clam AV plugged in for the AV scanning
 
Ev0 said:
As mentioned above there are tools that do this.

I worked somewhere whereby admin credentials were checked out when you wanted to use them (and needed two people to put in their halves of the password that allowed you to do so), then when you logged out it changed the password with a new one it had generated.
Click to expand...


How secure is the mechanism that's resetting the admin password?

Either way it seems a bit extreme :), you don't need the password, you just need a user account capable of resetting the password (EoP)
 
LizardKing said:
How secure is the mechanism that's resetting the admin password?

Either way it seems a bit extreme :), you don't need the password, you just need a user account capable of resetting the password (EoP)
Click to expand...

You store the admin password on a secure server. The secure server has the ability to remote-connect to the target server by SSH or Powershell Remote or whatever. The secure server rotates the password by logging on to the target server as the admin account and resetting it using standard command like passwd. You don't need another account.

It's not extreme when you realise that the majority of hacks involve stolen admin credentials, captured using keyloggers, ram scrapers, network taps or stealing them from plaintext password stores (eg Excel) or config files. Keeping these credentials away from hackers means keeping them away from users desktops.
 
Ev0 said:
Depends what it is you are protecting...
Click to expand...

A great recent example is Bangladesh Central Bank. Hackers managed to get malware on user's desktops (not picked up by AV) that was able to scan for and find privileged credentials for an application called SWIFT, which controls inter-bank transactions. They were also able to record the steps that people went through to actually use SWIFT, and learn how to use it for themselves.

They then were able to use the stolen credentials to execute $1billion of transactions. Fortunately most were stopped by intermediary banks (due to obvious spelling mistakes in some transactions!) but about $80million found its way to a dodgy casino in the Philippines.

You can also look up Target (40 million sets of credit card details stolen) and 'Kemuri Water Company' (hackers were able to change the mix of chemicals going in to the consumer water supply) to see what can happen when the bad guys manage to steal an admin password.

So yeah, lock them up tight.
 
LizardKing said:
You don't need to lock them passwords up so secure (other than to appease auditors) because at the end of the day bypassing them or resetting them is far simpler.
Click to expand...

Those are interesting vulnerabilities, for sure. However I disagree when you say you don't need to lock up passwords. The research from organisations like Mandiant shows that almost every attack involves credential theft at some point. Engineering attacks like the two you mentioned is pretty difficult, and once the flaw is repaired (as your examples were) then you're forced to find a new point of entry.

If I steal a password and log on, I'm immediately bypassing all of the security measures in place, and there's no patch that will stop users coughing up passwords sooner or later.
 
You must log in or register to reply here.
Back
Top Bottom