Breadcrumbs to loafs: How tidbits of information lead us to full-scale compromises

Presented at BSides Austin 2017, May 4, 2017, 4 p.m. (60 minutes).

Often on red teams, there is no obvious path to compromising the environment. Reconnaissance efforts, both external and internal, may yield only crumbs of information. Though tiny and often in obscure locations, these bits of information can serve as a trail of breadcrumbs to full-scale compromise. Specific keys in the Windows Registry and unusual sources of open-source intelligence gathering can provide valuable information about a network mapping that most companies don't know exist. We walk you step-by-step through what some of these crumbs are, how to find them, and how we have used tiny bits of information to escalate our privileges to full-scale enterprise compromise.


Presenters:

  • Brandon Arvanaghi
    Brandon Arvanaghi is a security consultant at Mandiant (a FireEye company), where he has conducted red team operations against several Fortune 500 companies. At Mandiant, he has written tools for webshell detection and malware sandbox evasion. He has also developed a large-scale post-exploitation tool used internally by consultants on red team engagements. Prior to Mandiant, Brandon conducted research on automated attack plan generation at Vanderbilt University.

Links:

Similar Presentations: