prisons escalation. This is the next category of attack,
and what we're talking about here is the idea that once an attacker gets into the computer network, they have limited access, potentially based on whatever user they fished or whatever system they compromised.
Generally, an attacker is gonna want unlimited access to your network. How do they go about doing that? Well, they do that through privilege escalation attacks.
This could be through user name and password cracking could be through additional social engineering attacks are maybe even exploiting trust relationships that you have on your network or with other partner organizations.
There's a great Web site out there. Exploit D B.
This is maintained by anything is maintained by the folks. Offensive security maintains that,
but it's a collection of
exploits on. So if you were looking to do province escalation or something like that, there's a whole bunch of suggestions for what you can do on this site, and it's all publicly available information.
Why would somebody do present escalation? Well, they're looking to gain access to additional information. So once their first attack, once their initial attack is done, they usually have some subset of access right they've got access to certain systems. They've got access to certain information. What they really want to do is increase that.
And they do that through ribbons, escalation.
They're going to target any type of system or relationship that might have something of value.
Well, what is value? What's valuable to an attacker?
Well, it depends really on what their motivations are, right,
So it could be information. It could be simple access.
It really depends on what that attacker wants out of this attack. What are their objectives for this attack?
If their objectives are to get in and, ah,
maintain a presence so that when their employer comes up a year later and says, Okay, crash that router, take that system out. They're not really concerned about pulling data out.
What they will do is go in and they'll sit there on the network and wait patiently until somebody tells them. Okay, shut it down and then they'll push the button
completely different objective here might be if they're going after intellectual property.
So they're trying to find your trade secrets and that sort of thing. Their their motivations are I've got to get this file and I don't care how I get it. I just need to get it.
So break down the door. They'll grab the file on the run away
on. We'll do it very quickly.
It's not just a English language problem.
how would you actually go about doing privates? Escalation. A couple examples for you
Password cracking the idea that you're trying to brute force the password or using a dictionary attack to crack out passwords.
Dictionary attacks The idea that you have a word list
and you're trying every word that's in that list. Compute the hash of that compared to what you have and see if the passwords match.
There are password dictionaries for every single language, very obscure ones and even a cling on language dictionary. So for all of you Trekkie fans who have passwords and cling on,
I'm sorry there's a dictionary to crack that out. So, you know, it was a Trekkie who came up with that word list.
additional ways of doing proves escalation here. Trust relationships.
Who is the attack are going to go after in this scenario? Are they going to go after the the company who has a really solid firewall they do lots of defensive measures. They're really strong, secure network. Or they're going to go after the partner of that organization. Maybe 1/3 party
or an outsource service provider
who doesn't know the first thing about security. Who do you think they're gonna go after?
Well, they're gonna go after the weaker of the two, right?
You don't have to have really good security network security. You just have to have better security than the other guy because that that's who the Attackers were gonna go after. They're gonna go after the weaker links.
So if you have relationships with external companies, understand that those relationships can be abused. We see this quite a bit within the corporate, the corporate sector, where you've got a company and they've got hundreds of service providers that provide
Well, they're always network connections. There's always some type of data transfer that happens between,
you know, parent company and service provider. And sometimes those links aren't monitored or they aren't looked at or, you know, the parent company just said, Here's one of our computer systems. Put it in your office, and when you need to connect to us It's like you've got an always on live drop to our network
mitigating strategies. Here you have to use strong and complex passwords, anything that uses a password again Windows accounts, email accounts, even WiFi access points. You need to have strong, complex passwords on it,
and by strong and complex, we don't necessarily mean random characters. It's better to have a long, single word like a 16 character word that's in a dictionary, as opposed to a five or six character
random password, because it's very easy to crack out short passwords. But the longer it is, the harder it is for that attacker to actually compromise it.
So using a pass phrase or not a single dictionary, word s o like I have the power or something. I mean that you can use that as a pass phrase, and that's actually pretty secure because it's long number of characters
do network monitoring, so look for failed log in attempts. This will tell you who's knocking at the door. Who's trying to get in?
Take a look at the trusted pass eso. If you have a trust relationship with an external provider,
make sure you monitor those
the internal or intrusion detection systems. Of course, you've gotta have that. You've gotta have an a virus, but you have to keep it updated.
Ah, and that will also go towards mitigating somebody doing further escalation