Share this page!

Tal Be'ery Profile picture
Twitter logo
23 Jan, 4 tweets, 4 min read
Abusing #ADFS for #GoldenSAML attack, heavily used by #Sunburst attackers.
To get context, see the fabulous '19 talk @WEareTROOPERS by @doughsec @BakedSec of @Mandiant @FireEye (the irony..)
Slides: slideshare.net/DouglasBiensto…
Decrypting #ADFS #SAML private key
Tools:
github.com/fireeye/ADFSpo…
github.com/fireeye/ADFSDu… Image
BTW @gentilkiwi when #mimikatz support for #ADFS dump? (or is it already supported since then) Image

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Tal Be'ery

Tal Be'ery Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @TalBeerySec

Tal Be'ery Profile picture
25 Jan
1/ Solving the root cause of #GoldenSAML attacks, recently used in #Sunburst attacks.
Don't of scale security "UP", burying #SAML's private key deeper in HSM,
scale it "OUT": distribute it w/ modern crypto (#TSS #MPC)+ service architecture, as we do for #cryptocurrency @ZenGo Image
2/ Advanced attackers (#APT) steal long term secrets ("the stamp") that allow them to issue access tokens and thus access all services in victims' environment, bypassing all security, including multi-factor auth (#MFA,#2FA) Image
3/ @CISAgov recommends protecting such secrets with hardware (HSM), but this solution is not always feasible, does not scale well and is susceptible to vulnerabilities especially when facing #APT attackers (hence: "aggressively updated")
media.defense.gov/2020/Dec/17/20… Image
Read 8 tweets
Tal Be'ery Profile picture
5 Nov 20
1/ IT politics is part of the "physics" of the security problem, much like friction, noise and air resistance in the physical world.
An often overlooked aspect of security solutions is that they empower CISOs to mitigate issues without asking others for help
2/ Per the "Kerberoasting" example mentioned by @jaredhaight, the naive solution would be to just ask service account owners to upgrade password strength.
However, the CISO may have a security solution that monitors Kerberos requests to the DC and blocks massive harvesting
3/ while it might not be the perfect solution, but the CISO can do it right away without asking anyone and buy precious time to fix the root cause of the problem.
Read 5 tweets
Tal Be'ery Profile picture
3 Feb 20
1/ I just published Hitting a CurveBall Like a Pro!
Using #wireshark to detect and hunt #curveball exploits by following the NSA advisory
link.medium.com/JarIb0qQM3
2/ detecting non-standard elliptic curve params
3/ Detecting non-standard base points (but standard a and b parameters)
Read 6 tweets
Tal Be'ery Profile picture
26 Nov 19
1/ Adding details from #NSO Group request for injunction against #Facebook
#NSOgroup
2/ The gist of it: Facebook breached their TOS as it allows blocking only in cases the blocked user actually violated the TOS and requires informing the blocked user
3/ some of the plaintiffs were blocked from both #Facebook and #instagram, while others were only blocked from FB
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @TalBeerySec has new unrolls!

Check out other threads from @TalBeerySec!

Read all threads by @TalBeerySec