Blog
Findings, advisories and field notes from Threatbear engagements.
Network defence using RouterOS (Part 1)
When looking for threats sometimes you know exactly what you’re looking for. Sometimes — actually often — you only have a general direction in which you wish to conduct your hunt. RouterOS has an operator for a fuzzy search ~ and an operator for an exact match = . This is extremely useful for those situations in which you only have a single clue to go on! If you’re anything like me, once you have a single “high signal” indicator, this then is all the motivation you need to continue the search no matter how arduous.
Read moreIs RouterOS vulnerable to CVE-2023-48795 ?
Is RouterOS vulnerable to CVE-2023–48795 ? Update (20/12/2023) : Terrapin scanner no longer crashes and correctly identifies RouterOS as not being vulnerable to the Terrapin attack — thanks to @TrueSkrillor It was recently discovered that the SSH protocol has a weakness that enables an attacker with the ability to perform a man in the middle to affect the negotiation of protocol security features without the client or server noticing.
Read moreQuick and dirty RouterOS forensics
Here are some commands you can use to conduct a basic forensic examination of a RouterOs device or VM. Note that this it not a full fledged forensic acquisition — this is just a quick single pass look if you don’t have time to pull the data off the flash chips. Check for suspicious logins (should cover webfig and ssh methods) /log/print where topics~"system" Review recent config change history /system/history/print detail /system/history is a very powerful audit feature, especially if you are conducting incident response on an engagement that doesn’t have centralised logs (aka most sites). This is because it includes the detail of the change, the actor and a timestamp, for example :
Read moreRouterOS visibility using Elastic Security
xHaving visibility into host events gives you an insiders view to what is happening on a desktop or server. This information is the primary domain for detecting threats on endpoints, however this information isn’t always available or is not available at all for non general purpose operating systems. This article will give you a jumping off point to get logs of all kinds from RouterOS into Elastic using Elastic Agent
Read moreBacking up Proxmox VMs to Backblaze B2
There are many ways to backup VMs on a Proxmox hypervisor : Use their “Proxmox Backup Server” — this is a great option because it offers incremental backups & deduplication. Use a ZFS volume to store your VMs and use zfs send to backup the snapshots to a remote system Copy the backup files to S3 compatible storage such as Backblaze B2 or Amazon S3. We will be doing the latter due to the fact that is it simple and cost effective.
Read moreMicrosoft Edge popping shells on macOS
Microsoft Edge popping shells on macOS If you’re wondering why Microsoft Edge on Mac spawns a bash shell on Mac you might have the same reaction and thought process as me. I don’t want my browser to be able to spawn a shell (or possibly any program that isn’t shipped with the browser) Is there a better way to do this? probably! Can we turn this off!? Why? Let us look at the last question — why? If we inspect the process.args we can derive an indication of what Microsoft are getting at :
Read moreProperly renaming Proxmox nodes
In the event you need to rename a Proxmox PVE node you will probably stumble upon this article : https://pve.proxmox.com/wiki/Renaming_a_PVE_node I followed most of these instructions, but missed a crucial bit : This must be done on a empty node. Yeah…whoops! After rebooting you might find that your VMs are not running! Thankfully it is a simple-ish fix: Backup your /etc/pve directory Move the files from the /etc/pve/nodes/oldnodename/qemu-server to their respective new directory, for example to /etc/pve/nodes/newnodename/qemu-server
Read moreZeek without rc.local
Zeek without rc.local In order for Zeek to properly capture packets you need to disable some network card features, such as tcp offloading and the like. Security Onion has a handy article at https://blog.securityonion.net/2011/10/when-is-full-packet-capture-not-full.html While you can just run this manually : for i in rx tx sg tso ufo gso gro lro; do ethtool -K enp2s0 $i off; done You don’t really want to be doing this every time the system restarts. Before systemd you might have just put the above command in /etc/rc.local but nowadays systems are not guaranteed to have this legacy feature.
Read moreUsing Osquery to check if you’ve patched CVE-2022-26809
Using Osquery to check if you’ve patched CVE-2022–26809 Update: this won’t work as monthly rollups supersede discreet KB patches. See https://claroty.com/2022/05/04/blog-research-from-kbs-to-cves-understanding-the-relationships-between-windows-security-updates-and-vulnerabilities/ Here is a quick search you can run across any vulnerable Windows version to see if you have installed the patch for CVE-2022–26809 select * from patches where hotfix_id in ('KB5012596', 'KB5012599', 'KB5012599', 'KB5012604', 'KB5012596', 'KB5012670' ,'KB5012639' ,'KB5012650' ,'KB5012666' ,'KB5012658', 'KB5012632', 'KB5012670', 'KB5012626' ,'KB5012649', 'KB5012592' ,'KB5012653', 'KB5012599', 'KB5012599', 'KB5012591', 'KB5012647');
Read moreUsing Google Chat for Elastic Security Alerts
If you’re a fan of Google’s new spaces feature and want to have one less app to check you may be considering replacing Slack with Google Chat or Spaces. Here is how to configure an Elastic connector so that you can get alerts and notifications in Google Spaces : Add an incoming web-hook in the space that you want to receive notifications in. I recommend a dedicated space per environment so you can mute and better manage notifications
Read more