Blog

Findings, advisories and field notes from Threatbear engagements.

18 April 2022 · 2 MIN READ

Getting Dockerd to behave with Snap

When you install docker using snap on Ubuntu you can’t configure it using the default config files dues to the isolated nature of snapd. Here is how you can configure dockerd to listen on a network socket when using snap on Ubuntu First, edit /var/snap/docker/current/config/daemon.json and add a hosts line like so: { "log-level": "error", "storage-driver": "overlay2", "hosts": ["tcp://1.2.3.4:2376"] } Then run : snap restart docker You can now connect to Dockerd over the network (remember to set the TLS cert and secure the service appropriately) by specifying the socket

27 March 2022 · 2 MIN READ

Increasing signal to noise ratio for Mitel systems

If you’re responsible for defending Mitel systems, specifically the Mitel MiCollab suite running on Mitel’s “Mitel Standard Linux” you have probably noticed by now that the systems are very noisy from defenders point of view, for example: Yes this is actually a legitimate process tree on a Mitel Micollab system — I was investigating an alert that detects suspicious child processes spawned by Java and this is what I found. With process parent-sibling relationships as long as these being the normal (the full tree is about 20 processes long) it is hard to detect or alert on actual malicious activity.

23 November 2021 · 1 MIN READ

Detecting CVE-2021–41379 using EQL

Microsoft’s patch for https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41379 was apparently done on a bumpy taxi ride and we now have an exploit that can do local privilege escalation with very few mitigations. If you use Elastic Agents on your fleet you can detect exploitation of this using the following EQL query. Please note that this is a work-in-progress (although due to the severity of this bug a noisy detection might be better than getting owned) :

28 October 2021 · 2 MIN READ

Deploy Elastic Agent with Microsoft Intune

In my previous story I shared how any organisation can go from having zero security visibility to having a wealth of contextual information in less than a day. In this article I’m going to share a small Powershell script that can be used with any management tool to deploy Elastic Agent to a whole fleet of Windows systems. Using this tool an administrator can easily deploy Elastic Agent to 10 or 1000 systems without breaking a sweat!

28 May 2021 · 3 MIN READ

From Zero to Visibility in record time

With Security context is critical ; to make a simple analogy there is a huge difference between your wife holding a bread-knife during the daytime is a very different situation to an intruder wielding that same knife in the dark of night. At Threatbear we help Aussie companies detect and respond to Cybersecurity threats and the workflow often goes like this : Install an Osquery fleet server ~1day Build the binaries and connect the endpoints ~1day+

27 February 2019 · 1 MIN READ

Renaming multiple files

When trying to rename multiple files in a directory tree that have the same name — such as Azure signin logs that are written to Azure storage accounts — if you are like me then your first thought would be to use the find . -name *.json -exec mv {}; pattern. The problem is that find executes only one mv here and not one for each file as you would assume. To achieve this we need the help of our venerable bash shell :

2 January 2019 · 1 MIN READ

Digital Ocean dictates what nodes you can add to their Kubernetes service

When one pays money to rent the compute resources from another it should be the customer — not the provider — that decide whether a system can run a workload or not. Simply put I signed up for the Digital Ocean Kubernetes preview and it worked well. Super easy way to get started with Kubernetes and in my case a great way to run periodic jobs in a secure (using k8s secrets) and repeatable (defining my CRON job in a YAML file and ‘applying’ it to the cluster) way.

23 July 2018 · 2 MIN READ

Using Amazon Athena to check if a password has been pawned

Ever wonder if a password you use has been used before or more importantly whether this password is widely known to hackers? Troy Hunt runs an excellent site called “Have I Been Pwned” that allows one to check if their account details have been compromised as a result of a data breach. This works well if you want to check a dozen or so accounts but what if you want to check a couple thousand or million passwords?

6 September 2017 · 1 MIN READ

FTDI drivers on OSX reap havoc with USB ports

In order to update the firmware on pycom.io’s Lopy development boards you need to install the FTDI Virtual COM port drivers (shasum b57377e10de1c8ae9ddaffa147e4cc529c3571b512bba4798b2b6054d4fabd92) for OSX. After an indeterminate amount of time my left USB port on my Macbook Air stopped working properly. If I listed the USB devices on the system : system_profiler SPUSBDataType The device would be listed yet the device details would not be present (and would not work To solve this issue you basically need to remove the driver (I will just use the serial port on my raspberry pi or something like that

29 August 2017 · 3 MIN READ

Why you should choose Hashicorp Vault to store your secrets

I have an ageing certificate authority that is stored mostly offline on a minimal Debian VM. This provides decent security when the VM is not running however there are several risks that have to be considered on the odd occasion when it is running: Integrity of my local machine is roughly proportional to the security afforded by the VM, i.e a compromise of my local machine is the weakest link in the chain of security that protects the VM and the CA within it.