USUALLY DISPATCHED SAME DAY OR NEXT DAY. This exciting, new product from Skywatcher, the SynScan Wi-Fi Adaptor Module is compatible with all of Sky-Watcher's Go-To mountings and telescopes, it allows convenient, wireless control with your smartphone or tablet using either the SynScan App or SynScan PRO App, which are available for free download from either the Google Play.
The Komodo CAN Duo Interface can operate as a CAN node, to send and receive messages, on up to two different CAN networks. Communicate with any type of CAN network, from automotive systems to industrial controls. The Komodo interface operates at up to a maximum bitrate of 1 Mbps.

Download Syscan Network & Wireless Cards Drivers
Download Syscan Network & Wireless Cards Drivers

Page 1 of 3 - Using the Skywatcher AZGTi with a Windows PC, ASIAIR, and Stellarmate: Review and Opinion - posted in Mounts: The following is a lengthy post regarding my review and opinion using various hardware/software control devices with the Skywatcher AZGTi. Hopefully the review is not too long, but I wanted to be comprehensive in order to answer the many questions I’ve read and received.

For those of you that didn’t make it to SyScan ‘15 last week, this is a blog post version of the presentation I gave about the vulnerabilities I found in group policy that resulted in Microsoft releasing MS15-011 and MS15-014 in February. These bulletins resolve issues in Microsoft’s group policy engine that allow remote code execution at SYSTEM level if an attacker can intercept network traffic from a domain-joined system.

The full process leading up to their discovery, along with exploitation details and accompanying video demonstrations, will be given. Additionally, the new security controls introduced by Microsoft will be discussed to assess how effective they are, show what attack scenarios they mitigate and which ones they do not. Finally, some additional guidance will be given on other mitigating controls that can provide additional protection will be discussed.

How does group policy work?

Group policy is Microsoft’s core infrastructure for managing the configuration of both users and computers in an enterprise windows forest. Configuration settings can be grouped into group policy objects (GPOs) and these can be linked to various physical and logical groupings of computers and/or users. Alongside Microsoft Office, it is arguably the defining reason that Microsoft still dominate the business endpoint market. Some of its key selling points are summarised below:

Allows highly flexible, centralised machine and user configuration over global enterprise networks
Smart redundancy, designed to handle many sites/offices distributed over a global WAN
It is key to enforcing security critical configuration settings across an enterprise

In a windows domain, there are domain members and domain controllers. Domain controllers store all GPOs and domain members communicate with domain controllers in order to determine which GPOs are relevant to them and to fetch the GPOs themselves. At a high level, there are four key services that allow this to happen:

DNS – Used to find the nearest domain controller
RPC – Used to establish a secure channel with the domain controller make various RPC calls
LDAP – Used to query the high level group policy configuration and which GPOs should be apply
SMB – Used to get the full GPO content for each applicable GPO

There are a huge number of configurable settings that can be set via group policy but the wealth of these end up as enforced registry changes on the endpoint. However, some notable exceptions to this are those that involve user accounts or group membership changes and file creation/modification. Different settings fall within different client side extensions (CSEs) and these CSEs will only be enforced on the client side if it has been indicated via LDAP that the relevant CSE is applicable for any given GPO. There are a large number of CSEs but some examples include security settings, registry settings, user accounts/groups, internet explorer zones etc.

How can it be attacked?

First we will cover the situation prior to February 2015 (when MS15-011 and MS15-014 were released in response to these attacks) and look at what attack scenarios apply and how they could be exploited. The first important point to understand is that the sheer control group policy affords over system configuration means that if you can control group policy then you effectively have full SYSTEM equivalent control over the systems under it. Beyond that, we need to understand that each of the four key steps outlined earlier need to complete successfully in turn for the next one to begin. For example, if the RPC stage fails then we won’t reach the LDAP stage and so any attacks focused on later stages need to ensure the earlier stages complete.

The focus of this post is on the latter two protocol stages of the group policy update process, LDAP and SMB. These are the most interesting from a security perspective because LDAP is used to specify which GPOs and CSEs should apply to a host and SMB is used to fetch the individual GPOs including all the detailed configuration changes they contain. Control over either of these stages would give us significant control over the domain member that is fetching group policy.

So what security controls are in place to protect LDAP and SMB communications? Well the key concern here is that the domain member verifies the identity of the domain controller to ensure it is a getting its group policy from a legitimate source and that integrity protection is in place to ensure the data can not be tampered with in transit. These are principally handled via authentication within the protocols plus integrity protection in the form of LDAP signing and SMB signing. We will focus on SMB from this point forward as this would give the most flexible control over individual configuration options due to it being used to fetch the individual GPOs themselves.

There are configurable settings in group policy for controlling security critical options related to SMB signing. An excerpt of the “default domain controllers” policy is given below:

As you can see, the default behaviour for domain controllers is to require SMB signing. This is a good control to have in place as we would not want SMB connections pulling down GPO information from domain controllers without integrity protection in place. This was alluded to in one of Microsoft’s technet articles from back in 2010 with the following quote:

“SMB signing is available in all currently supported versions of Windows, but it’s only enabled by default on Domain Controllers. This is recommended for Domain Controllers because SMB is the protocol used by clients to download Group Policy information. SMB signing provides a way to ensure that the client is receiving genuine Group Policy.”

However, that does not paint the full picture as it tells us nothing about the client. The relevant group policy options for specifying SMB signing on the client side are not specified in the “default domain policy”, which is applied to all domain members. Consequently, we need to look at what the default local configuration is. An excerpt of this showing the relevant settings is given below:

As can be seen, SMB signing is not set to be a requirement on the client side. This means that domain members acting as an SMB client will negotiate SMB signing but will not require it if it is not supported.

Defeating SMB Server Signing

If the domain member does not require SMB signing but the domain controller requires SMB signing then how do we attack it? If we were in a position intercepting network traffic then we could either allow signing to be negotiated and then the connection would go on fine but be protected or we could prevent signing from being negotiated but the server would terminate the connection. However, we can avoid the domain controller SMB service altogether to eliminate the problem. The key points outlining this are given below:

We allow DNS, RPC and LDAP traffic to all pass through from the domain member to the domain controller unhindered
We redirect SMB traffic to our own malicious SMB server via NATing rules or similar
The “real” SMB service on the domain controller is never involved so we can force SMB signing to be disabled on our own malicious SMB server
The domain me

Download Syscan Network & Wireless Cards Driver