Cybercriminals have moved beyond brute force. Rather than spinning up smash-and-grab attacks, many now infect single machines and then perform reconnaissance to prioritize their next network targets.
CFO put it simply: “The strategy of defending a perimeter to keep attackers out is no longer sufficient. Organizations instead need to assume that their network will be penetrated.” Malicious actors are biding their time, discovering what they can before stepping up their efforts.
But how do IT administrators detect and deflect recon attacks? A pair of Microsoft researchers developed a way to help IT departments stay safe, known as SAMRi10.
Flying Blind
Recon attacks are now a key part of cybercriminals’ threat chain. While infecting single machines without detection isn’t difficult, crashing randomly around corporate networks tends to attract attention. As a result, fraudsters developed ways to quietly map company connections and determine the most lucrative next step.
According to Bleeping Computer, Windows’ Security Account Manager (SAM), which contains all information about user accounts, makes this easier for many fraudsters. Authorized users can conduct Security Account Manager Remote (SAMR) queries to return information about local and domain users, aliases, memberships and other critical network data.
While computers separate from larger network domains are largely problem-free, since they only hold local user data, those attached to the corporate system at large can help point cybercriminals in the direction of sensitive or mission-critical information.
Since SAMR queries happen regularly in both Windows 10 and Windows Server 2016 environments, fraudsters can easily avoid red flags as long as they establish access on one PC. These queries under control of attackers give them eyes in every corner of the network but leave admins flying blind.
Good SAMRi10
Microsoft researchers Itai Grady and Tal Be’ery developed a counter-recon tool by the clever name of SAMRi10, pronounced “Samaritan,” to limit the reach of recon-minded attackers. As noted by the The Register, SAMRi10 is a PowerShell script that system admins can execute to limit the ability of users to perform SAMR queries.
The tool leverages a registry key present in Windows 10 and newer versions of Microsoft’s OS, HKLM/System/CurrentControlSet/Control/Lsa/RestrictRemoteSAM. This allows system administrators to restrict SAMR actions to admins only and create a separate user group if they need to authorize specific personnel who don’t have admin status.
So far, the tool has performed well against popular recon software such as PowerSploit and BloodHound, and the Microsoft team encouraged all security admins to consider reviewing the full documentation.
No Good Deed…
While Grady and Be’ery have certainly performed a good deed for Windows 10 users, it’s worth noting that SAMRi10 doesn’t work on any previous version of the OS, and Windows 10 has only 22 percent of the current market share. In other words, shutting down this recon pipeline doesn’t trip up attackers anywhere else.
But a recent Cyber Scoop article pointed to another way forward: The Department of Homeland Security (DHS) wants Silicon Valley companies to turn the tables on cyberattackers by developing deception techniques designed to confuse and frustrate any attempt at recon.
Observation is the new cybercriminal watchword. Tools such as SAMRi10 and a focus on taking the fight to shifty cyber spies, however, may help tip the scales in favor of IT security.