Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Tuesday, January 30, 2018

DNS

Public DNS Server


Secure DNS

DNSSEC No Logs
DOwn Resolver Mexico 01 - 201.131.126.212


Open DNS

208.67.222.222
208.67.220.220

Google

8.8.8.8
8.8.4.4

Security

Hack Fix – WIndows 8.1 10 2012 2012/R2 2016
https://www.bishopfox.com/blog/2017/10/a-bug-has-no-name-multiple-heap-buffer-overflows-in-the-windows-dns-client/

DNSCrypt - command line - Encrypts all DNS traffic between the user and OpenDNS, preventing any spying, spoofing or man-in-the-middle attacks
https://www.opendns.com/about/innovations/dnscrypt/

Simple DnsCrypt –GUI - Configure DNScrypt-proxy on Windows-based systems so that you can encrypt and secure your DNS traffic
https://github.com/bitbeans/SimpleDnsCrypt

Monday, June 26, 2017

Cloud Security

News

Summer 2017

Azure vs AWS

UpGuard in a post

The UpGuard report was just the latest in a string of such announcements, including:

The finding by UpGuard resulted in a post about "AWS S3 Bucket Provisioning."

Tools

DNS

Simple DNSCrypt

image

DNS Proxy

https://simplednscrypt.org/

https://github.com/bitbeans/SimpleDnsCrypt

IPLookup

https://community.spiceworks.com/tools/ip-lookup/results

Browsers

Epic Privacy Browser

image

https://www.epicbrowser.com/

Comodo Dragon

https://www.comodo.com/home/browsers-toolbars/internet-products.php

Brave

image

https://brave.com/

Tor

image

Anonymous Browsing

https://www.torproject.org/index.html.en

Google

If using Google via tor you might end up redirected to a localized google site so try:

http://www.google.com/ncr (no country redirect) instead

https://www.google.com/webhp?cr=countryUS should also work.

Browser Security – Go Private

Use InPrivate or InCognito Browsing

image

Internet Explorer: Control + Shift + P

image

add –private to shortcut

image

Chrome Control/Command + Shift + N

add –incognito to shortcut

imagepr

FireFox

"C:\Program Files\Mozilla Firefox\firefox.exe" -private-window

Clean your Flash Cookies

%appdata%\Macromedia\Flash Player\#SharedObjects

Clean your DNS Cache

ipconfig /flushdns

Reference

In Private Browsing

https://www.howtogeek.com/137466/how-to-always-start-any-browser-in-private-browsing-mode/

Tuesday, September 1, 2015

Loopback Check

There are two methods to work around this issue that is designed to protect your system from bad internal code or malicious viruses.  Introduced on Windows XP SP2 and Windows Server 2003 SP1 to protect from what Microsoft calls to reflection attacks on your computer.  These are both well documented on TechNet.  https://support.microsoft.com/en-us/kb/896861
Typical syspton in Sharepoint is the windows security box to reappear after you type in a correct username and password.  To try again with no luck.  If you are getting this check the registry.

Creating a whitelist of good websites is the preferred method seen below.  However many SharePoint Admins just totally disabled the check in method 2 also noted below.
Method 1: Specify host names (Preferred method if NTLM authentication is desired)
To specify the host names that are mapped to the loopback address and can connect to Web sites on your computer, follow these steps:
  1. Set the DisableStrictNameChecking
    registry entry to 1. For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:
    281308 Connecting to SMB share on a Windows 2000-based computer or a Windows Server 2003-based computer may not work with an alias name
  2. Click Start, click Run, type regedit, and then click OK.
  3. In Registry Editor, locate and then click the following registry key:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

  4. Right-click MSV1_0, point to New, and then click Multi-String Value.
  5. Type BackConnectionHostNames, and then press ENTER.
  6. Right-click BackConnectionHostNames, and then click Modify.
  7. In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.
  8. Quit Registry Editor, and then restart the IISAdmin service.

Method 2: Disable the loopback check (less-recommended method)
The second method is to disable the loopback check by setting the DisableLoopbackCheck registry key.
To set the DisableLoopbackCheck registry key, follow these steps:
  1. Set the DisableStrictNameChecking
    registry entry to 1. For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:
    281308 Connecting to SMB share on a Windows 2000-based computer or a Windows Server 2003-based computer may not work with an alias name
  2. Click Start, click Run, type regedit, and then click OK.
  3. In Registry Editor, locate and then click the following registry key:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

  4. Right-click Lsa, point to New, and then click DWORD Value.
  5. Type DisableLoopbackCheck, and then press ENTER.
  6. Right-click DisableLoopbackCheck, and then click Modify.
  7. In the Value data box, type 1, and then click OK.
  8. Quit Registry Editor, and then restart your computer.




Wednesday, April 29, 2015

SharePoint Security

Security 101

Concerns

Edward Snowden, SharePoint, and Security
https://www.credera.com/blog/technology-insights/microsoft-solutions/edward-snowden-sharepoint-security/

Pentest – Phases

  1. Recon
  2. Scan
  3. Gain Access
  4. Maintain Access
  5. Cleanup
  6. Pivot

https://en.wikipedia.org/wiki/Penetration_test
https://windsorwebdeveloper.com/comptia-pentest-study-guide/

Tools

https://www.kali.org/
https://nmap.org/

Tutorials – NMAP Zenmap MegaPing
https://www.youtube.com/channel/UCtudLj18oXlrzrPHqKC5bLA

News

WikiLeaks CIA Files: The 6 Biggest Spying Secrets Revealed By the Release of 'Vault (2017)

https://yro.slashdot.org/story/17/03/07/2124251/wikileaks-cia-files-the-6-biggest-spying-secrets-revealed-by-the-release-of-vault-7

“”1,2,3, and 5 were revealed with the documents that Edward Snowden released to The Guardian and was subsequently detailed in at least a couple of the books written about that leak including Data and Goliath by Bruce Schneier and The Snowden Files by Luke Harding.

The NSA and CIA also maintain a cache of vulnerabilities they have discovered but kept to themselves and not shared with Microsoft, Android/Google or Apple as well as the other operating system vendors so they can perform surveillance on any company running those OS.

This activity has been approved by the FISA court all in the name of Homeland security but not necessarily restricted to that activity.” George

2016

Plan security hardening for SharePoint Server 2016

https://technet.microsoft.com/en-us/library/cc262849(v=office.16).aspx

MS16-101 Prevents SharePoint From Changing Managed Account Passwords

https://thesharepointfarm.com/2016/09/ms16-101-prevents-sharepoint-from-changing-managed-account-passwords/

2013/2010

Technet on Planning Security Hardening (2010 or 2013)

https://technet.microsoft.com/en-us/library/cc262849(v=office.15).aspx

https://technet.microsoft.com/en-us/library/cc262849(v=office.14).aspx

Good Article on SharePoint Groups vs. AD Groups and effect on Search Crawls
http://blogs.msdn.com/b/kaevans/archive/2013/05/06/clarifying-guidance-on-sharepoint-security-groups-versus-active-directory-domain-services-groups.aspx

Preview as user (Third Party)
http://blog.mastykarz.nl/previewing-pages-content-targeting-user-segments-sharepoint-2013/

Updates
Interesting Vulnerability Site on SharePoint
Lists - http://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-11116/Microsoft-Sharepoint-Server.html
Stats - http://www.cvedetails.com/product/11116/Microsoft-Sharepoint-Server.html?vendor_id=26

Legacy


Great Security Articles by Liam Cleary
https://www.helloitsliam.com/

PenTest (Part 1 and 2)
https://www.helloitsliam.com/2014/11/06/sharepoint-2013-pentest-part-1/
https://www.helloitsliam.com/2014/11/10/sharepoint-2013-pentest-part-2/

https://www.helloitsliam.com/2014/11/06/10-ways-to-a-more-secure-sharepoint-infographic/

”SO you wanna hack SharePoint” Presentation - TechEd
http://view.officeapps.live.com/op/view.aspx?src=http%3a%2f%2fvideo.ch9.ms%2fsessions%2fteched%2fna%2f2013%2fATC-B315.pptx

OLD LINKS – Broken due to new site
http://blog.helloitsliam.com/Lists/Posts/Post.aspx?ID=121
Is SharePoint Secure?
part 1
http://blog.helloitsliam.com/Lists/Posts/Post.aspx?ID=100
part 2 http://blog.helloitsliam.com/Lists/Posts/Post.aspx?ID=101
part 3 http://blog.helloitsliam.com/Lists/Posts/Post.aspx?ID=103
part 4 http://blog.helloitsliam.com/Lists/Posts/Post.aspx?ID=105
Is SharePoint Vulnerable
http://blog.helloitsliam.com/Lists/Posts/Post.aspx?ID=116

Effect of SharePoint Security Groups and/or AD Security Groups on Search Crawl Performance
http://blogs.msdn.com/b/kaevans/archive/2013/05/06/clarifying-guidance-on-sharepoint-security-groups-versus-active-directory-domain-services-groups.aspx

Best practices for using fine-grained permissions in SharePoint Server 2013
http://technet.microsoft.com/en-us/library/gg128955.aspx

Troubleshoot common fine-grained permissions issues for SharePoint Server 2013
http://technet.microsoft.com/en-us/library/dn169566.aspx

UAG - SharePoint Publishing Guide
http://technet.microsoft.com/en-us/library/dd857299.aspx

Firewall Ports
azure acs
http://msdn.microsoft.com/en-us/library/windowsazure/jj136814.aspx
office 365
http://blogs.technet.com/b/educloud/archive/2011/11/30/what-firewall-ports-do-i-need-open-to-connect-to-office-365-for-education.aspx
http://ahandyblog.wordpress.com/cloud-technologies/firewall-ports-for-office-365/

2010

Articles

Copy Permissions Between Site Collections Using AD Groups
https://social.technet.microsoft.com/wiki/contents/articles/8138.sharepoint-2010-copying-permissions-between-site-collections.aspx

Fine Grained Permissions Guide
http://technet.microsoft.com/library/gg128953(office.14).aspx

More from SharePoint Galaxy

Authentication
http://thecloudengineer.blogspot.com/2013/02/authentication.html

TMG UAG
http://thecloudengineer.blogspot.com/2011/07/golden-5-rules-on-sharepoint-security.html

Document Security
http://thecloudengineer.blogspot.com/2011/09/sharepoint-document-security.html

SharePoint Designer
http://thecloudengineer.blogspot.com/2012/03/sharepoint-designer-security.html

Books

Actual book http://www.amazon.com/Office-Sharepoint-Security-Microsoft-Corporation/dp/0735626545

Free Ebook http://technet.microsoft.com/en-us/library/cc287889(v=office.12).aspx

Friday, August 15, 2014

Kerberos and SharePoint

2016

Setup and Troubleshooting Kerberos
https://www.noralku.net/2016/05/08/sharepoint-20132016-kerberos-authentication/

2013

Plan for Kerberos authentication in SharePoint 2013
http://technet.microsoft.com/en-us/library/ee806870(v=office.15).aspx

The first and final Kerberos guide’s for SharePoint 2013 technicians
http://blog.blksthl.com/2012/09/26/the-first-kerberos-guide-for-sharepoint-2013-technicians/
http://blog.blksthl.com/2012/09/26/the-final-kerberos-guide-for-sharepoint-technicians/

CodePlex Tools
http://sdssharepointlibrary.codeplex.com/

2010


Planning
http://technet.microsoft.com/en-us/library/ee806870.aspx

TechNet Magazine article
http://technet.microsoft.com/en-us/magazine/ee914605.aspx

Notes from Harbar on issues with above article http://www.harbar.net/archive/2010/01/12/technet-misinformation-how-not-to-use-kerberos-for-sharepoint-authentication.aspx

Monitoring
http://www.mssharepointtips.com/tip.asp?id=1058&page=1

Step by Step (document)
http://www.microsoft.com/download/en/details.aspx?id=23176

Here are some more resources for Kerberos Authentication and configuring Kerberos for SharePoint 2010:

http://blogs.msdn.com/b/russmax/archive/2009/10/20/configuring-kerberos-authentication-in-sharepoint-2010-part-1.aspx

http://blogs.msdn.com/b/echarran/archive/2010/02/11/howto-configure-sharepoint-2010-for-kerberos.aspx

Step by Step (unoffical)
http://www.thesharepointblog.net/Lists/Posts/Post.aspx?List=815f255a%2Dd0ef%2D4258%2Dbe2a%2D28487dc9975c&ID=43

Thursday, July 28, 2011

TMG UAG and SharePoint Security

2014

Update
http://blogs.technet.com/b/server-cloud/archive/2013/12/17/important-changes-to-the-forefront-product-line.aspx

2013

Roadmap http://blogs.technet.com/b/server-cloud/archive/2012/09/12/important-changes-to-forefront-product-roadmaps.aspx

2010

Good article on Security but I would add that ISA TMG are good solutions but you can use any internet appliance that would give you protection.
http://www.sharepointmonitor.com/2010/12/sharepoint-security-tips-dmz/

Smart card or a common access card (CAC) - Overview
http://www.sharepointsecurity.com/sharepoint/cac-enabled-anonymous-sharepoint-sites/
http://www.synergyonline.com/Blog/Lists/Posts/Post.aspx?ID=10

CAC Authentication in TMG for SharePoint 2010
http://stumpj.wordpress.com/2012/04/18/cac-authentication-in-tmg-for-sharepoint-2010/

TMG or UAG
http://blogs.technet.com/b/tomshinder/archive/2011/04/19/choosing-between-forefront-tmg-or-forefront-uag-for-publishing-scenarios.aspx
Good Feature Comparison – TMG vs. UAG
http://www.isaserver.org/tutorials/Microsoft-Forefront-TMG-UAG-feature-comparison.html
http://blogs.technet.com/b/edgeaccessblog/archive/2010/04/14/forefront-uag-and-adfs-better-together.aspx
Great Articles on Publishing Site in UAG
http://blog.hametbenoit.info/sites/archives/Lists/Posts/Post.aspx?ID=497
http://www.isaserver.org/tutorials/Microsoft-Forefront-UAG-Publishing-Microsoft-Sharepoint-Server-2010.html
Another Great Article on UAG/ADFS Setup
http://blogs.technet.com/b/germany/archive/2012/06/20/steps-to-configure-adfs-2-0-and-uag-for-adfs-2-0-authentication-and-authorization-teil-1.aspx
Issues with multiple IP Addresses
http://blogs.technet.com/b/isablog/archive/2011/03/17/tmg-enhanced-nat-considerations-when-using-the-default-ip-address.aspx

Securing SharePoint for Internet Site Deployments Presentation
http://pointblankadmin.com/?page_id=75 by http://pointblankadmin.com/