Earlier this year Department of Homeland Security’s US-CERT issued Technical Alert TA18-074A called ‘Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors’. This alert provided information on Russian government actions targeting U.S. Government entities as well as organizations in the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors. It also contained indicators of compromise (IOCs) and technical details on the tactics, techniques, and procedures (TTPs) Russian government cyber actors use to compromise their victims’ networks.
In this webinar we will go over those TTPs and put them to use. Specifically, we will demonstrate how easy it is to leverage Server Message Block (SMB) protocol authentication session to obtain user’s credential hash and then crack it in real-time revealing the actual password. We will show multiple ways of using this approach and attempt to reproduce Russia’s success in our environment. No product pitches, just good old live hacking!
Guy Meoded is a Senior Security Researcher at Nyotron. Prior to Nyotron, Guy was a Trojan Analyst at RSA.
Rene Kolga, CISSP, is a Sr. Director of Product and Marketing at Nyotron. Rene has over 20 years of industry experience, including expertise in endpoint protection, insider threat, encryption and vulnerability management. Rene run Product teams at multiple Silicon Valley startups as well as Fortune 500 companies, including Symantec, Citrix, Altiris and ThinAir. Earlier in his career, Rene managed Customer Success and QA teams. Rene earned his Computer Science degree from Tallinn University of Technology. He also received an MBA from University of Utah.