<?xml version="1.0" encoding="utf-8" standalone="yes"?>Articles from May 2014 on PowerShell.org - Welcome Automaters!https://powershell.org/articles/2014/05/Recent content in Articles from May 2014 on PowerShell.org - Welcome Automaters!Hugoen-usAnalyzing the "Black Magic" PowerShell "Exploit" and Appropriate Actionshttps://powershell.org/articles/2014-05-31-analyzing-the-black-magic-powershell-exploit-and-appropriate-actions/https://powershell.org/articles/2014-05-31-analyzing-the-black-magic-powershell-exploit-and-appropriate-actions/Sat, 31 May 2014 14:39:14 +0000<p>Trend Micro released a report on a new <a href="http://blog.trendmicro.com/trendlabs-security-intelligence/black-magic-windows-powershell-used-again-in-new-attack/">PowerShell-vectored exploit named Black Magic</a>. I had a lovely Twitter conversation about what this means in terms of PowerShell&rsquo;s vulnerability to attack, and what admins should do. Unfortunately Twitter sucks for carrying on that kind of conversation, so I wanted to post this to clarify a few things.<br> First, I&rsquo;m going to write this article as if &ldquo;you&rdquo; were hit by this exploit. Don&rsquo;t take it personally, it&rsquo;s just an easier style of language for me - it&rsquo;s not actually addressing <em>you.</em><br> Second, when it comes to security, the goal is to <em>stop attacks from happening.</em> That means you have to consider all the ways something could nail you, and try to block as many of them as is practical. That&rsquo;s called &ldquo;defense in depth,&rdquo; giving you multiple layers of defense. The corollary to that is that your environment must still be functional. I mean, from a secure standpoint, if I unplugged all the WiFi access points and Ethernet switches you have, you&rsquo;d be pretty secure. And non-functional.<br> Third&hellip; and I don&rsquo;t know how to be delicate about this, but a lot of admins out there aren&rsquo;t very sophisticated about security. There&rsquo;s sometimes a tendency to fix what they can get their hands on, whether or not that makes any impact on security or not. So let&rsquo;s be very clear about what you do when it comes to security: <em>You do as little as possible, and impinge as little functionality as possible, while achieving your security goals.</em> That helps maintain a &ldquo;functional&rdquo; environment, and keeps the security aspect of it &ldquo;maintainable.&rdquo; Sometimes, &ldquo;as little as possible&rdquo; is quite a lot indeed - but you look for that balance. Finally, you almost <em>never do anything to &ldquo;improve&rdquo; security if it is in fact a null improvement.</em> That is, you don&rsquo;t lock the doors if the windows can&rsquo;t be closed. There&rsquo;s no point.<br> Now, let&rsquo;s look at how Black Magic operates.</p><![CDATA[

Trend Micro released a report on a newPowerShell-vectored exploit named Black Magic. I had a lovely Twitter conversation about what this means in terms of PowerShell’s vulnerability to attack, and what admins should do. Unfortunately Twitter sucks for carrying on that kind of conversation, so I wanted to post this to clarify a few things.
First, I’m going to write this article as if “you” were hit by this exploit. Don’t take it personally, it’s just an easier style of language for me - it’s not actually addressingyou.
Second, when it comes to security, the goal is tostop attacks from happening. That means you have to consider all the ways something could nail you, and try to block as many of them as is practical. That’s called “defense in depth,” giving you multiple layers of defense. The corollary to that is that your environment must still be functional. I mean, from a secure standpoint, if I unplugged all the WiFi access points and Ethernet switches you have, you’d be pretty secure. And non-functional.
Third… and I don’t know how to be delicate about this, but a lot of admins out there aren’t very sophisticated about security. There’s sometimes a tendency to fix what they can get their hands on, whether or not that makes any impact on security or not. So let’s be very clear about what you do when it comes to security:You do as little as possible, and impinge as little functionality as possible, while achieving your security goals. That helps maintain a “functional” environment, and keeps the security aspect of it “maintainable.” Sometimes, “as little as possible” is quite a lot indeed - but you look for that balance. Finally, you almostnever do anything to “improve” security if it is in fact a null improvement. That is, you don’t lock the doors if the windows can’t be closed. There’s no point.
Now, let’s look at how Black Magic operates.

Step 1: Social Engineering