What impact are you expecting Windows 10 Forced Updates to have on your Penetration Testing?

Question

Unpatched Windows machines (even machines that are just a couple of updates behind) can greatly increase the chances of a successful penetration test (assuming your success criteria is gaining access and compromisation). Has there been anything written on the potential impact of the Windows 10 forced updates on penetration testing?

Answer 1

whilst obviously automatic updates will have an impact in reducing the window of vulnerability for OS level bugs in Windows 10, I'd say that realistically the OS itself is less often the target these days for client-side attacks, so the impact will be limited.

Usually for client-side attacks, the vector will either be social engineering (e.g. "hey you have a virus, install this") which isn't affected by patching or one of the commonly unpatched and Internet exposed pieces of software (e.g. Flash, Java, Adobe Reader) is attacked using either a patched or 0-day issue.

For external penetration testers, usually you'd go with something like a phishing campaign followed by either credential grabbing or social engineering to get the target to execute a piece of software which would give you access to their system.

For internal testers again the auto-updating will have limited impact I'd say, as usually testers once they've got access to one machine will make use of pass-the-hash / password cracking/tools like mimikatz to get credentials, none of which rely on missing Windows patches. The days of finding things like MS08-067 missing and easily compromising systems based on that, are coming to an end for most organisation.

That's not to say that Windows 10 won't make things harder to exploit, but that I don't think that automatic updates will be the biggest differentiator.

Answer 2

Exploiting missing Windows patches are actually not very often needed during a pentest. You can very easily take over a corporate domain using just the below:

Default Credentials - Applications and services running with elevated privileges, with default credentials (or none at all!). e.g. MS Sql, Tomcat, JBoss...

Misconfigurations - Application logic flaws, not using least privilege principle everywhere, other authentication/authorization issues

Social Engineering - "Hey click this link!" SocEng has a high success rate in most cases as an initial way in, but also during privilege escalation.

Sensitive Files Everywhere - passwords.txt, password.xls, web.config etc. These things are great and exist somewhere in almost every corporate environment.

The truth is before you even get to the problem that a lot of places are missing patches there are a lot of other areas of weakness to address.