5

Assume the network is already penetrated, and the attacker already fully controls another PC.

Other than setting up a proxy to intercept traffic from all other systems on the network and use that to inject rogue traffic. Other than that, what would the vectors be for an attacker to attempt to directly infiltrate one of the computers on this network. More importantly, what would the corresponding mitigation steps be?

Note:

  1. The purpose of this question is mainly educational/theoretical. So mitigation steps required (however few there are) other than "installing an AV" are preferred.

  2. All attacks would be through the network. There is no transfer of physical media between the infected computer and the (to-be-)protected one. You can further assume that there is no shared storage (NAS, etc), nor are there any shared folders, shared credentials (user-groups), RDP/VNC etc on ANY of the computers.

  3. However, other than the above, no further hardening steps have been taken.

  4. The primary concern is data-theft. (in case that matters, or if it can help narrow down the scope of the question)

  5. This question is intentionally limited to Windows 7 so as to limit the scope of the answers, and to provide some further limiting, pre-existing conditions (folder-sharing and RDP disabled). However if the essential nature of in-network PC-to-PC threats do not vary much, then a platform-neutral answer will also be appreciated.

  6. If the question is still too broad, I'd appreciate being pointed in the direction of an informative (if technical) guide, or even a starting point for getting such (technical / detailed) guides.

Improve this question

2 Answers 2

Reset to default
4

There are a few possible scenarios, even after assuming Man in the Middle is not happening.

Missing patches:

If your system is missing a patch that allows RCE, that is an easy win. There are plenty of remote exploits that exist, and new ones every so often. Mitigation: Patch your system!

Are you on a domain?

You didn't mention Windows 7 Home or Professional. If your machine belongs to a Windows domain, and another machine on your network is compromised you are in trouble. Once the attacker gets Domain Admin, they can control your PC fairly easily. Mitigation: Deactivate your network card and cry?

Default Configurations:

Windows has a number of insecure default configurations. LLMNR is one of them, and is easily exploited. Mitigation: Disable LLMNR & NBT-NS (see the bottom of that link)

PSExec

I know you mentioned that you are not sharing folders, but is port 139 and 445 closed? Read over the capabilities of PSExec.

Vulnerable Applications

Run NETSTAT on your PC. You may find that some applications you have installed are listening on a port for an incoming connection. If there is a vulnerability here you leave an opportunity for a remote exploit.

Mitigations?

Patching obviously. OSSEC is a nice tool that goes beyond AV in that you can get alerts when events happen on your PC that shouldn't typically happen. Also review your Windows Event Logs, check your AutoRuns (and use the VirusTotal integration), check your listening ports (with NETSTAT) and change passwords often.

Improve this answer
3
  • This is fantastic information. I had no idea remote exploits were such a vast topic, or that there were so many other avenues for attackers either! I'll be reading for days. Thanks!
    – someonenoone
    Jul 6, 2015 at 14:26
  • P.S: Forgot to mention that there are no user groups or centralized administration across the computers. Each one is just an island - again to limit the scope of the question. (the topic is pretty vast anyway!). I'll update the question a bit to reflect.
    – someonenoone
    Jul 6, 2015 at 14:29
  • 1
    Just an add to @Morgoroth's mitigations list... MS's own tool, EMET: technet.microsoft.com/en-us/security/jj653751 Haven't used it myself, but people who have seem to like it.
    – s1ns3nt
    Jul 6, 2015 at 16:39
0

Security is a process, where new software bugs are discovered from time to time. Sometimes by good people, and sometimes by bad people.

Software bugs can be discovered in both user software, like Excel, but also in OS network stack. Windows 7 is based on rather well tested code, in which hundreds of remote vulnerabilities were found and patched during last 15-20 years, but still it's theoretically possible that someone will break into your system just by exploiting vulnerable OS.

Just read some security articles from 90-ties about any OS to image, what I'm writing about.

But calm down: nowadays difficulty level to break in on "secured" (well configured, will current security patches applied, installed antivirus and firewall turned on) computer is rather high. So don't panic and instead just check, if your computer is secured, as I mentioned above.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .