<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div></div><div>I agree AD is far from irrelevant. I have run into IBM mainframes and in one instance OS2 during tests. Legacy dogma is hard to get rid of. </div><div><br></div><div>I understand the business case for ID management but it seems smaller companies that become larger companies don't invest in Microsoft like they use to. I may have a biased view but i am seeing fewer and fewer Exchange/AD installs in favor of things like Google apps or SSO offerings from people like Ping. </div><div><br></div><div>This doesn't mean I've given up on AD I just now focus on its interoperability with 3rd services. Or backups...backups seem hard for people to do correctly. </div><div><br>On Sep 11, 2015, at 03:46, Konrads Smelkovs <<a href="mailto:konrads.smelkovs@gmail.com">konrads.smelkovs@gmail.com</a>> wrote:<br><br></div><blockquote type="cite"><div> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Active Directory is far from being irrelevant - it is probably the one system that will remain in the enterprise forever* and here's why:<span style="font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; font-size: initial; text-align: initial; line-height: initial;"> nearly every enterprise security strategy has identify management as their #1 priority and you need a master repository of those. It is practically very difficult to do cloud-anything if you don't know for sure who works for you and the SAML based authentication that ADFS makes point-and-click easy means it probably is a CIOs smartest investment and everyone will remind her/him of that </span></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><span style="font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; font-size: initial; text-align: initial; line-height: initial;"><br></span></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><span style="font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; font-size: initial; text-align: initial; line-height: initial;">It is also true, that proliferation of easy targets on the internal network that happen to have domain admin creds is being reduced and as such the length of the attack chain increases before you achieve full control. </span></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><span style="font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; font-size: initial; text-align: initial; line-height: initial;"><br></span></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">* in the future, where everything is in the cloud, the only reason VPN will exist is so that security ops can sniff your traffic. </div> <div style="font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">--<br>Applied IT sorcery</div> <table width="100%" style="background-color:white;border-spacing:0px;"> <tbody><tr><td colspan="2" style="font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"> <div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in; font-family: Tahoma, 'BB Alpha Sans', 'Slate Pro'; font-size: 10pt;"> <div><b>From: </b><a href="mailto:dmaynor@gmail.com">dmaynor@gmail.com</a></div><div><b>Sent: </b>Thursday, 10 September 2015 20:23</div><div><b>To: </b>Dave Aitel</div><div><b>Cc: </b><a href="mailto:dailydave@lists.immunityinc.com">dailydave@lists.immunityinc.com</a></div><div><b>Subject: </b>Re: [Dailydave] Cicadas</div></div></td></tr></tbody></table><div style="border-style: solid none none; border-top-color: rgb(186, 188, 209); border-top-width: 1pt; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"></div><br><div id="_originalContent" style=""><meta http-equiv="content-type" content="text/html; charset=utf-8"><div></div><div>Dave,</div><div>Active Directory has long been my favorite target because of the power a Domain Admin wields combined with the odds and ends that get integrated means any bug can be devastating</div><div><br></div><div>The "cloud" has been making vast inroads in Enterprise customer bases. I find companies that have started post 2010 that are large enough to require pen tests favor the out sourced infrastructure. </div><div><br></div><div>Alas AD is becoming less important and Microsoft might come out ahead on the technical debt because the pushed the can down the road far enough to where they are no longer as important. </div><div><br></div><div>DaveM </div><div><br></div><div><br>On Sep 10, 2015, at 13:17, Dave Aitel <<a href="mailto:dave@immunityinc.com">dave@immunityinc.com</a>> wrote:<br><br></div><blockquote type="cite"><div>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<i>Yagate shinu</i><i><br>
</i><i> Keshiki wa miezu</i><i><br>
</i><i> Semi no koe</i><i><br>
- Basho<br>
</i><br>
I updated my SILICA this morning while making pancakes for the kids,
as you do, and of course, all around me looked about with new eyes.
I have a new mesh network that a friend installed in my house and
it's interesting to see what it looks like to a wireless hacker. If
you haven't seen the new SILICA video it is here:
<a class="moz-txt-link-freetext" href="https://vimeo.com/136964755">https://vimeo.com/136964755</a><br>
<br>
There's this sense that hackers get which is divorced from what is
in Wired or Business Insider or BlackHat which is "Works in the
Wild". It's a palpable thing, that sets priorities like a hot oil
such that you can tell who has "Gone Active", as they say, from
their recoiling from various technologies. One technology that is
currently on the hot plate is Active Directory. You can see from
talks even at DefCon that people are looking at WMI as a persistence
mechanism in the wild. And the Microsoft talk from INFILTRATE 2014
went over a whole methodology for attacking Active Directory
networks that dragged public discussion of the techniques into the
modern age. For decades AD has been a disaster from a security
perspective - by design - and now all that technical debt is coming
due like a storm of cicadas chirping their last song.<br>
<br>
-dave<br>
<br>
<br>
<br>
<br>
<br>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Dailydave mailing list</span><br><span><a href="mailto:Dailydave@lists.immunityinc.com">Dailydave@lists.immunityinc.com</a></span><br><span><a href="https://lists.immunityinc.com/mailman/listinfo/dailydave">https://lists.immunityinc.com/mailman/listinfo/dailydave</a></span><br></div></blockquote><br><!--end of _originalContent --></div>
</div></blockquote></body></html>