Hello, welcome to the Tuesday, January 15th, 2019 edition of the Science and at Storm Center's Stormcast. My name is Johannes Ulrich. And I'm recording from Jacksonville, Florida.

Today we got a diary by Rob about Labs, the local administrator password solution, which is a tool that's offered as a free

download by Microsoft. The great thing about Labs is that it does allow you to set a unique

admin password for all workstations within an organization. And well, it keeps a database of all

these passwords so you can still log in but if

one of these workstations gets compromised the attacker will only get the admin password for this

particular workstation and the hacker won't be able to then connect to other systems in your network using these credentials.

But Rob also took a look at the red team part of this particular tool and how it could be used by an attacker.

Well, if you're using labs, then of course administrators somehow need to have access to these passwords

and labs provides for that. So if an attacker is able to access one of these IT administrator

passwords, maybe a help desk password, then they may have access to the Labs database, which of course stores all the passwords

for all of your systems in clear text. So what Labs really does is it reduces your attack

surface instead of being able to steal the common admin password from any system in your network, the attacker

now has to compromise a particular account on a particular system in order to get this information.

Of course, you could use a paper-based database or something like this to accomplish the same thing.

The advantage of using labs is that it's scalable, it's a tool that's supported by Microsoft,

so much easier to assign random unique passwords to all your systems than doing it manually.

And last week, Intel released an interesting patch for its software guard extension

or SGX. SGX allows software to define secure enclaves in memory. So if you're doing something

security sensitive, you can define one of these SGX enclaves and even administrators on the system shouldn't be able to access this memory.

Sadly, the software that sort of implemented SGX had a vulnerability that actually made a system less secure by allowing for privilege escalation.

This vulnerability has been patched now, so if you're using SGX, do apply this patch from Intel.

...