BSidesSF 2016 has ended
Back To Schedule
Sunday, February 28 • 3:00pm - 3:55pm
Scan, Pwn, Next! – exploiting service accounts in Windows networks

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Service accounts are prevalent in Windows networks, but are often mismanaged and ripe for exploitation. Too often these accounts are over-privileged, dual-used (both by human users and automated processes), and have credentials omnipresent in the network. The services that use these accounts are easily discovered, as they are registered as SPNs on the Active Directory, thus presenting a lucrative target for an attacker.In this talk we will discuss how service accounts can be mismanaged and thus exploited, and present new research examining the exposure of service accounts in real-world networks.We will demonstrate exploitation techniques and introduce an open source tool for detecting potentially vulnerable service accounts in Windows networks. We will also discuss how targeted behavioral analytics can be employed to detect potential abuse of service accounts.Armed with the knowledge and tools from this presentation, you can now go and test your own networks – and, perhaps, prevent that sneaky attacker from exploiting your service accounts.


Andrey Dulkin

Andrey Dulkin has over 15 years of experience in information security research and development, both in technical and leadership positions. In his current position, Andrey heads the CyberArk Labs, where his research focuses on targeted attacks mitigation, critical infrastructure security... Read More →

Matan Hart

Matan Hart is a security researcher (he doesn't like the term cyber) at CyberArk Labs, where he researches targeted attacks (he doesn't like the term APT neither) and hacking techniques to come up with novel detection and mitigation capabilities. Based on his extensive experience... Read More →

Sunday February 28, 2016 3:00pm - 3:55pm PST
DNA Lounge 375 11th St, San Francisco, CA 94103