Do You Have Your Service Accounts Under Control? – Tec-Bite IT Security

About the job

Although service accounts often have elevated privileges, they are mostly completely neglected! They frequently have excessively high permissions and the password, which attackers can usually read very easily, is never changed. We take a close look at the service accounts and show you in the video how you can protect them. The original problem lies in our time. Service accounts are usually created and set up during PoCs of new software solutions. Since the software often has many interfaces, service accounts usually have elevated permissions. Because in PoCs the new software is to be made operational as quickly as possible, only the functionality of the solution is considered. Its security is not thought about, let alone after the procurement of the new solution. Why are Windows service accounts so vulnerable? The password of the Windows service accounts is stored encrypted in the registry under HKLM\SECURITY\Policy\"Servicename"\CurrVAL\Default. After all, the system must be able to start the service with the corresponding service account. If the attacker has local administrative rights, they can very easily compromise the service account password. For this, they use, for example, the PSExec tool from Sysinternals to gain system rights and then read the password from the registry with a hacking tool from CQURE Academy. Enjoy the demo video: Why Microsoft's solution is insufficient. With Windows Server 2008 R2, Microsoft introduced the new Group Managed Service Account (gMSA) feature for the first time. gMSAs no longer have passwords compared to normal user accounts. When gMSAs are used with Windows services, no passwords are stored in the registry. Therefore, they cannot be read either. Simply put, if it is not there, it cannot be stolen – see the example below: The problem with this whole design is that most software manufacturers do not support gMSA. Great, so how do you solve the problem now? The Privileged Remote Access (PRA) solution from BeyondTrust is known for being able to completely manage all administrative accesses from internal IT staff as well as external service providers. Additionally, the solution rotates the password of the administrative account after each session. For those who want to learn more, I recommend the article RDP – The Silent Threat as well as the article Has the Management Zone Become Obsolete? – Here is a Comparison! In any case… (9x in this video) the PRA can now not only manage human accounts but also non-human accounts such as those of Windows services. This way, you no longer have orphaned accounts with elevated privileges. How does that work? See the video. The article Do You Have Your Service Accounts Under Control? first appeared on Tec-Bite.