Users exceeding permissions -- How do you find 'em?

I just came into work this morning, and first thing I see is an e-mail from the boss asking me why Photoshop was installed on our newest terminal server.

Here's the odd thing -- Only he and I, as administrators, have install permission on our terminal servers. So if he didn't do it, and I didn't do it, who could have done it?

None of our employees are anywhere near having the knowledge to hack their accounts to add permissions. But, the only thing I can figure is that somehow, somebody managed to get it installed on there. And if they can do that, then we have a security issue.

SonicWALL logs look clean (other than the one port scan I mentioned in my other thread yesterday), so it doesn't look like anything of concern's going on from the outside.

So, where do I start looking for clues?

First thing I would do is get any old app, log in as a regular user and try to install it. If it works then there is something wrong with your permissions somewhere.

Hrmm.. Personally I'd start with the time of installation and see if you can find out who logged in during that time period. Also, you might want to ensure that some auditing is in place to log events that are "successful" in what they do and not just those that fail.

What is the OS of the Terminal Server and what other permissions cascade down? (Permissions on directories, etc.) What about "operator" accounts or poweruser accounts?

As a first; double check your permission set up. You MIGHT have missed something.
I seem to remember that the LEAST restrictive applies on a profile, and it could be there that you have a cross over.............

Cannot remember when it goes to the MOST restrictive. Presumably, the user has just slotted the CD in and set it up ? This suggests (to me) that the permissions are a bit wonky.........

On the files themselves, aren't there ownership details available ? At the least you should be able to determine WHEN the deed was done.

[edit] Damn !!! but my typing is SLOW. beaten to the punch line by MsM AND Tiger, and this time I was in the ball park. Ah Well, there's always tomorrow.........[/edit]

Quote:

---

On the files themselves, aren't there ownership details available ? At the least you should be able to determine WHEN the deed was done.

---

The boss uninstalled it as soon as he found it. Doh!!

Thanks for all the input guys, that gives me some ideas to start with. It was installed at 1:04 pm yesterday before the boss removed it 6:45 that same evening.

I installed it, you ungrateful bastard!

Oh and the back doors and trojans, whilst I was at it :D

OK....Serious now,

1. If it has been loaded onto a server, rather than a desktop, it is for shared use?
2. Who would use such an application
3. Is your "boss" a for real "boss" or only in his dreams
4. Go and kill one in ten in Marketing/Sales/Publicity, until one of the little toads squeals?

If someone with a budget gets in outsiders, and there is money involved....you will find it in the morning

Maybe keep quiet and log who tries to access it?
Maybe get a boozing buddy go find you a nice 9mm.....and your wife go out of state and get you a couple of boxes of 50?

Sorry old chap, I think that you have been undermined at a higher level?

/me smell treason

:cool:

If memory serves correct, I go into the security section of Event Viewer to see logon times, right? Well, the security portion is completely empty of an entries.

Ok Nihil, on those points:

1) That's usually the case with any program installed. Ufortunately, now that it's been removed, I'll never know.
2) That's one thing I want to know. Not many. Actually, pretty much me and the president, maybe the HR manager.
3) He's very much the real boss, prez of the company.
4) Kill....kill....

As Foxyloxley noted another way to find out who installed it is by looking at the ownership of the files. You're scewed if it's administrator though.

Edit: AFAIK there's no real need to "install" photoshop. You can just drag 'n drop the program dir and it will function.

You don't have security logging enabled. It's not a default setting. If you have access to the AD use a domain policy to enable logging on all domain objects. Or just turn it on the server.

//edit let me know what you have access to and I'll show you how to enable it. Domain policy is best.

Is there a way I can still see those files since it's all been uninstalled though?

RoadClosed -- I have full administrative access.

Angelic: Can I just clear one thing up?

Is this Term server accessible from the public network or is it an internal only "thing"?

Everyone on the LAN has access to the terminal server. Most employee work is done on the terimal server as opposed to on their local machines. Those who connect from home, outside the LAN, also have the ISP of the terminal server so they may do so.

No one but employees have access though.

I meant do you have access to change domain level security in active directory, more like are you using active directory? I will assume so:

Ok let's see how my memory is. In active directory users and computers right click domain controllers and select properties then go to Group Policy. Edit the default domain policy listed since you probably haven't customized any.
Drill down to windows settings/security settings/event log and set the attributes you want.

While you are there you can see all kinds of setting to be played with on other objects. Just be careful you don't lock things out and make a handwritten log of every change you make. Peace.

//edit Well my memory sucks, don't drill into the even log go above it to /Local Policies and play with the audit policy. If those are all turned on you should see something in the security log. It won't log application installs I don't think, perhaps someone else can comment. Unless it's to a protected directory. It should audit priveleged changes to the registry though? Not sure. This is a reason aslo to never allow admins to share common credentials. Like having all admins use "administrator" it should be removed or changed to something protected. Etc.

Quote:

---

No one but employees have access though

---

I never like seeing sweeping statements like that in this field......

Are you saying that because all your users are using the same ISP the TS is not available from outside teh ISP, (ie. they have port 3389 blocked at thier firewall inbound)? Have you ever tried to get to the TS from somewhere else in the world?

I understand your point about your users not being the sharpest knives in the drawer but never underestimate them either, (one of them got Photoshop on your TS... ;) ). With TS you have to allow them to login through TS in their AD account. This means that if they can get to the TS from anywhere then they can log in. So actually, a user who you don't have set up to log in from home but does have access to the TS server internally also has access from home if they use WINXP and know the address.....

That aside though, from the timing of it it looks like a user messing around on their lunch break. If no installation is required as SirDice said then there wasn't much you could do to stop it other than making policies about which programs can be run on the box and block all others but that is very restrictive and can be very time consuming if you install something like office because it relies on so many things to run and it takes you weeks to track them all down.

Get a proper audit policy going is the best advice I can give at this point. Since there was no harm done I would put it down to experience and write an acceptable use policy that includes a part that says no-one can install any software on any machine without the prior permission of the MIS.

Just an off the wall comment...

Is physical access to the server easy?

Could it have been left logged in?

Steve

Quote:

---

newest terminal server.

---

This is a really, really really stupid question.

Did photoshop elements come with the new box?

Just curious...

Another question: Do you know what version of Photoshop was installed? Maybe a cracked copy that doesnt edit the registry? (And therefore bypasses permisssions)

Tiger -- I don't know of any way to access the TS without using the ISP if trying to connect from outside the LAN. The TS can indeed be accessed from other locations (for example, our CEO is currently using it from the Virgin Islands). Definately agree with your point about not underestimating users too. No worse enemy than complacency.

Steve -- The server room is upstairs and, unfortunately, is inbetween offices, so there's quite a bit of traffic through it (note: I didn't set it up this way!). However, no server is ever left logged on and unattended to. The only way this could have been pulled off yesterday would have been for someone to whisk in and do a mad fast installation while I had stepped away for a couple of minutes to tend to a copier problem. I don't think a Photoshop installation could be done that quickly though.

Soda -- Photoshop indeed did not come with the box. No question's stupid though. Even the best of us miss the obvious from time to time, especially me!

Jarrod -- I have no idea. The boss uninstalled it soon as he found it, so I have nothing to look at.

Well, I looked through all the accounts in AD, and everything looks as it should be.

I also tested out normal user permissions by logging on as another normal user...I couldn't install anything...hmm, I think I'm stumped.

No Angelic~

Quote:

---

maybe the HR manager

---

Kill "human remains"......the ultimate scapegoats, no-one will ever hate you for it ;)

Your boss acted a bit prematurely, I would say?....have a talk if you want to "catch" them in future......hell we are talking about an app, not malware?

good luck

Boy, do I ever agree with you on that one!

Quote:

---

I don't know of any way to access the TS without using the ISP if trying to connect from outside the LAN. The TS can indeed be accessed from other locations (for example, our CEO is currently using it from the Virgin Islands).

---

I dunno, maybe I'm being dumb.... You seem to contradict yourself there... Is your ISP a dial in only affair that has no internet connectivity? How is the CEO connecting between pina coladas right now?

One of us is missing something.... Hopefully it's me.... otherwise, a reasonable conclusion to come to might be thata there is an outsider with admin access....

Lets also note in this thread that the main reason we are kind of "fishing in the dark" is because the logging was deficient, (Not a criticism Angelic, it's the most overlooked asset in the security world, but as you can see - without them you are "blind").

NOTE TO ALL: If you think it is irrelevant, will never be useful and will only take up disk space..... Log it anyway.... It will be one day... when you _really_ need it to determine what happened....

Quote:

---

I dunno, maybe I'm being dumb.... You seem to contradict yourself there... Is your ISP a dial in only affair that has no internet connectivity? How is the CEO connecting between pina coladas right now?

---

No, I'm probably the confused one. Let me try to put it another way best I can, maybe I am contradicting myself (when does the noobness end?!). Anyone in the LAN can connect to TS via the IP on the LAN, 192.168...., whereas someone like our CEO who is nowhere near the LAN connects via the ISP (as I understand it anyway), which is something down the lines of 64.63....

Those are the only two ways I know to connect to the TS.

Great points too, Tiger, I'll remember that.

Angelic: then your TS is publicly available..... simple as that....

I am at my "satellite office" right now and have to run so I don't utterly peeve the wife.... ;)

Probably won't get back to this tonight but we can chat again in the morning.... No further harm is going to be done, realistically.

[edit]

"When will the noobness end?"

Never.... The ingenuity and dedication of people on computers never ceases to amaze and interest me.... and they are always ahead of me...... it's a game.... if you apply yourself to it and, most importantly, enjoy it..... then it gets much easier.... but it's always a challenge....

[/edit]

Quote:

---

"When will the noobness end?"

---

Ya? Read my mail server exploitation thread. Closer attention could have prevented that.

Me <---- supanooba

Okie, you said that only you and the boss have rights to install, but something was installed and it was neither of you. The server was never left alone long enough for someone to walk up to it and say 'hey lets have some fun'


You do have users and they use Terminal Service on a Windows 2000 Server machine (I hope I remembered that you said you use W2k Server). You said you tried to log on as a user and install something and that did not work.

Do you have different security groups/policies set up for different departments? If so then I would create a test user and put TEST in one group/policy, then try, then another then try, till you run out of security groups/policies. Once you find the one that works, then that can narrow down your search to that group. I would try them all to be sure that you dont have sereral holes like this.

If you don't find any that work, then that would mean that all of your group/policies are set up to prevent that from happening. So there is a user on your system that does not have one of your group/policies as part of their logon profile.

Good luck and keep us updated.

Halv

Ok, I have an update, and it only gets more interesting...

Though the software was removed, I did manage to find the installer. Specifically, the program installed was Adobe Photoshop Album 2.0 Starter Edition, and it was downloaded to this folder:

C:\Documents and Settings\Administrator\WINDOWS\Downloaded Installations\{30F65707-62BC-4443-BB21-86DA6E7F8A55}

So, now I know whoever did it managed to get access to the administrator folder somehow.I also checked out everyone's cookies, and though various users surfed the Adobe website, only the administrator account had a cookie from the downloads page.

Evidently, then, whatever was done was done from the administrative login somehow.

This is from my experience, but I'd start looking over what your boss is doing more carefully. If your company handles private second party data the fact that he has disrupted the investigation of a potential security breach puts him at risk for criminal charges.

The nature of the rouge application (photoshop) and the fact that he "resolved" the issue and still put you on the case point to a very low likelihood of a malicious element here... with the exception of the boss himself. It is not uncommon for administrative users to commit a crime, then commit a lesser offense which will make lots of noise in the logs, "resolve" this lesser offense without following proper procedure making a totally mess of the logs, then report the lesser issue to another admin so the whole thing is glossed over and the admin appears to be on the up and up... and little too eager, but honest. The original clandestine actions lost forever and no one suspects a thing.

I don't know that this is applicable in this situation... but having worked in Audit & Control as well as Policy Enforcement & Governance as long as I have... this situation just seems suspect to me and it seemed like a good idea to mention this possability since no one else has. ;)

catch

Quote:

---

Photoshop Album 2.0 Starter Edition, and it was downloaded to this folder

---

Have you got Abode Acrobat Reader 6. The above will install if Reader updates it's self when used.


Jinxy

Indeed we do! Maybe that's it. I bet that's the solution to our mystery -- The darn server is the culprit itself!