Showing posts with label attacks. Show all posts
Showing posts with label attacks. Show all posts
Tuesday, April 4, 2017
Protecting the Perimeter Old Attacks Work Just as Well as New Ones
Protecting the Perimeter Old Attacks Work Just as Well as New Ones
When we think about external threats to information security, often our first thoughts are of hacker attacks on the network perimeter—say, advanced persistent threats (APTs) targeting large companies and governments. One example is the compromise of the Equation Group with publication of some of the groups tools for breaching the network perimeter. But as it turns out, many of the exploits have been known for a long time, although the “cherry on the cake” was a zero-day vulnerability for SNMP services (with SNMP standing for “Security Not My Problem”). While we do not have a full list of the compromised exploits, we can start with the other end of the equation by evaluating the state of protection of corporate perimeters with the help of real-world vulnerability statistics.
One such study was presented at PHDays VI as part of Positive Research 2016. The sample spanned approximately 10,000 accessible addresses and 15,000 vulnerabilities over a two-year period (2014–2015). Note that these numbers include ONLY network perimeters with above-average security. Only companies with asset inventory and vulnerability management processes (which, in turn, enable collecting statistics) were included.
Lets start with the “sexiest” morsel from the published exploit pack: the SNMP 0-Day. Is this something to be worried about? Our study shows that the answer is “yes”. A few reasons:
Based on these statistics, we clearly see that the SNMP exploit is very dangerous and can be used to breach the network perimeter of many companies and organizations.
But there remains another interesting question. Why would the toolkit of the Equation Group, which has been described as a “full-fledged nation-state cyber-arsenal,” contain so many exploits for old vulnerabilities for which patches were issued over five years ago? If this hacker group is so amazing, shouldnt they be using new, unknown vulnerabilities?
The answer is paradoxically simple once we restate the question. Why should hacker groups waste their precious time on finding zero-days if many Internet-accessible systems have not been updated for years?
Our study showed that three quarters of all the vulnerabilities found were over one year old; 30% were over five years old. Almost one in ten vulnerabilities were fixed a whopping ten years ago! During the time period of our research, vulnerabilities were found on 37% of systems.
A successful attack does not require using the latest-and-greatest vulnerabilities. Old ones will do the job just as well and are cheaper too. And importantly, potentially drawing attention to an old vulnerability is a much easier choice for an attacker than risking a precious zero-day.
But so far we have been looking only at exploits in non-public packs. What about exploits for old vulnerabilities available publicly, such as from MSF? To answer this question, we selected vulnerabilities with a CVSS rating of “High” that were present at the beginning of the research period on the test systems. We then cross-referenced them with known exploit packs.
The data shows that the tested perimeters are vulnerable to publicly available exploits. However, this sample contains a very small number of vulnerabilities. Does this actually mean that there are not many of them? As mentioned above, the breakdown of vulnerabilities in the previous figure reflects only the start of the study period, even though perimeter security is constantly in flux. The following charts show the change in security level over two years:
To summarize: breaching network perimeters with above-average security does not require non-public exploits, much less secret zero-days by APT groups. Standard tools and basic knowledge are more than enough in many cases.
How to stay protected
Based on our findings, we propose several main points for increasing the overall level of protection of the network perimeter:
One such study was presented at PHDays VI as part of Positive Research 2016. The sample spanned approximately 10,000 accessible addresses and 15,000 vulnerabilities over a two-year period (2014–2015). Note that these numbers include ONLY network perimeters with above-average security. Only companies with asset inventory and vulnerability management processes (which, in turn, enable collecting statistics) were included.
Lets start with the “sexiest” morsel from the published exploit pack: the SNMP 0-Day. Is this something to be worried about? Our study shows that the answer is “yes”. A few reasons:
- Our analysis based on honeypot systems shows that SNMP services are very popular with would-be intruders. Many hackers are well aware of the availability of these services, and those who dont know yet need only Shodan to find out.
- SNMP services are numerous and accessible on most modern network infrastructures. We have written previously how exploitation of SNMP vulnerabilities allows intruders to gain a foothold on the internal networks of telecom operators.
- Many SNMP services are running on obsolete software. Our research showed that in the category of DNS/NTP/SNMP services, the vulnerability rate reaches one in ten:
Based on these statistics, we clearly see that the SNMP exploit is very dangerous and can be used to breach the network perimeter of many companies and organizations.
But there remains another interesting question. Why would the toolkit of the Equation Group, which has been described as a “full-fledged nation-state cyber-arsenal,” contain so many exploits for old vulnerabilities for which patches were issued over five years ago? If this hacker group is so amazing, shouldnt they be using new, unknown vulnerabilities?
The answer is paradoxically simple once we restate the question. Why should hacker groups waste their precious time on finding zero-days if many Internet-accessible systems have not been updated for years?
Our study showed that three quarters of all the vulnerabilities found were over one year old; 30% were over five years old. Almost one in ten vulnerabilities were fixed a whopping ten years ago! During the time period of our research, vulnerabilities were found on 37% of systems.
A successful attack does not require using the latest-and-greatest vulnerabilities. Old ones will do the job just as well and are cheaper too. And importantly, potentially drawing attention to an old vulnerability is a much easier choice for an attacker than risking a precious zero-day.
But so far we have been looking only at exploits in non-public packs. What about exploits for old vulnerabilities available publicly, such as from MSF? To answer this question, we selected vulnerabilities with a CVSS rating of “High” that were present at the beginning of the research period on the test systems. We then cross-referenced them with known exploit packs.
The data shows that the tested perimeters are vulnerable to publicly available exploits. However, this sample contains a very small number of vulnerabilities. Does this actually mean that there are not many of them? As mentioned above, the breakdown of vulnerabilities in the previous figure reflects only the start of the study period, even though perimeter security is constantly in flux. The following charts show the change in security level over two years:
To summarize: breaching network perimeters with above-average security does not require non-public exploits, much less secret zero-days by APT groups. Standard tools and basic knowledge are more than enough in many cases.
How to stay protected
Based on our findings, we propose several main points for increasing the overall level of protection of the network perimeter:
- Constant monitoring of the network perimeter, resulting in timely awareness of the services that are on the perimeter and Internet-accessible.
- Automated search for vulnerabilities in perimeter services, resulting in identification and eventual elimination of vulnerabilities.
- Removal of services from the perimeter when there is no compelling need for them. These services may include NTP, SNMP, database management, administration interfaces, and other potentially dangerous services.
- Implementation of a patch management policy, prioritizing systems with vulnerabilities for which exploits are publicly available as well as the most vulnerable systems. Remaining systems should be updated based on vulnerability and system criticality priorities.
- A comprehensive approach to information security. Protecting the network perimeter is a vital part of security, but the perimeter is by no means the only vector for intruders to gain access to company infrastructure.
Read the full version of our report on Corporate Perimeter Protection here: https://www.ptsecurity.com/upload/iblock/9db/network_perimeter_eng.pdf
Available link for download
Monday, March 13, 2017
NPR Retraction of Story on Apple Factories Provides Insight into the Mentality behind Attacks on Gene Patents and Agricultural Biotechnology
NPR Retraction of Story on Apple Factories Provides Insight into the Mentality behind Attacks on Gene Patents and Agricultural Biotechnology
On March 16, the popular National Public Radio (NPR) program This American Life (TAL) was forced to retract statements made during an episode that aired in January alleging abuse of workers at Chinese factories manufacturing products for Apple. The explanation provided by “monologist” Mike Daisy, source of the "significant fabrications" reported on the TAL program, provide some insight I think into the mentality behind the flood of misinformation that has been promulgated with respect to gene patents and agricultural biotechnology, and which unfortunately has found its way into the courts and Congress.
TAL admits to having excerpted the fabricated story from "The Agony and The Ecstasy of Steve Jobs," a one-man show that Mike Daisey had been performing across the country, and which is currently in production at the Public Theater in New York. In a press release, TAL says it first learned Daisey had fabricated parts of his story when another public radio program, Marketplace, tracked down Daiseys interpreter, who disputed parts of Daiseys monologue. After being caught lying, Daisey apologized to NPR, explaining that:
“I’m not going to say that I didnt take a few shortcuts in my passion to be heard. [] My mistake, the mistake I truly regret, is that I had it on your show as journalism, and its not journalism. Its theater."Daiseys rationalization of his lies reminds me a lot of the response of an author after I reviewed his book entitled "Who Owns You? The Corporate Gold Rush to Patent Your Genes", and pointed out some of the numerous inaccuracies in the book regarding patent law in general, and gene patents in particular. In the book, the author characterized himself as an intellectual property attorney, but when he was unable to refute the many inaccuracies in his book that I pointed out in my review, he dismissed them, and asserted that it did not matter because he had approached the issue as a philosopher, rather than as a lawyer or scientist; very reminiscent of Daiseys explanation that his report on NPR was "theater," not journalism.
The problem is, these people target a lay audience largely unfamiliar with the subject matter they cover, and push forward their work as evidence allegedly supporting their position. It would be one thing if Daisey had explained to his NPR audience that he was merely engaged in theater, or if the author of "Who Owns You?" had explained that his book was nothing more than philosophical ponderings, with no grounding in fact. But that is not how they present their work, and unfortunately their works can play an important role in motivating others (including judges and members of Congress) to take action.
For example, according to NPR the TAL piece featuring Daisey made him "Apples chief critic and it also inspired a Change.org petition that collected more than 250,000 signatures demanding that Apple better the working conditions at the factories.” Books like "Who Owns You?” have no doubt played a role in shaping the current widespread antipathy toward gene patents.
I also found it interesting that Daisey characterizes his fabrications about Apple factories as "shortcuts in [his] passion to be heard." I suspect that this sort of mentality might explain the bending of reality routinely engaged in by the opponents of gene patents and agricultural biotechnology. They are convinced that gene patents and genetically engineered crops endanger society, and that companies like Myriad Genetics and Monsanto are evil, and will seemingly say anything in their passion to be heard. Like Daisey, they do not appear to be bothered by specific facts, and are willing to take shortcuts around the truth in seeking to eliminate these evils from the world.
The disturbing thing is that there is so much incentive for people to propagate these myths. People like Daisey clearly love being in the spotlight, and the more sensational he can make his reports of condition Apple factories, the more people he will have listening. NPR reported that this episode of TAL had the largest audience that show had ever achieved, and that Daisey became the most prominent critic of Apple factories because of the coverage. Unfortunately, I think there are also incentives at play, particularly in academia and with respect to advocacy groups such as the ACLU and Public Patent Foundation, for making overblown and sensationalistic allegations on hot button issues such as gene patents and agricultural biotechnology.
Available link for download
Subscribe to:
Posts (Atom)