Home > 2014

Archives for 2014

What is a penetration test?

December 3, 2014 by

What is a penetration test?

Penetration testing simulates an attack by a malicious party by using tools and manual investigation to identify weaknesses. Testing involves the exploitation of found vulnerabilities to gain further access. Using this approach will result in an understanding of the ability of an attacker to gain access to confidential information, affect data integrity or availability of a service and the respective impact.

What do you get?

This approach looks at the depth and impact of a potential attack, as compared to the security assessment approach that looks at the broader coverage. It is great for understanding the depth of exposure from a vulnerability but it can result in a narrow focus that potentially misses other vulnerabilities that would have been identified through a security assessment. The level of assurance gained is directly associated with the ability of the tester, the scope of engagement and the time and effort allocated.

For more information on security testing, see our blog here and download our cheat sheet here.

What is a security assessment?

December 3, 2014 by

What is a security assessment?

A security assessment builds upon a vulnerability assessment by adding manual verification of the results to confirm the level of exposure. It does not though include the use of exploitation code to gain further access to systems.

What do you get?

A security assessment is looking to gain a broad coverage of the systems under test but does not consider the depth of exposure to which a specific vulnerability could lead. False positives should be excluded through the analysis of the results. Security assessments are great for exposing business logic flaws and identifying security vulnerabilities that automated tools are unable to identify. This leads to a higher level of assurance. However, the time and effort required to complete a security assessment are higher than vulnerability scanning and assessments and require a higher level of technical skill to deliver.

For more information on security testing, see our blog here and download our cheat sheet here.

What is a vulnerability assessment?

December 3, 2014 by

What is a vulnerability assessment?

A vulnerability assessment takes a vulnerability scan a step further by using a security tester‘s knowledge to drive an appropriate use of automated tools and test scripts.

What do you get?

The report for the results should be manually created, which places the findings into the context of the environment under test. An example would be removing common false positives from the report and deciding risk levels that should be applied to each report finding to improve business understanding and overall context of a finding. It is great for increasing the level of assurance gained through automated testing, whilst still helping to keep costs low.

For more information on security testing, see our blog here and download our cheat sheet here.

What is a vulnerability scan?

December 3, 2014 by

What is a vulnerability scan?

A vulnerability scan uses automated tools to identify known security issues through matching conditions with known vulnerabilities.

What do you get?

The tool automatically sets the risk level for the results of the scan and no manual verification or interpretation of the results prior to issue takes place. This is great for identifying technical vulnerabilities at a low financial cost. However, it also generates a high level of false positives while missing certain types of issues. This limits the overall level of assurance gained.

For more information on security testing, see our blog here and download our cheat sheet here.

Creating a Strong SNMP Community String

November 21, 2014 by

Creating a Strong SNMP Community String

To ensure that an attacker does not gain privileged or read access to your devices via a poorly configured SNMP community string, we would recommend that the following steps should be taken:

Follow similar guidance to mainstream password guidance.

• Use both upper and lower case

• Include one or more numerical digits

• Use special characters, e.g. @, #, $ etc.

• Prohibit use of words found in a dictionary

• Disallow passwords matching the format of calendar dates, license plate numbers, telephone numbers, or other common numbers

• Prohibit of use of company name or an abbreviation

Kerb Your Enthusiasm – Microsoft Release Critical Security Update (MS14-068)

November 20, 2014 by

One week after “Patch Tuesday” and contrary to standard operating procedures Microsoft has released a Critical security update (MS14-068) to fix a security hole in all supported versions of Windows. MS14-068 addresses a vulnerability in the Kerberos Key Distribution Center (KDC) component, used within a domain environment for authenticating users. The vulnerability allows an unprivileged authenticated user to elevate their privileges to those of a domain administrator. The KDC component is available remotely and the vulnerability can be initiated as long as the miscreant has domain credentials. This has severe consequences for businesses and shows why Microsoft took steps to release an out-of-band patch. The patch was actually rumored to have been included in November’s patch cycle and then pulled last minute.

Additional Information

The vulnerability takes advantage of improper validation of signatures, which can allow certain elements of a service ticket to be forged. An attacker can trick the KDC by sending forged tickets impersonating any user in the domain, resulting in compromise of the domain. The vulnerability was privately reported to Microsoft however, within the Bulletin released, Microsoft stated that they were “aware of limited targeted attacks that attempt to exploit the vulnerability.”

Quick reminder about Kerberos: http://msdn.microsoft.com/en-us/library/bb742516.aspx

When the user first authenticates to the Authentication Service (AS) they are passed through the KDC and provided a TGT (Ticket Granting Ticket). The TGT contains an area called PAC (Privilege Attribute Certificate), which holds the user’s information. When the user wants to access a service they will present their TGT to the KDC, which will validate the PAC information and copy it to the ST (Service Ticket). The ST is then used to gain access to a service. The break down in validation occurs in the way that PAC information is validated. MS14-068 amends the way in which the validation occurs.

Log Analysis

As per the instructions in the following blog post http://blogs.technet.com/b/srd/archive/2014/11/18/additional-information-about-cve-2014-6324.aspx, it is possible to detect attempts to execute this vulnerability. However, it should be noted that log data can be amended and should not be relied on for identification of earlier exploitation.

Patch-Patch-Patch

It is therefore recommended that all Domain Controllers in your environment be updated immediately with all other servers being updated in due course. The priority is Domain Controllers due to their overarching dominion of all other entities within the network.

Now for some scaremongering, the only assurance you can have that you have not been ‘pwned’ is to rebuild your entire domain. This is due to the multiple ways in which it is possible to hide backdoors and amend entities or information stored in an Active Directory Domain.

Winshock Exploits (MS-14-064) Gone Wild, Patch Now!

November 17, 2014 by

Recap

The MS-14-064 patch last week addressed several vulnerabilities that could allow for remote code execution in applications using the SChannel Security Service Provider. The vulnerabilities (including cve-2014-6332) affect distributions of Microsoft Operating Systems from Windows 95 IE 3.0 to Windows 10 IE 11. More background can be found in our earlier blog post and in summary, our advice was to patch your systems now without delay.

That was last week, where are we now?

Exploit: All The Things!

“As both security researchers and blackhats are inevitably working toward creating a workable exploit, enterprises need to apply the patch released to all applicable systems without delay.”

The promise of exploitation was kept by @yuange who released an exploit that allowed an attacker to remotely open notepad on a victim machine. This exploit was then adapted by Rik van Duijn. This adaptation executes Powershell in order to inject payloads directly into memory and as an added benefit, using Powershell maximises the chances of successfully bypassing anti-virus software (Powershell is often whitelisted as a trusted application).

The proof of concept code injected a “reverse_tcp” meterpreter payload into memory, resulting in a shell from which system commands could be executed.   Rik van Duijn has released this proof of concept as a Metasploit module to allow a multitude of further payloads to be delivered. This also has the associated impact of making the exploit easier to deliver, therefore increasing the overall likelihood that systems vulnerable to cve-2014-6332 will be targeted.

Meanwhile, another proof of concept has been published by Immunity Inc, this SChannel exploit using their CANVAS tool, may allow remote command execution(RCE) via the Windows remote desktop protocol(RDP).

Vulnerability Checking

Anexia have released a tool that will check if a Windows operating system is vulnerable. This tool conducts behavioural analysis based upon available SSL ciphers. Their script checks to see if the target system has been patched or not. It does this by checking if the system supports four new SSL ciphers that were introduced by MS14-066.

To run the tool you need to specify a target IP address and a port that with a service running that listens for connectable SSL connections. If the script takes too long or times-out then it is likely that a firewall is blocking the connection, you are connecting to the workstation indirectly or that no service is listening.

Example:

winshock test

 

Vulnerable System Result:

winshock vulnerable

Patched System Result:

winshock patched

 

Disclaimer

While testing in our labs was accurate, Anexia warn that the script may, in certain cases, generate false negatives/positives and should be used as a hint for further investigation, do not take results of this script on faith.

Inevitable XP Swansong

Microsoft have not indicated plans to patch Windows XP, therefore it would be wise to decommission any vulnerable machines or where this is currently not possible, segregate legacy environments to limit potential exposure.

 

Links

http://blog.beyondtrust.com/triggering-ms14-066

https://forsec.nl/2014/11/cve-2014-6332-internet-explorer-msf-module/

http://itsecurityguru.org/microsoft-patches-winshock-flaw-amid-attack-reports/#.VGoZModLGiA

A WinShock Tale: The Patchable and Un-patchable

November 14, 2014 by

Introduction

On Tuesday Microsoft released several fixes bundled in a patch, MS14-066, to address several vulnerabilities in SChannel, the standard SSL library that ships with Windows. Affecting almost all versions of Microsoft operating systems, this vulnerability allows attackers to exploit a weakness in the TLS implementation service that forms windows server and desktop communication protocols.

‘Unicorn-like’

Cisco reports that the 19 year old bugs, covered in CVE-2014-6332, contain a complex ‘Unicorn-like’ bug found in code that IE relies on. Attackers exploiting the bug are able to sidestep the Enhanced Protected Mode sandbox in IE 11 and the anti-exploitation tool, the Enhanced Mitigation Experience Toolkit. The problem stems from the inclusion of VBScript in IE 3.0 and Cisco warn that more undiscovered bugs may still pose a threat.

Exploits Imminent

Not yet in existence, an inevitable exploit would allow attackers to run arbitrary code on targeted servers by sending “specially crafted” packets. Attackers may be able to deploy malicious code to vulnerable remote systems and Microsoft admits there are no workarounds or mitigating factors to employ against the vulnerability.

 

“Every major TLS stack: OpenSSL, GNUTLS, NSS, MS SChannel, and Apple SecureTransport has had a severe vulnerability this year,”

Tony Arcieri, Security engineer

 

This year it has become clear that attackers are choosing to attack and decipher the channels used to communicate between machines. These channels may contain usernames, passwords and financial details that are highly desirable to attackers.

“So in war, the way is to avoid what is strong, and strike at what is weak.”

Sun Tzu, The Art of War

It makes more sense to attack infrastructure that has remained relatively unchanged for many years than applications that are updated and made more secure on a regular basis.

The Un-patchable

Microsoft quickly issued patches for these vulnerabilities but neglected machines running Windows NT, 2000 or XP. As Microsoft no longer supports several of these older operating systems. Joe Barrett, senior security consultant with Foreground Security warns that due to this support expiration, we may be witnessing the first true “forever-day” vulnerability.   Microsoft’s stance on halting security patches for older operating systems, even in this case where it is clear the products were vulnerable at the point of sale, has resulted in enterprises knowing that some systems will end up exploitable-but-un-patchable. It is easy to forget that Windows XP still holds 17.18% of the market. Given how Microsoft has articulated this issue, it is clear they expect an exploit to be developed soon.

 

Plan of Action

While Microsoft have rightly been relatively quiet about vulnerability details, the patches released may help inform exploit creation by revealing the nature of the flaws being addressed. As both security researchers and blackhats are inevitably working toward creating a workable exploit, enterprises need to apply the patch released to all applicable systems without delay.   To prevent serious compromises, systems running un-patchable versions of Windows will need to be isolated and removed.  The most likely targets of this vulnerability are externally reachable SSL services such as Web and Mail Servers.

Johannes Ullrich, PhD of the Sans Technology Institute, has outlined several steps that should be taken to address the vulnerability:

1. Highlight for attention all SSL services, it may be useful to check your last external infrastructure scan to ensure all have been identified. It is advisable to repeat the scan on a regular basis.

2. Examine internal servers, only one infected operating system on the network could expose harder to reach systems.

3. Audit all devices, such as laptops, that leave the controlled perimeter. While they are unlikely to be listening for SSL connections, insufficient locking down mechanisms may have left vulnerable instant messenger software or older SSL VPN services exposed. A port scan should indicate the degree of vulnerability.

4. Patch in a controlled, verifiable and reproducible way. Good operations and procedures will offset the chance of vulnerable systems remaining after hurried and ill-conceived patching exercises. The system must also be rebooted after the patch is applied to be sure it takes effect.

5. Ensure you are aware of how to disable certain ciphers or SSL modes of operations in case Microsoft publish workarounds.

(An inventory of systems is essential to be prepared to treat vulnerabilities, formulate counter-measures and alternative emergency configurations)

Cisco Guidance

Cisco published a blog focusing on WinShock reporting multiple vulnerabilities bundled within the single CVE. The vulnerabilities range from buffer overflows to certificate validation bypasses. Also published were a number of Snort rules, SID 32404-3242.  For a technical breakdown of how a potential exploit may work see “IBM X-Force Researcher Finds Significant Vulnerability in Microsoft Windows” by Robert Freeman.

 

Links

How bad is the SCHANNEL vulnerability (CVE-2014-6321) patched in MS14-066?

https://isc.sans.edu/diary/How+bad+is+the+SCHANNEL+vulnerability+%28CVE-2014-6321%29+patched+in+MS14-066%3F/18947

Microsoft Security Bulletin MS14-066 – Critical

https://technet.microsoft.com/library/security/MS14-066

IBM X-Force Researcher Finds Significant Vulnerability in Microsoft Windows

http://blogs.cisco.com/security/talos/ms-tuesday-nov-2014

http://securityintelligence.com/ibm-x-force-researcher-finds-significant-vulnerability-in-microsoft-windows/#.VGXfJodLGiC

Market Share of Operating Systems

http://www.netmarketshare.com/operating-system-market-share.aspx?qprid=10&qpcustomd=0

Information Security Assurance from a Resilience Perspective

November 14, 2014 by

Information Security Assurance from a Resilience Perspective White Paper

Today the global business environment is more complex and interconnected than ever before. Organisations rely on electronic data as their lifeblood, and the systems that enable the storage, transport, access and manipulation of this data have become critical. Even simple spreadsheets can become mission critical systems in their own right and this has resulted in an era where networks and the applications sitting within them have become the very backbone of every organisation regardless of their size and market sector. As a result, networks and applications are a primary channel for businesses and one that they must protect if they are to meet their businesses objectives and in the end, to survive.

For many organisations, their approach to information security results in a fortress mentality that focuses on the implementation of defences and preventing an attack. It is increasingly acknowledged however, that we cannot build sufficient defences to be 100% secure while allowing our organisations to effectively carry out their business, and as such, for many this siege based approach is no longer acceptable. A more resilient approach to the management of information security is therefore needed. This approach should not only take into account the mentality that organisations cannot be 100% secure but also acknowledge that the cost of securing our organisations can be large. A risk based approach should therefore be adopted which takes a more holistic approach to managing information security that accepts that the risks cannot be fully mitigated and adopts a resilient approach. Doing so will therefore place greater emphasis on the importance of gaining an appropriate level of assurance.

Following on from our recent article in SC Magazine on the topic of resilient information security, we have now issued our white paper. A copy of which can be found here.

Information Security Assurance from a Resilience Perspective

November 13, 2014 by

SC Magazine recently published an article by our CEO, David Stubley on the topic of resilience and the need to adopt a holistic approach to information security.

“If we accept that our defences will no longer hold against every attack and we cannot therefore 
be 100 percent secure, then we also need to think about information security from a new perspective.”

The full article can be found here and a link to our white paper can be found here.