05:19 PM

'App Store For Exploits' Could Reduce Enterprise Vulnerabilities

NSS Labs' Exploit Hub, a marketplace where coders can sell attacks on specific vulnerabilities, could help with enterprise security, experts say

The Exploit Hub -- a proposed free market for the buying and selling of attacks that exploit specific software vulnerabilities -- sounds more like a threat than a security aid. Yet the brainchild of security testing firm NSS Labs could just be what the doctor ordered to help enterprises eliminate their vulnerabilities, security experts say.

The "app store for exploits" will allow security researchers and developers to sell validated exploits to known security professionals. NSS Labs plans to test every exploit in the marketplace to make sure each one works and does not carry malicious code. In addition, the company will check every buyer to prevent criminals from using the marketplace to fuel their own activities.

The exploits will be in a standard format, making it easier for them to be added to the Metasploit Framework, and only attacks on previously reported vulnerabilities will be allowed.

"We are not selling zero-days -- this is not the Pirate Bay," says Rick Moy, president of NSS Labs. "One of the key things we are offering in our scenario here is that all of the exploits that go into the store will be validated."

For enterprise security teams, this new, darker analog to Apple's App Store could help immensely, says one security specialist at a Fortune 100 firm, who spoke on condition of anonymity.

"It is putting some parity on the playing field between the bad guys and the good guys," the security specialist says. "The bad guys have had this sort of capability for a while, and now the good guys can have it as well."

While vulnerability monitoring can reveal which systems have serious security issues, prioritizing the patching of flaws is difficult. That's where exploits can help, says the security specialist. Showing management that a particular issue can be easily exploited is a good way to open doors.

"Unless you can exploit a machine and pull it off -- give them the shock and awe -- it is hard to get their attention," he says.

The ability to buy exploits of publicly known software flaws could also help penetration testers and security professionals test the high-value targets that many security researchers might not care about, experts say.

Vulnerabilities in critical pieces of software, such as SAP and Oracle, are not always publicly exploited, making it difficult for security teams to show their vulnerabilities. In fact, only about 10 percent of the almost 15,000 most serious vulnerabilities have been publicly exploited, according to data from CVE Details.

The Exploit Hub concept extends the evolution of the security researchers' marketplace, observers say. In 2002, security firm iDefense -- now part of VeriSign -- created its Vulnerability Contributor program, which bought previously undisclosed vulnerability information from researchers. TippingPoint -- now part of Hewlett-Packard -- created its own bug bounty program in 2005, called the Zero Day Initiative. In 2007, an auction site, WabiSabiLabi, went online as a place to sell vulnerabilities. Other security researchers have sold their vulnerabilities and exploits privately.

But writing exploits has become increasingly difficult, leading many vulnerability researchers to forgo creating reliable exploits for known vulnerabilities. For many penetration testers, that means they are not showing their clients a complete picture of their vulnerability posture, Moy says.

"If a pen tester goes into a client and only uses what's in Metasploit and what's in his virtual back pocket, then he is doing his client a disservice," Moy says.

Not everyone agrees. Dan Holden, director of HP's TippingPoint DV Labs, notes that penetration testers find only a few avenues of vulnerability, and frequently that vulnerability is not in the computer systems, but with the employees.

"They argue that pen testers are as good as their exploits, but that is not necessarily true," Holden says. "A lot of pen testers use social engineering to get access to systems."

Moreover, with technologies such as address space layout randomization (ASLR) and data execution protection (DEP) now standard in Windows systems and applications, the task of finding exploits even for known vulnerabilities is difficult, Holden says.

"Weaponizing a vulnerability these days is far, far more difficult. There are a lot of hurdles to reliably exploiting the operating system," he says.

NSS Labs' Moy argues that as the market for exploit developers evolves, exploitation will become reliable once more -- and exploiting known vulnerabilities will become a routine, if not simple, task.

"The researcher will ask themselves: 'Do I spend all my time on the Hail Mary, or do I take my skills and go for the small wins and make a living?'" he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-01-23
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.

Published: 2015-01-23
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quote and cause a denial of service (disk consumption) by deleting an image in the saving state.

Published: 2015-01-23
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.

Published: 2015-01-23
Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.

Published: 2015-01-23
oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.