05:19 PM
Connect Directly

'App Store For Exploits' Could Reduce Enterprise Vulnerabilities

NSS Labs' Exploit Hub, a marketplace where coders can sell attacks on specific vulnerabilities, could help with enterprise security, experts say

The Exploit Hub -- a proposed free market for the buying and selling of attacks that exploit specific software vulnerabilities -- sounds more like a threat than a security aid. Yet the brainchild of security testing firm NSS Labs could just be what the doctor ordered to help enterprises eliminate their vulnerabilities, security experts say.

The "app store for exploits" will allow security researchers and developers to sell validated exploits to known security professionals. NSS Labs plans to test every exploit in the marketplace to make sure each one works and does not carry malicious code. In addition, the company will check every buyer to prevent criminals from using the marketplace to fuel their own activities.

The exploits will be in a standard format, making it easier for them to be added to the Metasploit Framework, and only attacks on previously reported vulnerabilities will be allowed.

"We are not selling zero-days -- this is not the Pirate Bay," says Rick Moy, president of NSS Labs. "One of the key things we are offering in our scenario here is that all of the exploits that go into the store will be validated."

For enterprise security teams, this new, darker analog to Apple's App Store could help immensely, says one security specialist at a Fortune 100 firm, who spoke on condition of anonymity.

"It is putting some parity on the playing field between the bad guys and the good guys," the security specialist says. "The bad guys have had this sort of capability for a while, and now the good guys can have it as well."

While vulnerability monitoring can reveal which systems have serious security issues, prioritizing the patching of flaws is difficult. That's where exploits can help, says the security specialist. Showing management that a particular issue can be easily exploited is a good way to open doors.

"Unless you can exploit a machine and pull it off -- give them the shock and awe -- it is hard to get their attention," he says.

The ability to buy exploits of publicly known software flaws could also help penetration testers and security professionals test the high-value targets that many security researchers might not care about, experts say.

Vulnerabilities in critical pieces of software, such as SAP and Oracle, are not always publicly exploited, making it difficult for security teams to show their vulnerabilities. In fact, only about 10 percent of the almost 15,000 most serious vulnerabilities have been publicly exploited, according to data from CVE Details.

The Exploit Hub concept extends the evolution of the security researchers' marketplace, observers say. In 2002, security firm iDefense -- now part of VeriSign -- created its Vulnerability Contributor program, which bought previously undisclosed vulnerability information from researchers. TippingPoint -- now part of Hewlett-Packard -- created its own bug bounty program in 2005, called the Zero Day Initiative. In 2007, an auction site, WabiSabiLabi, went online as a place to sell vulnerabilities. Other security researchers have sold their vulnerabilities and exploits privately.

But writing exploits has become increasingly difficult, leading many vulnerability researchers to forgo creating reliable exploits for known vulnerabilities. For many penetration testers, that means they are not showing their clients a complete picture of their vulnerability posture, Moy says.

"If a pen tester goes into a client and only uses what's in Metasploit and what's in his virtual back pocket, then he is doing his client a disservice," Moy says.

Not everyone agrees. Dan Holden, director of HP's TippingPoint DV Labs, notes that penetration testers find only a few avenues of vulnerability, and frequently that vulnerability is not in the computer systems, but with the employees.

"They argue that pen testers are as good as their exploits, but that is not necessarily true," Holden says. "A lot of pen testers use social engineering to get access to systems."

Moreover, with technologies such as address space layout randomization (ASLR) and data execution protection (DEP) now standard in Windows systems and applications, the task of finding exploits even for known vulnerabilities is difficult, Holden says.

"Weaponizing a vulnerability these days is far, far more difficult. There are a lot of hurdles to reliably exploiting the operating system," he says.

NSS Labs' Moy argues that as the market for exploit developers evolves, exploitation will become reliable once more -- and exploiting known vulnerabilities will become a routine, if not simple, task.

"The researcher will ask themselves: 'Do I spend all my time on the Hail Mary, or do I take my skills and go for the small wins and make a living?'" he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-10-22
Cross-site request forgery (CSRF) vulnerability in the MRBS module for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.

Published: 2014-10-22
Shim allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted DHCPv6 packet.

Published: 2014-10-22
Heap-based buffer overflow in Shim allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the "tftp:// DHCPv6 boot option."

Published: 2014-10-22
Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

Published: 2014-10-22
House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.