Risk
9/14/2010
05:19 PM
Connect Directly
RSS
E-Mail
50%
50%

'App Store For Exploits' Could Reduce Enterprise Vulnerabilities

NSS Labs' Exploit Hub, a marketplace where coders can sell attacks on specific vulnerabilities, could help with enterprise security, experts say

The Exploit Hub -- a proposed free market for the buying and selling of attacks that exploit specific software vulnerabilities -- sounds more like a threat than a security aid. Yet the brainchild of security testing firm NSS Labs could just be what the doctor ordered to help enterprises eliminate their vulnerabilities, security experts say.

The "app store for exploits" will allow security researchers and developers to sell validated exploits to known security professionals. NSS Labs plans to test every exploit in the marketplace to make sure each one works and does not carry malicious code. In addition, the company will check every buyer to prevent criminals from using the marketplace to fuel their own activities.

The exploits will be in a standard format, making it easier for them to be added to the Metasploit Framework, and only attacks on previously reported vulnerabilities will be allowed.

"We are not selling zero-days -- this is not the Pirate Bay," says Rick Moy, president of NSS Labs. "One of the key things we are offering in our scenario here is that all of the exploits that go into the store will be validated."

For enterprise security teams, this new, darker analog to Apple's App Store could help immensely, says one security specialist at a Fortune 100 firm, who spoke on condition of anonymity.

"It is putting some parity on the playing field between the bad guys and the good guys," the security specialist says. "The bad guys have had this sort of capability for a while, and now the good guys can have it as well."

While vulnerability monitoring can reveal which systems have serious security issues, prioritizing the patching of flaws is difficult. That's where exploits can help, says the security specialist. Showing management that a particular issue can be easily exploited is a good way to open doors.

"Unless you can exploit a machine and pull it off -- give them the shock and awe -- it is hard to get their attention," he says.

The ability to buy exploits of publicly known software flaws could also help penetration testers and security professionals test the high-value targets that many security researchers might not care about, experts say.

Vulnerabilities in critical pieces of software, such as SAP and Oracle, are not always publicly exploited, making it difficult for security teams to show their vulnerabilities. In fact, only about 10 percent of the almost 15,000 most serious vulnerabilities have been publicly exploited, according to data from CVE Details.

The Exploit Hub concept extends the evolution of the security researchers' marketplace, observers say. In 2002, security firm iDefense -- now part of VeriSign -- created its Vulnerability Contributor program, which bought previously undisclosed vulnerability information from researchers. TippingPoint -- now part of Hewlett-Packard -- created its own bug bounty program in 2005, called the Zero Day Initiative. In 2007, an auction site, WabiSabiLabi, went online as a place to sell vulnerabilities. Other security researchers have sold their vulnerabilities and exploits privately.

But writing exploits has become increasingly difficult, leading many vulnerability researchers to forgo creating reliable exploits for known vulnerabilities. For many penetration testers, that means they are not showing their clients a complete picture of their vulnerability posture, Moy says.

"If a pen tester goes into a client and only uses what's in Metasploit and what's in his virtual back pocket, then he is doing his client a disservice," Moy says.

Not everyone agrees. Dan Holden, director of HP's TippingPoint DV Labs, notes that penetration testers find only a few avenues of vulnerability, and frequently that vulnerability is not in the computer systems, but with the employees.

"They argue that pen testers are as good as their exploits, but that is not necessarily true," Holden says. "A lot of pen testers use social engineering to get access to systems."

Moreover, with technologies such as address space layout randomization (ASLR) and data execution protection (DEP) now standard in Windows systems and applications, the task of finding exploits even for known vulnerabilities is difficult, Holden says.

"Weaponizing a vulnerability these days is far, far more difficult. There are a lot of hurdles to reliably exploiting the operating system," he says.

NSS Labs' Moy argues that as the market for exploit developers evolves, exploitation will become reliable once more -- and exploiting known vulnerabilities will become a routine, if not simple, task.

"The researcher will ask themselves: 'Do I spend all my time on the Hail Mary, or do I take my skills and go for the small wins and make a living?'" he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2886
Published: 2014-09-18
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename encountered during ins...

CVE-2014-4352
Published: 2014-09-18
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.

CVE-2014-4353
Published: 2014-09-18
Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the presence of an attachment after the deletion of its parent (1) iMessage or (2) MMS.

CVE-2014-4354
Published: 2014-09-18
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.

CVE-2014-4356
Published: 2014-09-18
Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen.

Best of the Web
Dark Reading Radio