05:19 PM

'App Store For Exploits' Could Reduce Enterprise Vulnerabilities

NSS Labs' Exploit Hub, a marketplace where coders can sell attacks on specific vulnerabilities, could help with enterprise security, experts say

The Exploit Hub -- a proposed free market for the buying and selling of attacks that exploit specific software vulnerabilities -- sounds more like a threat than a security aid. Yet the brainchild of security testing firm NSS Labs could just be what the doctor ordered to help enterprises eliminate their vulnerabilities, security experts say.

The "app store for exploits" will allow security researchers and developers to sell validated exploits to known security professionals. NSS Labs plans to test every exploit in the marketplace to make sure each one works and does not carry malicious code. In addition, the company will check every buyer to prevent criminals from using the marketplace to fuel their own activities.

The exploits will be in a standard format, making it easier for them to be added to the Metasploit Framework, and only attacks on previously reported vulnerabilities will be allowed.

"We are not selling zero-days -- this is not the Pirate Bay," says Rick Moy, president of NSS Labs. "One of the key things we are offering in our scenario here is that all of the exploits that go into the store will be validated."

For enterprise security teams, this new, darker analog to Apple's App Store could help immensely, says one security specialist at a Fortune 100 firm, who spoke on condition of anonymity.

"It is putting some parity on the playing field between the bad guys and the good guys," the security specialist says. "The bad guys have had this sort of capability for a while, and now the good guys can have it as well."

While vulnerability monitoring can reveal which systems have serious security issues, prioritizing the patching of flaws is difficult. That's where exploits can help, says the security specialist. Showing management that a particular issue can be easily exploited is a good way to open doors.

"Unless you can exploit a machine and pull it off -- give them the shock and awe -- it is hard to get their attention," he says.

The ability to buy exploits of publicly known software flaws could also help penetration testers and security professionals test the high-value targets that many security researchers might not care about, experts say.

Vulnerabilities in critical pieces of software, such as SAP and Oracle, are not always publicly exploited, making it difficult for security teams to show their vulnerabilities. In fact, only about 10 percent of the almost 15,000 most serious vulnerabilities have been publicly exploited, according to data from CVE Details.

The Exploit Hub concept extends the evolution of the security researchers' marketplace, observers say. In 2002, security firm iDefense -- now part of VeriSign -- created its Vulnerability Contributor program, which bought previously undisclosed vulnerability information from researchers. TippingPoint -- now part of Hewlett-Packard -- created its own bug bounty program in 2005, called the Zero Day Initiative. In 2007, an auction site, WabiSabiLabi, went online as a place to sell vulnerabilities. Other security researchers have sold their vulnerabilities and exploits privately.

But writing exploits has become increasingly difficult, leading many vulnerability researchers to forgo creating reliable exploits for known vulnerabilities. For many penetration testers, that means they are not showing their clients a complete picture of their vulnerability posture, Moy says.

"If a pen tester goes into a client and only uses what's in Metasploit and what's in his virtual back pocket, then he is doing his client a disservice," Moy says.

Not everyone agrees. Dan Holden, director of HP's TippingPoint DV Labs, notes that penetration testers find only a few avenues of vulnerability, and frequently that vulnerability is not in the computer systems, but with the employees.

"They argue that pen testers are as good as their exploits, but that is not necessarily true," Holden says. "A lot of pen testers use social engineering to get access to systems."

Moreover, with technologies such as address space layout randomization (ASLR) and data execution protection (DEP) now standard in Windows systems and applications, the task of finding exploits even for known vulnerabilities is difficult, Holden says.

"Weaponizing a vulnerability these days is far, far more difficult. There are a lot of hurdles to reliably exploiting the operating system," he says.

NSS Labs' Moy argues that as the market for exploit developers evolves, exploitation will become reliable once more -- and exploiting known vulnerabilities will become a routine, if not simple, task.

"The researcher will ask themselves: 'Do I spend all my time on the Hail Mary, or do I take my skills and go for the small wins and make a living?'" he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.