Vulnerabilities / Threats
7/16/2013
04:17 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

'Tortilla' Spices Up Active Defense Ops

New free Tor tool, due out at Black Hat USA, aims to make the Tor anonymizing network easier to use for all types of intel-gathering

A researcher later this month at Black Hat USA will release a free tool that simplifies the use of Tor and makes it more approachable for all types of security researchers, not just malware analysts.

Click here for more of Dark Reading's Black Hat articles.

CrowdStrike researcher Jason Geffner says the new tool, called Tortilla, routes all TCP/IP and DNS traffic anonymously via the Tor Project's network, but unlike existing Tor tools, it operates with Windows and works with all types of browsers.

Geffner says he got the idea for Tortilla after realizing that no other Tor tools provided all of the elements he needed to anonymize his Internet access while he researched bad cyberactors. The new tool also supports Flash and other plug-ins, and doesn't require additional hardware or virtual machines, he says.

But perhaps one of the more attractive features for enterprises is that it plays nicely with Windows, which isn't traditionally the case with other Tor tools, many of which require Linux, for example, Geffner says. "It doesn't require that users work with OSes that are unfamiliar to them," he says. "One of the requirements for Tortilla was that it would require it to be as easy as possible for users to use."

It also prevents malware from circumventing the Tor tunnel, he says -- something that wily hackers can do today via the Tor's browser, the Tor Browser Bundle tool, which is based on Firefox. "While it's great in concept, the downside [with Tor Browser Bundle] is if you're visiting a website with Tor Browser Bundle and the browser gets exploited, it's possible that the exploit could use code executed in the browser to circumvent that Tor tunnel," say Geffner, who is providing only limited details on Tortilla prior to its release.

Tortilla is the latest of a series of free active defense tools becoming available in the public domain. Security experts John Strand, Paul Asadoorian, Ethan Robish, and Benjamin Donnelly offer a Linux distro set of tools called Active Defense Harbinger Distribution (ADHD) for active defense measures, including feeding the attacker phony information about the targeted network.

Active defense, not to be confused with pure "hacking back," is about frustrating, identifying, and, in some cases, physically locating the bad guys behind the keyboard. The goal is to raise the bar and make it more expensive for the attacker, and it's a constant game of one-upsmanship.

"We want to see companies start doing ... [these] nontraditional defense tactics," Strand says. "We're trying to get as much of this open source" and generate other ideas as well for it, he says.

[Ammunition for fighting back against cyberattackers in subtle yet disruptive ways is becoming available in open source. See Free 'Active Defense' Tools Emerge .]

CrowdStrike's Geffner says Tortilla was designed with security researchers in mind, including those who aren't necessarily downloading malware for analysis or communicating with command-and-control servers. "[CrowdStrike has] a large intel team that seeks to capture actionable information on ... adversaries. Some of us do very technical work, and others research the actors themselves, reading their blogs and Web forum posts," he says. "They are using Tortilla with whatever browser they like to have."

For enterprises investing in threat intel efforts, it allows their researchers to investigate malicious actors without revealing their identities, he says. "If Company XYZ gets hit and the attacker sees connections to its server with probes from Company XYZ, that's going to tip off the attacker. If the company can anonymize their research through Tor, it keeps the attacker in the dark and raises the cost to the attacker."

Geffner plans to post both the source code for Tortilla and a working executable during his July 31 presentation at Black Hat in Las Vegas.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
iNtHEmACHINE
50%
50%
iNtHEmACHINE,
User Rank: Apprentice
8/1/2013 | 3:03:54 PM
re: 'Tortilla' Spices Up Active Defense Ops
Apropo and useful. Thank you CrowdStrike.
Printers: The Weak Link in Enterprise Security
Kelly Sheridan, Associate Editor, Dark Reading,  10/16/2017
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Why Security Leaders Can't Afford to Be Just 'Left-Brained'
Bill Bradley, SVP, Cyber Engineering and Technical Services, CenturyLink,  10/17/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.