Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

7/25/2012
01:39 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Free Advanced Evasion Technique Tool Unleashed

'Evader' to demonstrate how attacks slip by popular network security devices

BLACK HAT USA -- Las Vegas, NV -- Researchers here yesterday released a free testing tool that checks for attacks employing so-called advanced evasion techniques (AETs) that bypass network perimeter security devices.

Click here for more of Dark Reading's Black Hat articles.

The new Evader tool developed and offered by Stonesoft basically launches these types of attacks against the user's next-generation firewall, intrusion prevention system (IPS), and unified threat management (UTM) products to gauge the organization's risk of these types of threats.

"Evader launches a set of AETs against the tester's own next-generation firewall, IPS, or UTM device to understand if it poses any AET threat," says Richard Benigno, senior vice president of Stonesoft Americas. "They can then determine if they are protected against these [attacks] or not" and make adjustments to existing controls, he says.

The idea is to avoid just throwing more layers of technology at the problem. "Increasing numbers of people are not understanding how networks are being compromised, even though they are buying more point solutions to protect [the products] from being evaded," Benigno says.

Evader runs on Linux and Windows. Stonesoft plans to demonstrate here at its booth at Black Hat how the tool allows it to bypass several network vendors' devices. "In under 30 seconds, we can get shell access to a host -- undetected by any of these [network security] devices," he says, describing them as "household names."

Stonesoft will run Evader against HP/TippingPoint, McAfee, Palo Alto Networks, and Sourcefire network security products. The tool is available here for download.

Where are AET attacks being leveraged? Benigno says military, government, and regulated sectors are in the bull's eye. "But AETs are very expensive and not easy" to pull off, he says. "So we believe it's [moving] more toward critical infrastructure."

And when a network security device doesn't have the proper signature in place to catch one of these attacks, they sneak by. "If a device cannot understand the anomalies being sent through them, they let them go by," Benigno says. So when an attacker slices, dices, and scrambles Conficker into a format an IPS can't detect, it can get inside. The malware gets reconfigured on the other end and is able to deliver its malicious payload to the target host system.

"Network security vendors have ignored the problem posed by AETs for a number of years," says Andrew Blyth, professor at Glamorgan University and an AET expert. "Stonesoft’s free Evader test tool makes securing against AETs accessible for organizations of all sizes. Hopefully, this will encourage the whole network security industry to come together and seriously research AETs and their ongoing threat."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
p0t8o0x2a
50%
50%
p0t8o0x2a,
User Rank: Apprentice
7/26/2012 | 1:03:19 AM
re: Free Advanced Evasion Technique Tool Unleashed
Link to the tool is broken. -Take out the %20 and it 404s
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3493
PUBLISHED: 2021-04-17
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivile...
CVE-2021-3492
PUBLISHED: 2021-04-17
Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (ker...
CVE-2020-2509
PUBLISHED: 2021-04-17
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later Q...
CVE-2020-36195
PUBLISHED: 2021-04-17
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia C...
CVE-2021-29445
PUBLISHED: 2021-04-16
jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...