Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:39 AM
Connect Directly

Free Advanced Evasion Technique Tool Unleashed

'Evader' to demonstrate how attacks slip by popular network security devices

BLACK HAT USA -- Las Vegas, NV -- Researchers here yesterday released a free testing tool that checks for attacks employing so-called advanced evasion techniques (AETs) that bypass network perimeter security devices.

Click here for more of Dark Reading's Black Hat articles.

The new Evader tool developed and offered by Stonesoft basically launches these types of attacks against the user's next-generation firewall, intrusion prevention system (IPS), and unified threat management (UTM) products to gauge the organization's risk of these types of threats.

"Evader launches a set of AETs against the tester's own next-generation firewall, IPS, or UTM device to understand if it poses any AET threat," says Richard Benigno, senior vice president of Stonesoft Americas. "They can then determine if they are protected against these [attacks] or not" and make adjustments to existing controls, he says.

The idea is to avoid just throwing more layers of technology at the problem. "Increasing numbers of people are not understanding how networks are being compromised, even though they are buying more point solutions to protect [the products] from being evaded," Benigno says.

Evader runs on Linux and Windows. Stonesoft plans to demonstrate here at its booth at Black Hat how the tool allows it to bypass several network vendors' devices. "In under 30 seconds, we can get shell access to a host -- undetected by any of these [network security] devices," he says, describing them as "household names."

Stonesoft will run Evader against HP/TippingPoint, McAfee, Palo Alto Networks, and Sourcefire network security products. The tool is available here for download.

Where are AET attacks being leveraged? Benigno says military, government, and regulated sectors are in the bull's eye. "But AETs are very expensive and not easy" to pull off, he says. "So we believe it's [moving] more toward critical infrastructure."

And when a network security device doesn't have the proper signature in place to catch one of these attacks, they sneak by. "If a device cannot understand the anomalies being sent through them, they let them go by," Benigno says. So when an attacker slices, dices, and scrambles Conficker into a format an IPS can't detect, it can get inside. The malware gets reconfigured on the other end and is able to deliver its malicious payload to the target host system.

"Network security vendors have ignored the problem posed by AETs for a number of years," says Andrew Blyth, professor at Glamorgan University and an AET expert. "Stonesoft’s free Evader test tool makes securing against AETs accessible for organizations of all sizes. Hopefully, this will encourage the whole network security industry to come together and seriously research AETs and their ongoing threat."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
7/26/2012 | 1:03:19 AM
re: Free Advanced Evasion Technique Tool Unleashed
Link to the tool is broken. -Take out the %20 and it 404s
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-17
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivile...
PUBLISHED: 2021-04-17
Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (ker...
PUBLISHED: 2021-04-17
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS Build 20210202 and later Q...
PUBLISHED: 2021-04-17
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia C...
PUBLISHED: 2021-04-16
jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...