Attacks/Breaches

7/12/2017
05:20 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

How Active Intrusion Detection Can Seek and Block Attacks

Researchers at Black Hat USA will demonstrate how active intrusion detection strategies can help administrators detect hackers who are overly reliant on popular attack tools and techniques.

Penetration testers as well as bad-guy hackers typically rely on several common attack tools to break into business networks. 

Enterprises defending their networks can flip the equation on attackers by using active intrusion detection strategies to create situations where attackers overly reliant on these tools inadvertently expose themselves to detection and other complications, says John Ventura, practice manager for applied research at Optiv. It's a trap that even pen testers can fall into while running their tools, he says.

Ventura will this detail a more active approach to intrusion prevention - where defenders can use basic network software applications to look for threats and stop attacks - later this month in his Black Hat USA talk entitled "They're Coming for Your Tools: Exploiting Design Flaws for Active Intrusion Prevention." 

The field of intrusion detection and prevention systems has been "relatively stagnant" for the past 15 to 20 years, Ventura says. Passive intrusion detection systems can be computationally intensive and their responses rarely go far.

"If your company is using intrusion detection and prevention systems, and dealing with those alerts responsibly, you are doing great relative to the rest of the industry," he notes.

Ventura at Black Hat will take hacking tools popular among attackers and pen testers such as Metasploit, and show how design flaws in those tools can be exploited for intrusion prevention.

"There are common hacking tools that a lot of people use, and if you target those tools, you can make it harder to break into computers," he explains.

Ventura plans to demonstrate methodologies for finding and disrupting common attacks; organizations can integrate these into their IDS/IPS products to make the software better. Software written over the course of this research can be used on lightweight hardware to defend against real-world attacks. It's an effective swap for more expensive "magic box" solutions.

One of the examples he plans to discuss involves man-in-the-middle (MitM) attacks. The goal is to target the communications channel while it's being established, he says. The attacker introduces his or her software onto a compromised host, and that software initiates communication with the attacker's computer. The goal is to disrupt that "handshake," Ventura says. Attackers need to maintain control over the target machine once they break in, but it's hard to communicate during a MitM attack.

"It is really hard to get two computers to talk to each other in a secure fashion if they have never communicated before," Ventura continues. "Even with a head start, they'll still have vulnerabilities that pop up from time to time."

Though they have decades of experience, developers and researchers working on these problems still find themselves facing serious vulnerabilities in their tools, he notes.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

 

Ventura will demonstrate IDS/IPS software that uses the Metasploit Framework's Meterpreter control channel to take control over a machine that has been compromised and breaks its communication channel, replacing it with one of the user's choosing. Traffic still goes to where you might expect it; however, the attacker has a broken TCP connection, so the person running the software has control over a machine that the initial attacker compromised, he explains.

The topic is relevant to both offensive and defensive security professionals. Blue team defenders can become more proactive by manipulating their network traffic to detect and complicate common attacks, targeting attackers, and exploiting vulnerabilities in their software.

Red teamers who break into computers need to understand how their tools work, says Ventura. Those who don't understand the functionality of their tools may heighten the risk for detection and exploitation.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8010
PUBLISHED: 2018-05-21
This vulnerability in Apache Solr 6.0.0 to 6.6.3, 7.0.0 to 7.3.0 relates to an XML external entity expansion (XXE) in Solr config files (solrconfig.xml, schema.xml, managed-schema). In addition, Xinclude functionality provided in these config files is also affected in a similar way. The vulnerabilit...
CVE-2018-8012
PUBLISHED: 2018-05-21
No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
CVE-2018-1067
PUBLISHED: 2018-05-21
In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is ...
CVE-2018-7268
PUBLISHED: 2018-05-21
MagniComp SysInfo before 10-H81, as shipped with BMC BladeLogic Automation and other products, contains an information exposure vulnerability in which a local unprivileged user is able to read any root (uid 0) owned file on the system, regardless of the file permissions. Confidential information suc...
CVE-2018-11092
PUBLISHED: 2018-05-21
An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table (aka Clear Table) action.