Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


09:28 AM
Connect Directly

Tiger Team Member Attacks Developers, Not Apps

Expert shows how he can get into a Web app without touching the application itself

Chris Nickerson can gain access to a Web application without ever touching it -- with just the right amount of reconnaissance, the so-called Tiger Team hacker can infiltrate the development team and compromise their machines.

“I can get into the application from the back side while on the outside, without touching” the app, says Nickerson, who gave attendees of the Open Web Application Security Project (OWASP) USA conference in New York today a taste of what he considers the big-picture cyber threats to organizations, targeted attacks for money or corporate espionage. “Closing all the holes in a Web application doesn’t make you secure,” he says.

Most Web application security testing is focused on searching for vulnerabilities, he says, but that’s not as comprehensive as his brand of tiger team, or red team, testing that assesses physical and electronic security as well as social engineering weaknesses. “Red teaming provides comprehensive testing."

Nickerson, who along with colleagues Ryan Jones and Luke McOmie starred in the reality TV show Tiger Team that aired briefly on CourtTV, says the red team testing approach is more realistic for assessing the risks to an organization.

“Instead of spending time going through the application first, I figure out who the developers are," he says. “If they have Twitter accounts, MySpace pages, personal email accounts, and phone numbers... I start profiling them. I can guarantee I will find code faster than those who are directly touching the code” looking for vulnerabilities. (See Pen Testing Goes Reality TV and The Perfect Jewelry Heist .)

Online developer forums are one of the first places to look, he says, because developers often post snippets of their code to get help from other developers.

“Going out to forums... you start to see the different flaws in the apps they’re trying to fix,” says Nickerson, who is CEO of Lares Consulting, which performs penetration testing, social engineering, red team, and other risk assessments for organizations. “And you can start manipulating the developer” online by posing as a helpful developer, but instead giving them fixes that give you inside access to their machine. “I’ll embed exploits into PDFs, etc.,” he says.

Attackers who really want to make money or gather information for industrial espionage aren’t likely to spend hours trying to find holes in a Web application, Nickerson observes. “They take the path of least resistance... They’re not going to spend 100 hours on an application when they can walk into the [victim’s] facility in two minutes and use their technologies... or flat-out steal them."

You can find details about a member of a development team by pulling the metadata off a PDF file he posts on line, for instance. Or you can assess the physical makeup of the organization with Google Maps: “Are you on top of a hill? I can look at Google Maps and see that you have nine doors, and I can get into two of them,” he says. “We are testing all of these kinds of real-world vulnerabilities.”

After profiling the developers, a full-scope penetration test can be conducted, including client-side attacks and hijacking browsers. “If you can’t get in when testing the app, you can go on-site” and perform a social engineering caper -- use a USB U3 key to siphon user credentials, plant a sniffer on-site, or use other handy hacking tools.

The bottom line is gauging whether your organization has a culture of security or not, he says. “Even if you closed all the holes in your software, you did nothing for the security of your company” if someone can still walk through the door and gain access to your valuable data or assets, he says.

One of Nickerson’s clients, which he describes as a “well-known luxury brand,” learned that its main rival had assembled a team dedicated to finding out what his client has in the works. “They were all hackers... [Our client was] getting so concerned because they had found they were beating their ‘front door’ every day,” he says.

So Lares's client tried out a tiger-team honeypot method -- they posted phony documents and PDF files with a fake username wrapped inside the metadata. “Then they started seeing log-ins coming from that that [phony user] account,” Nickerson says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/14/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to obtain all user accounts credentials.
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text. An attacker may also ...
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker to remotely execute arbitrary code.
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code.
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection�) vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that create...