Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

7/16/2018
03:00 PM
50%
50%

10 Ways to Protect Protocols That Aren't DNS

Here's how to safeguard three other network foundation protocols so they don't become weapons or critical vulnerabilities.
Previous
1 of 11
Next

When an attack using a basic Internet protocol makes the news, it tends to focus on the Web, with either HTTP or DNS in a starring role. But history shows us that other protocols can be used as both weapons and doors for attacking vulnerable organizations.

Three different protocols — BGP, NTP, and FTP — are especially useful to threat actors looking to disrupt operations or steal assets from individuals and organizations. Recent incidents around cryptocurrency wallets show just how effective Border Gateway Protocol (BGP) hijacking can be as part of an attack plan. BGP's mystery, from most users' points of view, stems from its complexity and adds to the danger because most organizations only begin to work directly with BGP when their networks pass into the "very large" category.

Network Time Protocol (NTP) might seem like the sort of protocol that is merely convenient, allowing users to avoid listening for time announcements on the radio and typing the results into their systems, but everything from cryptography to file transfer depends on computers and network components getting authoritative time from a canonical server. This requirement makes NTP ubiquitous and valuable when it comes to wreaking havoc on a victim.

And while users tend to use HTTP far more than File Transfer Protocol (FTP) for moving files between systems, many applications and systems still use FTP as an essential mechanism. Because FTP is often used for transferring very large files, it becomes a powerful weapon when criminals are able to use it against a target.

"Stop using these protocols" isn't practical advice for most organizations; far too many applications and users depend on them to make abandonment anything but a very long-term solution — and in the case of BGP and NTP, no replacement is on the horizon. So it becomes necessary for companies to figure out how to protect the protocols so that they remain tools while not becoming weapons or critical vulnerabilities.

There are, of course, many ways to protect network foundation protocols, but a handful of suggestions may help spur thought and provide inspiration for moving defense forward. This list is intended to provide a jumping-off point for discussions on how an organization can protect itself and its Internet neighbors from harm through one of these protocols.

What steps has your organization taken to protect these essential protocols? If you have found a suggestion not on this list to be especially helpful, let us know in the comments, below. The online community is waiting to become more secure!

(Image: Tatiana Popova)

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio
 

Recommended Reading:

Previous
1 of 11
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jon M. Kelley
100%
0%
Jon M. Kelley,
User Rank: Moderator
7/19/2018 | 12:01:23 PM
Too many tabs, too little info
THis is the first time this year that I've gone through one of DRs multitab "specials".  To be honest this post subject still explains why I skip them:  too many slow loading tabs, with almost no relevant text per tab. Tabs with less than 100 words - get real.  Maybe I'll try again near Christmas.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15208
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can ...
CVE-2020-15209
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one....
CVE-2020-15210
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and ...
CVE-2020-15211
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices f...
CVE-2020-15212
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `outpu...