Operations

7/16/2018
03:00 PM
50%
50%

10 Ways to Protect Protocols That Aren't DNS

Here's how to safeguard three other network foundation protocols so they don't become weapons or critical vulnerabilities.
Previous
1 of 11
Next

When an attack using a basic Internet protocol makes the news, it tends to focus on the Web, with either HTTP or DNS in a starring role. But history shows us that other protocols can be used as both weapons and doors for attacking vulnerable organizations.

Three different protocols — BGP, NTP, and FTP — are especially useful to threat actors looking to disrupt operations or steal assets from individuals and organizations. Recent incidents around cryptocurrency wallets show just how effective Border Gateway Protocol (BGP) hijacking can be as part of an attack plan. BGP's mystery, from most users' points of view, stems from its complexity and adds to the danger because most organizations only begin to work directly with BGP when their networks pass into the "very large" category.

Network Time Protocol (NTP) might seem like the sort of protocol that is merely convenient, allowing users to avoid listening for time announcements on the radio and typing the results into their systems, but everything from cryptography to file transfer depends on computers and network components getting authoritative time from a canonical server. This requirement makes NTP ubiquitous and valuable when it comes to wreaking havoc on a victim.

And while users tend to use HTTP far more than File Transfer Protocol (FTP) for moving files between systems, many applications and systems still use FTP as an essential mechanism. Because FTP is often used for transferring very large files, it becomes a powerful weapon when criminals are able to use it against a target.

"Stop using these protocols" isn't practical advice for most organizations; far too many applications and users depend on them to make abandonment anything but a very long-term solution — and in the case of BGP and NTP, no replacement is on the horizon. So it becomes necessary for companies to figure out how to protect the protocols so that they remain tools while not becoming weapons or critical vulnerabilities.

There are, of course, many ways to protect network foundation protocols, but a handful of suggestions may help spur thought and provide inspiration for moving defense forward. This list is intended to provide a jumping-off point for discussions on how an organization can protect itself and its Internet neighbors from harm through one of these protocols.

What steps has your organization taken to protect these essential protocols? If you have found a suggestion not on this list to be especially helpful, let us know in the comments, below. The online community is waiting to become more secure!

(Image: Tatiana Popova)

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Previous
1 of 11
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jon M. Kelley
100%
0%
Jon M. Kelley,
User Rank: Moderator
7/19/2018 | 12:01:23 PM
Too many tabs, too little info
THis is the first time this year that I've gone through one of DRs multitab "specials".  To be honest this post subject still explains why I skip them:  too many slow loading tabs, with almost no relevant text per tab. Tabs with less than 100 words - get real.  Maybe I'll try again near Christmas.
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Starwood Breach Reaction Focuses on 4-Year Dwell
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/5/2018
Symantec Intros USB Scanning Tool for ICS Operators
Jai Vijayan, Freelance writer,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I guess this answers the question: who's watching the watchers?
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-3988
PUBLISHED: 2018-12-10
Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then Signal will leave the picture in its own cache directory, which is available to any application on the...
CVE-2018-10008
PUBLISHED: 2018-12-10
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended...
CVE-2018-10008
PUBLISHED: 2018-12-10
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace br...
CVE-2018-10008
PUBLISHED: 2018-12-10
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jen...
CVE-2018-10008
PUBLISHED: 2018-12-10
A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.