Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
11:20 AM
Carric Dooley
Carric Dooley
Partner Perspectives
Connect Directly

Five Easiest Ways to Get Hacked Part 2

Continuing a conversation with principal security consultant Amit Bagree

I had the opportunity recently to sit down with Amit Bagree, one of our principal security consultants, for a chat about the most common weak points in network security. Amit has been breaking things apart since childhood, has been working in the security field for almost 10 years, and is a graduate of the prestigious Carnegie Mellon University Master’s program in Information Security Technology and Management.  In the first installment of the interview, we discussed three weaknesses. This second part of the conversation addresses two more.

Previously, we talked about weak points primarily caused by simple configuration issues or user error. At the end of the last blog, you mentioned taking advantage of how Windows networks do name resolution. What is that?

Openness and ease of configuration are the weaknesses here. When a resource is requested that the server does not recognize, the end-client sends out a broadcast message to everyone in order to find it. Any device can respond to that broadcast claiming to be the missing resource, and the client may end up sending out its password or hash information. Since users frequently mistype the names of shared resources, such as printers or network drives, an attacker inside the network does not have to wait long to get an opening.

When passwords are sent across the network, they obviously should not be sent as clear text, and when they are hashed they should not be easily reversible. It is common to see unencrypted traffic such as http on an internal network. And unfortunately, the hash commonly used by older Microsoft systems (known as the LAN Manager Hash or LM Hash) uses a relatively short key space that current computing power can break quickly in a brute-force attack. Newer systems (post-Windows XP and Server 2003) use a more robust hash now, but it is still common to find some older systems on the network. Although Microsoft ends extended support for Windows 2003 Server in July 2015, people always procrastinate. There are still millions of these servers out there needing to be upgraded or replaced.

The best way to close this off is to upgrade all servers to something newer than 2003, and change the system configurations to refuse the LM hash. In addition, only encrypted traffic should be used on the network. Tools are available to monitor and detect spoofing attacks based on this vulnerability.

Speaking of vulnerabilities, what happens after a vulnerability is published? Is there some inflection point when the risk of being successfully attacked increases?

Unfortunately, yes. There are several online sources for exploits that attackers can easily search, specifying desired target and level of access. Once an exploit for a particular vulnerability becomes publicly available, the risk of attack increases substantially. Of the weaknesses we have discussed, public exploits generate the most attack traffic.

Defense-in-depth is the best approach to combating these types of attacks. First, develop a patch management strategy. Second, make sure your strategy keeps systems up to date. Third, even with up-to-date patches, regularly scan your network for vulnerabilities, especially those with available exploits.

Thanks Amit, any closing thoughts?

Too many breaches start with an easily gained foothold in some innocuous part of the network, and then work into systems that are more sensitive. Closing these five vulnerabilities can significantly improve your defenses and reduce your attack surface.

For more details on these security issues, read Amit’s detailed white paper, Low Hanging Fruits: The Top Five Easiest Ways to Hack or Get Hacked

Carric Dooley has extensive experience leading comprehensive security assessments as well as network and application penetration tests in a wide range of industries across North America, Europe, and Asia. As the Worldwide VP of Foundstone Services at McAfee, part of Intel ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
3/6/2015 | 6:11:41 PM
Re: Vulnerability Standpoint

This is a great question and it's something Amit discusses a bit in his Low Hanging Fruits: The Top Five Easiest Ways to Hack or Get Hacked whitepaper (link in blog). In my personal experience, SMB's tend to have almost zero awareness of the threats or their vulnerabilities. They don't really have a geek culture (unless the owner happens to be one) that really participates in the community, that lives and breathes this stuff. I think you can take an affordable approach to achieve SOME level of security. It doesn't take an enterprise-level effort or tool to secure an SMB.

From a purely vulnerability standpoint SMBs would typically look for high value in return for the time and money they invest. My suggestion is to use a scan policy that performs checks only for vulnerabilities, which have an exploit available, or alternatively you can filter the results of a full vulnerability scan to only those which have exploits. This would provide a shorter and more manageable list of actionable items, and you can start with addressing the critical/high risk findings first. Also, for an SMB it will be very valuable to invest in a software for patch management (including non-Microsoft patches), otherwise it becomes too big and discouraging of a problem to solve for most organizations. Lastly, SMBs should use a maturity model based approach to plan where they currently stand and where they would like to go. This would need a thorough understanding of what an organization is trying to protect, and what people, process and technology controls they can put in place to achieve the security level they would like.

Consider the following:

  • Nessus is $1,500/ year, and a very good tool used by almost everyone at all levels of security maturity. It helps find missing patches, default configurations and accounts, etc. For a homogeneous Windows environment (typical for SMB), the "Microsoft Baseline Security Analyzer" is a reasonable start, and not so complicated that just a little IT know-how can't handle the tasks.
  • Microsoft now ships with some basic AV and anti-malware protection built-in, but it's not centrally manageable (less of a problem a problem for a small shop).

Some ISP's offer services to help filter e-mail as well so you might be subject fewer attacks on that vector as well. And, don't run or open anything you get that you don't absolutely trust... Also, having someone local (a small consultancy) help with setting baseline configurations for servers and workstations would help, and vendors provide a lot of guidance for both applications and the OS, especially since most small business these days run some version of Windows.


Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
3/2/2015 | 12:11:10 AM
Testing patches
An important yet oft overlooked aspect of a good patch management strategy: implement everything in a testbed first.  Test everything with everything.  Otherwise, you could really screw things up -- especially in a multi-vendor environment.

Verizon learned this lesson (so we might hope) the hard way last summer when its billing system suffered a multi-day outage because of its failure to test updates.
User Rank: Ninja
2/26/2015 | 9:25:23 AM
Vulnerability Standpoint
From a vulnerability standpoint, it may be difficult to dedicate the bandwidth required for assessment and remediation.It's an ongoing process and is a multi-team faceted endeavor. What tips do you have for small to medium sized organizations that are trying to increase their security posture through their vulnerability remediation effort?
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.2.0, BinaryHeap is not panic-safe. The binary heap is left in an inconsistent state when the comparison of generic elements inside sift_up or sift_down_range panics. This bug leads to a drop of zeroed memory as an arbitrary type, which can result in a memory ...
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, String::retain() function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when the provided closure panics. This bug could result in a memory safety violation when other string APIs assume that UTF-8 encoding is used on the sam...
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.49.0, VecDeque::make_contiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free.
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe context. This bug could lead to a buffer overflow.
PUBLISHED: 2021-04-11
In the standard library in Rust before 1.52.0, the Zip implementation has a panic safety issue. It calls __iterator_get_unchecked() more than once for the same index when the underlying iterator panics (in certain conditions). This bug could lead to a memory safety violation due to an unmet safety r...