Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/14/2017
02:19 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Cloud AV Can Serve as an Avenue for Exfiltration

Black Hat USA researchers show how bad guys can use cloud AV connections to bypass air-gaps and extremely segmented networks to keep stolen data flowing.

Over the past few years, security researchers have been drawing increasing attention to the fact that under the right circumstances security products could potentially be used to attack the very machines they're meant to protect. For the most part, the body of work on this front tends to fixate on authentication bypasses and attack techniques early in the attack lifecycle. 

Later this month at Black Hat USA in Las Vegas, a pair of researchers will show that security product vulnerabilities can be leveraged late in an attack as well. Vulnerable cloud antivirus products can not only be used to get attackers in to a target network, they can also be used to get stolen data out. In their The Adventures of AV and the Leaky Sandbox talk, the researchers will demonstrate how cloud-enhanced AV agents can be used as a vehicle for exfiltration on very secure and isolated endpoints.

Amit Klein, vice president of security research for SafeBreach, and Itzik Kotler, co-founder and CTO, dug into their research to challenge the assumption that there's no downside to moving to AV systems that leverages the cloud to incorporate up-to-date intelligence from multiple sources. They found that it's possible to subvert the Internet connection of AV products that use in-the-cloud sandbox technology to turn it into a rogue connection for getting stolen data off the target's network and onto the criminal's server.  

This can be a very powerful attack tool against enterprises that have enforced strong controls through egress filtering, whitelisting, and even airgaps with no other Internet connections.

Klein and Kotler plan to also release at Black Hat a tool to carry out their new technique, and they'll offer evidence about how a number of prominent AV products fared against the new attack. Klein says that even before digging into the troubling issues of insecure security products opening new lines of attack, the even more important lesson is to consider every possible angle of attack when it comes to the bad guys filching data from systems.

"Exflitration from the enterprise can take some very surprising and unexpected forms. With that in mind, security personnel should consider all possible ways of data to leave the enterprise and analyze them as potential exfiltration vectors," he says. " In our particular case it was the connection between AV agents and their cloud servers, but there are many other ways, to be sure."

As Klein explains, security product vulnerabilities are hardly a new phenomenon. For example, just last year at Black Hat, two researchers from enSilo presented techniques that leverage flaws in AV hooking engines to start an attack by bypassing ASLR protections in 32-bit and 64-bit systems.

In addition to Klein and Kotler's presentation, there will be a couple other new findings presented at Black Hat that show how attackers can break the mathematical engines that govern machine-learning based detection models. In one presentation, researchers at the Intel Science & Technology Center for Adversary-Resilient Security Analytics (ITSC-ARSA) at Georgia Tech will demo a tool they call AVPASS that can effectively spy on Android anti-malware detection models and manipulate malicious apps' APKs in such a way that it can disguise Android malware from the security software

Klein says all of this research should get practitioners to keep in mind that security products are very appealing attack targets.

"They usually have high privileges in the operating system on which they run - typically they run with administrator rights - and visibility access to enterprise network traffic," he says. "They also employ complex logic, interacting with a lot of file formats, protocols, and operating system features. This complexity translates into a broad attack surface."

As such, it's incumbent upon CISOs and other practitioners to stay on top of new research about this field and keep the pressure up on their vendors to keep their security tools hardened from attack. 

"I'm pretty sure that once vendors feel the pressure from major customers, their response time will improve, and they will also invest more time in internal research to predict and circumvent yet-unknown attacks," he says.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

 

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.