Vulnerabilities / Threats
7/14/2017
02:19 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Cloud AV Can Serve as an Avenue for Exfiltration

Black Hat USA researchers show how bad guys can use cloud AV connections to bypass air-gaps and extremely segmented networks to keep stolen data flowing.

Over the past few years, security researchers have been drawing increasing attention to the fact that under the right circumstances security products could potentially be used to attack the very machines they're meant to protect. For the most part, the body of work on this front tends to fixate on authentication bypasses and attack techniques early in the attack lifecycle. 

Later this month at Black Hat USA in Las Vegas, a pair of researchers will show that security product vulnerabilities can be leveraged late in an attack as well. Vulnerable cloud antivirus products can not only be used to get attackers in to a target network, they can also be used to get stolen data out. In their The Adventures of AV and the Leaky Sandbox talk, the researchers will demonstrate how cloud-enhanced AV agents can be used as a vehicle for exfiltration on very secure and isolated endpoints.

Amit Klein, vice president of security research for SafeBreach, and Itzik Kotler, co-founder and CTO, dug into their research to challenge the assumption that there's no downside to moving to AV systems that leverages the cloud to incorporate up-to-date intelligence from multiple sources. They found that it's possible to subvert the Internet connection of AV products that use in-the-cloud sandbox technology to turn it into a rogue connection for getting stolen data off the target's network and onto the criminal's server.  

This can be a very powerful attack tool against enterprises that have enforced strong controls through egress filtering, whitelisting, and even airgaps with no other Internet connections.

Klein and Kotler plan to also release at Black Hat a tool to carry out their new technique, and they'll offer evidence about how a number of prominent AV products fared against the new attack. Klein says that even before digging into the troubling issues of insecure security products opening new lines of attack, the even more important lesson is to consider every possible angle of attack when it comes to the bad guys filching data from systems.

"Exflitration from the enterprise can take some very surprising and unexpected forms. With that in mind, security personnel should consider all possible ways of data to leave the enterprise and analyze them as potential exfiltration vectors," he says. " In our particular case it was the connection between AV agents and their cloud servers, but there are many other ways, to be sure."

As Klein explains, security product vulnerabilities are hardly a new phenomenon. For example, just last year at Black Hat, two researchers from enSilo presented techniques that leverage flaws in AV hooking engines to start an attack by bypassing ASLR protections in 32-bit and 64-bit systems.

In addition to Klein and Kotler's presentation, there will be a couple other new findings presented at Black Hat that show how attackers can break the mathematical engines that govern machine-learning based detection models. In one presentation, researchers at the Intel Science & Technology Center for Adversary-Resilient Security Analytics (ITSC-ARSA) at Georgia Tech will demo a tool they call AVPASS that can effectively spy on Android anti-malware detection models and manipulate malicious apps' APKs in such a way that it can disguise Android malware from the security software

Klein says all of this research should get practitioners to keep in mind that security products are very appealing attack targets.

"They usually have high privileges in the operating system on which they run - typically they run with administrator rights - and visibility access to enterprise network traffic," he says. "They also employ complex logic, interacting with a lot of file formats, protocols, and operating system features. This complexity translates into a broad attack surface."

As such, it's incumbent upon CISOs and other practitioners to stay on top of new research about this field and keep the pressure up on their vendors to keep their security tools hardened from attack. 

"I'm pretty sure that once vendors feel the pressure from major customers, their response time will improve, and they will also invest more time in internal research to predict and circumvent yet-unknown attacks," he says.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

 

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
121 Pieces of Malware Flagged on NSA Employee's Home Computer
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/16/2017
Mobile Malware Incidents Hit 100% of Businesses
Dawn Kawamoto, Associate Editor, Dark Reading,  11/17/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.