Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/16/2013
04:17 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

'Tortilla' Spices Up Active Defense Ops

New free Tor tool, due out at Black Hat USA, aims to make the Tor anonymizing network easier to use for all types of intel-gathering

A researcher later this month at Black Hat USA will release a free tool that simplifies the use of Tor and makes it more approachable for all types of security researchers, not just malware analysts.

Click here for more of Dark Reading's Black Hat articles.

CrowdStrike researcher Jason Geffner says the new tool, called Tortilla, routes all TCP/IP and DNS traffic anonymously via the Tor Project's network, but unlike existing Tor tools, it operates with Windows and works with all types of browsers.

Geffner says he got the idea for Tortilla after realizing that no other Tor tools provided all of the elements he needed to anonymize his Internet access while he researched bad cyberactors. The new tool also supports Flash and other plug-ins, and doesn't require additional hardware or virtual machines, he says.

But perhaps one of the more attractive features for enterprises is that it plays nicely with Windows, which isn't traditionally the case with other Tor tools, many of which require Linux, for example, Geffner says. "It doesn't require that users work with OSes that are unfamiliar to them," he says. "One of the requirements for Tortilla was that it would require it to be as easy as possible for users to use."

It also prevents malware from circumventing the Tor tunnel, he says -- something that wily hackers can do today via the Tor's browser, the Tor Browser Bundle tool, which is based on Firefox. "While it's great in concept, the downside [with Tor Browser Bundle] is if you're visiting a website with Tor Browser Bundle and the browser gets exploited, it's possible that the exploit could use code executed in the browser to circumvent that Tor tunnel," say Geffner, who is providing only limited details on Tortilla prior to its release.

Tortilla is the latest of a series of free active defense tools becoming available in the public domain. Security experts John Strand, Paul Asadoorian, Ethan Robish, and Benjamin Donnelly offer a Linux distro set of tools called Active Defense Harbinger Distribution (ADHD) for active defense measures, including feeding the attacker phony information about the targeted network.

Active defense, not to be confused with pure "hacking back," is about frustrating, identifying, and, in some cases, physically locating the bad guys behind the keyboard. The goal is to raise the bar and make it more expensive for the attacker, and it's a constant game of one-upsmanship.

"We want to see companies start doing ... [these] nontraditional defense tactics," Strand says. "We're trying to get as much of this open source" and generate other ideas as well for it, he says.

[Ammunition for fighting back against cyberattackers in subtle yet disruptive ways is becoming available in open source. See Free 'Active Defense' Tools Emerge .]

CrowdStrike's Geffner says Tortilla was designed with security researchers in mind, including those who aren't necessarily downloading malware for analysis or communicating with command-and-control servers. "[CrowdStrike has] a large intel team that seeks to capture actionable information on ... adversaries. Some of us do very technical work, and others research the actors themselves, reading their blogs and Web forum posts," he says. "They are using Tortilla with whatever browser they like to have."

For enterprises investing in threat intel efforts, it allows their researchers to investigate malicious actors without revealing their identities, he says. "If Company XYZ gets hit and the attacker sees connections to its server with probes from Company XYZ, that's going to tip off the attacker. If the company can anonymize their research through Tor, it keeps the attacker in the dark and raises the cost to the attacker."

Geffner plans to post both the source code for Tortilla and a working executable during his July 31 presentation at Black Hat in Las Vegas.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
iNtHEmACHINE
50%
50%
iNtHEmACHINE,
User Rank: Apprentice
8/1/2013 | 3:03:54 PM
re: 'Tortilla' Spices Up Active Defense Ops
Apropo and useful. Thank you CrowdStrike.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.