Penetration Test Data Shows Risk to Domain Admin Credentials

But gaining a foothold on the LAN via vulnerabilities on Internet-facing assets is becoming harder, Rapid7 found in its real-world pen tests.

[Continued from previous page]

penetration testers encountered was weak transport-layer security resulting from old or absent encryption standards. Many organizations had websites that did not offer any encryption at all, and instead had HTTP-only resources or used authentication mechanisms that exposed credentials. When they did use encryption, the cipher suites were often weaker than those currently recommended.

Other common external vulnerabilities included weak passwords and outdated or unpatched software. Most of the vulnerabilities that exist on Internet-facing assests tend be those that impact data confidentiality.

Web application vulnerabilities are another class of flaws that fall within this category. The most common vulnerabilities here include user name enumeration issues that allow an attacker to guess or confirm valid users on a system; weaknesses that lead to encryption failures for data in transit; and SQL injection and cross-site scripting flaws.

However, cloud adoption is making it harder for attackers to use Web application flaws and other external flaws to break into the internal LAN. Enterprise organizations are increasingly embracing external hosting services from providers such as Amazon, Microsoft, and Google. 

"As such, there is often no clear path from an external compromise of a networked software component to the client's internal network," Beardsley notes.

In situations where an attacker is able to gain internal access via an externally facing vulnerability, outdated software and weak passwords are often the main cause. "Attackers can often test a lot of passwords against something like an externally-accessible mail server, and then turn those around and use those same credentials to hit internal assets," Beardsley says.

Related Content:

Black Hat USA returns to Las Vegas with hands-on technical Trinings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.