STE WILLIAMS

If you were at BSides Manchester in England this week, you hopefully caught James Williams’ presentation on the shortcomings of some commercial antivirus tools.

If not, and you hoped to watch it on YouTube, you may be out of luck for a while.

That’s because one of the vendors mentioned – SentinelOne – is rather upset with the talk, funnily enough titled “Next-gen AV vs my shitty code.” To stop people seeing it, the Silicon Valley biz filed a copyright-infringement complaint to make YouTube remove a recording of the presentation from the BSides Manchester channel.

The effort to strip the presentation from the official channel, and out of sight of the internet, worked: at time of writing, the video of Williams’ talk has been removed.

Not surprisingly, the takedown complaint is not being met with much sympathy from the security research community, which sees it more as an attempt by an embarrassed vendor to cover up bugs and stamp out unflattering attention.

Williams told El Reg he has yet to hear the reasoning on why the video has been taken down, while BSides Manchester organizers said they are still reviewing the video and claim to work out what got SentinelOne so upset.

For one thing, his presentation did not include any source code nor any other sensitive intellectual property owned by SentinelOne, from what we can tell.

The Register pinged SentinelOne for comment, which in turn revealed it was a tad unhappy with the presentation, something something something, copyright and trademark claim. A spokesperson told us:

We strongly support the work of BSides and participated in the conference earlier this year by sending our own researchers. We’re always open to feedback, but we expect that feedback to come through the use of a supported version of our product and this video showed our 1.8.4 version which reached its end of life earlier this year (our notification from March can be found here).

In addition, as we are protecting critical global enterprises, if a party believes there’s a bug in our product, we expect them to follow the common disclosure practices in place that protect the entire community.

From a legal perspective, the video breached our terms of service, copyright laws, and trademark laws. It was removed lawfully after being reviewed by YouTube. With that said, we’ve invited the author to collaborate with us on a supported version and look forward to that opportunity.

El Reg has asked for clarification on what exactly the infringing content was – because a breach of the antivirus maker’s terms-of-service is not a valid reason to take down a video – and has yet to hear back at the time of publication. We also asked Williams to comment on SentinelOne’s allegations about bug disclosure methods.

And if you want to see what all the fuss is over, Williams gave a very similar talk last month at SteelCon, a hacker gathering in the north of England, which happens to be online here…

Youtube Video

…and you can find the slides and more resources on GitHub over here. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/08/18/sentinelone_bsides_copyright_takedown/

BSides Manchester Websites can be hijacked to turn their caches into exploit delivery systems.

James Kettle of Portswigger, the biz behind Burp Suite, has developed techniques to go beyond previous cache poisoning.

Caching speeds up webpage loads by reducing latency while also reducing the load on application server. Some organizations host their own cache using software like Varnish, and others opt to rely on a Content Delivery Network such as Cloudflare, with caches scattered across geographical locations. Also, some popular web applications and frameworks like Drupal – a popular content management system – have a built-in cache.

Web cache poisoning is geared towards sending a request that causes a harmful response that then gets saved in the cache and served to other users.

Kettle’s research focused on looking at how it might be possible to poison caches using unkeyed inputs¹ such as HTTP headers. Other, likely less fruitful trickery, such as request smuggling [PDF] might also be possible, as Kettle is careful to note.

Cache poisoning isn’t an end in itself but rather a way to open the door towards the exploitation of secondary vulnerabilities such as XSS (cross-site scripting) in the unkeyed input. Done correctly, this creates a mechanism to cause a response that will execute arbitrary JavaScript against whomever attempts to view a particular resource on a targeted website through its cache.

In spite of its “fearsome reputation”, cache poisoning is often very easy to exploit, Kettle discovered when he began experimenting with the attack, exclusively targeting websites with researcher-friendly policies.

Mr Robot

The researcher said he was able to compromise Mozilla’s infrastructure and partially hijack a notorious Firefox feature², related to a badly thought-through add-on designed to promote hacking-themed show Mr Robot. The approach theoretically would have allowed Kettle to co-opt millions of Firefox browsers as a low-fat botnet.

The potential for mischief was somewhat curtailed by controls that meant only code signed by Mozilla could be pushed in this way but it nonetheless posed the potential to cause problems, as Kettle explained.

“The recipes used by Firefox were signed so I couldn’t just install a malicious add-on and get full code execution, but I could direct tens of millions of genuine users to a URL of my choice,” he said. “Aside from the obvious DDoS usage, this would be extremely serious if combined with an appropriate memory corruption vulnerability.

“Also, some backend Mozilla systems use unsigned recipes, which could potentially be used to obtain a foothold deep inside their infrastructure and perhaps obtain the recipe-signing key. Furthermore, I could replay old recipes of my choice which could potentially force mass installation of an old known-vulnerable extension, or the unexpected return of Mr Robot.”

Kettle reported the issue to Mozilla and it patched its infrastructure in under 24 hours but there was some disagreement about the severity of the problem, so the exploit only attracted a bug bounty of $1,000.

The researcher discovered problems in another direction after he expanded the header wordlist by downloading and scouring the top 20,000 PHP projects on GitHub for header names.

“This revealed the headers X-Original-URL and X-Rewrite-URL which override the request’s path,” Kettle explained. “I first noticed them affecting targets running Drupal, and digging through Drupal’s code revealed that the support for this header comes from the popular PHP framework Symfony, which in turn took the code from Zend.”

He added: “The end result is that a huge number of PHP applications unwittingly support these headers.”

These headers are “great for bypassing WAFs and security rules” as well as offering an avenue for cache poisoning, according to Kettle. If an application uses a cache, these headers can be abused to confuse it into serving up incorrect pages.

Unity through strife

One attack (which Kettle christened as “local route poisoning”) allows someone to replace a path with another path. The end result is that after sending this request, anyone who tries to access the Unity for Education webpage is liable to get a bit of a surprise.

Unity for Education gets a makeover through a variant of web cache poisoning

Other related security flaws create a means for hackers to override the query string. This, when combine with Drupal’s open redirect, created “building blocks” for hacker exploitation.

“We can combine the parameter override attack with the open redirect to persistently hijack any redirect,” Kettle explained, adding that pages on pinterest.com are among sites that are vulnerable.

Nested cache poisoning, a two-stage attack, was also possible. “If the site uses an external cache (like virtually all high-traffic Drupal sites), we can use the internal cache to poison the external cache, and in the process convert any response into a redirection,” Kettle explained.

The practical upshot, as demonstrated by Kettle, is that clicking “Download installer” on unity.com would download some opportunistic malware from evil.net.

This vulnerability was disclosed to Drupal, Symfony, and Zend in May. A security update is now available, and should be installed.

Kettle cited Mozilla and Drupal as particular examples during a well-received presentation at BSides Manchester in England on Thursday, which he delivered days after unveiling his research at Black Hat in Las Vegas, USA. Other projects also had cache weaknesses, and the response from them was mixed, he said in this blog post:

The response from my targets was mixed; Unity patched everything swiftly and rewarded well, Mozilla at least patched quickly, and others including data.gov and Ghost did nothing for months and only patched due to the threat of imminent publication.

Many of these case studies exploit secondary vulnerabilities such as XSS in the unkeyed input, and it’s important to remember that without cache poisoning, such vulnerabilities are useless as there’s no reliable way to force another user to send a custom header on a cross-domain request. That’s probably why they were so easy to find.

Here’s a video of his presentation at Bsides with more detail, if you’re interested:

Youtube Video

How to protect yourself

Kettle said that websites should either test to make sure they are not vulnerable or restrict the use of caching in order to avoid potential problems.

“The most robust defence against cache poisoning is to disable caching,” Kettle advised. “This is plainly unrealistic advice for some, but I suspect that quite a few websites start using a service like Cloudflare for DDoS protection or easy SSL, and end up vulnerable to cache poisoning simply because caching is enabled by default.”

“Restricting caching to purely static responses is also effective, provided you’re sufficiently wary about what you define as ‘static’,” he added.

Simply placing a cache in front of a website can take it from secure to vulnerable, Kettle warned.

“Web cache poisoning is far from a theoretical vulnerability, and bloated applications and towering server stacks are conspiring to take it to the masses,” Kettle concluded. “Web cache poisoning has long been an elusive vulnerability, a ‘theoretical’ threat used mostly to scare developers into obediently patching issues that nobody could actually exploit.” ®

Updated to add

A spokesperson for the Drupal Security Team has been in touch to say:

James Kettle reported this vulnerability to the Drupal Security Team. We found issues in some Symfony and Zend framework code that Drupal has as a dependency. Symfony and Zend project members worked with us to coordinate a release for those issues which we then packaged and released at https://www.drupal.org/SA-CORE-2018-005.

Bootnotes

¹Unkeyed inputs refer to parts of a request that a cache ignores, such as the type of browser a user is using, for example. An open source Burp Suite extension called Param Miner automates the process of identifying unkeyed inputs.

²Firefox maintained a list of “recipes” as part of its SHIELD system for silently installing extensions for marketing and research purposes. Mr Robot was among the products promoted using the approach, which triggered something of a backlash.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/08/17/web_cache_poisoning/

Common methods AD administrators use to protect their environments can easily be exploited. Here’s how.

No matter how many tools you buy or how many alerts flood the SOC, your security strategy is only as strong as its administration. If attackers can bypass an admin, they can own the system.

Administrator security was the crux of Sean Metcalf’s 2018 DEF CON talk, “Exploiting Active Directory Administrator Insecurities,” during which the Trimarc cofounder and CTO outlined the strategies admins are adopting to protect their environments and the flaws in their approaches.

Metcalf dove into current methods businesses are using to administer Active Directory, inherent weaknesses, and what defenders should be watching for. Examples included using read-only domain controllers in ways the organization doesn’t expect, exploiting access to agents installed on domain controllers and other privileged systems, and exploiting AD forests.

His idea was to provide insight for red teamers pentesting against organizations improving their defenses, as well as for blue teamers hoping to improve their Active Directory security.

Years ago, he explained, organizations had many admins and sometimes, user accounts doubled as domain admins. Every local administrator account had the same username and password, and some environments had nearly as many domain admins as they did users.

“Old school admin methods,” as Metcalf put it, meant logging into a workstation as an admin with credentials stored in Local Security Authority Subsystem Service (LSASS), running standard Microsoft admin tools with credentials in LSASS, and using RDP to log into the domain controller or admin servers for management.

It was “a target-rich environment” with multiple paths to exploit, he said. Now, admins are using newer methods like multi-factor authentication (MFA) and password vaults to protect their credentials so threat actors can’t gain access to their environments.

Sneaking Past MFA

There are a few ways for attackers to subvert MFA and gain Active Directory access, Metcalf explained.

“Yes, MFA is good,” he said. “But there are situations in which MFA can be bypassed depending on how it’s configured.” If an attacker knows how to switch authentication data, for example, they can enter their own phone number and have second-factor codes directly sent to their device without the administrator’s knowledge.

One of the interesting things about MFA is its onboarding process, he added, using a vendor’s authentication technology as an example. The tech works by connecting to an API; when someone connects and sees a prompt, it checks to see if that user can access a specific resource.

However, he continued, if a third party could compromise the admin account, they could have influence over that email so they could filter it out and/or add more devices. Metcalf presented a screen showing different integration options during the configuration process. For example, he explained, an attacker could configure an admin’s authentication so it could be bypassed while the user is offline, and/or uncheck the policy that requires authentication while logging in via RDP.

Metcalf recommended using MFA but advised attendees not to rely on it as the primary method for protecting admin accounts. Use hardware tokens or apps, he said, and disable SMS when possible. Ensure all MFA users know how to report anomalies when they see them.

“Remember that once an attacker has AD admin credentials, MFA doesn’t really stop them,” he noted. He advised correlating users to admin accounts and the workstation used by each admin, in order to make sure the proper person is in place ot be handling admin processes.

Password Vaults

Enterprise password vaults are another tool being deployed more broadly to improve admin security and maintain admin accounts, Metcalf continued. Many businesses include additional components like “Session Manager” to augment security in addition to the password vault.

He detailed several weaknesses in password vault configuration: authentication to the password vault’s Web server is usually done with the admin’s user account, and connecting to the server doesn’t always require MFA. Password vault servers are often administered like any other server and usually permit anyone on the network to send traffic.

Sessions on the server aren’t always limited, he continued, creating an opportunity for an attacker to create a new session. Combining the password vault Web server and password management system increases risk, and a flaw in the vault can lead to full AD compromise.

Metcalf pointed to vulnerability CVE-2018-9843 as an example. The flaw in the REST API of password vault software could potentially allow remote attackers to execute arbitrary code through a serialized .NET object in an Authorization HTTP header.

Related Content:

• 6 Eye-Raising Third-Party Breaches
• The 5 Challenges of Detecting Fileless Malware Attacks
• Active Third-Party Content the Bane of Web Security
• Overcoming ‘Security as a Silo’ with Orchestration and Automation

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info. 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/exploring-exploiting-active-directory-admin-flaws/d/d-id/1332593?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Network Computing
Darkreading

Raytheon Cyber Protection Solutions CTO Mark Orlando suggests under-resourced SOCs enhance their effectiveness at-scale by tapping the advanced cyber defense automation his company has developed.

‘);
}

‘);
}

Comments

‘);
}

‘);
}

Live Events

Webinars

More UBM Tech
Live Events

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

Cartoon Contest

Write a Caption, Win a Starbucks Card! Click Here

Latest Comment: Man, “I wish you to complete my GDPR compliance for me” Genie… “aaaaaa… no habla englis”

The Biggest Cybersecurity Breaches of 2018 (So Far)

Reports

The State of IT and Cybersecurity

IT and security are often viewed as different disciplines – and different departments. Find out what our survey data revealed, read the report today!

Bug Report

googletag.display(‘div-gpt-ad-961777897907396673-15’);

[close this box]
• Tweet This
• [close this box]



Article source: https://www.darkreading.com/operations/supplementing-the-soc-with-cyber-as-a-service/v/d-id/1332582?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

As companies pump more code into production at a faster pace, CA Veracode VP of Security Research Chris Eng stresses the importance of avoiding vulnerabilities by building security directly into the DevOps pipeline.

Article source: https://www.darkreading.com/application-security/building-security-into-the-devops-pipeline/v/d-id/1332583?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A new form of modular downloader packs the ability to download other modules and payloads.

Researchers have detected a new modular downloader in large campaigns primarily hitting financial institutions, where it may be planting the seeds for future compromise.

Proofpoint experts first observed multiple large email campaigns, each consisting of millions of messages, earlier this month. They noticed all led to the same “Marap” malware and shared common features with earlier campaigns linked to the threat actor TA505. The emails contained Microsoft Excel Web Query files, password-protected ZIP files containing the Query files, PDFs with embedded Query files, and Word documents containing macros.

Researchers say the modular nature of Marap lets actors add new capabilities or download additional modules after a system is already infected. They have so far seen it download a system fingerprinting module that performs reconnaissance, they write in a blog post.

This malware, the researchers’ report continues, is part of a growing trend of small, versatile malware which gives attackers more flexibility to launch attacks and detect systems that could lead to more damaging compromise.

Read more details here.

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info. 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/marap-malware-appears-targeting-financial-sector/d/d-id/1332594?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Network Computing
Darkreading

Ofer Maor of Synopsys Software Integrity Group describes how automated testing can non-intrusively pinpoint where developers may be inadvertently exposing data and/or violating compliance mandates.

‘);
}

‘);
}

Comments

‘);
}

‘);
}

Live Events

Webinars

More UBM Tech
Live Events

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

0 Comments

Cartoon Contest

Write a Caption, Win a Starbucks Card! Click Here

Latest Comment: Man, “I wish you to complete my GDPR compliance for me” Genie… “aaaaaa… no habla englis”

The Biggest Cybersecurity Breaches of 2018 (So Far)

Reports

The State of IT and Cybersecurity

IT and security are often viewed as different disciplines – and different departments. Find out what our survey data revealed, read the report today!

Bug Report

googletag.display(‘div-gpt-ad-961777897907396673-15’);

[close this box]
• Tweet This
• [close this box]



Article source: https://www.darkreading.com/application-security/ensuring-web-applications-are-hardened-secure/v/d-id/1332584?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Reversing Labs CEO Mario Vuksan contends that SOCs are overwhelmed by global threat intelligence, and can benefit more from a targeted “pull” model that focuses on YARA-type binary pattern matching.

Article source: https://www.darkreading.com/threat-intelligence/filtering-the-threat-intelligence-tsunami/v/d-id/1332585?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Illusive Networks CEO Ofer Israeli reveals how distributed deception technology can be as effective against insider threats as it is against outsiders, since it thwarts the lateral movement common to both.

Article source: https://www.darkreading.com/vulnerabilities---threats/using-threat-deception-on-malicious-insiders/v/d-id/1332586?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

While AI greatly enhances security, Securonix CTO Tanuj Gulati points out the need for predictable cost models that insulate SOCs from the variables of massive data volume and intense real-time processing.

Article source: https://www.darkreading.com/analytics/the-economics-of-ai-enabled-security/v/d-id/1332587?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple