4.3 Vulnerability Scanning Flashcards
Vulnerability scanning
Usually minimally invasive
– Unlike a penetration test
* Port scan
– Poke around and see what’s open
* Identify systems
– And security devices
* Test from the outside and inside
– Don’t dismiss insider threats
* Gather as much information as possible
– We’ll separate wheat from chaff later
Static code analyzers
Static Application Security Testing (SAST)
– Help to identify security flaws
* Many security vulnerabilities found easily
– Buffer overflows, database injections, etc.
* Not everything can be identified through analysis
– Authentication security, insecure cryptography, etc.
– Don’t rely on automation for everything
* Still have to verify each finding
– False positives are an issue
Dynamic analysis (fuzzing)
Send random input to an application
– Fault-injecting, robustness testing, syntax testing,
negative testing
* Looking for something out of the ordinary
– Application crash, server error, exception
* 1988 class project at the University of Wisconsin
– “Operating System Utility Program Reliability”
– Professor Barton Miller
– The Fuzz Generator
Fuzzing engines and frameworks
Many different fuzzing options
– Platform specific, language specific, etc.
* Very time and processor resource heavy
– Many, many different iterations to try
– Many fuzzing engines use high-probability tests
* Carnegie Mellon Computer
– Emergency Response Team (CERT)
– CERT Basic Fuzzing Framework (BFF)
– https://professormesser.link/bff
Package monitoring
Some applications are distributed in a package
– Especially open source
– Supply chain integrity
* Confirm the package is legitimate
– Trusted source
– No added malware
– No embedded vulnerabilities
* Confirm a safe package before deployment
– Verify the contents
Threat intelligence
Research the threats
– And the threat actors
* Data is everywhere
– Hacker group profiles, tools used by the attackers,
and much more
* Make decisions based on this intelligence
– Invest in the best prevention
* Used by researchers, security operations teams,
and others
Open-source intelligence (OSINT)
Open-source
– Publicly available sources - A good place to start
* Internet - Discussion groups, social media
* Government data
– Mostly public hearings, reports, websites, etc.
* Commercial data
– Maps, financial reports, databases
Proprietary/third-party intelligence
Someone else has already compiled the threat
information - You can buy it
* Threat intelligence services
– Threat analytics
– Correlation across different data sources
* Constant threat monitoring
– Identify new threats
– Create automated prevention workflows
Information-sharing organization
Public threat intelligence
– Often classified information
* Private threat intelligence
– Private companies have extensive resources
* Need to share critical security details
– Real-time, high-quality cyber threat information sharing
* Cyber Threat Alliance (CTA)
– Members upload specifically formatted
threat intelligence
– CTA scores each submission and validates across
other submissions
– Other members can extract the validated data
Dark web intelligence
Dark web
– Overlay networks that use the Internet
– Requires specific software and configurations to access
* Hacking groups and services
– Activities
– Tools and techniques
– Credit card sales
– Accounts and passwords
* Monitor forums for activity
– Company names, executive names
Penetration testing
Pentest - Simulate an attack
* Similar to vulnerability scanning
– Except we actually try to exploit the vulnerabilities
* Often a compliance mandate
– Regular penetration testing by a 3rd-party
* National Institute of Standards and Technology
– Technical Guide to Information Security
– Testing and Assessment
– https://professormesser.link/800115 (PDF download)
Rules of engagement
An important document
– Defines purpose and scope
– Makes everyone aware of the test parameters
* Type of testing and schedule
– On-site physical breach, internal test, external test
– Normal working hours, after 6 PM only, etc.
* The rules
– IP address ranges
– Emergency contacts
– How to handle sensitive information
– In-scope and out-of-scope devices or applications
Exploiting vulnerabilities
Try to break into the system
– Be careful; this can cause a denial of service or
loss of data
– Buffer overflows can cause instability
– Gain privilege escalation
* You may need to try many different vulnerability types
– Password brute-force
– Social engineering
– Database injections
– Buffer overflows
* You’ll only be sure you’re vulnerable if you
can bypass security
– If you can get through, the attackers can get through
The process
Initial exploitation
– Get into the network
* Lateral movement
– Move from system to system
– The inside of the network is relatively unprotected
* Persistence
– Once you’re there, you need to make sure there’s a way back in
– Set up a backdoor, build user accounts, change or verify
default passwords
* The pivot
– Gain access to systems that would normally not be accessible
– Use a vulnerable system as a proxy or relay
Responsible disclosure program
It takes time to fix a vulnerability
– Software changes, testing, deployment, etc.
* Bug bounty programs
– A reward for discovering vulnerabilities
– Earn money for hacking a system
– Document the vulnerability to earn cash
* A controlled information release
– Researcher reports the vulnerability
– Manufacturer creates a fix
– The vulnerability is announced publicly
