{"id":10649,"date":"2017-11-29T06:00:38","date_gmt":"2017-11-29T14:00:38","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/11\/29\/news-4421\/"},"modified":"2017-11-29T06:00:38","modified_gmt":"2017-11-29T14:00:38","slug":"news-4421","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/11\/29\/news-4421\/","title":{"rendered":"Our Exposed World \u2013 How Exposures Translate into Attacks"},"content":{"rendered":"

Credit to Author: Natasha Hellberg (Senior Threat Researcher)| Date: Wed, 29 Nov 2017 13:00:41 +0000<\/strong><\/p>\n

\"\"<\/p>\n

One of the questions I am asked often is why am I not more concerned about sophisticated attacks? Why do I not deeply investigate new exploits as they are released? To which I reply \u201cbecause the old ones still cause more damage.<\/em><\/strong>\u201d After 30 years of looking at the security of networks, the main trend I see can be summarized in a stanza from an old poem I used to read, \u201cThe Calf Path\u201d <\/em>by American poet Sam Foss<\/a>.\u201d<\/p>\n\n\n\n\n
<\/td>\nA hundred thousand men were led<\/em>
By one calf near three centuries dead;
They followed still his crooked way
And lost a hundred years a day;
For thus such reverence is lent
To well-established precedent.<\/em><\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

We have protocols and computer code that were created when dial up computers and the move Wargames was in the theatres that have been rolled into newer technology, that then was rolled into other technology, and never did we go back and look at how vulnerable these older protocols and code were because \u201cwe\u2019ve always used them and nothing has happened so we must be safe.\u201d\u00a0\"\"<\/p>\n

Sound familiar? We also take technology and install it straight out of the box, not only leaving it insecure, but also without understanding how it might expose the other things around it. And the faster we have to move \u2013 because of lack of time, lack of resources, limited people \u2013 the more this is going to happen.<\/p>\n

This brings me to my love of looking at our exposed world. The key fact most people miss is that exposed devices <\/strong>on the Internet means potential devices that can be used in attacks<\/strong>. If we are lucky, the devices are not like I have described above, they have been both secured and locked down so it takes developing an exploit or brute force hacking to use them in these attacks. Unfortunately, based on the research Trend Micro\u2019s FTR team has done, we can see we are not that lucky. There are still hundreds of thousands of devices out on the internet that are vulnerable (which is to say, it\u2019s known how to break into them) or have absolutely no security on them whatsoever.<\/p>\n

My top 4 favorite example of these are the following:<\/p>\n\n\n\n\n
<\/td>\n\n
    \n
  • Ransomware \/ Wannacry-like attacks \u2013 attacks against network shares.<\/li>\n
  • Data Exposures \u2013 forget breaches, this is where we do it to ourselves.<\/li>\n
  • Device \/ Server Defacement \u2013 no hacking is needed if we leave the front door open.<\/li>\n
  • DDoS Botnets and Booters \u2013 we are helping them make their networks bigger.<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

So let\u2019s talk about these a bit further.<\/p>\n

\"\"WannaCry type attacks \u2013 attacks against Network Shares<\/u><\/em><\/strong><\/p>\n

In these types of attacks, the attacker is looking to move from network share to another network share in order to spread itself and do ransomware type attacks against the data it finds. What makes this attack worse is that there are many network shares that are exposed directly to the internet \u2013 in these cases the attacker doesn\u2019t even need to get a foothold into the corporate network (either via a phish or download of some kind) first before committing their attack.\u00a0 \"\"When last looked in May of 2017 there were 1.7M counts of SMB enabled devices (the protocol used to enable network shares) with exposed to Internet, with 24.9 percent of these in the US, 19.2 percent of these in the United Arab Emirates, and the rest distributed through the world.\u00a0 Worse yet, there were approximate 40K (13 percent in the US, 11.4 percent Germany) with all forms of authentication disabled. That means anyone with those internet addresses can connect to those shares without a user name or password, no exploit even needed in order to commit that attack.<\/p>\n

Data Breaches<\/u><\/em><\/strong><\/p>\n

\"\"Data exposed on the internet can come in a few different forms. The most obvious of these is Internet-facing databases. MySQL, ElasticSearch, PostgresSQL, MongoDB, SQL Service, and CouchDB systems can all be seen in Shodan. \"\"Any in just one of these database types, for just one country we could see over a terabyte of data exposed. Sadly the attackers know this too, and we can see many of the table names have been alerted to things like \u201cContact Me,\u201d \u201cWarning,\u201d \u201cPleaseRead,\u201d or \u201cWehaveyourdata,\u201d all suggesting many of these databases were subject to ransomware attacks known to have happened earlier this spring<\/a> and new ones were on the rise earlier this fall<\/a>.<\/p>\n

Another instance of exposed data is illustrated in our example of exposed network drives. These drives are only vulnerable to Ransomware as discussed previously, but the data on those network drives are also wide open for anyone to view. Forget attackers breaching the data when it\u2019s already open to the internet to read! I am sure some of that is by design, but the drive names one can see in the Shodan data suggests otherwise.<\/p>\n

The third means that data can be exposed is via NAS devices that are sitting open on the internet. At the time of writing, there were over 52.4K NAS devices of a variety of kinds sitting outward facing to the internet, many of which had no authentication enabled for either SSH or FTP (a common means of accessing these devices).<\/p>\n

Finally, it should be mentioned that any or all of these systems that either reside in Europe or contain information on a European citizen is soon to be subject to GDRP, whose fines for these types of exposures should more than given the average organization pause to reflect on how they are architecting their network.<\/p>\n

Server Defacements and Hacking<\/u><\/strong><\/p>\n

The most depressing aspect of studying exposed systems for a threat analyst such as myself is to observe how many servers themselves have doors that are wide open with no authentication. This is akin to leaving the door unlocked and wide open so people can walk in. We\u2019ve already used the example of exposed SMB but these again can also provide a pivot point into the rest of the corporate network when they are not only exposed to the internet, but also have internet network access at the same time. VNC is another older protocol used to create desktop and server connections, and the study found more than 3K of these on the internet with no authentication.<\/p>\n

The breadth of the problem can be seen by just looking at router names and web server titles via Shodan. The number of web servers now with the http banner header \u201chacked by\u2026\u201d is heartbreaking. \"\"In all three of these areas, these kinds of attacks could be made significantly harder if organizations focused efforts on some of the basics, as illustrated here<\/a>. Its been found that 80 percent of all attacks are because of something lacking in one of these Top10\u2019s \u2013 can we make it that much harder for the attackers please?<\/p>\n

DDoS Botnets and Booters<\/u><\/strong><\/p>\n

\"\"<\/p>\n

What\u2019s worse than exposed systems being used to attack a victim through is when these systems and devices are used to attack others. Most attacks these days, malware or otherwise, are \u201cbounced\u201d off of somewhere else, and this is especially true when it comes to DDOS botnets and booters (e.g. Mirai and the like). In the case of DDoS, there are very specific old network protocols that attackers like to use as part of their attacks to \u201cbounce\u201d or reflect these attacks.<\/p>\n

\"\"<\/p>\n

This is because these older protocols did not take into account security, and as such, they send back significantly more data than they receive, thus making them very efficient at flooding a system with input. Christian Rossow wrote an excellent paper<\/a> on how specific protocols (SSDP, NTP, DNS, SNMP, netbios, Chargen, QOTD) can be used to amplify denial of services attacks into larger attacks. When you combine these figures in with some of the exposures for these same protocols via Shodan, you can see the situation in terms of denial of service can be significant worse than what we are currently seeing.<\/p>\n

 <\/p>\n\n\n\n
\n

If we do not take the time to adequately address Internet Hygiene, both organizationally and privately, we ourselves are making it easy for attackers to attack ourselves and others. Like any business model, the harder it is to take action and the lower the return, the less likely the attack will happen.<\/em><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

http:\/\/feeds.trendmicro.com\/TrendMicroSimplySecurity<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Credit to Author: Natasha Hellberg (Senior Threat Researcher)| Date: Wed, 29 Nov 2017 13:00:41 +0000<\/strong><\/p>\n

\"\"One of the questions I am asked often is why am I not more concerned about sophisticated attacks? Why do I not deeply investigate new exploits as they are released? To which I reply \u201cbecause the old ones still cause more damage.\u201d After 30 years of looking at the security of networks, the main trend…<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10378,10413],"tags":[714,10421],"class_list":["post-10649","post","type-post","status-publish","format-standard","hentry","category-security","category-trendmicro","tag-security","tag-vulnerabilities-exploits"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/10649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=10649"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/10649\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=10649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=10649"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=10649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}