Defending The Castle Rwsp


Published on

The following paper was submitted as my thesis for the RWSP certification. Thought others may find interest in it.


Research indicates that current trends in information security threats outpaces the security controls that reduce and or eliminate information security vulnerabilities. This document examines the approach of achieving maximum information security defensibility, by utilizing effective offensive testing. Compared are the differences in the effectiveness of security testing by performing a controlled test – referred to as “vanilla” testing, and a responsibly orchestrated blackhat test. Contrary to popular industry belief, realistic “adversarial” testing can be accomplished in a responsible manner without the consequences of “bringing down the house,” contrary to popular belief. Offered, are arguments, costs associated with testing, and counterpoints against organizational decisions that disallow certain types of testing. Blackhat based testing is similar to what a malicious and structured attacker would perform and it is believed that by performing “blackhat” testing, we are taking a “realistic” approach to vulnerability testing. This is the proper route to take to ensure fully scoping the potential vulnerabilities in a given environment in an effort to maintain proper defensibility.

  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Defending The Castle Rwsp

  1. 1. Defending the Castle 1 Defending the Castle by Actively Abusing It Jesus OquendoC|EH, CHFI, OSCP, CPT IACRB, SGFA, SGFE Chief Security Architect AEON Inc. November 18th, 2010
  2. 2. Defending the Castle 2 AbstractResearch indicates that current trends in information security threats outpaces the securitycontrols that reduce and or eliminate information security vulnerabilities. This documentexamines the approach of achieving maximum information security defensibility, by utilizingeffective offensive testing. Compared are the differences in the effectiveness of security testingby performing a controlled test – referred to as “vanilla” testing, and a responsibly orchestratedblackhat test. Contrary to popular industry belief, realistic “adversarial” testing can beaccomplished in a responsible manner without the consequences of “bringing down the house,”contrary to popular belief. Offered, are arguments, costs associated with testing, andcounterpoints against organizational decisions that disallow certain types of testing. Blackhatbased testing is similar to what a malicious and structured attacker would perform and it isbelieved that by performing “blackhat” testing, we are taking a “realistic” approach tovulnerability testing. This is the proper route to take to ensure fully scoping the potentialvulnerabilities in a given environment in an effort to maintain proper defensibility.
  3. 3. Defending the Castle 3 Defending the Castle by Actively Abusing It.Introduction Between 2003 and 2006, retailer TJ Maxx suffered a breach where the data for 94million cards were stolen. [CON09] Similarly, Heartland Payment Systems was also breached[RAG09] yet the two given the green light for compliance from the PCI Security StandardsCouncil [PCI10]. Research has noted that collectively, the estimated cost of a security breach is6.75 million as of 2009 [MESS10] and the figure continues to rise. These respective companiesunder regulatory mandates from PCI were required to perform penetration testing. Ponemon institute noted "The magnitude of the breach events, according to the study,ranged from about 5,000 to about 101,000 lost or stolen customer records. Among the incidentsreported, the most expensive data breach cost nearly $31 million to resolve, and the leastexpensive cost $750,000." Using the “least expensive cost” figure of $750,000 as a budgetaryfigure, we will create a "red team" security testing team whose sole purpose is to provideadversarial testing in the effort to defend us in a realistic fashion.The goal is to provide the following:  gain a realistic view of our security posture  rise above the security baselines set by organizations  compare realistic testing versus vanilla / controlled testing  increase security testing effectiveness  minimize residual risks using focused, responsible and targeted testing  provide an insight into realized costs associated with testing, training versus a compromiseGuidelines and Recommendations Guidelines and frameworks mentioned in this document rely on standards predominantlyused in the United States of America. Other countries have their own regulatory frameworks,guidelines and laws. For example, in Europe, there is the Council of Registered EthicalSecurity Testers (CREST). Wikipedias entry for CREST is:
  4. 4. Defending the Castle 4 CREST is a non-profit association created to provide recognised standards and professionalism for the penetration testing industry [CRE10] My “vanilla” testing will rely on predominantly on NIST and ISECOMs OSSTMMstructures, of which NIST heavily borrows information, concepts and testing methods andparameters.SP 800-15 The National Institute of Standards and Technologies (NIST) created SP 800-115[NIS08] in 2008 which replaced 800-42. This standard laid the foundation for security testingand assessments. Throughout those documents, an assessor is given a testing framework,information on recommended security tools to use, rules of engagement and so forth.OSSTMM OSSTMM was developed by ISECOM which is a non-profit organization with acollaborative group of security subject matter experts who have collectively laid out the “OpenSource Security Testing Methodology Manual” otherwise known as OSSTMM. From theISECOM website: The Open Source Security Testing Methodology Manual (OSSTMM) is a peer- reviewed methodology for performing security tests and metrics. The OSSTMM test cases are divided into five channels (sections) which collectively test: information and data controls, personnel security awareness levels, fraud and social engineering control levels, computer and telecommunications networks, wireless devices, mobile devices, physical security access controls, security processes, and physical locations such as buildings, perimeters, and military bases. The OSSTMM focuses on the technical details of exactly which items need to be tested, what to do before, during, and after a security test, and how to measure the results. New tests for international best practices, laws, regulations, and ethical concerns are regularly added and updated. [ISE10] Much information has been published by both NIST and ISECOM on the subject oftesting; how the tests are to be performed, what is to be performed during the testing phases,what tools should be used in the testing phases, how those tools should be used and so forth.Yet both organizations fail to accomplish obtaining a real world view of the security posture of anetwork and or target system. This is primarily because of the prohibitive “controls” theyconvey in the choice of wording and perhaps, unsubstantiated fears, due to a lack ofunderstanding that, certain parameters that can be configured with most tools to minimize risksof inflicting damage during testing.
  5. 5. Defending the Castle 5Overview of Security ToolsImmunity Canvas [CAN10] Canvas is an automated exploitation program that allows its users to use existing exploitsas well as develop their own exploits. The application is written in Python and can be deployedfrom Windows, Linux and OSX platforms. Currently there are over 400 reliable exploitsavailable in Canvas.Metasploit Community [MET10] Metasploit is a penetration testing framework which currently consists of 613 exploits,306 modules, 215 different payloads and can be used on most operating systems. Metasploit canbe used in a Java-based GUI or via a command line terminal which makes it a very attractivealternative to Canvas. Because of the structure of Metasploit, a penetration tester can get thisapplication deployed onto a smart phone [MOO10] which could allow for minimal physicalsecurity detection in perhaps a controlled environment.GFI LANGuard GFI LANGuard is a network security scanner and vulnerability management solution. Ittoo relies on "known" patches to determine vulnerabilities. GFI is marketed as an application toassist in the following areas:  Patch management  Vulnerability management  Network and software auditing  Assets inventory  Change management  Risk analysis and complianceAcunetix Web Vulnerability Scanner Acunetix Web Vulnerability Scanner is a web-application based scanner. It is targetedspecifically for HTTP web based servers and allows for deep analysis of applications running ona web server. Unlike GFI LANGuard, it is capable of discovering vulnerabilities inside of anapplication running on a web server whereas LANGuard cannot perform these intricate tests.
  6. 6. Defending the Castle 6Overview of the Test Production System My test production system consisted of a Windows 2003 Advanced Server R2 running anopen source Enterprise Resource Planning (ERP) and Customer Relationship Management(CRM) application called OpenTaps [COM10]. In my production set-up, there were a fewMicrosoft security patches that needed to be omitted in order to allow clients to connect to theEnterprise CRM. Networking consisted of two network interfaces, one assigned a private RFC1918address and the other, a public address to enable remote customers and workers the ability to usethe system. Testing will include an adversarial test from the outside scope – what an attackerwould see via the public view – and an internal adversarial test – what an attacker would see ifthey were an insider, or if the attacker compromised another machine inside the infrastructureand targeted the ERP/CRM server. Using these different types of tests, we can conclusivelyillustrate the discrepancies in testing and how by following the guidelines and methodologies, atester will yield many false positives that will skew the outcome of their tests.Corporate Vulnerability Assessment Many corporations lack an in-house “red team” and often solicit the services ofcompanies that provide these types of security tests. It is observed that in many industries,companies dislike “real world” testing against the infrastructure. For example: "Certain kinds ofsystems should almost never be subjected to live penetration testing," [CLE08]. While this maybe the case for specific industries such as SCADA [SCA10], security managers have oftenfollowed this train of thought throughout many industries often prohibiting realistic testing. Mytest begins with what I call a “vanilla” vulnerability/security test, using two commercial off theshelf (COTS) applications found in most enterprise environments, GFI LanGuard and IBMRational AppScan version 7.7Whitebox using GFI LANGuard GFI LANguard was launched against the external IP address. Due to the placement of theserver, a firewall filtered the majority of simulated attacks which were based on signaturesavailable in GFI. From the outside scope – according to GFI LANGuard – we have a wellprotected system as it returned no high or medium vulnerabilities. The result is rather obvious asmost firewalls are deployed with “block all” and “allow trusted” rules, with most ports beingfiltered. To a security management team, there is a high likelihood this server would be flaggedas “secure” based solely on the output of this type of “vulnerability test.”
  7. 7. Defending the Castle 7Full Scan via External IP without credentialsFull Scan via External IP without credentials
  8. 8. Defending the Castle 8 As shown in the images above, we have a false positive in the results. This statementcomes from the fact that simply running a database server (MySQL) is not a vulnerability.While it may be improper to design a server in this method, it is not uncommon to disallowaccess to the database server from external sources, but the mere fact that a database is running,is not necessarily a vulnerability. Should the database have “known vulnerabilities” which couldbe exploited, it would then be problematic. However, I ran the same GFI LANGuard scan against the internal IP address along withcredentials and it yielded a variety of vulnerabilities. Performing this scan is the equivalent of an“insider” attackers point of view. Output from this type of scan is more critical than an externalpoint of view. I state this in the sense that an insider threat is more dangerous than an outsiderthreat – as the insider will always have more visibility of the true security state of the system.This (external) scan is closer to the “real world” security view of the server. Full scan with credentials against the Internal IP
  9. 9. Defending the Castle 9 Full scan without credentials against the Internal IP As security professionals, the need to perform the two types of testing (internal andexternal) at all times is critical - as all threats need to be determined – both internally andexternally. The goal of an internal scan is to reduce the potential exploitation of a client sideattack - not necessarily to mitigate the threats from insiders who physically work inside of theinfrastructure. By relying solely on an outside “security” point of view, results will not beaccurate and a skillful attacker may exploit a client side vulnerability. Internal security risks canallow an attacker to take complete control of a server just as outside facing risks would also givean attacker control. However, the vulnerabilities listed on GFI LANGuards report should beviewed with skepticism. GFIs output relies on the availability of a port being opened, closed ora revision number. It then correlates this information to label something as a “vulnerability.”Simply running an application is not a vulnerability.” This scanner and others like it will often yield both false positives and false negatives asGFI LANGuard is not capable of validating whether or not an application or service isexploitable. While it may be bad practice to configure servers in a certain fashion, for example:placing a DB server publicly facing the Internet, the mere fact that a service is running does notmake that service a vulnerability. By relying on skewed information such as this (false positivesand false negatives), security managers may spend unnecessary money towards defending aserver simply because a port is opened or a service is running, yet is not exploitable.
  10. 10. Defending the Castle 10Whitebox using Acunetix Web Vulnerability Scanner Acunetix was configured to perform two similar assessments from the web applicationside of the spectrum. The parameters chosen for the first Acunetix test was an “internal facingweb application scan” with Acunetixs “Extensive” test being chosen, and no credentials given.Acunetix is capable of performing functions above a typical scanner in the sense that it allowssorting out of many false positives as it is programmed to ignore and or learn about. Theapplication also performs SQL injection tests, parameter manipulations, Cross Site RequestForgery (CSRF) and other port scanning tests. Our goal in performing this internal scan,“without” credentials, is to mimic what an outside attacker may be able to access should theyuse this tool. Our testing yielded no high or medium vulnerabilities. In our first test, we simply aimed the vulnerability scanner as if we were a “drive-by”attacker with no knowledge of the system. The goal was to re-create what a random attackerwould see in the event they stumbled onto the system. The results were negligible with novulnerabilities being found. In our second test, we supplied the scanner with the credentials of anormal user. This served two purposes: the first was to determine what, was possible for arogue employee to access based upon a privilege escalation attack, and the second would besimilar to an attacker who had “phished” credentials, or perhaps bruteforced an account on thesystem. Both tests resulted in similar reports a “Clean Bill of Security Health.” My testing thus far has used applications currently in use in many environments. I alsofollowed the same “responsible” structure as alluded to in the aforementioned frameworks(OSSTMM, NIST). Operating continued without incident on the operating system – the machinewas not “taken out” and there were no discernible performance issues with normal tasks. Inother words, the system operated transparently while the testing was performed.Adversarial Outsider Attack My “adversarial” outsider attack began quite differently as I sought to perform a “realworld” test without the limitations of timing variables within tools, what tools I would use andhow far I would go to get into the system. It is my belief that as a simulated attacker responsiblefor the defense of the system, I need to know what an attacker can see realistically. In myopinion, there is no real world security value to “sanitized” testing as I have explained. Sometools report false positives and false negatives and these results can skew security metrics whichcan lead to wasted security dollars and false representations of security.
  11. 11. Defending the Castle 11 It is my belief that a rogue attacker will not likely spend much money on security toolsand there are plenty of “point and click” exploitation tools available on the market - Core Impact,Immunity Canvas; however, these tools can cost tens of thousands of dollars. The other optionsavailable would be for an attacker to create their own tool or use “community based tools.”These tools are usually open source based tools available for download and use within theparameters included in the licenses when applicable. I also must clarify that there are different types of malicious attackers. There is a typical“drive-by” like attacker which usually searches for the “low hanging fruit” to exploit. Theseattackers seem to aim random tools at random target in the hopes that something is found. Theother type of attacker is the “structured” attacker. This can be a foreign government, acompetitor, a former employee or former partner. Whomever the “structured attacker” is, thereis a likelihood that they would be the attackers, who with a budget, and or more informationavailable, would perform a targeted attack. They are likely to be the more successful and covertattacker. My goal is to test as both a random attacker and a “structured attacker.” My goal is toinfiltrate the infrastructure no matter what the cost. I performed this phase of testing bothrecklessly and responsibly for a few reasons. First, this allows me to test incident response if anyis in place. During the course of an attack, bells should be ringing and alarms should besounding. Secondly, from a real world perspective, if any system is unstable, there is analtogether different issue that would obviously need to be addressed. Any attacker will not carewhether or not a service is rendered inoperable. An attacker would aim their tools at a target andtry their best to get in. Furthermore, in real world testing, I prefer performing real world adversarial tests and Ialmost always choose not to give notification to anyone outside of a “need to know” basis. Thisenables me – the tester - to perform a realistic test without the possibility of an administratortrying to tidy up prior to my testing. It has been observed that security assessments and auditingbring connotations of “pointing a finger.” Administrators and operators of systems can feel as ifthere will be some form of repercussion if a vulnerability is found. This attitude and orconfusion often leads to an administrator or operator trying to defend against the tester. Ifsuccessful at defending against the tester, the operator then in turn creates an even biggersecurity issue. The tester is blocked but perhaps an attacker isnt.Adversarial using Metasploit Metasploit was launched against the ERP/CRM server using a module called “autopwn.”Autpwn is an automated exploitation module that works by associating available exploits withopen ports. Unlike the commercial tools, metasploit doesnt necessarily rely on credentials. Withor without them, the tools core value consists of many publicly available exploits which are used
  12. 12. Defending the Castle 12by “real” attackers in compromising systems. It is a very refined tool with cutting edge exploitsupdated by a community. I performed the same parameters for testing, from inside the perimeter and outside theperimeter. This type of testing always yields different results, yet the bottom line is the same,exploitation from within the network should not be viewed differently from exploitation outsideof the network. The initial launch of metasploit occurred from an internal address aimed at the ERP/CRMsystem:msf > db_driver sqlite3[*] Using database driver sqlite3msf > db_connect opentaps[*] Creating a new database instance...[*] Successfully connected to the database[*] File: opentapsmsf > db_nmap -P0 -sV -O -sS Nmap 5.00 ( ) at 2010-11-17 16:29 ESTInteresting ports on shown: 988 closed portsPORT STATE SERVICE VERSION80/tcp open http Microsoft IIS httpd135/tcp open msrpc Microsoft Windows RPC139/tcp open netbios-ssn445/tcp open microsoft-ds Microsoft Windows 2003 microsoft-ds1025/tcp open msrpc Microsoft Windows RPC1057/tcp open unknown1061/tcp open unknown1099/tcp open unknown3389/tcp open microsoft-rdp Microsoft Terminal Service8009/tcp open ajp13?8080/tcp open http Apache Tomcat/Coyote JSP engine 1.18443/tcp open https-alt?Device type: general purposeRunning: Microsoft Windows 2003OS details: Microsoft Windows Server 2003 SP1 or SP2Network Distance: 1 hopService Info: OS: WindowsOS and Service detection performed. Please report any incorrect results at .Nmap done: 1 IP address (1 host up) scanned in 107.67 secondsmsf > db_autopwn -p -t -e -r--> OUTPUT OMMITTED[*] (342/342 [0 sessions]): Waiting on 7 launched modules to finishexecution.
  13. 13. Defending the Castle 13 Metasploit was unable to compromise our system. This is a bonus on the defensive sideof our security aspects, it is not an easy target being that Metasploit has hundreds of securityexperts constantly submitting valuable exploits against all types of applications and operatingsystems. One of the benefits of testing with Metasploit versus commercial tools is that thereseems to be more effort placed into creating exploits as well as the amount of exploits availableversus commercial systems. Commercially written “vulnerability” tools will always stress the need for structure,reliability and the need to “not bring down the house.” The mechanisms used to develop thesignatures in commercial tools tend to search for known exploits that have been assigned a“CVE” number from the MITRE Corporation. CVE from their website is explained as: “adictionary of publicly known information security vulnerabilities and exposures.” [CVE10]Common logic dictates that an attacker is not going to wait for a CVE number in order to use aspecific attack, attack methodology, etc., but rather, attack a system in an effort to gain afoothold. Metasploit was then run from “outside the perimeter” and was unable to get past thefiltered ports due to a firewall in place. From a security management and risk assessmentperspective, the system so far seems to have a clean security bill of health.Adversarial using CANVAS My secondary test mimics a “structured” attacker that is focused on compromising aninfrastructure. An attacker who may have the financial capability of purchasing professionalgrade exploitation tools. The tool of choice was Canvas for its ease of use, functionality, speedand its programming capabilities. Canvas is a commercially developed exploitation application written by a company thatfocuses strictly on exploitation. Personal experience demonstrate that these types of companiesthat have a sole purpose, often put out the most rigorous and accurate tools. It is their primesource of revenue, and the Canvas authors are some of the most prominent experts at developingexploits that target unique applications and operating systems. One of the main differences between a tool like Canvas and Metasploit is the targetaudience. Metasploits community edition was originally tailored for security engineers, security
  14. 14. Defending the Castle 14hobbyists and security testers. While this approach is clever in the sense that many can engage isproactive exploit development, it also leads to many exploits for programs that may not be usedin an enterprise environment. Canvas authors seem to focus on “high value” targets. By this wemean, a vast majority of the exploits found in Canvas are often geared to exploit enterprisesoftware; e.g. SAP, Microsoft, Apple, IBM, etc. Canvas was launched under the premise of a focused attacker intent on gaining access.Our test also was two-fold; internal and external security postures. Our external testing resultswere similar to all other tools. Any assessor would give the ERP/CRM a clean security bill ofhealth. Were I to provide CVE scoring in comparison to the realities of vulnerabilitiesdiscovered, the numbers may as well be zeroed out. To date, nothing aimed at the ERP/CRMseemed to be capable of compromising the server. Internally targeting the server however, wasan entirely different case. Not only was Canvas capable of compromising the server, it did so ina whopping 20 seconds. Canvas was completely transparent to the normal operations of the server. Had Imanaged to get a hook inside of the network, I can conclusively state that the “clean bill ofhealth,” given by all other security tools and testing was “not so clean” after all. This in itselfposes a dilemma. If an attacker cant get in, there is no potential to compromise a server, device,etc.. While a tester, manager, assessor, et al, post the same argument, the reality is that withthe rise of “client side attacks” all avenues of risk must be assessed.
  15. 15. Defending the Castle 15 Canvas via External TestCanvas Internal Exploitation
  16. 16. Defending the Castle 16Conclusions We can gather a few conclusions about the variances in tests and the effects ofperforming multiple tests. By solely relying on the output of “vanilla based” testing from thecommercial offerings, one can never obtain valuable security metrics. Many assessors rely onthis kind of output when creating a risk based score, in fact many PCI assessors choose to relyon the output of an “external scan” which we have shown cannot detail true exposure. In mytests, I used the same commercial grade tools cherished for their “security prowess.” All of thetools tested, both commercial and open source, effectively performed as they were programmedto. Not one tool in my testing disrupted the server in any shape form or fashion. Not one tool“brought down the house.” Reliance on a single sided point of view – the external security posture – must never beused as the de-facto guideline for an organization. The results always differ and the testingshould differ in order to reflect the true nature of all security risks. These security risks will notcome solely from a wandering “drive-by” attacker, but they may also come from an insider.Whether this insider is physically an insider, or an insider who was subjected to a client sideattack. Performing “blackhat” like testing does not always lead to “bringing down the house.”On the contrary, skillful attackers have been careful in their exploits programming that theyoften try to code exploits that avoid “crashing the system.” An attacker is going after acompromise, access to a system for whatever purpose; corporate espionage, data exfiltration,etc. Risking detection by way of or via a system crashing, through the use an unreliable exploit,is something attackers are steadily crafting. Against this can the comparison of a bank robberthrowing a brick through a window. Why would they risk it after all the reconnaissance,planning, etc.? It makes more sense for an attacker to use validated exploits to gain a foothold,than it would be to use tools that set off bells and whistles. Exploit developers have an interesting way of modifying code and are almost alwaysimplementing changes that make exploits more lethal the longer the exploits are around. Forexample, a comment from “Linux 2.6.30+/SELinux/RHEL5 Test Kernel Local Root Exploit0day” states: “A vulnerability which, when viewed at the source level, is unexploitable! Butwhich thanks to gcc optimizations becomes exploitable.” [EXP10] Along with explanations ofexploits from the commercial vendors:
  17. 17. Defending the Castle 17 MICROSOFT WINDOWS PRINT SPOOLER OVERFLOW ARCH: [[Windows, 2000]] MSADV: MS09-022 SITE: Remote TYPE: Exploit CVE NAME: CVE-2009-0228 VENDOR: Microsoft REPEATABILITY: One shot NOTE: A string is non-zero terminated after a wcsncpy(), ending up in a miscalculation before a wcsncat(). This is kind of like an uninitialized variable issue, and thus reliable code execution depends on the content of the stack. This version of the exploit triggers the bug, but will not be extremely reliable. This exploit requires “root” privileges since it starts a fake SMB server on TCP port 445. There is a 4-byte difference in the stack layout if MS08-062 is not installed, making the exploit fail. The theory that “tools that cause chaos” and “will bring down the house” should bereviewed on a case by case basis. Organizations must learn to educate and trust their securitystaff enough so that their testers can use realistic tools in a responsible fashion. This includestheir staff fully understanding what functions the tools perform, how they perform their tasksand what are the potential outcomes of running the tools. Most exploit developers categorizetools which render systems useless as “denial of service” tools. Commenting inside of most codeexplains what a particular tool can do and many times there will be mentions of the reliability ofmost tools. However, it is ultimately up to the tester to perform their due diligence byperforming not only responsible testing, but accurate testing. Any other “scaled down” testingwill always be inaccurate. Our dual method of testing (internally and externally) provided four distinct sets ofresults. All of which must be addressed as there is real risk associated from two distinct sides ofthe spectrum; the internal threat and the external threat.
  18. 18. Defending the Castle 18 COTS Based TestingInternal Vanilla Test GFI LanGuard 1 Warning 0 vulnerabilities(no credential)Internal Vanilla Test Acunetix Web Vulnerability Scanner 0 Warnings 0 vulnerabilities(no credential)External Vanilla Test GFI LanGuard 5 vulnerabilities (1 critical)(low level credential) 3 potential vulnerabilitiesExternal Vanilla Test Acunetix Web Vulnerability Scanner 4 warnings 0 vulnerabilities(low level credential) Red Team Test No RestrictionsInternal CompromiseMetasploit Community EditionNo vulnerabilities exploitedExternal CompromiseMetasploit Community EditionNo vulnerabilities exploitedInternal CompromiseImmunity CanvasCompromise in 20 secondsExternal CompromiseImmunity CanvasNo vulnerabilities exploited Organizations face an uphill battle defending against attackers and perhaps this is due to alack of understanding of the nature of an attacker. An attacker will use many different tools andwhile I theorize that a “drive by” attacker will not having the financial backing to purchase“professional grade” exploitation applications such as Core Impact or Immunity Canvas, thethreat should not be minimized. As a drive by attacker without the financial backing, there are no available, plausible,metrics to discuss; this kind of attacker will use whatever tool is available and functions. Theywill not care whether or not a tool crashes an application, they will stay aim at the target. Oftenafter the fact, there will come the realization of a compromise but by then, it may be too late.Something to ponder as an attacker “didnt bring down the house” yet successfully managed tocompromise an infrastructure. Structured attackers may have the financial backing to purchasehigh end tools and most often will as the benefits of those tools outweigh their costs. There is nological reason that a company should not do the same. Organizations should have and utilize thesame tools as not only the hobbyist, but of those used by the professionals.
  19. 19. Defending the Castle 19 The realized cost of purchasing Core Impact, Immunity Canvas, GFI LANGuard andAcunetix for the testing is far lower than the cost of a compromise. Some vendors listed do notprovide pricing on their websites however, I have listed the prices that were disclosed to me indiscussions. Along with the pricing for applications, I have also included a base salary for twofull time security testers and the pricing on constant training for the employees. Applications Tool Pricing Immunity $3,500.00 (estimated) No IP restrictions Canvas GFI $32.00 main price 10-24 IP addresses [GFP10] LANGuard Core Impact $9,000.00 per quarter (unrestricted license) (take note, pricing $10,000.00 per year per 8 IPs (single installation) is based off a quote from 2008) Acunetix $4,995.00 perpetual license WVS Total $17,527.00 (with Cores per quarter license) $18,527.00 (with Cores per year license) Salaries $173,418.00 Two full-time Penetration Testers (highest available salary): [PAY10] Training (provided for both employees) $8,738.00 SANS GPEN Training (onDemand) ($3,870 training, $499.00 exam x 2 employees) $7,000.00 IACRB Advanced Penetration Testing $4,000.00 Peak Security Real World Security Professional training My estimated pricing totals $211,683.00 for two employees and provides them withcutting edge applications and training. Managers may view the numbers initially and scoff at thehigh price however, the costs associated with a compromise as mentioned in the beginning aremuch greater: “$31 million to resolve, and the least expensive cost $750,000” Addressing security can be costly. But we have proven that security can be achievedeffectively from a cost perspective, provide realistic based attack capabilities, and finally,testing can be accomplised without bringing down the house. I abused my ERP/CRM server no
  20. 20. Defending the Castle 20differently than a real world attacker would using the same tools and methods. In fact, I went astep beyond and attempted to abuse the system with the information of an “insider” attacker –someone authorized to work on the server attempting to abuse the system. At no time was thesystem degraded and ultimately the results show a need to perform multiple tests from differingaspects of an attackability perspective.
  21. 21. Defending the Castle 21 References[CON09] "TJ Maxx Settles Data Breach Charges." June 23, 2009. URL:[RAG09] Ragan, Steve. "Does the Heartland breach prove PCI useless?" Jan 26, 2009. URL:[PCI10] PCI Security Standards Council. URL:[MES10] Messmer, Ellen. “Data breach costs top $200 per customer record” Jan 25, 2010. URL:[MOO07] Moore, HD. “A rootshell in my pocket (and maybe yours).” Sept 25, 2007. URL:[COM10] Compiere[CLE08] Clem, John. “Red Team Versus Blue Team: How to Run an Effective Simulation”[SCA10] “Supervisory Control And Data Acquisition”[NIS08] “Technical Guide to Information Security Testing and Assessment”[ISE10] “Open Source Security Testing Methodology Manual”[CVE10] “Common Vulnerabilities and Exposure”[EXP10][GFP10] LANGuard Pricing[PAY10] “Salary Snapshot for Penetration Tester Jobs”[HON10] “Client Side Attacks”