Friday, April 29, 2011

When to burn a Zero-Day?

So I've often heard people say "Why would you waste a Zero-day on <insert something>?". And on the opposite end of using your Zero-day, you have the hoarders who simply collect them to keep in their back pocket. So the question remains, when is the appropriate time to actually use a Zero-day for legitimate purposes?

The primary impetus for this discussion was someone smugly claiming they would never use a zero-day in a hacking competition or CTF event. So I can understand that stance, however if your trying to win something like P0wn20wn or some other serious hacking competition why wouldn't you? Is that truly a waste of a good Zero-day if it brings you respect in the industry and potentially more consulting work? I don't believe so, however financially given the cost of exploit development it may be wasteful. I think it really depends on the exploit. I've heard that security research companies often task teams of individuals for months to years just to develop a great reliable remote exploit on a popular platform or application. That isn't cheap in terms of billable hours by any means. Financially it may make sense to sell your exploit, however as a whitehat and someone who is a fan of responsible disclosure I can't agree with this line of thought. The other option may be to leverage that exploit in your pen testing engagements. So how would that benefit the customer? Yes it may give you credibility, but if they can't do anything about it patching wise, then nothing is gained. I don't buy into that approach unless you as a pen tester can recommend a solid mitigation plan for the vulnerability you've exploited.

To wrap things up, unless you are specifically tasked to research and deliver a working exploit to a customer for their use, I think it makes the most sense to just follow the responsible disclosure methods. To the contrary, if you are trying to build up your credibility and/or consulting business then it may also make sense to use them in an engagement or competition. I still do not believe the customer is looking to be exploited by a zero-day without any mitigation possibilities, unless you can show them that the exploit is already being traded in the underground. In that case, it is not really your private exploit but a legitimate attack they need to prepare for.

Friday, April 22, 2011

What scares you more: APT vs Anonymous vs Wikileaks?

So the past few years have been very interesting in IT security as the amount of public disclosures have increased exponentially. Victims like Google, RSA, HBGary, Bank of America, etc and consultants like Mandiant, McAfee, and Verizon Business have provided more details then ever about the serious threats facing the public and private sector. Its almost coming to the point of information overload, and that's even after weeding out the FUD and sales talk.

So as a security leader in your company what keeps you up at night? First lets define the three "threats" I'm detailing. Yes there are still plenty of other big time threats like organized crime, however I'm keeping the list intentionally small and current.

First you have our beloved APT. I hate this term, its been polluted by the originators of the term, by the people who should know better calling it FUD, and by the sales/marketing folks. But its what we have to work with. APT, has various goals, but the noisiest among them is theft of intellectual property. The outcome of such attacks is also varied, however in the near term it can impact business negotiations and M&A activity and in the long term it turns whatever special sauce your company has into a commodity available to other companies that can likely do it cheaper than US/EU counterparts. Of the three, this is by far the hardest to detect and respond to. It takes a strong security leader with both a short term tactical plan and a long term strategic vision to effectively mitigate this threat.

Next you have the Anonymous threat. For this discussion, just assume Anonymous = Hacktivists. The first rule of dealing with Hactivists is do not underestimate them. HBGary did and they are paying dearly. Hactivists groups are so different its hard to categorize them, however they generally target your company for its perceived policies, ethics, actions, or political stances. Like other threats this requires a comprehensive approach to hardening your network with a particular focus on email and document security. The outcome of such attacks is immediately felt, as its routinely publicized. Having a proactive communications and legal team is crucial to dealing with this threat also. While it's not always the case, acting in a transparent and ethical manner could also alleviate these fears. But that might just be too much to ask many businesses! :-)

Finally, we have johnny come lately Wikileaks and the lot. There are several Wikileaks type sites and for this discussion we can consider them the disgruntled insider threat (FYI, and before you call me out on it, I'm aware that Wikileaks stole some documents via p2p). The outcome of this attack is very similar to Hactivists in that you have an immediate public relations nightmare. Countering insider threats is extremely difficult. In basic terms you cannot not stop a skilled, privileged insider. The upside is that they are the most likely to be caught afterwards and be convicted. Companies have to use that to your advantage. Aside from the typical controls like access logging, DLP, and DRM, there is a whole set of another controls companies don't use. You should routinely communicate to employees that they are being monitored and even demonstrate this capability at internal security/it shows. Do not show them every card you have up your sleeve, however show them that the deck is stacked against them if they try to steal company data. We know this not to be the case, in terms of prevention, but the psychological effect is real.

So while I'm not going in depth on countermeasures, I've generally outlined the threats. Yes, I'm not adhering to the precise definition of threats in all cases, but you know what I mean if you are in IT security. So how do you rate them?

C-Level Executives/Upper Security Management
1 - Wikileaks
2 - Anonymous
3 - APT

CIRT/IT Security
1 - APT
2 - Wikileaks
3 - Anonymous

These are my rankings of what I think and what I believe upper management thinks. As I thought about this, it almost correlates to what causes the most discomfort for the person involved. If you are an incident responder, you don't want advanced foreign CNE actors gliding through your network undetected. If you are an executive, you don't want to do anything the will jeopardize the stock price in the near term. Every company is different, so its not a one size fits all solution. It never is. However, in my opinion taking a long term approach to the defense of your computing assets is the way to go. There are NO silver bullets. Knee jerk reactions need to be avoided to ensure they don't hurt rather then help your company. Consistent security leadership along with a c-level security advocate is beyond important.

Stay secure my friends