Operations

7/16/2018
03:00 PM
50%
50%

10 Ways to Protect Protocols That Aren't DNS

Here's how to safeguard three other network foundation protocols so they don't become weapons or critical vulnerabilities.
Previous
1 of 11
Next

When an attack using a basic Internet protocol makes the news, it tends to focus on the Web, with either HTTP or DNS in a starring role. But history shows us that other protocols can be used as both weapons and doors for attacking vulnerable organizations.

Three different protocols — BGP, NTP, and FTP — are especially useful to threat actors looking to disrupt operations or steal assets from individuals and organizations. Recent incidents around cryptocurrency wallets show just how effective Border Gateway Protocol (BGP) hijacking can be as part of an attack plan. BGP's mystery, from most users' points of view, stems from its complexity and adds to the danger because most organizations only begin to work directly with BGP when their networks pass into the "very large" category.

Network Time Protocol (NTP) might seem like the sort of protocol that is merely convenient, allowing users to avoid listening for time announcements on the radio and typing the results into their systems, but everything from cryptography to file transfer depends on computers and network components getting authoritative time from a canonical server. This requirement makes NTP ubiquitous and valuable when it comes to wreaking havoc on a victim.

And while users tend to use HTTP far more than File Transfer Protocol (FTP) for moving files between systems, many applications and systems still use FTP as an essential mechanism. Because FTP is often used for transferring very large files, it becomes a powerful weapon when criminals are able to use it against a target.

"Stop using these protocols" isn't practical advice for most organizations; far too many applications and users depend on them to make abandonment anything but a very long-term solution — and in the case of BGP and NTP, no replacement is on the horizon. So it becomes necessary for companies to figure out how to protect the protocols so that they remain tools while not becoming weapons or critical vulnerabilities.

There are, of course, many ways to protect network foundation protocols, but a handful of suggestions may help spur thought and provide inspiration for moving defense forward. This list is intended to provide a jumping-off point for discussions on how an organization can protect itself and its Internet neighbors from harm through one of these protocols.

What steps has your organization taken to protect these essential protocols? If you have found a suggestion not on this list to be especially helpful, let us know in the comments, below. The online community is waiting to become more secure!

(Image: Tatiana Popova)

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Previous
1 of 11
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jon M. Kelley
100%
0%
Jon M. Kelley,
User Rank: Moderator
7/19/2018 | 12:01:23 PM
Too many tabs, too little info
THis is the first time this year that I've gone through one of DRs multitab "specials".  To be honest this post subject still explains why I skip them:  too many slow loading tabs, with almost no relevant text per tab. Tabs with less than 100 words - get real.  Maybe I'll try again near Christmas.
How Cybercriminals Clean Their Dirty Money
Alexon Bell, Global Head of AML & Compliance, Quantexa,  1/22/2019
Facebook Shuts Hundreds of Russia-Linked Pages, Accounts for Disinformation
Sara Peters, Senior Editor at Dark Reading,  1/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-15720
PUBLISHED: 2019-01-23
In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.
CVE-2017-17835
PUBLISHED: 2019-01-23
In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.
CVE-2017-17836
PUBLISHED: 2019-01-23
In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, weather it be via XSS or by leaving a machine unlocked can exfil all credentials from the system.
CVE-2018-15614
PUBLISHED: 2019-01-23
A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the Conference Scheduler Service that could affect other application users. Affected versions of IP Office include 10.0 through 10.1 SP3 and 11.0 ...
CVE-2018-20245
PUBLISHED: 2019-01-23
The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking.