Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

8/26/2010
03:27 PM
David Maynor
David Maynor
Commentary
50%
50%

The Case For Zero-Day Penetration Testing

Penetration testing is a tightrope act where you balance existing knowledge with a mixture of freshly released- and zero-day knowledge. As a penetration tester, I often hear the argument that zero-day attacks do not belong in a test, that there is no time to prepare for them, so of course the target will be compromised. But I have the exact opposite philosophy: zero-day testing should occur to gauge an organization's response to such an attack. If mitigating controls are in place, an unknown att

Penetration testing is a tightrope act where you balance existing knowledge with a mixture of freshly released- and zero-day knowledge. As a penetration tester, I often hear the argument that zero-day attacks do not belong in a test, that there is no time to prepare for them, so of course the target will be compromised. But I have the exact opposite philosophy: zero-day testing should occur to gauge an organization's response to such an attack. If mitigating controls are in place, an unknown attack should gain some level of access -- but not compromise the entire organization. This is the real value of penetration testing.My thoughts here on testing were more of a set-up to discuss an attack that was recently released. HD Moore of Rapid7 unleashed a devastating attack that can force a number of different applications to load malicious DLLs at startup. This is a trivial attack to execute and can give an attacker complete control of a victim's machine. There is a Microsoft hotfix for this, but I can assume that has been sparsely applied. This makes an enterprise ripe for compromise by a penetration tester.

The question I have been asked is if a tester uses this exploit and gains control of a machine, what does it mean? Does it mean your security is lacking, or that your update process is slow an inadequate? To me, it just means you have room for growth.

Take an example of using the Webdav exploit in a phishing attack where I am able to compromise a workstation. If I am able to do nothing else but poke around the workstation, gather network traffic, and attempt to trick other people into falling victim to the attack, then mitigating controls are working. If I am able to access to workstation and elevate myself to domain admin, add myself to the payroll, and write myself a check, multiple controls have failed.

The detractors that don't want these new attacks used in tests are often the ones surprised when a real attacker will use them in the wild. Good testing means using everything at your disposal, putting shackles on your tester just means you are putting shackles on your organization's ability to improve. So the "no zero day" penetration-test philosophy is about as useful as a "gun-free zone" at protection.

David Maynor is CTO of Errata Security. Special to Dark Reading

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Cybersecurity Industry: It's Time to Stop the Victim Blame Game
Jessica Smith, Senior Vice President, The Crypsis Group,  2/25/2020
5 Ways to Up Your Threat Management Game
Wayne Reynolds, Advisory CISO, Kudelski Security,  2/26/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9447
PUBLISHED: 2020-02-28
The file-upload feature in GwtUpload 1.0.3 allows XSS via a crafted filename.
CVE-2019-10064
PUBLISHED: 2020-02-28
hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.
CVE-2019-8741
PUBLISHED: 2020-02-28
A denial of service issue was addressed with improved input validation.
CVE-2020-9399
PUBLISHED: 2020-02-28
The Avast AV parsing engine allows virus-detection bypass via a crafted ZIP archive. This affects versions before 12 definitions 200114-0 of Antivirus Pro, Antivirus Pro Plus, and Antivirus for Linux.
CVE-2020-9442
PUBLISHED: 2020-02-28
OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10, which allows local users to gain privileges by copying a malicious drvstore.dll there.