Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

8/26/2010
03:27 PM
David Maynor
David Maynor
Commentary
50%
50%

The Case For Zero-Day Penetration Testing

Penetration testing is a tightrope act where you balance existing knowledge with a mixture of freshly released- and zero-day knowledge. As a penetration tester, I often hear the argument that zero-day attacks do not belong in a test, that there is no time to prepare for them, so of course the target will be compromised. But I have the exact opposite philosophy: zero-day testing should occur to gauge an organization's response to such an attack. If mitigating controls are in place, an unknown att

Penetration testing is a tightrope act where you balance existing knowledge with a mixture of freshly released- and zero-day knowledge. As a penetration tester, I often hear the argument that zero-day attacks do not belong in a test, that there is no time to prepare for them, so of course the target will be compromised. But I have the exact opposite philosophy: zero-day testing should occur to gauge an organization's response to such an attack. If mitigating controls are in place, an unknown attack should gain some level of access -- but not compromise the entire organization. This is the real value of penetration testing.My thoughts here on testing were more of a set-up to discuss an attack that was recently released. HD Moore of Rapid7 unleashed a devastating attack that can force a number of different applications to load malicious DLLs at startup. This is a trivial attack to execute and can give an attacker complete control of a victim's machine. There is a Microsoft hotfix for this, but I can assume that has been sparsely applied. This makes an enterprise ripe for compromise by a penetration tester.

The question I have been asked is if a tester uses this exploit and gains control of a machine, what does it mean? Does it mean your security is lacking, or that your update process is slow an inadequate? To me, it just means you have room for growth.

Take an example of using the Webdav exploit in a phishing attack where I am able to compromise a workstation. If I am able to do nothing else but poke around the workstation, gather network traffic, and attempt to trick other people into falling victim to the attack, then mitigating controls are working. If I am able to access to workstation and elevate myself to domain admin, add myself to the payroll, and write myself a check, multiple controls have failed.

The detractors that don't want these new attacks used in tests are often the ones surprised when a real attacker will use them in the wild. Good testing means using everything at your disposal, putting shackles on your tester just means you are putting shackles on your organization's ability to improve. So the "no zero day" penetration-test philosophy is about as useful as a "gun-free zone" at protection.

David Maynor is CTO of Errata Security. Special to Dark Reading

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11583
PUBLISHED: 2020-08-03
A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVE-2020-11584
PUBLISHED: 2020-08-03
A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.
CVE-2020-5770
PUBLISHED: 2020-08-03
Cross-site request forgery in Teltonika firmware TRB2_R_00.02.04.01 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
CVE-2020-5771
PUBLISHED: 2020-08-03
Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious backup archive.
CVE-2020-5772
PUBLISHED: 2020-08-03
Improper Input Validation in Teltonika firmware TRB2_R_00.02.04.01 allows a remote, authenticated attacker to gain root privileges by uploading a malicious package file.