Addition by Subtraction: How
Networked Devices Affect your Security
Chris Campbell
BSidesPR
TL;DR
Network security can be improved by removing
security appliances and other devices which
introduce unnecessary risk.
Who am I?
Chris Campbell (@obscuresec)
Former Army Signal Officer
Security Researcher/Penetration Tester
Spoken at Derbycon, BlackHat, Shmoocon Firetalks,
BsidesLV
PowerShell fan and contributer to PowerSploit
Who do I speak for?
I do not speak for anyone but myself
This research was individually conducted and
should be considered free-search
Who are you?
Managers
Administrators
Auditors
Penetration Testers
Vendors
Students
Story Time
You never forget your first
Attack Diagram
Still Out There
ShodanHQ shows that they are exposed
What I Learned
Just because a product solves a security
problem doesnt mean it is secure.
Anyone can find vulnerabilities.
These types of devices are a perfect place to
hide from incident handlers.
Started Collecting
Remote Access Appliances
Cososys Endpoint Protector
McAfee Email and Web Gateway
EdgeWave Iprism Web Proxy
ForeScout Counteract
Barracuda Spam & Virus Firewall
Servgate Edgeforce M30
Celestix Scorpio RAS3000
Qualys Qualysguard Scanner
Bluelane Patchpoint
MRV LX Series Console Server
Avaya ASG Guard Secure Access
Server
Network and Monitoring Appliances
Infoblox Trinzic Network Services
Riverbed Steelhead
ManageEngine Opmanager
Alert-on-Failure (AOF) Enterprise
Mutiny Technology Mutiny
Appliance
Security and Firewall Appliances
Other Appliances
Google Search Appliance
Symantec Opscenter
InfoBlox IPAM
EMC Clariion
F5 Big-IP Appliance
Procurement
Craigslist, eBay and borrowed from friends
Fully-functional demos from vendor's
websites
Virtual appliance marketplace
Arent appliances expensive?
Storage Issues
Testing a New Device
Image (backup) HDDs and RTFM
Put in lab network (isolated)
Testing
Port scan with NMAP/NSE scripts
Look for known vulnerabilities with services
Login with default credentials
Looked for ways to gain root OS privileges
Identify features that could be used by an attacker
Before we move on, lets get real!
Your enterprise goes from this
To this
With 1 of these
Reasons to Attack Appliances/Devices
Powerful Linux OS
Ability to leverage Python, Lua, Ruby and Bash
Tools like Netcat, Nmap, TCPDump and others
Privileged network segment
Difficult IR environment
Admins probably dont even have root access
Best place to persist in an enterprise
What is an appliance?
Could be virtualized, but typically:
Out-dated server hardware (cheap)
Open-Source Operating System (Linux)
A few security tools
Web Application to manage and audit
Why your boss buys them
blocks both known and unknown attacks with
100% accuracy.
provides complete security protection against all
attacks.
protected against compromise by any potential
attackers.
operates without human intervention or manual
updates.
Example 1: Network Monitoring
Examine Open Ports
SSH is open, but we dont know the root
password
HTTP has default passwords
Where to find the default password?
What if I change the password?
Backdoor accounts with default passwords
Many appliances limit length and complexity
Lots of tools to brute-force (e.g. Fireforce)
Custom dictionaries are effective
Now What?
Easiest vuln to find is Cmd Injection
Commonly in troubleshooting utilities
Great for persistence on RO file systems
But how do you get Root?
Use Curl to pull down payload and execute
Since webapp is running as root we can
Thanks Juan!
Example 2: Security Appliance
Scan and Enumerate
Vulnerable FTP service
running
Web interface for
management
SSH is enabled but no
credentials provided
Different Approach: Ask
Support Procedures
Documentation revealed that remote access
was possible for remote support
Is the password static or derived?
What does it mean?
Script calculates sum of
each number in 10-digit
serial number
91 possible outcomes
SSH in and sudo to root!
Example 3: The Other Security
Isolate and Scan
Remote Access?
Backdoor?
Monitor the Device
Where are my passwords going?
Free Features!
Im sure my passwords are safe.
What to do from here?
Privileged Network Location
Server segment or VLAN could be trusted
Attack enterprise with PTH-Suite
Attacks against Administrators
Full access to servers is way worse than a normal XSS
Think malicious iframes or Java applets on every page
Admins arent browsing with elevated privileges are they?
Keylog /capture credentials
Domain Authentication
Password reuse to other networked devices
What is better than a XSS vuln?
XSS Features!
Recommendations
Don't immediately trust the vendor
Especially those that claim to stop unknown attacks with 100%
accuracy
Look at their security track record on security sites
Securityfocus, exploit-db and osvdb are a good start
No vulnerabilities disclosed != good sign
Assess your current appliances and evaluate demos of all
networked devices before purchasing
Ask to see previous security test results from the vendor
Use a systematic approach but think like an attacker
Look for vulnerabilities like those documented by OWASP
Document potential vulnerabilities and share your findings
Think about how you will sanitize and dispose of the device
Recommendations (2)
Segment them from your enterprise
Many organizations drown in data from continuous monitoring
Eliminating unfamiliar and untested architectures could improve
your overall posture: If you dont need them, get rid of them
Train yourself and your team
Do internal training (e.g. brown-bag lunches)
Attend and participate in security conferences like Blackhat and
Bsides
Read security blogs
Demand control
Ask if the vendor gives you root control before purchasing
Ask how the appliance stores passwords
If they don't, don't buy it
Until we make real security a financial priority, vendors wont fix
What did you do with that hardware?
Questions?
@obscuresec
www.obscuresec.com
Thanks to Matt, Josh,
Juan, Carlos, Skip & the
whole BsidesPR crew!
