During penetration tests, and especially scoping calls, we often get quizzed about what secret, proprietary techniques we’ll use to gain access to privileged resources. Most folks assume they’re doing “good enough” or at least meeting “industry best practices” so only the latest, unknown attacks will be successful. The notorious ZeroDay always seems to take the top spot in many organizations’ threat matrix. Fortunately, that’s not realistic.
Last month Rob Joyce spoke at the Usenix Enigma conference in San Francisco. Rob is the head of the NSA’s Tailored Access Operations (TAO) hacking team. These guys are the American version of Mandiant’s APT1 in China. It’s their job to gain access to the systems of foreign nations. During his talk, Rob discussed how they go about their work, and lessons that businesses should learn from their experiences.
In several ways, their attack process is very similar to those of a good penetration test. Rob talked about the detailed reconnaissance phase in which they seek to know the network “better than the people running it.” Seeking out available information about the people, processes, & technologies in a network should be part of any good pen test. Part of that recon includes scanning the network, mapping out systems & services, looking for openings that may be exploitable.
“A lot of people think the nation states are running on this engine of zero days… There are so many more vectors that are easier, less risky, and more productive than going down that route.” Later he shared that “You know the technologies you intended to use in that network. We know the technologies that are actually in use in that network.” Similarly, in most of our pen tests, the issues that allow us to gain access are rarely a new fancy attack as opposed to chaining together common flaws that are often unknown to the organization. Rob shared that one required key to good security, and to defending against any attacker, is to know and understand your network and systems extremely well. He suggested common best practices such as regular scanning, penetration tests, and table top red teaming to discuss and familiarize yourself with every aspect of your network.
However there are a few critical differences between a TAO engagement and a standard penetration test that are important to realize. And understanding these differences is key to scoping out & receiving a good penetration test. An attack by a nation state is an active, live-fire event; not an exercise. Conversely, a penetration test is an exercise designed to educate. So even though many of the techniques outlined and used by Rob’s team are similar, their purpose is not.
The first major difference is the scope of the engagement. Every penetration test has limitations on the scope of the assessment, many of which are are very reasonable. For example targeting the personal email accounts or home networks or employees during an education test is both illegal and unethical. Oftentimes though scope limitations are introduced for other reasons. Perhaps the business won’t accept the additional cost, or a compliance-driven test is focused only on checking a box on a form for auditors. In most cases, the fewer restrictions placed on an assessment, the more successful it will ultimately be at painting a true picture of risk exposure.
A second key difference between an APT attack and a pen test is the amount of resources afforded for the assessment. Rob spoke of having copies of known software and experts in those systems that often know more about the technologies than the administrators themselves. Every firm and pen tester has a range of experiences and a network of colleagues that can be leaned on for support when attacking unfamiliar systems, but no private company can rival the checkbook of the U.S. government. For this reason, we strongly recommend against black-box testing which is both impractical and ineffective. I mentioned previously that a pen-test is an educational opportunity that should provide as much benefit as possible to the organization. A black-box test inherently limits that transfer of knowledge. Alternatively nearly all of our tests are gray-box tests in which we utilize the existing resources of the organization to some degree in order to better assess security findings and associated risk. If you’re still approaching a pen test as a red-vs-blue contest, you’re doing it wrong.
The final issue is closely related. Rob discussing his team’s persistence (APT remember?) “We’ll poke and we’ll poke and we’ll wait and we’ll wait and we’ll wait…,” he shared. Eventually a hole will be introduced, maybe just for a short time during a maintenance window or while a vendor is fixing an issue. With nearly unlimited resources they can continue to scan and test and push until something changes. Most pen tests though rarely last more than a few weeks. However a good test can take these issues into account. A good tester can help you consider different variables and potential events and how those may effect deployed security controls. It may not be realistic to wait for an event to occur, but often a simulated situation can be used to explore potential risk. Again this falls back on the importance of an open gray-box test.
Ultimately, it’s important to understand the difference between advanced attackers and a penetration test. There are similarities, but also key differences. If your testers aren’t able to have that conversation, give us a call.
Rob had a lot more great advice for businesses on how to secure their network. His 35 minute talk is definitely worth a listen. https://www.youtube.com/watch?v=bDJb8WOJYdA
Nathan Sweaney is a Senior Security Consultant with Secure Ideas. If you are in need of a penetration test or other security consulting services you can contact him at nathan@secureideas.com, on Twitter @eternalsecurity, or visit the Secure Ideas – ProfessionallyEvil site for services provided.