As an example, we encountered a Secure Email Gateway during an Advanced External Penetration Test for a customer. When a user sends an email, the email can either be sent from the gateway's webmail gui, or from outlook. If it is sent from outlook then the gateway will intercept the email and store the message contents locally. Then instead of actually sending the sensitive email message to the recipient, the gateway sends a link to the recipient. When the recipient clicks on the link their browser launches and they are able to access the original message content.
While this all looked fine, there was something about that gateway that made me want to learn more (a strange jboss version response), so I did... I called the vendor and ask to speak to a local sales rep. When the rep got on the phone I told him that I had an immediate need for 50 gateways but wouldn't make any purchases until I knew that his technology was compatible with my infrastructure. He got really excited and asked me what I needed in order to verify compatibility. I told the rep that I needed a list of all Open Source libraries and software that had been built into the gateway along with version information. The rep said that he didn't really understand what I was asking him but that he'd go to someone in development and figure it out. Within about fifteen minutes I received an email with a .xls attachment. Shortly after that I received an email from the rep asking me to delete the .xls attachment because he wasn't supposed to share that particular one.... go figure...
(I deleted it after I read it)
When I studied the document I realized that the gateway was nothing more than a common bloated linux box with a bunch of very, very old Open Source software installed on it. In fact, based on the version information provided, the newest package that was installed was OpenSSL and that was 3 years old! The JBoss application sever was even older than that and was also vulnerable as hell (but it was hacked and reported incorrect version information). Needless to say we managed to penetrate the secure email gateway by using a published exploit that was also about 3 years old. Once we got in our client decided that their secure gateway wasn't so secure any more and did away with it. We did contact the vendor by the way and they weren't receptive or willing to commit to any sort of fix.
The fact of the matter is that we run into technology like this all the time, especially with appliances. We've seen this same sort of issue with patch management technologies, distributed policy enforcement technologies, anti-virus technologies, HIDS technologies, etc. In almost every case we are able to use these technologies to penetrate or at least to assist in the penetration of our target. While most of these technologies introduce more risk than the risk that they resolve, there are a few good ones. My recommendation is to have a third party assess the technology before you decide to use it, just make sure that they are actually qualified and not Fraudulent Security Experts.
I can't say I hate the fact that vendors find it easy and cheap to implement open source software in their devices, but for God's sake, support the device afterwards with REAL updates and REAL firmware revisions. Great article Adriel.
ReplyDeleteThis has been an ongoing issue for quite some time. How do you filter the snake oil from the quality solution? Customers need to understand that purchasing a security solution does not give them a golden key, or get out of jail free card. It generally does provide them a layer of security on which to build. Simply trusting one piece of a solution as the end all be all tends to prove fatal in the end.
ReplyDeleteEverything is vulnerable...
Unfortunately, this is par for the course for security "appliances."
ReplyDeleteGovernments use formal evaluations under systems such as Common Criteria to provide a known level of assurance of a product's security capabilities. Perhaps business should be doing more of the same.