Cloud AV Can Serve as an Avenue for Exfiltration

Black Hat USA researchers show how bad guys can use cloud AV connections to bypass air-gaps and extremely segmented networks to keep stolen data flowing.

Over the past few years, security researchers have been drawing increasing attention to the fact that under the right circumstances security products could potentially be used to attack the very machines theyre meant to protect. For the most part, the body of work on this front tends to fixate on authentication bypasses and attack techniques early in the attack lifecycle.
Later this month at Black Hat USA in Las Vegas, a pair of researchers will show that security product vulnerabilities can be leveraged late in an attack as well. Vulnerable cloud antivirus products can not only be used to get attackers in to a target network, they can also be used to get stolen data out. In their
The Adventures of AV and the Leaky Sandbox
talk, the researchers will demonstrate how cloud-enhanced AV agents can be used as a vehicle for exfiltration on very secure and isolated endpoints.
Amit Klein, vice president of security research for SafeBreach, and Itzik Kotler, co-founder and CTO, dug into their research to challenge the assumption that theres no downside to moving to AV systems that leverages the cloud to incorporate up-to-date intelligence from multiple sources. They found that its possible to subvert the Internet connection of AV products that use in-the-cloud sandbox technology to turn it into a rogue connection for getting stolen data off the targets network and onto the criminals server.
This can be a very powerful attack tool against enterprises that have enforced strong controls through egress filtering, whitelisting, and even airgaps with no other Internet connections.
Klein and Kotler plan to also release at Black Hat a tool to carry out their new technique, and theyll offer evidence about how a number of prominent AV products fared against the new attack. Klein says that even before digging into the troubling issues of insecure security products opening new lines of attack, the even more important lesson is to consider every possible angle of attack when it comes to the bad guys filching data from systems.
Exflitration from the enterprise can take some very surprising and unexpected forms. With that in mind, security personnel should consider all possible ways of data to leave the enterprise and analyze them as potential exfiltration vectors, he says. In our particular case it was the connection between AV agents and their cloud servers, but there are many other ways, to be sure.
As Klein explains, security product vulnerabilities are hardly a new phenomenon. For example, just last year at Black Hat, two researchers from enSilo presented techniques that leverage flaws in AV hooking engines to start an attack by bypassing ASLR protections in 32-bit and 64-bit systems.
In addition to Klein and Kotlers presentation, there will be a couple other new findings presented at Black Hat that show how attackers can break the mathematical engines that govern machine-learning based detection models. In one presentation, researchers at the Intel Science & Technology Center for Adversary-Resilient Security Analytics (ITSC-ARSA) at Georgia Tech will demo a tool they call AVPASS that can effectively spy on Android anti-malware detection models and manipulate malicious apps APKs in such a way that it can disguise Android malware from the security software
Klein says all of this research should get practitioners to keep in mind that security products are very appealing attack targets.
They usually have high privileges in the operating system on which they run - typically they run with administrator rights - and visibility access to enterprise network traffic, he says. They also employ complex logic, interacting with a lot of file formats, protocols, and operating system features. This complexity translates into a broad attack surface.
As such, its incumbent upon CISOs and other practitioners to stay on top of new research about this field and keep the pressure up on their vendors to keep their security tools hardened from attack.
Im pretty sure that once vendors feel the pressure from major customers, their response time will improve, and they will also invest more time in internal research to predict and circumvent yet-unknown attacks, he says.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the
conference schedule
and
to register.

Related Content:
New SQL Injection Tool Makes Attacks Possible from a Smartphone
Microsoft Patches Critical Zero-Day Flaw in Windows Security Protocol
Desperately Seeking Security: 6 Skills Most in Demand
How Code Vulnerabilities Can Lead to Bad Accidents

Last News
▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Cloud AV Can Serve as an Avenue for Exfiltration