Tortilla Spices Up Active Defense Ops

New free Tor tool, due out at Black Hat USA, aims to make the Tor anonymizing network easier to use for all types of intel-gathering

A researcher later this month at Black Hat USA will release a free tool that simplifies the use of Tor and makes it more approachable for all types of security researchers, not just malware analysts.
CrowdStrike researcher Jason Geffner says the new tool, called Tortilla, routes all TCP/IP and DNS traffic anonymously via the Tor Projects network, but unlike existing Tor tools, it operates with Windows and works with all types of browsers.
Geffner says he got the idea for Tortilla after realizing that no other Tor tools provided all of the elements he needed to anonymize his Internet access while he researched bad cyberactors. The new tool also supports Flash and other plug-ins, and doesnt require additional hardware or virtual machines, he says.
But perhaps one of the more attractive features for enterprises is that it plays nicely with Windows, which isnt traditionally the case with other Tor tools, many of which require Linux, for example, Geffner says. It doesnt require that users work with OSes that are unfamiliar to them, he says. One of the requirements for Tortilla was that it would require it to be as easy as possible for users to use.
It also prevents malware from circumventing the Tor tunnel, he says -- something that wily hackers can do today via the Tors browser, the Tor Browser Bundle tool, which is based on Firefox. While its great in concept, the downside [with Tor Browser Bundle] is if youre visiting a website with Tor Browser Bundle and the browser gets exploited, its possible that the exploit could use code executed in the browser to circumvent that Tor tunnel, say Geffner, who is providing only limited details on Tortilla prior to its release.
Tortilla is the latest of a series of free active defense tools becoming available in the public domain. Security experts John Strand, Paul Asadoorian, Ethan Robish, and Benjamin Donnelly offer a Linux distro set of tools called Active Defense Harbinger Distribution (ADHD) for active defense measures, including feeding the attacker phony information about the targeted network.
Active defense, not to be confused with pure hacking back, is about frustrating, identifying, and, in some cases, physically locating the bad guys behind the keyboard. The goal is to raise the bar and make it more expensive for the attacker, and its a constant game of one-upsmanship.
We want to see companies start doing ... [these] nontraditional defense tactics, Strand says. Were trying to get as much of this open source and generate other ideas as well for it, he says.
[Ammunition for fighting back against cyberattackers in subtle yet disruptive ways is becoming available in open source. See
Free Active Defense Tools Emerge
.]
CrowdStrikes Geffner says Tortilla was designed with security researchers in mind, including those who arent necessarily downloading malware for analysis or communicating with command-and-control servers. [CrowdStrike has] a large intel team that seeks to capture actionable information on ... adversaries. Some of us do very technical work, and others research the actors themselves, reading their blogs and Web forum posts, he says. They are using Tortilla with whatever browser they like to have.
For enterprises investing in threat intel efforts, it allows their researchers to investigate malicious actors without revealing their identities, he says. If Company XYZ gets hit and the attacker sees connections to its server with probes from Company XYZ, thats going to tip off the attacker. If the company can anonymize their research through Tor, it keeps the attacker in the dark and raises the cost to the attacker.
Geffner plans to post both the source code for Tortilla and a working executable during his July 31 presentation at Black Hat in Las Vegas.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Tortilla Spices Up Active Defense Ops