Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Management apps the new soft underbelly

Myriad of convenience apps pose security risk.

Article comments

Insecure coding and loose deployments of enterprise management applications could turn anti-virus, patch management and systems management applications into powerful and malicious botnets, according to research presented at Black in Las Vegas.

Enterprise management applications of all stripes are plagued by easy-to-exploit security holes, like buffer overflow flaws, bad cryptographic implementations and loose authentication, said Dave Goldsmith, president of Matasano Security.

The researchers declined to name specific companies whose products were vulnerable but said the kinds of systems that demonstrate the loose security are varied.

"Think of when your machine loads up in the corporate network. These are all those things that load in the system tray and keep you from getting work done in the morning. These are programs that are running on everyone's desktop," Goldsmith said.

Although they are used to help system administrators maintain control and consistency across enterprise systems, the management applications themselves are little different from malicious "bot" programs that are used to distribute spam and launch denial of service attacks on the Internet, Goldsmith added.

"These are agents that listen on a port and connect back to a system that other people are administering and that push out commands that tell the agents to do something. Architecturally, they're identical to bots," Goldsmith said.

"These are botnets that the IT group installed for you," Ptacek said.

In fact, enterprise management applications are potentially more dangerous than bots, because many are cross-platform programs that can run on Windows, Linux, and mainframe systems, and because they frequently use proprietary protocols to communicate that are difficult to monitor, Ptacek said.

The software often escapes scrutiny because it is deployed internally on enterprise networks, behind perimeter defences that keep out Internet-based attacks. Like other internal applications, however, the systems can be vulnerable to compromise from insiders or hackers who slip in behind the firewall, Goldsmith said.

As enterprise IT managers deploy more and more of the applications, the complexity of monitoring them for malicious behaviour becomes more complex.

"Multiply the security problem by how many agent applications people have running. You might have 40 or 50 different protocols running on a network, so you can't say "firewall it off here, but not there," Goldsmith said.

In their Black Hat presentation, Goldsmith and Ptacek discussed 12 different methods by which enterprise management systems could be vulnerable to compromise.

In one scenario, a malicious hacker who has gained access to an enterprise network compromises a machine running agent software used by an enterprise management product, then connects through the agent to a central management console that can be used to control agents across the enterprise network.

"At that point, it's pretty much 'game over'," Ptacek said.

There is no evidence that hacking groups are targeting enterprise management applications, but with more research into security vulnerabilities on enterprise platforms, IT managers should be aware of their exposure and take simple steps to make their deployments more secure, the researchers said.

Anti-virus and enterprise management applications have been getting more attention in recent months from security researchers who look for product vulnerabilities.

In July, eEye Digital Security publicised a hole in McAfee's ePolicy Orchestrator, a remote security management tool, that would allow a malicious hacker to write and run malicious files to any remote system managed by ePO. In recent weeks there have been reports of similar holes in McAfee's Security Center product and Symantec's Anti-virus software.

Organizations can request third-party code audits to verify the quality of the enterprise management software. At a more basic level, customers should ask about the kinds of security controls that are included with the system and then enable those controls when the product is deployed.

"Many of the issues we found could have been mitigated by having stronger authentication - some kind of access control at the agent and administrative console levels," Goldsmith said.

Compounding the problem, Ptacek said, are security features such as strong user authentication that are included with enterprise management systems but often disabled by default when the products ship.

"It's critically important that IT groups turn on (the authentication) features. Otherwise it really is like you have a botnet on your network," Ptacek said.


More from Techworld

More relevant IT news


Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *