By Paul F. Roberts
August 29, 2006
Insecure coding and loose deployments of enterprise management
applications could turn anti-virus, patch management and systems
management applications into powerful and malicious botnets, according
to research presented at Black in Las Vegas.
Enterprise management applications of all stripes are plagued by
easy-to-exploit security holes, like buffer overflow flaws, bad
cryptographic implementations and loose authentication, said Dave
Goldsmith, president of Matasano Security.
The researchers declined to name specific companies whose products
were vulnerable but said the kinds of systems that demonstrate the
loose security are varied.
"Think of when your machine loads up in the corporate network. These
are all those things that load in the system tray and keep you from
getting work done in the morning. These are programs that are running
on everyone's desktop," Goldsmith said.
Although they are used to help system administrators maintain control
and consistency across enterprise systems, the management applications
themselves are little different from malicious "bot" programs that are
used to distribute spam and launch denial of service attacks on the
Internet, Goldsmith added.
"These are agents that listen on a port and connect back to a system
that other people are administering and that push out commands that
tell the agents to do something. Architecturally, they're identical to
bots," Goldsmith said.
"These are botnets that the IT group installed for you," Ptacek said.
In fact, enterprise management applications are potentially more
dangerous than bots, because many are cross-platform programs that can
run on Windows, Linux, and mainframe systems, and because they
frequently use proprietary protocols to communicate that are difficult
to monitor, Ptacek said.
The software often escapes scrutiny because it is deployed internally
on enterprise networks, behind perimeter defences that keep out
Internet-based attacks. Like other internal applications, however, the
systems can be vulnerable to compromise from insiders or hackers who
slip in behind the firewall, Goldsmith said.
As enterprise IT managers deploy more and more of the applications,
the complexity of monitoring them for malicious behaviour becomes more
"Multiply the security problem by how many agent applications people
have running. You might have 40 or 50 different protocols running on a
network, so you can't say "firewall it off here, but not there,"
In their Black Hat presentation, Goldsmith and Ptacek discussed 12
different methods by which enterprise management systems could be
vulnerable to compromise.
In one scenario, a malicious hacker who has gained access to an
enterprise network compromises a machine running agent software used
by an enterprise management product, then connects through the agent
to a central management console that can be used to control agents
across the enterprise network.
"At that point, it's pretty much 'game over'," Ptacek said.
There is no evidence that hacking groups are targeting enterprise
management applications, but with more research into security
vulnerabilities on enterprise platforms, IT managers should be aware
of their exposure and take simple steps to make their deployments more
secure, the researchers said.
Anti-virus and enterprise management applications have been getting
more attention in recent months from security researchers who look for
In July, eEye Digital Security publicised a hole in McAfee's ePolicy
Orchestrator, a remote security management tool, that would allow a
malicious hacker to write and run malicious files to any remote system
managed by ePO. In recent weeks there have been reports of similar
holes in McAfee's Security Center product and Symantec's Anti-virus
Organizations can request third-party code audits to verify the
quality of the enterprise management software. At a more basic level,
customers should ask about the kinds of security controls that are
included with the system and then enable those controls when the
product is deployed.
"Many of the issues we found could have been mitigated by having
stronger authentication - some kind of access control at the agent and
administrative console levels," Goldsmith said.
Compounding the problem, Ptacek said, are security features such as
strong user authentication that are included with enterprise
management systems but often disabled by default when the products
"It's critically important that IT groups turn on (the authentication)
features. Otherwise it really is like you have a botnet on your
network," Ptacek said.
HITBSecConf2006 - Malaysia
The largest network security event in Asia
32 internationally renowned speakers
7 tracks of hands-on technical training sessions.
Register now: http://conference.hitb.org/hitbsecconf2006kl/