Stonesoft
ADVANCED EVASION TECHNIQUES-
TRUE STORY
BITTERSWEET DISCOVERY
Stonesoft security researchers in the outskirts of
Europe discovered that there is millions and
millions of ways to bypass the most advanced
and leading network security solutions without
leaving any traces or alerts on management
systems.
Being a good citizen Stonesoft has reported in
public hundreds out of those millions and millions.
But it is the tip of the iceberg
”do the math” yourself
Those ways are called
as:
ADVANCED
EVASION
TECHNIQUESAETs
See more at: aet.stonesoft.com
THINKING UNTHINKABLE.
Story In a Nutshell
Failed in NSS group tests
Dedicated Evasion research team
started
Creation of automated tools and
setting up a test lab to ease product
testing
Discovery of Advanced Evasion
Techniques
Test run against all the leading IPS and
NGFW products. 99% ineffective
Communicating through CERT to other
vendors and finally in public
Our research idea was very
simple:
“to break all the principles
and rules in sending and
receiving data”
Just Like
Hackers Do!
Advanced Evasion Techniques (AET)
What are they?
Any technique to engineer a network based attack in order to evade and
bypass security detection.
What makes them advanced?
Combination of evasions working simultaneously on multiple protocol layers
Combination of evasions that can change during the attack
Carefully designed to evade inspection
Typically, AETs are used as part of Advanced Persistent
Threats (APT)
APT = motivation
Advanced Evasion Techniques disguise and make cyber attacks /malicious
payloads/ exploits look normal and safe when the security device inspects the
data traffic. The number of AETs can be virtually limitless as you can combine,
vary and modify them dynamically.
Everything looks safe and
normal when evasions are
used and security devices
are not anti-evasion ready.
…but this can be reality.
So Why worry ?
AETs can breach sensitive data
AETs can ruin brand reputation
AETs can cause financial losses
AETs can harm business continuity
AETs can risk critical infrastructure
AETs can risk national security
As long as there is a vulnerable target- and there
always is, advanced evasion techniques can deliver
any known and unknown (zero day) exploits to it.
And nobody knows it.
Currently AETs
work as a Master
Key that security
vendors DO NOT
HAVE.
Industry
Blind Spot
WHY THIS IS POSSIBLE?
Evasion Research so far…
Comprehensive
description of attacks
by Ptacek and Newsha
The seminal text on
attacks against IDS
systems appeared in 1997
1997
1998
Article in the Phrack
Magazine describes ways
to by-pass network
intrusion detection
Stonesoft starts to design
multilayer normalization
capabilities in its IPS
2001
Evasion Research so far…
Handley and Paxson
suggest normalization
Gorton and Champion
suggest combinations
Moore and Caswell
discuss evasions at
Black Hat
2004
2006
2007
Evasion Research so far…
NSS test results
boost evasion
research
Stonesoft’s
Evasion research
Starts
Dedicated team starts
testing Stonesoft with the
Automated Evasion tools
First version of evasion
testing tool with 12
non-stackable evasions
2007
2009
Tests expanded
against all leading
security devices
2010
Evasion Research so far…
June 2010: First 23 AETs
reported to CERT for global
vendor remediation
Dec 2010: CERT coordination
process ends. Vendors remain
silent about their remediation.
Oct 2010: Public announcement of
Advanced Evasion Techniques and
the evasion threat
Oct 2010: Knowledge
and awareness of
evasions spreads
2010
2011
Feb 2011: 124 new AETs
evasions reported
Mar 2011: 180+ stackable
and combinable evasions
in the testing framework.
2012
Evasion Research so far…
May 2011 Stonesoft
introduces first commercial
version of Antievasion
Readiness Test for other
security vendors, test labs
and organizations
Stonesoft delivers AERT tools to
many of the leading security vendors
and test labs.
UK cyber forensics team and leading
computer science university verifies the
existence of evasions in reality and Stonesoft
signs up a collaboration agreement with the
university to start an academic research.
Stonesoft publishes whitepaper of
how company’s technology differs from others
and publishes new aet.stonesoft.com site.
2011
2012
…
Justified Question:
Why this is possible?
Design flaws.
It has been a industry blind spot or ignorance
Speed & false positive problem used to be a sales obstacles and that led to
pure speed and minimized inspection orientation
> industry sacrificed security
Speed and some security functionalities were built on hardcoded security
>impossible to dynamically update and evolve
Current Technologies are 15 years old and designed during the era of :” weknow-the-threat- and-that’s- why-we-can- deal-with-it”
>Leading to match pattern and signature based detection only, not truly understanding the
BIG picture of data stream. In the era of unknown and uncertain threats signatures only
will not work!
Déjà vu
Automobile safety in 1959
Network security in 2010?
Status Quo: Before 1959 all the established automobile brands
marketed that cars were safe and users believed and felt safe.
Before 2010 all the Network Security vendors marketed that
their solutions offered high level of protection and
organizations felt their digital assets were secured.
Disruption: Then came one Nordic brand, VOLVO who claimed
that current cars are not even close to be safe and innovations
are needed.
Then came one Nordic brand, STONESOFT who claimed that
the current security solutions are not as secured as they should
be. (Disruption)
Technology breakthrough: In 1959 They introduced Three
Point Seat Belts.
Technology breakthrough: 2010 They introduced Advanced
Evasion Techniques and innovative technologies to fight back.
Claim: They claimed lives can be saved if all brands would start
adding Seat Belts to their cars. (Tested facts and reality)
Claim: They claimed governments, businesses and brands can
be saved if their anti-evasion technologies are taken into use.
Industry Response: “This is marketing, Extra costs, No
relevance to safety, dangerous, uncomfortable, People won´t
use, theoretical only,
Industry Response: “Most kept silent and others claimed “This
is marketing, we can fix this, only extra costs, no relevance to
security, unproven, theoretical, not happening in reality.”
Bottom Line : Millions of human lives have been and will be
saved.
Bottom Line: Organizations will be saved if AET threat is taken
seriously
We claimed: Businesses are
driving without Seat Belts!
…And we can show and prove
it to anybody!
For the record…
“Advanced Evasion Techniques can evade many network security
systems. We were able to validate Stonesoft’s research and believe
that these Advanced Evasion Techniques can result in lost corporate
assets with potentially serious consequences for breached
organizations.”
– Jack Walsh, Program Manager
“If the network security system misses any type of evasion it means a
hacker can use an entire class of exploits to circumvent security
products, rendering them virtually useless. Advanced Evasion
Techniques increase the potential of evasion success against the IPS,
which creates a serious concern for today’s networks.”
– Rick Moy, President
“Recent research indicates that Advanced Evasion Techniques are a
real and credible – not to mention growing –and growing threat against
the network security infrastructure that protects governments,
commerce and information-sharing worldwide. Network security
vendors need to devote the research and resources to finding a
solution.“
– Bob Walder, Research Director
We believe AETs pose a serious threat to network security and have
already seen evidence of hackers using them in the wild. It is also very
promising to see that Stonesoft is taking the threat posed by evasions
seriously as they have been overlooked by many in the past
-Andrew Blyth, Professor of Glamorgan University
Meanwhile
other security
vendors keep
radio silence!
For the record…
Meanwhile
other security
vendors keep
radio silence!
Off the Record
Some are acquiring anti-evasion technology and
knowledge from Stonesoft
Some are focusing on surviving next public tests
Some are doing workarounds and quick fixes
Some are downplaying the threat and risks if they are
asked directly
Some are protecting their business at the expense of
customers
Some have truly started to investigate their design flaws
Some ignore and do NOTHING!
Meanwhile
other security
vendors are
saving their
business.
Reality.
NOTE!
In this particular test only simple, known and well documented evasions where used. What
happens if more Advanced Evasions hit this security device??
Palo Alto’s HTML evasion protection
100%
33%
Marketed
Tested by NSS NGFW 2011