Forty-seven percent of all breaches were caused by malicious or criminal attacks according to the most recent global data breach study released by the Ponemon Institute. Resolving an attack cost businesses an average of $170 per record, translating to an average total cost of $3.79 million for a data breach.
Today’s cybercriminals are getting smarter at finding and breaching high value targets. Detecting, deterring and remediating vulnerabilities are key to protecting your data from these advanced cyberattacks.
Scanning to identify areas vulnerable to an attack is a first line of defense against malicious users, however, penetration testing to gain as much access as possible is an essential part of a complete risk assessment strategy. Penetration testing, also known as ethical hacking, is one of the most effective methods of finding possible targets malicious users could exploit.
Penetration testing is a highly manual practice, which requires a knowledgeable operator with the right toolset. Some penetration testing tasks have been automated by complex tools, such as Core Impact. Still, pen-testing requires making decisions as to which is the best next step and being able to judge the information available after each step.
As a fulltime security researcher, part of my work involves vulnerability research aiming at finding exploitable vulnerabilities. During this research, I discovered the recently announced vulnerability in the Samsung SW Update Tool.
We add these vulnerabilities to our solutions, Core Impact Pro and Core Insight, and the Security Consulting Services Team includes them when performing penetration tests against a client’s infrastructure.
The Samsung Vulnerability
The Samsung SW Update Tool analyzes the system drivers of a computer and installs relevant software and driver updates. Through vulnerability research, I discovered this tool is prone to a man-in-the-middle attack which could result in integrity corruption of the transferred data, information leak and consequently code execution.
In other words, these vulnerabilities could allow a malicious user to read and modify the requests made both by the user and by the Samsung servers. This could potentially allow such user to infect the victim with a malware or a remote access tool and gain control over its machine.
CoreLabs immediately alerted Samsung to this discovery. As a result, Samsung issued a patch which implemented a ciphered communication between the tool and its servers and also a verification mechanism of the downloaded drivers.
Penetration Testing Methodology
Core Security’s Consulting Team (SCS) follows a five-step methodology to find and properly mitigate possible vulnerabilities like the Samsung discovery. These steps include: planning and preparation, discovery, penetration attempt, analysis and reporting, and clean up. SCS would test for the Samsung vulnerability in the third step of their methodology, the penetration attempt.
Malicious users are continually adapting their techniques to break through new layers of defensive security mechanisms. Penetration testing helps identify and prioritize security risks to prevent unauthorized access to critical systems and valuable information. As your organization works to improve security through penetration testing, there are a few key tips for success.
Tips for Effective Penetration Testing
1. Define your goals. Step back and ask, “What am I trying to protect? What are my critical assets?” Consider the impact if your email, website or another system fundamental to your business are attacked and shut down.
2. Evaluate risk. It’s better to be safe than sorry. Take a look around your physical office and consider every potential event or procedures that could put assets at risk.
3. Test well and test often. Attackers are testing your IT infrastructure every day. Enterprises should conduct penetration testing at least once per quarter or whenever there is a major change to IT structure in order to protect against more recent attacks.
4. Ensure proper remediation. Remember to validate remediated vulnerabilities to ensure they were properly mitigated.