Researchers: Management apps could pose security risk

Insecure coding and loose deployments of enterprise management applications could turn anti-virus, patch management and systems management applications into powerful and malicious botnets, according to research presented at the Black Hat Briefings Conference in Las Vegas.

Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft Free IT resource Attend the SOA Executive Forum: Breaking SOA Bottlenecks SOAExecForum.com/may2007 Sponsored by InfoWorld

Enterprise management applications of all stripes are plagued by easy-to-exploit security holes, like buffer overflow flaws, bad cryptographic implementations and loose authentication, said Dave Goldsmith, president of Matasano Security, who spoke with colleague Thomas Ptacek on Tuesday.

The researchers declined to name specific companies whose products were vulnerable but said the kinds of systems that demonstrate the loose security are varied.

"Think of when your machine loads up in the corporate network. These are all those things that load in the system tray and keep you from getting work done in the morning. These are programs that are running on everyone's desktop," Goldsmith said.

Although they are used to help system administrators maintain control and consistency across enterprise systems, the management applications themselves are little different from malicious "bot" programs that are used to distribute spam and launch denial of service attacks on the Internet, Goldsmith added.

"These are agents that listen on a port and connect back to a system that other people are administering and that push out commands that tell the agents to do something. Architecturally, they're identical to bots," Goldsmith said.

"These are botnets that the IT group installed for you," Ptacek said.

In fact, enterprise management applications are potentially more dangerous than bots, because many are cross-platform programs that can run on Windows, Linux, and mainframe systems, and because they frequently use proprietary protocols to communicate that are difficult to monitor, Ptacek said.

The software often escapes scrutiny because it is deployed internally on enterprise networks, behind perimeter defenses that keep out Internet-based attacks. Like other internal applications, however, the systems can be vulnerable to compromise from insiders or hackers who slip in behind the firewall, Goldsmith said.

As enterprise IT managers deploy more and more of the applications, the complexity of monitoring them for malicious behavior becomes more complex.

"Multiply the security problem by how many agent applications people have running. You might have 40 or 50 different protocols running on a network, so you can't say "firewall it off here, but not there," Goldsmith said.

In their Black Hat presentation, Goldsmith and Ptacek discussed 12 different methods by which enterprise management systems could be vulnerable to compromise.

In one scenario, a malicious hacker who has gained access to an enterprise network compromises a machine running agent software used by an enterprise management product, then connects through the agent to a central management console that can be used to control agents across the enterprise network.

"At that point, it's pretty much ‘game over’," Ptacek said.

There is no evidence that hacking groups are targeting enterprise management applications, but with more research into security vulnerabilities on enterprise platforms, IT managers should be aware of their exposure and take simple steps to make their deployments more secure, the researchers said.

Anti-virus and enterprise management applications have been getting more attention in recent months from security researchers who look for product vulnerabilities.

In July, eEye Digital Security publicized a hole in McAfee Inc.'s ePolicy Orchestrator, a remote security management tool, that would allow a malicious hacker to write and run malicious files to any remote system managed by ePO. In recent weeks there have been reports of similar holes in McAfee's Security Center product and Symantec's Antivirus software.

Organizations can request third-party code audits to verify the quality of the enterprise management software. At a more basic level, customers should ask about the kinds of security controls that are included with the system and then enable those controls when the product is deployed.

"Many of the issues we found could have been mitigated by having stronger authentication -- some kind of access control at the agent and administrative console levels," Goldsmith said.

Compounding the problem, Ptacek said, are security features such as strong user authentication that are included with enterprise management systems but often disabled by default when the products ship.

"It's critically important that IT groups turn on (the authentication) features. Otherwise it really is like you have a botnet on your network," Ptacek said.