Researchers: Management apps could pose security risk

Insecure coding and loose deployments of enterprise management applications could turn anti-virus, patch management and systems management applications into powerful and malicious botnets, according to research presented at the Black Hat Briefings Conference in Las Vegas.

Enterprise management applications of all stripes are plagued by easy-to-exploit security holes, like buffer overflow flaws, bad cryptographic implementations and loose authentication, said Dave Goldsmith, president of Matasano Security, who spoke with colleague Thomas Ptacek on Tuesday.

The researchers declined to name specific companies whose products were vulnerable but said the kinds of systems that demonstrate the loose security are varied.

"Think of when your machine loads up in the corporate network. These are all those things that load in the system tray and keep you from getting work done in the morning. These are programs that are running on everyone's desktop," Goldsmith said.

Although they are used to help system administrators maintain control and consistency across enterprise systems, the management applications themselves are little different from malicious "bot" programs that are used to distribute spam and launch denial of service attacks on the Internet, Goldsmith added.

"These are agents that listen on a port and connect back to a system that other people are administering and that push out commands that tell the agents to do something. Architecturally, they're identical to bots," Goldsmith said.

"These are botnets that the IT group installed for you," Ptacek said.

In fact, enterprise management applications are potentially more dangerous than bots, because many are cross-platform programs that can run on Windows, Linux, and mainframe systems, and because they frequently use proprietary protocols to communicate that are difficult to monitor, Ptacek said.

The software often escapes scrutiny because it is deployed internally on enterprise networks, behind perimeter defenses that keep out Internet-based attacks. Like other internal applications, however, the systems can be vulnerable to compromise from insiders or hackers who slip in behind the firewall, Goldsmith said.

As enterprise IT managers deploy more and more of the applications, the complexity of monitoring them for malicious behavior becomes more complex.

"Multiply the security problem by how many agent applications people have running. You might have 40 or 50 different protocols running on a network, so you can't say "firewall it off here, but not there," Goldsmith said.

In their Black Hat presentation, Goldsmith and Ptacek discussed 12 different methods by which enterprise management systems could be vulnerable to compromise.

In one scenario, a malicious hacker who has gained access to an enterprise network compromises a machine running agent software used by an enterprise management product, then connects through the agent to a central management console that can be used to control agents across the enterprise network.

"At that point, it's pretty much ‘game over’," Ptacek said.

There is no evidence that hacking groups are targeting enterprise management applications, but with more research into security vulnerabilities on enterprise platforms, IT managers should be aware of their exposure and take simple steps to make their deployments more secure, the researchers said.