4 ms·

It would be interesting to read an ethical analysis of a tool like this.

mmaunder 8y ago
One point of view is it's a mafiosi tactic. Create the problem. Sell the security solution. Or, at best, it is irresponsible to enable attackers. Another is that by disclosing security problems and the tools to test and research them, we enable defenders and we fix what might be kept confidential and exploited by attackers. The theory that sunlight is the best disinfectant.
- h1d 8y ago
  It's not a magic and if detection tools don't support http/2, then it's their fault and quite frankly anybody could come up with this tool. The "enabled" attackers surely are nothing when they couldn't have come up with anything better themselves. It just made the discussion of such tools public.
BillinghamJ 8y ago
As noted in the blog post linked from the readme, their red team is using it for internal testing.
- qaq 8y ago
  Thats the funny thing sometimes people ignore alerts on tools that red teams normally use because they think it's their red team
  - kiallmacinnes 8y ago
    If people are ignoring alerts because it might be the red team then surely when the red team breaks in... those people all look like idiots who can't keep their systems secure? If this is happening, then either the red team needs to be disbanded as nobody cares enough to warrant their existence... or the engineers ignoring the alerts need to be educated on the value of a red team.
    - qaq 8y ago
      Very true I was not referring to SOC not reacting it's more things getting misinterpreted when things get escalated to higher ups if org is huge and structure is complex sometimes things get complicated. E.g. a company undergoing an external pen test and some real incident in the same time window using tools that a pen tester would use (e.g metasploit)
jerf 8y ago
Once you have the first 5 or 10 such tools, the consequences of the 11th are pretty minimal. And this is probably more like in the hundreds, not the 11th. Plus, they're sort of inevitable anyhow. The technical difference between ansible/puppet/etc. and blackhat C&C servers isn't that great. Definitely non-zero, but not that huge.
- qaq 8y ago
  well the evasion part is pretty huge diff.
  - jerf 8y ago
    If you're referring to what is mentioned in this post: https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a , I'm not sure "We use HTTP2 and TLS" is that significant of a difference. If there was some elaborate system in place for evasion, sure, but this is just "using a new, but standard, protocol before everybody else understands it yet". Heck, just the fact it's using TLS is about 90% of the evasion; HTTP2 is just icing on the cake. A more significant difference I was thinking of is that ansible et al are more focused on getting the system into a certain state, whereas a C&C server is likely to be oriented around executing commands and keeping certain tasks running. However, since the way you get a system into a certain state is by executing commands, well, the technical differences aren't that significant. Most of that difference would be in organization of the "UI" layer, rather than under the hood.
    - qaq 8y ago
      They are looking at adding domain fronting :)
    - SEJeff 8y ago
      My take is that HTTP/2 is more significant than you might expect, primarily because it is a full duplex protocol (unlike the typical request / response of HTTP/1). This makes it like a more efficient websocket, so the C2 bits can move faster than a polling based approach. That said, this makes it easier to detect.
kerng 8y ago
This is just another one, so there isn't anything really new to discuss ethically.

One point of view is it's a mafiosi tactic. Create the problem. Sell the security solution. Or, at best, it is irresponsible to enable attackers. Another is that by disclosing security problems and the tools to test and research them, we enable defenders and we fix what might be kept confidential and exploited by attackers. The theory that sunlight is the best disinfectant.

h1d 8y ago
It's not a magic and if detection tools don't support http/2, then it's their fault and quite frankly anybody could come up with this tool. The "enabled" attackers surely are nothing when they couldn't have come up with anything better themselves. It just made the discussion of such tools public.

BillinghamJ 8y ago

As noted in the blog post linked from the readme, their red team is using it for internal testing.

qaq 8y ago
Thats the funny thing sometimes people ignore alerts on tools that red teams normally use because they think it's their red team
- kiallmacinnes 8y ago
  If people are ignoring alerts because it might be the red team then surely when the red team breaks in... those people all look like idiots who can't keep their systems secure? If this is happening, then either the red team needs to be disbanded as nobody cares enough to warrant their existence... or the engineers ignoring the alerts need to be educated on the value of a red team.
  - qaq 8y ago
    Very true I was not referring to SOC not reacting it's more things getting misinterpreted when things get escalated to higher ups if org is huge and structure is complex sometimes things get complicated. E.g. a company undergoing an external pen test and some real incident in the same time window using tools that a pen tester would use (e.g metasploit)

jerf 8y ago

Once you have the first 5 or 10 such tools, the consequences of the 11th are pretty minimal. And this is probably more like in the hundreds, not the 11th. Plus, they're sort of inevitable anyhow. The technical difference between ansible/puppet/etc. and blackhat C&C servers isn't that great. Definitely non-zero, but not that huge.

qaq 8y ago
well the evasion part is pretty huge diff.
- jerf 8y ago
  If you're referring to what is mentioned in this post: https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a , I'm not sure "We use HTTP2 and TLS" is that significant of a difference. If there was some elaborate system in place for evasion, sure, but this is just "using a new, but standard, protocol before everybody else understands it yet". Heck, just the fact it's using TLS is about 90% of the evasion; HTTP2 is just icing on the cake. A more significant difference I was thinking of is that ansible et al are more focused on getting the system into a certain state, whereas a C&C server is likely to be oriented around executing commands and keeping certain tasks running. However, since the way you get a system into a certain state is by executing commands, well, the technical differences aren't that significant. Most of that difference would be in organization of the "UI" layer, rather than under the hood.
  - qaq 8y ago
    They are looking at adding domain fronting :)
  - SEJeff 8y ago
    My take is that HTTP/2 is more significant than you might expect, primarily because it is a full duplex protocol (unlike the typical request / response of HTTP/1). This makes it like a more efficient websocket, so the C2 bits can move faster than a polling based approach. That said, this makes it easier to detect.

kerng 8y ago

This is just another one, so there isn't anything really new to discuss ethically.