3 ms·

It's interesting to see the development of Red team tooling over the last couple of years. It's obviously necessary for red teamers to continue to advance to b

It's interesting to see the development of Red team tooling over the last couple of years. It's obviously necessary for red teamers to continue to advance to be able to cope with improving Blue team technology. However Red Team tech. is, by it's nature, dual-use. It's equally useful for "real" attackers to have these capabilities as it is for people emulating real attackers. The nature of open source makes these capabilities quickly distributable. So these capabilities will help "real" attackers in the same way they help red teams... Terminology - Red Team - Set of security professionals who emulate "real world" attackers in an attempt to find exploitable flaws in organizations systems. Blue Team - defensive security professionals who's job it is to detect and respond to attack from real atteckers and red teamers.

draugadrotten 8y ago
> So these capabilities will help "real" attackers in the same way they help red teams... They do. However if you do not enable the Red Teams with this capacity, it does not follow that the real attackers do not have it. It's a bit like guns. If the police don't have guns, the bad guys still do. The answer isn't to distribute military weapons and tanks to everyone but at least have them as an option for SWAT.
- raesene9 8y ago
  yeah it's a tricky question, I mean Red Teams can never fully emulate all classes of attacker as they're still constrained by laws, but more realistic red teams provide more realistic tests :) What seems to be the case is that lower end attackers who don't have the skills to create fully custom setups (or high end attackers who don't want to risk their own tooling getting discovered) will use "pentesting" or red team tools to enable their attacks. So the line (if there is one) is how much do you release in that direction. Some/Many people draw the line at dropping 0-Day others might draw it lower or higher...
  - O_H_E 8y ago
    > dropping 0-Day Does that convey reporting 0 day exploits
    - raesene9 8y ago
      "Dropping 0-day" usually refers to the act of releasing an exploit for a previously unknown security vulnerability, prior to the product owner being able to deliver a patch for it.
freehunter 8y ago
As someone who has spent their entire life on the blue team, I've used some of these red team tools to assess my effectiveness. I can remember using Metasploit to make as much noise as possible to test my team's responsiveness to our SIEM going crazy with alerts. We've used Burp and similar tools to perform security audits of the company's custom code, and audits of software we're doing a PoC with to ensure quality. I've never once worried that the tools I'm using would end up in the hands of more sophisticated hackers. If anything, I'm glad for the basic red team tools because it makes script kiddies easier to find. They're not going to do custom exploits anymore when Metasploit exists. On the other side, it's almost always a safe bet that the actual bad guys are going to skip the off-the-shelf tools... ... assuming, of course, you have a decent enough security posture as-is. If script kiddies and ransomware and Zeus can get into your network unnoticed, you've got a much larger problem on your hands. Unfortunately, most companies still fall into this category because even companies that spend tens of millions of dollars on security don't take basic security seriously.
- raesene9 8y ago
  So as a Blue teamer your perspective makes sense, as presumably you only work in organizations who can afford dedicated blue teams :) Where I think most of the re/mis-use of red team tools would be effective is in the many organizations who are not yet mature enough to staff a dedicated blue team capability...
deleted 8y ago
[deleted]

draugadrotten 8y ago

> So these capabilities will help "real" attackers in the same way they help red teams... They do. However if you do not enable the Red Teams with this capacity, it does not follow that the real attackers do not have it. It's a bit like guns. If the police don't have guns, the bad guys still do. The answer isn't to distribute military weapons and tanks to everyone but at least have them as an option for SWAT.

raesene9 8y ago
yeah it's a tricky question, I mean Red Teams can never fully emulate all classes of attacker as they're still constrained by laws, but more realistic red teams provide more realistic tests :) What seems to be the case is that lower end attackers who don't have the skills to create fully custom setups (or high end attackers who don't want to risk their own tooling getting discovered) will use "pentesting" or red team tools to enable their attacks. So the line (if there is one) is how much do you release in that direction. Some/Many people draw the line at dropping 0-Day others might draw it lower or higher...
- O_H_E 8y ago
  > dropping 0-Day Does that convey reporting 0 day exploits
  - raesene9 8y ago
    "Dropping 0-day" usually refers to the act of releasing an exploit for a previously unknown security vulnerability, prior to the product owner being able to deliver a patch for it.

freehunter 8y ago

As someone who has spent their entire life on the blue team, I've used some of these red team tools to assess my effectiveness. I can remember using Metasploit to make as much noise as possible to test my team's responsiveness to our SIEM going crazy with alerts. We've used Burp and similar tools to perform security audits of the company's custom code, and audits of software we're doing a PoC with to ensure quality. I've never once worried that the tools I'm using would end up in the hands of more sophisticated hackers. If anything, I'm glad for the basic red team tools because it makes script kiddies easier to find. They're not going to do custom exploits anymore when Metasploit exists. On the other side, it's almost always a safe bet that the actual bad guys are going to skip the off-the-shelf tools... ... assuming, of course, you have a decent enough security posture as-is. If script kiddies and ransomware and Zeus can get into your network unnoticed, you've got a much larger problem on your hands. Unfortunately, most companies still fall into this category because even companies that spend tens of millions of dollars on security don't take basic security seriously.

raesene9 8y ago
So as a Blue teamer your perspective makes sense, as presumably you only work in organizations who can afford dedicated blue teams :) Where I think most of the re/mis-use of red team tools would be effective is in the many organizations who are not yet mature enough to staff a dedicated blue team capability...

deleted 8y ago

[deleted]