SYSTEMS AND METHODS FOR DETECTING COMPUTER VULNERABILITIES THAT ARE TRIGGERED BY EVENTS

• US 20180219909A1
• Filed: 03/29/2018
• Published: 08/02/2018
• Est. Priority Date: 01/30/2017
• Status: Active Grant

• Current Assignee: XM Cyber Ltd. (Schwarz Unternehmenskommunikation GmbH & Co. KG)
• Original Assignee: XM Ltd.
• Inventors: GORODISSKY, Boaz, ASHKENAZY, Adi, SEGAL, Ronen
• Granted Patent: US 10,686,823 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 41/048 mobile agents
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281

Abstract

Methods and systems for carrying out campaigns of penetration testing for discovering and reporting security vulnerabilities of a networked system, the networked system comprising a plurality of network nodes interconnected by one or more networks.

Claims

1. ) A method for discovering and reporting a security vulnerability of a networked system by a penetration testing system, the networked system comprising a plurality of network nodes interconnected by one or more networks, wherein the penetration testing system comprises (i) a reconnaissance agent software module, that (A) can be installed on one or more network nodes of the plurality of network nodes, and (B) when installed on a network node of the plurality of network nodes, is operable to detect at least some free events occurring in the network node on which it is installed and to transmit data about occurrences of the at least some free events to a remote computing device, and (ii) a penetration testing software module installed on the remote computing device and operable to communicate with at least one of the plurality of network nodes on which the reconnaissance agent software module is installed, the method comprising:

a) receiving, by the penetration testing software module installed on the remote computing device, a message from a first network node on which the reconnaissance agent software module is installed, the message notifying the remote computing device of a specific occurrence of a specific free event in the first network node, wherein the message originates from the reconnaissance agent software module installed on the first network node, and wherein the specific free event is one of;

i) sending a network message out of the first network node caused by a command from a user of the first network node;

ii) sending a network message out of the first network node caused by an operating system of the first network node;

iii) sending a network message out of the first network node caused by a software application installed on the first network node;

iv) mounting a storage volume onto the first network node; and

v) physically attaching a physical device to the first network node;

b) identifying, by the penetration testing software module and based on the received message, a specific opportunistic vulnerability with which the specific free event is associated, wherein the identifying of the specific opportunistic vulnerability comprises;

i) identifying a method for an attacker to compromise the first network node, and

ii) identifying that the method to compromise would be available to the attacker at or after a future occurrence of the specific free event in the first network node; and

c) reporting, by the penetration testing system, the specific opportunistic vulnerability, wherein the reporting comprises at least one of;

(i) causing a display device to display a report including information about the specific opportunistic vulnerability, (ii) storing the report including information about the specific opportunistic vulnerability in a file, and (iii) electronically transmitting the report including information about the specific opportunistic vulnerability.

2. ) The method of claim 1, wherein the specific free event is an internal event of the first network node.

3. ) The method of claim 1, wherein the identifying of the specific opportunistic vulnerability comprises executing the method for an attacker to compromise so as to validate that the first network node is compromised by the method for an attacker to compromise.

4. ) The method of claim 1, wherein the identifying of the specific opportunistic vulnerability comprises validating that the first network node is compromised by the method of an attacker to compromise by simulating or otherwise evaluating the method for an attacker to compromise, without attempting to compromise the first network node.

5. ) The method of claim 1, wherein the message notifying the remote computing device of the specific occurrence of the specific free event in the first network node is sent by the reconnaissance agent software module installed on the first network node immediately after and in response to detecting the specific occurrence of the specific free event in the first network node.

6. ) The method of claim 1, wherein the message notifying the remote computing device of the specific occurrence of the specific free event in the first network node is sent by the reconnaissance agent software module installed on the first network node according to a schedule that is independent of (i) a time of occurrence of the specific occurrence of the specific free event in the first network node, and (ii) a time of detection of the specific occurrence of the specific free event in the first network node by the reconnaissance agent software module installed on the first network node.

7. ) The method of claim 1, wherein the specific free event is an event of physically attaching a physical device to the first network node.

8. ) The method of claim 7, wherein the specific free event is an attaching of a storage device to a port of the of the first network node.

9. ) The method of claim 8, wherein the storage device is a removable USB storage device and the port is a USB port.

10. ) The method of claim 7, wherein the specific free event is an attaching of a communication device to a port of the first network node.

11. ) The method of claim 1, wherein the specific free event is an event of mounting a storage volume onto the first network node.

12. ) The method of claim 1, wherein the specific free event is an event of sending a network message out of the first network node, the sending caused by a command from a user of the first network node.

13. ) The method of claim 1, wherein the specific free event is a submission of a query from the first network node to a server.

14. ) The method of claim 1, wherein the specific free event is an event of sending a network message out of the first network node, the sending caused by an operating system of the first network node.

15. ) The method of claim 1, wherein the specific free event is an event of sending an ARP request message out of the first network node.

16. ) The method of claim 1, wherein the specific free event is an event of sending a network message out of the first network node, the sending caused by a software application installed on the first network node.

17. ) The method of claim 1, wherein the specific free event is an event of sending a WPAD message out of the first network node.

18. ) A system for discovering and reporting a security vulnerability of a networked system, the networked system comprising a plurality of network nodes interconnected by one or more networks, each network node of the plurality of network nodes including one or more processors, and at least one network node of the plurality of network nodes is in electronic communication with a remote computing device, the remote computing device including one or more processors, the system comprising:

a) a reconnaissance agent non-transitory computer readable storage medium for instructions execution by the one or more processors of a first network node which is in electronic communication with the remote computing device, the reconnaissance agent non-transitory computer readable storage medium having stored;

(1) instructions to detect at least some free events occurring in the first network node; and

(2) instructions to transmit data about occurrences of the at least some free events to the remote computing device;

b) a penetration testing non-transitory computer readable storage medium for instructions execution by the one or more processors of the remote computing device, the penetration testing non-transitory computer readable storage medium having stored;

(1) instructions to receive a message from the first network node, the message notifying the remote computing device of a specific occurrence of a specific free event in the first network node, wherein the specific free event is one of;

(a) sending a network message out of the first network node caused by a command from a user of the first network node;

(b) sending a network message out of the first network node caused by an operating system of the first network node;

(c) sending a network message out of the first network node caused by a software application installed on the first network node;

(d) mounting a storage volume onto the first network node; and

(e) physically attaching a physical device to the first network node;

(2) instructions to identify, based on the received message, a specific opportunistic vulnerability with which the specific free event is associated, wherein the instructions to identify the specific opportunistic vulnerability comprise;

(a) instructions to identify a method for an attacker to compromise the first network node, and

(b) instructions to identify that the method to compromise would be available to the attacker at or after a future occurrence of the specific free event in the first network node; and

(c) instructions to report the specific opportunistic vulnerability, the instructions to report comprising at least one of;

(i) instructions to cause a display device to display information about the specific opportunistic vulnerability, (ii) instructions to store the information about the specific opportunistic vulnerability in a file, and (iii) instructions to electronically transmit the information about the specific opportunistic vulnerability.

19. ) The system of claim 18, wherein the specific free event is an internal event of the first network node.

20. ) The system of claim 18, wherein the instructions to identify the specific opportunistic vulnerability comprise instructions to execute the method for an attacker to compromise so as to validate that the first network node is compromised by the method for an attacker to compromise.

21. ) The system of claim 18, wherein the instructions to identify the specific opportunistic vulnerability comprise instructions to simulate or otherwise evaluate the method for an attacker to compromise so as to validate that the first network node is compromised by the method of an attacker to compromise, without attempting to compromise the first network node.