A new, easy to use tool known as AutoSploit is now on the market through a release on Github that can be used for mass hacking. It leverages Python code to automatically search for vulnerable devices connected to the Internet and then uses Metasploit’s collection of exploits to take over computers and IoT devices. IT security experts commented below.
Bob Noel, Director of Strategic Relationships and Marketing at Plixer:
“AutoSploit doesn’t introduce anything new in terms of malicious code or attack vectors. What it does present is an opportunity for those who are less technically adept to use this tool to cause substantial damage. Once initiated by a person, the script automates and couples the process of finding vulnerable devices and attacking them. The compromised devices can be used to hack Internet entities, mine cryptocurrencies, or be recruited into a botnet for DDoS attacks. The release of tools like these exponentially expands the threat landscape by allowing a wider group of hackers to launch global attacks at will. It also demonstrates that it is impossible for organizations to prevent all cyberattacks, and this should act as a wakeup call to invest in incident response technologies, people and best security practices. When breaches occur, having immediate access to forensic data (gathered from network traffic analytics platforms) is essential to understand what occurred, remediate the problem and quickly return to normal.”
Stephanie Weagle, VP at Correro:
“Autosploit makes it easy for anyone to launch massive hacks without savvy expertise. It automatically trolls the Internet for vulnerable devices which can be leveraged for DDoS attacks. This provides an unending opportunity for cybercriminals and script kiddies to hijack vulnerable devices and subsequently launch attacks against online organizations with ease. A significant motivation behind these DDoS attacks is for financial gain with a focus on extortion and ransom threats. These new, evolving malware as a service tools and techniques, is the signal that the gates are down and companies are faced with being attacked continuously. It is now imperative for organizations to implement a next generation Internet gateway that includes a DDoS layer of security to immediately detect and mitigate DDoS attacks. Without this DDoS mitigation layer, companies who are hit with a DDoS attack could face significant loss of revenues and reputation due to outages.”
Gavin Millard, Technical Director at Tenable:
“Both Metasploit and Shodan have been available for years, as integral to the pen testers toolkit as Nessus and Burpsuite. But with Autosploit pulling them together, the concern should be focused on curious kids thinking it would be fun to see what they can find, unknowingly falling foul of laws like the Misuse of Telecommunications Act.
“Responsible disclosure of vulnerabilities is good for everyone, but releasing tools that simplify the process of indiscriminately breaking into systems that leverage those vulnerabilities is foolhardy.
“Most organisations should have a process in place for measuring their cyber risk and identifying issues that could be easily leveraged by automated tools. For those that don’t, this would be an ideal time to understand where those exposures are and address them before a curious kid pops a web server and causes havoc with a couple of commands.”
Jason Garbis, VP at Cyxtera:
“From a technical perspective, this is a very small step. Even moderately sophisticated hackers have had the ability to manually combine these tools for a long time. But as an simple enabler of broad, automated, and undiscriminating exploits against open targets, this is definitely troubling.
“My fear is that this has magnified the attack surface, and made it so that “every” exposed service on the internet will be scanned and probed on a near-constant basis by an entirely new set of attackers.
“It is extremely likely that someone might use it. People have been using similar tools for years, this will make legitimate pen testing and malicious actors jobs easier.
“In order to protect themselves, organizations need to get a clear, accurate, and up-to-date picture of every service they expose to the Internet. Security teams must combine internal tools with external systems like Shodan to ensure they’re aware of all their points of exposure. This must include both traditional on-premises resources, as well as cloud-based resources such as applications running on IaaS. The latter can be considerably more difficult than the former.
“In addition, organizations need to seriously consider using a new and more secure approach to network security, which hides their services from unauthorized users and scanning tools. Security teams need to be honest, and embrace the hard fact that the fundamental premise of traditional network security – exposing services to unauthorized users prior to any sort of authentication – is profoundly flawed and puts the organization at risk. These just-released hacking tools should make this shift in philosophy even more urgent for enterprises, and they must consider new approaches such as the Software-Defined Perimeter.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.