A new, easy to use tool known as AutoSploit is now on the market through a release on Github that can be used for mass hacking. It leverages Python code to automatically search for vulnerable devices connected to the Internet and then uses Metasploit’s collection of exploits to take over computers and IoT devices. IT security experts commented below.
Bob Noel, Director of Strategic Relationships and Marketing at Plixer:
“AutoSploit doesn’t introduce anything new in terms of malicious code or attack vectors. What it does present is an opportunity for those who are less technically adept to use this tool to cause substantial damage. Once initiated by a person, the script automates and couples the process of finding vulnerable devices and attacking them. The compromised devices can be used to hack Internet entities, mine cryptocurrencies, or be recruited into a botnet for DDoS attacks. The release of tools like these exponentially expands the threat landscape by allowing a wider group of hackers to launch global attacks at will. It also demonstrates that it is impossible for organizations to prevent all cyberattacks, and this should act as a wakeup call to invest in incident response technologies, people and best security practices. When breaches occur, having immediate access to forensic data (gathered from network traffic analytics platforms) is essential to understand what occurred, remediate the problem and quickly return to normal.”
“Autosploit makes it easy for anyone to launch massive hacks without savvy expertise. It automatically trolls the Internet for vulnerable devices which can be leveraged for DDoS attacks. This provides an unending opportunity for cybercriminals and script kiddies to hijack vulnerable devices and subsequently launch attacks against online organizations with ease. A significant motivation behind these DDoS attacks is for financial gain with a focus on extortion and ransom threats. These new, evolving malware as a service tools and techniques, is the signal that the gates are down and companies are faced with being attacked continuously. It is now imperative for organizations to implement a next generation Internet gateway that includes a DDoS layer of security to immediately detect and mitigate DDoS attacks. Without this DDoS mitigation layer, companies who are hit with a DDoS attack could face significant loss of revenues and reputation due to outages.”
“Both Metasploit and Shodan have been available for years, as integral to the pen testers toolkit as Nessus and Burpsuite. But with Autosploit pulling them together, the concern should be focused on curious kids thinking it would be fun to see what they can find, unknowingly falling foul of laws like the Misuse of Telecommunications Act.
“Responsible disclosure of vulnerabilities is good for everyone, but releasing tools that simplify the process of indiscriminately breaking into systems that leverage those vulnerabilities is foolhardy.
“Most organisations should have a process in place for measuring their cyber risk and identifying issues that could be easily leveraged by automated tools. For those that don’t, this would be an ideal time to understand where those exposures are and address them before a curious kid pops a web server and causes havoc with a couple of commands.”
“From a technical perspective, this is a very small step. Even moderately sophisticated hackers have had the ability to manually combine these tools for a long time. But as an simple enabler of broad, automated, and undiscriminating exploits against open targets, this is definitely troubling.
“My fear is that this has magnified the attack surface, and made it so that “every” exposed service on the internet will be scanned and probed on a near-constant basis by an entirely new set of attackers.
“It is extremely likely that someone might use it. People have been using similar tools for years, this will make legitimate pen testing and malicious actors jobs easier.
“In order to protect themselves, organizations need to get a clear, accurate, and up-to-date picture of every service they expose to the Internet. Security teams must combine internal tools with external systems like Shodan to ensure they’re aware of all their points of exposure. This must include both traditional on-premises resources, as well as cloud-based resources such as applications running on IaaS. The latter can be considerably more difficult than the former.
“In addition, organizations need to seriously consider using a new and more secure approach to network security, which hides their services from unauthorized users and scanning tools. Security teams need to be honest, and embrace the hard fact that the fundamental premise of traditional network security – exposing services to unauthorized users prior to any sort of authentication – is profoundly flawed and puts the organization at risk. These just-released hacking tools should make this shift in philosophy even more urgent for enterprises, and they must consider new approaches such as the Software-Defined Perimeter.”
ISBuzz Team embodies the collaborative efforts of the dedicated staff at Information Security Buzz, converging a wide range of skills and viewpoints to present a unified, engaging voice in the information security realm. This entity isn't tied to a single individual; instead, it's a dynamic embodiment of a team diligently working behind the scenes to keep you updated and secure. When you read a post from ISBuzz Team, you're receiving the most relevant and actionable insights, curated and crafted by professionals tuned in to the pulse of the cybersecurity world. ISBuzz Team - your reliable compass in the fast-evolving landscape of information security
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.