GVScan: Scanning Networks for Global Vulnerabilities

Abstract

A global vulnerability is a set of vulnerabilities in one or several nodes of an ICT infrastructure. These vulnerabilities enable some attacks that may be sequentialized so that the privileges that each attack requires are acquired through the previous ones. Current vulnerability scanners cannot discover global vulnerabilities because they analyze each node in isolation, without correlating the vulnerabilities in the same or in distinct nodes. To discover global vulnerabilities, an analysis has to correlate node vulnerabilities according to the architecture and the topology of the infrastructure. After defining a formal analysis to discover global vulnerabilities and the corresponding attack sequences, we present GVScan, a tool to automate the analysis based upon a classification of vulnerabilities. A first application of GVScan to a real infrastructure is described together with an evaluation of its accuracy. I. INTRODUCTIONTo evaluate the security of an ICT infrastructure, we need to discover all its vulnerabilities and the attacks they enable. Currently, this analysis is supported by several tools that scan, e.g. analyze, a node to discover its local vulnerabilities and the elementary attacks they enable. However, these tools may miss some attacks because they do not correlate the vulnerabilities of distinct infrastructure nodes. Hence, they neglect that an intelligent threat agent may discover and implement a complex attack, e.g. a sequence of elementary attacks enabled by distinct local vulnerabilities in one or several nodes. A complex attack results in a privilege escalation where an agent uses the privileges acquired through an attack in the sequence to implement the following ones till acquiring all the privileges of interest. By properly exploiting interactions among nodes, an agent that owns some privileges on a node can implement a complex attack to acquire further privileges on a distinct node. A complex attack is enabled by a global vulnerability, i.e. by a set of local correlated vulnerabilities. Each distinct elementary attack in the complex one is enabled by a subset of the vulnerabilities in the global one. This paper presents a formal analysis to correlate local, distinct vulnerabilities in one or several nodes based upon a formal classification of vulnerabilities. Then, it describes GVScan, the tool that automates this analysis to discover global vulnerabilities of an ICT infrastructure starting from the output of the scanning of each node. The paper is organized as follows. Sect. 2 briefly

The spatial exposure of the Chinese infrastructure system to flooding and drought hazards

“…Therefore global graph measures such as the number of vertices and edges have been introduced to study network connectivity performance under different attack strategies (Holme et al 2002). Applications of such theories can be found in the Information & Communication Technology (ICT) and the power sectors where fictional or real networks are studied (Baiardi & Corò 2013;Bompard et al 2013;Mao et al 2009;Matisziw et al 2009).…”

Iterative selection of countermeasures for intelligent threat agents

“…The builder deduces from the CVE description of v and from its common vulnerability scoring system score other attributes of the attacks that v enables such as the pre‐condition and post‐condition, the success probabilities and the execution time. We refer to for a detailed discussion of the current implementation of the builder and the accuracy of the classification.…”

“…Haruspex is a suite of tools that supports the proposed approach. Some tools of the suite build the infrastructure, and the agent models starting from the output of a vulnerability scanning and by interacting with the user.…”

“…With respect to our previous works , this one is focused on risk management rather than on risk assessment. Hence, we briefly describe the tools to assess the risk and focus on the planner and the manager that automatically manage the risk.…”

Simulating Attack Plans Against ICT Infrastructures

“…We discuss the design of GVScan (Baiardi et al 2013a), our tool that builds the description of the target system, of its components, their vulnerabilities and the corresponding attacks. Since most of the scenarios of interest for an assessment differ because of the agents, the availability of a tool such as GVScan strongly reduces the complexity of the assessment.…”