Researchers map threat actors’ use of open source offensive security tools

guest · Oct 13, 2020

Researchers map threat actors’ use of open source offensive security tools
Hacking tools released by security researchers often end up being abused by bad guys as well
October 9, 2020
https://portswigger.net/daily-swig/...s-use-of-open-source-offensive-security-tools

Security researchers have developed techniques to chart how malicious hackers make use of open source offensive security tools.

The research, presented by Paul Litvak of Israeli start-up Intezer at the VB2020 localhost conference last week, informs the long-running debate on whether the development and publication of offensive security tools is beneficial or harmful to security as a whole.
Critics argue that offensive security tools give miscreants an advantage over the security community. Those on the other side of the argument contend that offensive security tools help defenders to mitigate newly discovered techniques and probe their own defenses for flaws.

"It's a hard question really, and I don't think we still have the full picture (hard data for the benefits of OST projects)," Litvak told The Daily Swig.
Click to expand...

Overall, 80 projects were checked for code reuse against a database of thousands of labeled threat actor samples from multiple vendor reports from the last few years. A total of 29 additional script-based tools were added using existing vendor reports.
Mapping miscreants
Intezer’s work allowed it to develop an interactive map that displays threat actors’ proclivity for open source offensive toolkits.

More sophisticated miscreants, mainly made up from cybercriminals, plagiarized open source tools. Such groups have an understanding of tools and their protocols and are capable of applying customizations and of integrating open source components into their existing toolsets.
Click to expand...

The OST map: mapping malware usage of open-source offensive security tools

The development and publication of offensive security tools (OSTs) has become one of the more controversial talking points in the information security community. Some argue releasing such tools to the Internet is irresponsible as it allows adversaries to outsource the development of tools and techniques from the InfoSec communities. Others believe the publication of these tools serves as a cornerstone to the education of new researchers, allowing defenders to mitigate newly discovered techniques and probe their own defences.
Click to expand...

Log in or Sign up

Researchers map threat actors’ use of open source offensive security tools

guest Guest

Log in or Sign up

Researchers map threat actors’ use of open source offensive security tools

guest Guest

Useful Searches