Re:FireEye Shares Details of Recent Cyber Attack
by pabs3 on Tuesday December 08, 2020 @10:07PM
(#25354861)
Whats your opinion of open source tools and distributions of them (like Kali) in this space and the tradeoff between open sourcing your red team tools vs reimplementing tools that are already out there.
[ Parent
| on HN ]
Re:FireEye Shares Details of Recent Cyber Attack
by mike_d on Tuesday December 08, 2020 @10:18PM
(#25354935)
A vulnerability that is secret is the biggest threat to security. Publishing tools makes them public knowledge that can be defended against.
If you are doing penetration testing and basic security work, there is no value in having private tools. It becomes important in red team work because you are trying to emulate a real attacker that has access to non-public tools.
Re:FireEye Shares Details of Recent Cyber Attack
by gen3 on Tuesday December 08, 2020 @11:19PM
(#25355312)
The point in them re-implementing some of the public tools is so sites like totalvirius or a hash based antivirus does not pick up on what the program is.
If they didn’t have a binary that looked reasonably different to those that already exist, then it would instantly get triggered. It is worth noting that there are tools to obfuscate sourcecode/bins.