The Most Important Critical Penetration Test Findings of 2024

One of the most effective ways for information technology (IT) professionals to uncover a company's vulnerabilities before malicious hackers do is through penetration testing. By simulating real-world cyber attacks, penetration tests provide invaluable insight into an organization's security posture and reveal weaknesses that could potentially lead to data breaches or other security incidents.

1. Multicast DNS (MDNS) Spoofing

Multicast DNS (mDNS) is a protocol used to resolve DNS names on small networks without a local DNS server. It sends queries to the local subnet, allowing any system to respond with the requested IP address. This can be exploited by attackers who can respond with their own system's IP address

Suggestion:

The most effective method to prevent abuse is to completely disable mDNS when not in use.

2. NetBIOS Name Service (NBNS) Spoofing

NetBIOS Name Service (NBNS) is a protocol used on internal networks to resolve DNS names when a DNS server is unavailable. It broadcasts queries over the network and any system can respond with the requested IP address. This can be exploited by attackers who can respond with their own system's IP address.

Suggestion:

Configure the UseDnsOnlyForNameResolutions registry key to prevent systems from using NBNS queries (NetBIOS via TCP/IP Configuration Parameters). Set the registry DWORD to:

Disable the NetBIOS service for all Windows hosts on the internal network. This can be done through DHCP options, network adapter settings, or a registry key.

3. Link-Local Multicast Name Resolution (LLMNR) Spoofing

Link-Local Multicast Name Resolution (LLMNR) is a protocol used on internal networks to resolve DNS names when a DNS server is unavailable. It broadcasts queries over the network, allowing any system to respond with the requested IP address. This can be exploited by attackers who can respond with their own system's IP address.

Suggestion:

Using Group Policy: Computer Configuration\Administrative Templates\Network\DNS Client\Turn Off Multicast Name Resolution = Enabled (To manage a Windows 2003 DC, use Remote Server Administration Tools for Windows 7)

Using the Registry for Windows Vista/7/10 Home Edition only: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\ Windows NT\DNSClient\EnableMulticast

4. IPV6 DNS Spoofing

IPv6 DNS spoofing occurs when a rogue DHCPv6 server is deployed on a network. Since Windows systems prefer IPv6 over IPv4, it will use the DHCPv6 server if IPv6-enabled clients are available. During the attack, these clients are assigned an IPv6 DNS server and the clients retain their IPv4 configuration. This allows the attacker to intercept DNS requests by reconfiguring clients to use the attacker's system as a DNS server.

 Suggestion:

Disable IPv6 unless required for business operations. It is highly recommended to test this configuration before mass deployment, as disabling IPv6 could potentially cause disruption to network services. An alternative solution would be to apply DHCPv6 protection to network switches. Essentially, DHCPv6 protection ensures that only an authorized list of DHCP servers is allowed to assign leases to clients.er.

5. Legacy Microsoft Windows Systems

An outdated Microsoft Windows system is vulnerable to attacks because it no longer receives security updates. This makes it an easy target for attackers who can exploit its vulnerabilities and potentially target other systems and resources on the network.

Suggestion:

Replace older versions of Microsoft Windows with up-to-date, manufacturer-supported operating systems.