CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva CS spirent securitylabs userscases reva
Trang 1Case Study
Large New York Hospital:
Project Type: Penetration Testing—Medical Devices,
Application, External and Internal Network
• External and Internal network penetration testing
on large IP ranges/infrastructure (Class B sized
networks, several thousand users)
• Followed appropriate precautions with internal
coordination to avoid impacting live clinical
systems and patient safety
• Server-side and client-side vulnerability testing
• Performed penetration testing, embedded
[Medical] device testing and mobile application
pen-testing to help identify vulnerabilities and
suggested remediation
International Railway Company:
Project Type: Red Team Engagement
• Identified random internal domain names using a
thorough recon process
• Breached external network and gained access to
the internal network remotely without triggering
any IDS/IPS/Firewall/AV/SIEM alert
• Breached physical security to obtain company
sensitive assets
• Bypassed various security controls and
compromised the internal network to gain access to
the mission critical data and systems
Global Restaurant Chain:
Project Type: Web, Mobile App scanning and
penetration testing
• The SecurityLabs dashboard is being used to
manage the entire Web and Mobile Application
Security program and remediation process for the
organization worldwide
• SecurityLabs platform is integrated with Client’s
application development lifecycle to perform
security assessments on the pre-production and
production environments
• The organization utilizes the portal to monitor the
overall security status of the organization, utilizes
the APIs, alerts and notification for prioritizing risk
and remediation efforts
Large Enterprise:
Project Type: Web Application and External Network Penetration Testing
• Performed a penetration test against the publicly exposed infrastructure such as servers, devices, applications and services
• Thorough Open source intelligence (OSINT) led
to the discovery of critical data such as IP ranges, employee details, domain & sub-domain names, administrative interfaces, remote access services etc
• Carefully crafted stealth attack based on the gathered information and acquired knowledge of the target environment enabled Spirent to breach the external perimeter and gain access to the internal network
• Furthermore, the primary internal domain was compromised, and highest level of access was achieved Consequently, it was possible to gain unauthorized administrative access to all the critical resources from the Internet without setting off any alarms
Government Entity:
Project Type: External Penetration Test, Internal Penetration Test, Wireless Assessment
• External network penetration testing and vulnerability scanning for primary and secondary datacenters
• Internal penetration testing covering network, server, and client systems and vulnerabilities
• Wireless network security assessment and rogue access point detection/mapping
Financial Services:
Project Type: Penetration Testing
• External network penetration testing on large IP ranges/infrastructure
• Followed appropriate precautions with internal coordination to avoid impacting live systems
• Performed unauthenticated and authenticated web application penetration testing to help identify vulnerabilities and suggested remediation
Spirent SecurityLabs
Experience and Use-Cases
Trang 2Spirent SecurityLabs—Experience and Use-Cases
Payment Gateway:
Project Type: Vulnerability Scanning and Penetration
Testing
• Performed quarterly assessment on payment card
applications and connected services to assess
against new threats and vulnerabilities on an
ongoing basis and ensure that these applications
are protected against known attacks by either of
the following methods such—_Injection—_XSS, SQL
Injection, Buffer Overflow, Phishing, Authentication
and Authorization, Insecure cryptographic storage,
Insecure communication and improper error
handling etc
• The vulnerabilities identified by the PCI assessment
6.5.1 to 6.5.10 provided a minimum baseline for
the organization to remain up to date with the
vulnerability trend and incorporate appropriate
measures into their secure coding practices
Global Automotive Manufacturer:
Project Type: Application Penetration Testing
• Performed a mobile application penetration test
on the connected car app that lead to a successful
man in the middle attack and uncovered a remote
carjacking issue
• Every HTTP request contains Account number,
Device ID and VIN in the URL These URL query
parameters remain static and can be reused to
perform actions like unlocking the car, flashing the
lights without authenticating into the application
using account number and PIN
• Several other similar HTTP Requests could be
issued remotely to start the car, modify climate
controls, modify parental controls etc
American Automotive Manufacturer:
Project Type: Exploiting Assisted Driving System
Weaknesses
• Attacks against vehicles that utilize optical vision
systems—the use of robotic vision ocular ques and
quick deploy decoys to redirect or stop the vehicle
• Attacks against vehicles that utilize radar based
assisted driving systems—By creating false radar
shadows and using radar reflector decoys
Automotive:
Project Type: Infotainment Penetration Test
• Performed penetration test on vehicle’s infotainment system Showcased ability to disable air bags, disable steering wheel, modify steering response, modify body sensor sensitivity, turn on lights, blinkers, modify car firmware over the USB port
• Use of USB interface to modify infotainment system firmware, extract contents of stored address book, add and modify address book entries, extract phone unlock pin and IMEI of phone associated to the vehicle And walkthrough of USB Rubber ducky modules
Banking:
Project Type: Prototype Architecture and Web Applications
• Performed testing on prototype architecture and web applications that were being rolled out by an international bank The infrastructure facilitates access and enforces procedures for transfers over SWIFTNet
American Multinational Financial Services Company:
Project Type: Managed Web Application Scanning
• Performed weekly scanning and monitoring
on all 1500+ web applications to help identify 0day and existing vulnerabilities Mitigate risk
by tactically help write firewall rules to patch existing vulnerabilities and suggested code level remediation to be implemented in subsequent release cycle
• Identified numerous critical vulnerabilities such
as SQL Injection, Cross-Site Scripting, Credit-Card Disclosures, PII Disclosure, PCI Violations, compromised critical risk applications
Contact Us
For more information, call your Spirent sales representative or
visit us on the web at www.spirent.com/ContactSpirent.
www.spirent.com
© 2019 Spirent Communications, Inc All of the company names and/or brand names
and/or product names and/or logos referred to in this document, in particular the
name “Spirent” and its logo device, are either registered trademarks or trademarks
pending registration in accordance with relevant national laws All rights reserved
Specifications subject to change without notice
Americas 1-800-SPIRENT +1-800-774-7368 | sales@spirent.com
US Government & Defense info@spirentfederal.com | spirentfederal.com
Europe and the Middle East +44 (0) 1293 767979 | emeainfo@spirent.com
Asia and the Pacific +86-10-8518-2539 | salesasia@spirent.com
Rev A | 01/19