Adversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker

Adversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker

Speakers: Roy

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=mVWSdqds9uo

Overview

In this thought-provoking VulnCon presentation, "Adversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker," Roy, an expert from Codem Security with a notable background at NSO Group, provided a unique perspective on application security. The talk delved into the strategic mindset of advanced attackers, drawing heavily from his experience with Pegasus, NSO Group's infamous spyware. The core thesis posits that defenders can significantly enhance their security posture by adopting an adversarial lens, understanding how vulnerabilities are exploited not in isolation, but as interconnected chains designed to achieve specific objectives.

Roy's insights challenge conventional security practices that often prioritize vulnerabilities based solely on individual CVSS scores. Instead, he advocates for a holistic approach, emphasizing that the true risk of a vulnerability often lies in its potential to be combined with others, even seemingly low or medium-severity flaws, to form a potent attack path. The presentation underscored the importance of understanding attacker workflows, leveraging frameworks like MITRE ATT&CK, and exploiting the defender's inherent advantage of internal knowledge to build more resilient systems.

This talk is crucial for anyone involved in application security, development, or risk management. It offers a paradigm shift from reactive vulnerability management to proactive, intelligence-driven defense. By dissecting the methodologies of sophisticated offensive operations, Roy illuminates practical strategies for identifying critical attack paths, optimizing remediation efforts, and fostering a more effective security dialogue within organizations.

Background

▶ Watch: Introduction: From NSO Group to application security (0:00)

The foundation of Roy's talk is his direct experience from NSO Group, a cyber offensive company globally recognized for its Pegasus spyware. Pegasus gained notoriety for its ability to covertly infiltrate mobile devices, including iPhones and Androids, effectively bypassing the sophisticated security measures implemented by top-tier security teams and device manufacturers. This background provided Roy with an unparalleled understanding of how advanced adversaries operate, what motivates them, and the techniques they employ to achieve their objectives.

A critical observation shared by Roy pertains to the general distribution of vulnerabilities. While specific numbers fluctuate, a consistent pattern emerges: medium and low-severity vulnerabilities are far more numerous than critical or high-severity ones. This statistical reality, combined with organizational Service Level Agreements (SLAs) that typically mandate faster remediation for critical and high findings, creates an exploitable gap for attackers. Medium and low vulnerabilities, often overlooked or deprioritized, remain unpatched for extended periods, making them attractive targets for productized exploitation.

Furthermore, Roy highlighted the limitations of traditional vulnerability scoring mechanisms like CVSS, which often lack the necessary context of a specific environment or application's use case. A vulnerability might be rated medium globally but could be critical within a particular system due to its unique configuration or data access. This disconnect between generic scoring and actual environmental risk is a significant blind spot for many defensive teams.

The talk also addressed the common challenges faced by security teams regarding their existing toolsets. Many security tools are noisy, generating thousands of alerts upon deployment, leading to significant backlogs. They are often narrow in scope, focusing on specific application components (e.g., SAST, DAST, CSPM, WAF) without providing a comprehensive, contextualized view of the entire attack surface. This fragmented visibility makes it difficult for defenders to piece together potential attack chains and understand the true risk across their environment. Attackers, conversely, adopt a holistic, opportunistic approach, weaving through these fragmented defenses to achieve their goals.

Key Findings

▶ Watch: Why attackers target medium/low severity vulnerabilities (3:00)

The central revelation of Roy's talk is the fundamental difference in perspective between attackers and defenders: attackers think in vulnerability chains, not isolated flaws. This leads to several key findings:

1. Chaining Low/Medium Vulnerabilities for Critical Impact: Attackers actively seek to combine multiple seemingly innocuous, low, or medium-severity vulnerabilities to achieve a high-impact outcome. Because these vulnerabilities often have longer remediation SLAs, they persist in systems, offering extended windows of opportunity for exploitation. Two medium vulnerabilities, when chained effectively, can collectively pose a critical risk that individual CVSS scores would never indicate.
2. Exploiting Organizational Workflows: Beyond technical flaws, sophisticated attackers exploit the operational workflows and prioritization mechanisms of their targets. Understanding how organizations triage vulnerabilities (e.g., focusing only on critical/highs) allows attackers to strategically target and leverage lower-severity issues that are less likely to be promptly addressed. The ability to find "adjacent" vulnerabilities in similar codebases or components, even before public disclosure, further amplifies this advantage, allowing attackers to prepare exploits in advance.
3. Holistic System View: Attackers adopt a holistic approach, viewing the entire system or platform as a complex, interconnected entity. They are not confined to specific applications or components but rather seek mini-holes and pathways that allow them to weave their way through different layers of defense. This contrasts sharply with the often-siloed views provided by individual security tools.
4. The Power of the "Story": A vulnerability chain creates a compelling narrative about how an attacker can achieve a specific goal (e.g., "credential exfiltration"). This "story" is invaluable for internal communication within an organization, helping to convey the true risk to developers, management, and other stakeholders, thereby improving prioritization and remediation efforts.
5. Proactive Defense Through Chain Breaking: By identifying these potential attack chains, defenders can adopt a more proactive security posture. Fixing even a single vulnerability that serves as a critical link in a chain can effectively break the entire attack path, preventing the attacker from achieving their objective, even if other vulnerabilities in the chain remain unpatched.
6. "Take What You Got": Attackers are opportunistic and pragmatic. They don't wait for the "perfect" vulnerability; they leverage whatever exploitable flaws are available at a given time, even if they are small, and combine them creatively. This includes developing "backups" for parts of a chain to ensure rapid adaptation to defensive updates (e.g., quickly exploiting new iOS versions).

Technical Deep Dive

▶ Watch: Single vulnerabilities are steps in an attack chain (5:00)

The technical core of Roy's talk revolves around the practical application of adversarial intelligence through vulnerability chaining. This concept moves beyond a static assessment of individual vulnerabilities to a dynamic understanding of how multiple flaws can be orchestrated to achieve a complete attack lifecycle.

At NSO Group, the process involved meticulously identifying individual vulnerabilities and then mapping them to specific tactics and techniques within a broader attack strategy. The MITRE ATT&CK Framework serves as an invaluable common language for this, allowing security teams to categorize and understand attacker goals, such as initial access, privilege escalation, persistence, or data exfiltration. By assigning these labels to vulnerabilities, it becomes possible to visualize how different flaws contribute to a larger objective.

Consider an example chain: an attacker might first exploit a medium-severity SQL injection vulnerability for initial access. This doesn't directly give them sensitive data but might grant them access to a less-privileged application server. From there, they might leverage a low-severity misconfiguration in a local service to achieve privilege escalation on that server. Finally, a critical-severity deserialization vulnerability in a backend component, accessible from the now-compromised server, could allow for remote code execution (RCE), ultimately leading to credential exfiltration and data retrieval. In this scenario, two medium/low-severity issues were crucial stepping stones to exploiting a critical one, highlighting how the overall risk is far greater than the sum of its parts.

A key technique used by NSO Group, and one that defenders can learn from, is expanding the vulnerability. When a vulnerability is discovered in a specific component or codebase, attackers actively search for "adjacent vulnerabilities." These might be practically the same flaw in different parts of the application, or similar logical flaws arising from shared code, copied components, or the same development team's patterns. These adjacent flaws, often undisclosed, become immediate targets because attackers can predict their existence and prepare exploits ahead of time, exploiting the SLAs and disclosure cycles of organizations.

For defenders, adopting this mindset requires a structured approach:

1. Comprehensive Inventory: The first step is to truly understand the full attack surface. This includes traditional assets like containers, Virtual Machines (VMs), and legacy software, but also modern cloud software and third-party dependencies. Without a clear inventory, identifying potential chain links is impossible.
2. Mitigation Analysis: Understanding existing mitigations (e.g., Web Application Firewall (WAF) rules, network segmentation, strong authentication) is crucial. These are an attacker's "worst nightmare" because they actively disrupt attack paths. Defenders must map their mitigations to potential attack techniques to identify gaps.
3. Developing Chain Thinking: This is the most critical shift. Instead of fixing vulnerabilities in isolation, security teams must ask: "What can an attacker do with this vulnerability, and what other vulnerabilities could they combine it with to achieve a more significant goal?"

Roy also highlighted several open-source tools that can aid in this transition:

• Steampipe: A TSQL tool that allows querying cloud providers using SQL, helping to build comprehensive asset inventories.
• Sift: An excellent tool for generating Software Bill of Materials (SBOMs) and performing Software Composition Analysis (SCA), crucial for understanding dependencies.
• Opengrep: A fork of Semgrep, useful for static analysis and finding code patterns that might indicate vulnerable or adjacent code.
• AI Providers: Roy emphasized the transformative potential of Artificial Intelligence (AI). By fine-tuning models (e.g., Llama, Llama 3) on vulnerability databases and source code, AI can automatically classify vulnerabilities, map them to MITRE ATT&CK tactics, explain their potential use, and even help in identifying potential chain components, significantly reducing manual effort for understaffed security teams.
• OSV (Open Source Vulnerability) database: This database, with its graph-like structure, is particularly useful for visualizing relationships between vulnerabilities and components, aiding in the identification of potential chains.

The overarching technical message is that by understanding how attackers pragmatically "take what they got" and weave together disparate flaws, defenders can proactively break these chains, even with "backups," and prevent the most impactful attacks.

Demo / Proof of Concept

▶ Watch: MITRE ATT&CK: Common language to think like an attacker (7:30)

While Roy's presentation did not feature a live, real-time demonstration or a step-by-step proof of concept of a specific exploit chain, the entire talk served as a conceptual deep dive into the methodologies and strategic thinking that underpinned the operations of NSO Group and the development of tools like Pegasus. The speaker's direct experience in a cyber offensive company, which was famously successful in breaking into highly secured mobile devices, acts as the ultimate "proof of concept" for the adversarial intelligence approach he advocates.

The conceptual "demo" is the historical success of Pegasus, which competed effectively with top security teams. This required the continuous discovery and chaining of vulnerabilities (e.g., memory corruption flaws in operating systems, privilege escalations, and data exfiltration techniques) to create robust, multi-stage exploits that could bypass sophisticated defenses and achieve persistent access. Roy's discussion of "expanding the vulnerability" by finding adjacent flaws and creating "backups" for parts of an exploit chain directly reflects the engineering rigor and strategic foresight necessary for such advanced offensive operations to maintain efficacy against rapid defensive updates, such as new iOS versions.

Therefore, although no specific code or exploit was shown, the talk demonstrated the philosophy and principles that enable such powerful attacks, urging defenders to internalize this adversarial mindset.

Defensive Implications

▶ Watch: Example: Building an attack chain and telling its story (8:30)

The insights from "Adversarial Intelligence" carry profound implications for defensive strategies, urging a fundamental shift from reactive, score-based remediation to proactive, intelligence-driven risk management.

1. Re-evaluate Vulnerability Prioritization: Defenders must move beyond solely relying on generic CVSS scores. Instead, they should prioritize vulnerabilities based on their potential role in an attack chain within their specific environment. Two medium-severity vulnerabilities that form a critical chain link should be treated with higher urgency than an isolated critical vulnerability that cannot be leveraged for a broader attack. This requires deep contextual understanding of the application's architecture, data flows, and existing security controls.
2. Adopt a MITRE ATT&CK-centric View: Integrate the MITRE ATT&CK Framework into vulnerability management processes. Map discovered vulnerabilities to specific attacker tactics and techniques. This provides a common language and a structured way to understand how individual flaws contribute to potential attack paths, enabling teams to visualize and disrupt chains.
3. Invest in Comprehensive Asset and Mitigation Inventories: Before chaining can be understood, defenders need a complete, up-to-date inventory of all assets (cloud, on-prem, containers, third-party) and, critically, all existing mitigations (WAFs, network segmentation, strong authentication, endpoint detection and response). Understanding what defenses are in place and where they are effective is key to identifying gaps and potential points of failure in an attacker's path.
4. Proactive Chain Disruption: Instead of trying to fix every vulnerability, defenders should focus on breaking critical links in potential attack chains. Identifying a "choke point" vulnerability that, if remediated, would disrupt multiple attack paths, is a highly efficient and effective defensive strategy. This requires an understanding of how vulnerabilities connect and what the attacker's ultimate goal might be.
5. Leverage AI for Contextual Analysis and Storytelling: Utilize AI and Machine Learning (ML), potentially fine-tuned models, to automate the classification of vulnerabilities, map them to ATT&CK techniques, and identify potential connections. AI can help understaffed teams process vast amounts of vulnerability data and generate "stories" about potential attack chains. This narrative approach can significantly improve communication with developers and management, helping them understand the real-world impact and urgency of remediation efforts.
6. "Know Thyself" – Exploit Internal Knowledge: Roy emphasized that the biggest advantage defenders have is first-party access to their entire infrastructure, code, and personnel. This internal knowledge is something external attackers inherently lack. Defenders should leverage this advantage by performing detailed threat modeling, conducting internal red teaming exercises focused on chain exploitation, and fostering a culture where developers understand how their code fits into the larger attack surface.
7. Focus on "Challenging" Attack Vectors: The speaker noted that for systems like phones, privilege escalation and data exfiltration are often the most challenging and interesting parts for attackers. Defenders should prioritize securing these stages of an attack, as disrupting them can be highly effective.

By internalizing the attacker's holistic, opportunistic, and chain-oriented mindset, defenders can move from a reactive posture of patching individual flaws to a proactive strategy of disrupting entire attack campaigns, ultimately building more resilient and secure applications.

Key Takeaways

• Attackers Think in Chains: Sophisticated attackers do not exploit single vulnerabilities; they chain together multiple flaws, including low and medium-severity ones, to achieve specific objectives like data exfiltration or privilege escalation.
• Organizational Workflows are Exploitable: Attackers leverage defender prioritization (SLAs favoring critical/highs) and disclosure cycles to exploit medium/low vulnerabilities that persist longer, or to prepare for newly discovered flaws.
• Holistic View is Crucial: Defenders must adopt an attacker's holistic view of the entire system, rather than focusing on isolated applications or components, to identify potential attack paths.
• MITRE ATT&CK for Common Language: Using frameworks like MITRE ATT&CK helps categorize vulnerabilities by attacker tactics, facilitating the identification and communication of potential attack chains.
• AI for Enhanced Defense: AI can significantly aid in classifying vulnerabilities, mapping them to attacker techniques, and generating "stories" about potential chains, improving prioritization and communication.
• "Know Thyself" is the Ultimate Advantage: Defenders possess unique first-party access to their infrastructure, code, and people, which is their greatest leverage against external attackers and should be actively utilized for proactive defense.

About the Speaker(s)

The speaker, Roy, is an application security expert currently working with Codem Security. Codem Security specializes in application security, focusing on runtime, SCA (Software Composition Analysis), and SAST (Static Application Security Testing) solutions. Prior to his role at Codem, Roy gained significant experience at NSO Group, a cyber offensive company renowned for its development of the Pegasus spyware. His background at NSO Group provided him with unique insights into the adversarial mindset and the sophisticated techniques employed by advanced attackers to compromise systems, particularly mobile phones. Roy's talk at VulnCon drew heavily on this experience to advocate for a proactive, attacker-centric approach to application security. He mentioned having flown in from Portland for the conference.