Companies with multiple branches often find it challenging to discover remote security vulnerabilities. Pwnie Express offers all-in-one solutions designed to help you do remote asset discovery, vulnerability scanning and penetration testing.
Do you have workers who access corporate systems and applications from branch offices or retail, warehouse or field locations? If so then the next question is, how do you feel about the security posture at these locations? Do they have adequate information security measures? Have you tested for vulnerabilities lately?
If these questions have reminded you that information security at remote locations can be iffy, then it may be time to put some sensors out there to do some vulnerability scanning and penetration testing. Pwnie Express promises to make that task easy.
Pwnie Express offers an active discovery vulnerability scanning and penetration testing solution for remote sites and branch locations. The plug-and-play solution is comprised of hardware (in several form factors) and more than a hundred security testing products. You can buy an all-in-one sensor for about $1,000 and place a sensor in each remote location to do continuous testing for vulnerabilities.
+ ALSO ON NETWORK WORLD 15 free security tools that you should try +
The easiest of the Pwnie products to use appears to be the Pwn Plug R2, a small sensor with a power plug and a connector that plugs into Internet connections at a remote site. No technical expertise is required; you just need someone to plug it in. All of the testing capabilities and the “phone home” capabilities are built in and activated remotely by a professional back at headquarters.
In early May, Pwnie Express launched its latest device, the Pwn Phone 2014, which is based on the LG Nexus 5 smartphone. In terms of mobility and convenience, it takes a place alongside the Pwn Pad 2014, a tablet-based sensor built on the LG Nexus 7 platform. These mobile devices allow an IT or InfoSec professional to walk into a remote or branch location and run tests unobtrusively. In particular, the Pwn Phone can be kept in a pocket while the tester walks around to detect wireless connections. Many of the phone-based tests can be run from a simple icon on the touchscreen interface.
All of the Pwnie devices are packed with open source tools that can do asset discovery and run various tests to determine what, if any, vulnerabilities exist. The test results are sent securely back to your home office so you can take steps to improve the location’s security posture.
For example, say you want to discover what devices are on the remote network. You can see all devices on the wired network in the remote office, and even those in the wireless spectrum, including devices using Bluetooth and Zigbee. You can compare this list to your internal list of authorized devices to determine if you have access by unauthorized devices. This is especially important as smartphones can become their own wireless hot spots that can provide illicit entry into your network.
The 100+ tools that ship with the product look like they cover almost any aspect of asset discovery that organization would be looking for. This includes everything from mobility scanning to discovering a new computer that comes online or helping you find rogue access points using the Wi-Fi tools. While the Pwnie device can do quite a bit out of the box, it is expandable so you can add whatever tools you want. Out of the box, you can do a full spectrum penetration test, from finding a computer to exploiting that computer to generating a report on how you did it.
Pwnie Express groups its tools broadly into three categories. One is asset discovery, which gives full visibility of all the devices on the network in the remote location. The next is vulnerability scanning, and then you can probe deeper with penetration testing. Basically you can be a white hat hacker using the same tools that a black hat hacker can throw at you to exploit your systems.
With all of these penetration tools on one device, you might think it would be a hacker’s dream to get hold of a Pwnie device and plug it into or walk it around your remote location to siphon off information and gain access to your network. Well, the hacker can dream but he can’t have. Pwnie Express has implemented security controls on several levels.
First, purchasing the product requires verification of the buyer and manual approval before the order is processed. Pwnie Express observes various rules pertaining to sales, including:
- The company only allows sales to U.S. entities and to entities in countries that are approved by the U.S. government.
- Foreign entities typically require a special clearance before they are whitelisted for purchase.
- For all sales – domestic or international – the company subscribes to the most robust identity verification services to be able to authenticate and verify the buyer.
- Individual buyers (as opposed to organizations) are subjected to additional scrutiny and verified by Pwnie Express’s customer support team.
Once a device is purchased, it is configured such that it can only deliver its collected data to one IP address — presumably the corporate headquarters of the buyer. The plug-in device itself has no user interface that would allow a hacker to access information via a keyboard.
Buyers should also keep in mind that Pwnie Express packages open source tools which are widely available to anyone. In the past, hackers have always been one step ahead and could have used any of these open source tools on their own. Pwnie Express has attempted to level the playing field and provide corporations with the means to protect themselves by using the same powerful open source tools to identify and close vulnerabilities in their security. The vendor has adapted the tools and packaged them on their products so they could be used within the corporate security frameworks along with the other corporate cyber defense tools.
Like the Pwn Plug R2, the portable Pwnie Express devices run a derivative of the Kali Linux operating system, on which all of the open source tools run. Data collected during the assessments and scans are stored on the devices themselves until it is “sent home” to the master IP address specified during configuration. Pwnie Express is in the process of building a SaaS capability for a one-to-many connection with numerous devices. This will provide the ability to manage multiple sensors and execute testing routines across multiple sensors and then generate reports that can be shipped off to a SIEM through an API.
The Pwnie tools appear to be easy to use and run, yet seem powerful enough for an information security expert to conduct thorough testing of a facility. What’s unique about these devices is the extensive built-in functionality at such a low price point.
Linda Musthaler is a Principal Analyst with Essential Solutions Corp., which researches the practical value of information technology and how it can make individual workers and entire organizations more productive. Essential Solutions offers consulting services to computer industry and corporate clients to help define and fulfill the potential of IT.