Remote Procedure Call (RPC)
In cybersecurity, a remote procedure call (RPC) refers to a protocol that allows a program on one computer to execute a procedure (a subroutine or function) on a different computer without the programmer explicitly coding the details for the remote interaction. It's a fundamental concept in distributed computing, enabling seamless communication between disparate systems.
While RPC is a legitimate and widely used communication mechanism, its inherent design and widespread use make it a significant target and vector for various cybersecurity attacks.
How RPC Works (Simplified)
Client Stub: The program makes a local call to a "client stub" (a library or interface). This stub is responsible for packaging the procedure call (including the procedure's name and arguments) into a message.
Marshalling: The client stub "marshals" (serializes) the parameters into a standard format for network transmission.
Network Transmission: The marshaled message is sent across the network to the server.
Server Skeleton: On the server side, a "server skeleton" (or dispatcher) receives the message.
Unmarshalling: The server skeleton "unmarshals" (deserializes) the parameters.
Procedure Execution: The server skeleton then makes a local call to the actual procedure on the server.
Return Value: Once the procedure executes, the server skeleton marshals any return values and sends them back to the client stub, which then unmarshals them and returns them to the client program.
This entire process is designed to be transparent to the programmer, making remote calls appear as if they were local.
RPC in the Context of Cybersecurity
RPC's role in cybersecurity stems from its ubiquity in operating systems (like Microsoft Windows, where it's heavily used for inter-process communication and network services), distributed applications, and network services. Attackers frequently target RPC implementations due to:
Attack Surface: RPC exposes a vast attack surface. Many services listen on RPC ports, and vulnerabilities in their implementations can be exploited remotely.
Privilege Escalation: Successful exploitation of an RPC vulnerability often grants attackers elevated privileges on the target system.
Lateral Movement: Once an attacker has a foothold, RPC can move laterally within a network and access other systems and services.
Remote Code Execution (RCE): Many critical RPC vulnerabilities lead to RCE, allowing attackers to run arbitrary code on the victim's machine.
Common RPC-Related Attack Vectors and Vulnerabilities
Buffer Overflows/Underflows: Classic vulnerabilities where input data exceeds or falls short of the allocated buffer size, leading to memory corruption. Exploiting these in RPC services can lead to denial of service, information disclosure, or RCE.
Example: The MS08-067 vulnerability (CVE-2008-4250), which affected the Server Service (RPC-based) in Windows, allowed remote code execution due to a buffer overflow. The Conficker worm notably exploited this vulnerability.
Authentication Bypass: Flaws in the authentication mechanisms of RPC services can allow unauthenticated attackers to invoke remote procedures that should require authentication.
Example: Weaknesses in RPC endpoint mappers or specific service implementations could allow attackers to connect and perform actions without proper credentials.
Information Disclosure: If not properly secured or configured, RPC services might inadvertently reveal sensitive information (e.g., system configuration, user data, network topology).
Denial of Service (DoS): RPC services can be crashed or rendered unresponsive by sending malformed requests or overwhelming them with legitimate-looking traffic, leading to DoS.
Example: A flood of invalid RPC requests can consume server resources, making the service unavailable.
RPC Endpoint Mapper Attacks: The RPC endpoint mapper is a service that helps clients find the specific port number a desired RPC service is listening on. Attackers can query this mapper to discover open RPC services, which allows them to identify potential targets for further exploitation.
Pass-the-Hash/Pass-the-Ticket (PtH/PtT): While not direct RPC vulnerabilities, RPC is often the transport used in these attacks. Attackers who steal credentials (hashes or Kerberos tickets) can use RPC (e.g., via
PsExecor WMI which uses RPC) to execute commands or access resources on remote systems without knowing the plaintext password.SMB/RPC Exploitation: Many critical Windows services (like Server Message Block, SMB) heavily rely on RPC. Exploits like EternalBlue (used in WannaCry and NotPetya) targeted SMB protocol vulnerabilities, which relied on RPC for underlying communication, allowing for widespread RCE.
Deserialization Vulnerabilities: If an RPC implementation uses insecure deserialization of objects passed as parameters, an attacker can craft malicious serialized objects that, when deserialized by the server, execute arbitrary code.
Weak/Null Sessions: Older Windows systems allowed "null sessions" (unauthenticated connections) to certain RPC services, enabling attackers to enumerate users, shares, and other sensitive information.
Man-in-the-Middle (MitM) Attacks: If RPC communication is not encrypted or integrity-protected, an attacker can intercept and modify RPC calls or responses, potentially leading to unauthorized actions or data manipulation.
Defense Strategies
Protecting against RPC-related attacks involves a combination of host-based and network-based security measures:
Patch Management: Regularly update and patch operating systems and applications to address known RPC vulnerabilities. This is the single most effective defense against many common RPC exploits.
Network Segmentation and Firewalls:
Block Unnecessary Ports: Restrict RPC communication to only necessary internal networks and specific hosts. Block RPC ports (e.g., TCP 135 for RPC Endpoint Mapper, and a dynamic range typically from 1024-65535, though newer versions use a smaller dynamic range or fixed ports for specific services) at network perimeters.
Internal Segmentation: Implement internal firewalls and network segmentation to limit lateral movement if an RPC service is compromised.
Least Privilege: Configure services to run with the minimum necessary privileges. If an RPC service is compromised, this limits the damage an attacker can inflict.
Strong Authentication and Encryption: Where possible, configure RPC services to use strong authentication mechanisms (e.g., Kerberos instead of NTLM) and ensure communication is encrypted (e.g., using RPC over authenticated IPsec or other secure tunnels).
Endpoint Detection and Response (EDR): Deploy EDR solutions to monitor for suspicious RPC activity, such as unusual process creation via RPC, attempts to access sensitive RPC services, or abnormal network connections originating from RPC.
Vulnerability Scanning and Penetration Testing: Regularly scan your network for open RPC ports and known vulnerabilities. Conduct penetration tests to simulate attacks and identify exploitable weaknesses.
Disable Unused Services: Turn off any RPC-dependent services that are not essential, reducing the attack surface.
Log Monitoring: Monitor Windows Event Logs (especially Security, System, and Application logs) for RPC-related errors, failed authentications, or suspicious activity.
By understanding how RPC functions and its common exploitation vectors, cybersecurity professionals can implement more effective defenses to protect systems from this pervasive threat.
ThreatNG, an external attack surface management, digital risk protection, and security ratings solution, can significantly help mitigate RPC-related attack vectors and vulnerabilities by focusing on external exposures that could lead to initial compromise. While RPC attacks often occur internally, they frequently originate from or are facilitated by external vulnerabilities that ThreatNG is designed to identify.
Here's how ThreatNG would help, highlighting its various capabilities:
ThreatNG's Role in Addressing RPC-Related Attack Vectors
1. External Discovery: ThreatNG performs purely external, unauthenticated discovery, using no connectors. This means it can identify internet-facing systems running vulnerable RPC services or have misconfigurations that attackers could exploit as an entry point.
Examples:
Identifying Exposed Servers: ThreatNG would discover servers directly exposed to the internet running services relying heavily on RPC, such as Windows servers.
Mapping Network Services: It can identify open ports and services, including those associated with RPC (e.g., TCP 135 for the RPC Endpoint Mapper or other high ports used dynamically by RPC services). This initial discovery helps map the potential external attack surface where RPC-related vulnerabilities might exist.
2. External Assessment: ThreatNG performs various external assessment ratings that can directly or indirectly highlight an organization's susceptibility to RPC-related attacks.
Cyber Risk Exposure: This score considers parameters covered by the Domain Intelligence module, including certificates, subdomain headers, vulnerabilities, and sensitive ports, to determine cyber risk exposure. Code Secret Exposure is also factored in.
Detailed Example: If a Windows server exposed to the internet (possibly an application server or a domain-joined machine) has RPC services listening on publicly accessible ports and is running an outdated operating system with known RPC vulnerabilities (e.g., a vulnerability allowing remote code execution via the Server Message Block (SMB) protocol, which heavily uses RPC), ThreatNG's "Cyber Risk Exposure" assessment would flag this. It would specifically identify the exposed sensitive ports (like SMB ports, TCP 445) and map them to known vulnerabilities. If configuration files for these services, or even credentials that could be used to exploit them, were inadvertently exposed in a public code repository, ThreatNG's "Code Secret Exposure" capability would discover this.
Breach & Ransomware Susceptibility: This is derived from external attack surface and digital risk intelligence, including domain intelligence (exposed sensitive ports, exposed private IPs, and known vulnerabilities), dark web presence (compromised credentials and ransomware events/gang activity), and sentiment and financials.
Example: A high "Breach & Ransomware Susceptibility" score could indicate an environment highly prone to attacks that often use RPC for lateral movement. If ThreatNG identifies exposed private IPs (even if on public-facing networks) that might hint at an internal network layout, or if compromised credentials relevant to servers running RPC services are found on the dark web, it points to direct avenues for attackers to initiate or pivot using RPC-related vectors like Pass-the-Hash.
Web Application Hijack Susceptibility: This analyzes parts of a web application accessible from the outside world to identify potential entry points for attackers.
Example: While not directly RPC, a compromised web application (e.g., via a SQL injection) could be the initial foothold an attacker needs. Once inside, they could use RPC-related techniques to move laterally within the network. ThreatNG's identification of high susceptibility here helps prevent that initial breach.
3. Reporting: ThreatNG provides various reports, including Executive, Technical, Prioritized (High, Medium, Low, and Informational), Security Ratings, Inventory, Ransomware Susceptibility, and U.S. SEC Filings.
Example: ThreatNG's prioritized report would highlight critical external vulnerabilities related to exposed services that use RPC, such as unpatched Windows servers with active RPC exploits or misconfigured firewall rules allowing RPC traffic from the internet. The report would detail the risk level, reasoning, and recommendations, enabling security teams to focus on the most critical exposures that could lead to an RPC-related attack.
4. Continuous Monitoring: ThreatNG offers continuous monitoring of all organizations' external attack surfaces, digital risks, and security ratings.
Example: If a new Windows server with default RPC settings is inadvertently exposed to the Internet, or if a previously unpatched RPC vulnerability becomes publicly known and exploited in the wild, ThreatNG's continuous monitoring would detect this change in the attack surface or risk profile. It would then update the security rating and alert the organization to the newly introduced RPC-related exposure.
5. Investigation Modules: ThreatNG's detailed investigation modules provide granular insights critical for understanding and mitigating RPC-related risks.
Subdomain Intelligence: This includes HTTP Responses, Header Analysis, Server Headers (Technologies), and crucially, identification of Ports, including those for Remote Access Services (SSH, Telnet, RPC, LDAP, SMB, RSYNC, RDP, VNC). It also identifies Known Vulnerabilities.
Detailed Example: ThreatNG can identify if the RPC Endpoint Mapper (TCP 135) or SMB (TCP 445), which heavily relies on RPC, is exposed externally. If an organization has direct exposure to these ports on an internet-facing server, ThreatNG would flag it. Furthermore, if these services run on an operating system with known, unpatched vulnerabilities (e.g., EternalBlue, which targets SMB/RPC vulnerabilities), ThreatNG would specifically list these "Known Vulnerabilities" associated with the exposed ports. This level of detail helps security teams understand precisely which RPC-dependent services are vulnerable and why.
IP Intelligence: This covers IPs, Shared IPs, ASNs, and Country Locations.
Example: If a server with exposed RPC ports is identified, IP Intelligence can provide context about its network location and whether it's part of a critical internal IP range that should never be publicly accessible.
Vulnerabilities (DarCache Vulnerability): This comprehensive repository includes NVD information (Attack Complexity, Impact scores, CVSS Score, and Severity), EPSS data (likelihood of exploitation), KEV (vulnerabilities actively exploited in the wild), and Verified Proof-of-Concept (PoC) Exploits.
Detailed Example: If a critical RPC vulnerability (e.g.,
CVE-2017-0144for EternalBlue) is present on an exposed server, DarCache Vulnerability would provide its CVSS score and severity and, crucially, indicate if it's in the KEV catalog, meaning it's actively exploited. The presence of "Verified Proof-of-Concept (PoC) Exploits" directly linked to this CVE would give the security team immediate insight into how the vulnerability can be leveraged, accelerating their understanding and remediation efforts. This intelligence is vital for prioritizing patching efforts to prevent RCE or privilege escalation via RPC.
6. Intelligence Repositories (DarCache): These continuously updated intelligence repositories provide vital context for identifying and prioritizing RPC-related risks.
Compromised Credentials (DarCache Rupture):
Example: If credentials for users or service accounts with administrative access to systems where RPC is heavily used (like domain controllers or application servers) appear on the dark web, DarCache Rupture would alert the organization. This intelligence is critical because compromised credentials are often the key to leveraging RPC for lateral movement within a network (e.g., using Pass-the-Hash attacks via RPC-based tools).
Vulnerabilities (DarCache Vulnerability):
Example: As discussed above, this repository directly provides intelligence on known RPC vulnerabilities, their exploitability, and their impact, including those actively exploited in the wild. This is paramount for understanding the threat posed by exposed RPC services.
Synergy with Complementary Solutions
ThreatNG's external perspective can be combined with internal security controls to create a robust defense against RPC-related attacks.
With Endpoint Detection and Response (EDR) Solutions:
How ThreatNG Helps: ThreatNG identifies externally exposed systems with RPC vulnerabilities. It can also flag compromised credentials that attackers might use to initiate an RPC-based attack.
Complementary Action: Once an attacker exploits an external vulnerability (identified by ThreatNG) and gains a foothold, or attempts to use compromised credentials (flagged by ThreatNG) for lateral movement, an EDR solution on endpoints and servers (including those running RPC services) would detect and prevent the execution of malicious RPC calls, suspicious process creation, or attempts to dump credentials. For example, if ThreatNG identifies an exposed server with an RPC vulnerability, and an EDR solution detects a remote process creation attempt on that server via RPC (like
PsExec), the combined intelligence allows for faster and more accurate incident response.
With Security Information and Event Management (SIEM) Systems:
How ThreatNG Helps: ThreatNG provides external attack surface data, digital risk intelligence, and specific vulnerability findings (e.g., exposed RPC ports, known RPC vulnerabilities, compromised credentials). This information can be integrated into a SIEM.
Complementary Action: A SIEM aggregates and correlates internal logs, including Windows Event Logs that detail RPC activity (e.g., RPC connection attempts, service startup/shutdown, security events related to RPC). By ingesting ThreatNG's external context, the SIEM can enrich internal alerts. For instance, if ThreatNG reports an exposed server with a high-severity RPC vulnerability, and the SIEM simultaneously detects an unusual volume of RPC traffic or failed authentication attempts targeting that server, the correlation drastically elevates the alert's priority, indicating a potential active attack.
With Network Access Control (NAC) Solutions:
How ThreatNG Helps: ThreatNG identifies exposed services and systems that might be targets for RPC attacks.
Complementary Action: While ThreatNG points out the external risk, a NAC solution can enforce internal network policies based on device posture and user identity. If an attacker manages to compromise a device internally and tries to use RPC for lateral movement, a NAC could detect the unauthorized connection or a change in the device's security posture and restrict its network access, limiting the scope of the RPC-based attack.
ThreatNG primarily focuses on the proactive identification of external weaknesses. Diligently exposing vulnerabilities like open RPC ports, insecure configurations, and leaked credentials on the digital perimeter helps organizations harden their defenses and prevent the initial breach that often precedes more complex RPC-related attacks like lateral movement and remote code execution.
