When delivering payloads to clients through RBI solutions, these solutions’ sandboxing and scanning capabilities present significant hurdles that must be overcome to achieve code execution in your target environment. Egress can be summarized as getting your C2 traffic to call back using traffic that communicates “through” the RBI solution, while bypass (as the name implies) means we are taking a different route entirely by avoiding RBI solutions. In our opinion, they are similar but distinctly different techniques concerning RBI. Ingress is pretty self-explanatory, but you may wonder why egress and bypass are separated. We categorize our suggested techniques into three categories: ingress, egress, and bypass. If your next engagement has RBI in place to protect their web traffic what do you do? Fear not, dear reader we have asked the same question and are here to help you work through it. As you can probably imagine, trying to figure out why your C2 traffic is not returning when an organization uses RBI can be very frustrating. This means your stealthy HTTPS C2 traffic gets sent through the same virtualized host process the same as everything else and results in the server responses to your agents being rendered as an inert stream. They may offer a link where a user can do that, but an organization usually has a proxy setup that sends ALL web traffic through RBI. Most RBI solutions we have dealt with are not set up to send individual browser sessions to a cloud-virtualized host. It is not generally advertised on the product pages that RBI affects C2 traffic, but we promise you it does. Additionally, one of the primary concerns you should have as an offensive professional is the profound impact RBI will likely have on your C2 traffic. Most RBI security vendors supplement their solution with extra email protections to block the delivery of malware via user inboxes along with scanning, sanitizing, and blocking malicious downloads from any site. Why should I care?” Well, my friend, RBI has many more implications than what the vendors provide at face value. Why Do We Care?Īt this point, you may ask yourself, “I don’t really do web-based attacks. It is tough to get a user to fall for your finely crafted HTML smuggling attack when the webpage never actually makes it to the end user their browser just shows a stream of pixels while the content renders on a separate system.

In this function, it does an excellent job. The primary focus of RBI is to prevent user interactions with web-based malware such as cross-site scripting (XSS), drive-by downloads, and various forms of malicious JavaScript. Different vendors stream the content to the user differently, but it is sufficient to say they all do the same thing: sanitize and render client web traffic. When users open their web browser to surf the web, they are not merely doing so from their local machine rather, they are connecting to a cloud-hosted virtualized browser in which all web content is rendered and executed and then sent back to the end-user in a sanitized manner (Figure 1).

The general concept of RBI is relatively simple. Each type of browser isolation has different pros and cons, but we will focus on RBI today.

As these names imply, client-side virtualizes the browsing on the local host, on-premises runs within the organization, and RBI virtualizes the web sessions in the cloud. There are three types of browser isolation in use today: client-side browser isolation, on-premises browser isolation, and RBI. What is RBI and Why Use It?īrowser isolation is a security concept in which a user’s web traffic is isolated in a virtual machine, hosted web browser, or some other manner to prevent malicious activities from reaching the end user thereby lowering the general risk of web browsing. This post then concludes with us sharing our perspective regarding the recommendation of RBIs as a defensive product for the modern enterprise. Following a brief introduction to the technology, we share our firsthand experiences when encountering RBI solutions and techniques the SpecterOps team have employed for establishing command and control (C2) to systems that proxy traffic through RBI products broken down into three segments: Payload Ingress, C2 Egress, and RBI Bypass. This blog post describes methods that SpecterOps consultants have researched to successfully circumvent this technology during offensive assessments. Remote Browser Isolation (RBI) is a security technology which has been gaining popularity for large businesses securing their enterprise networks in recent years.

Spectre ops faq