<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>
<div>Multiple comments. </div>
<div><br>
</div>
<div>Finding client-side vulnerabilities through network monitoring instead of</div>
<div>having to log in was one of the reasons we wrote the Passive Vulnerability</div>
<div>Scanner. For less mature organizations who don't want to or don't know</div>
<div>how to get creds for 5k desktops, sniffing who is vulnerable is a very real</div>
<div>alternative and extremely effective with no impact. </div>
<div><br>
</div>
<div>We also added functions to Nessus such that it can speak directly with</div>
<div>TEM (Bigfix), SCCM, WUS, RedHat Satellite and a few others. This lets</div>
<div>you do two things. First, you can get patch data from them and mix this</div>
<div>with your uncredentialed vuln scan. Second, if you do a credentialed</div>
<div>scan, you can cross reference this with what is in your patch management</div>
<div>system down to the DLL sort of level. </div>
<div><br>
</div>
<div>As was pointed out, the blog we have here really goes into the various</div>
<div>issues: <a href="http://www.tenable.com/blog/protecting-scanning-credentials-from-malicious-insiders">http://www.tenable.com/blog/protecting-scanning-credentials-from-malicious-insiders</a></div>
<div><br>
</div>
<div>I am really not that concerned about some of the attacks you point </div>
<div>out compared to the concern of securing the systems doing the scanning</div>
<div>and hosting the data. The big thing on the Windows side is packet signing.</div>
<div>Hi-jacking is indeed an issue as well. </div>
<div><br>
</div>
<div>Lastly, PCI ASV scans do not require credentialed audits which pushes</div>
<div>false positive analysis from back ported banners onto the admin and the </div>
<div>ASV vendor. This was one of the reasons we did an integration with RedHat</div>
<div>Satellite so that could cross reference some sort of old looking banner with</div>
<div>an actual patch with out needing to log in as root from the cloud. </div>
<div><br>
</div>
<div>Ron Gula</div>
<div>Tenable Network Security </div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Dave Aitel <<a href="mailto:dave@immunityinc.com">dave@immunityinc.com</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, February 6, 2013 2:03 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:dailydave@lists.immunityinc.com">dailydave@lists.immunityinc.com</a>" <<a href="mailto:dailydave@lists.immunityinc.com">dailydave@lists.immunityinc.com</a>><br>
<span style="font-weight:bold">Subject: </span>[Dailydave] Catch22's in Vulnerability Management<br>
</div>
<div><br>
</div>
<div>
<div bgcolor="#FFFFFF" text="#000000">I love both our Qualys and Tenable friends, but I have to say, I worry about "authenticated scans". Perhaps my worry is unwarranted, but having a domain admin that is connecting to and trying to authenticate to every host
on the network seems like a very bad idea. <br>
<br>
For example: <br>
<ul>
<li>What if you do a NTLM proxy attack? <br>
</li><li>What if you downgrade your accepted protocols to NTLMv1 and then crack the hash and now are domain admin for free?
<br>
</li><li>What if there is some vulnerability in the web apps or host box that supports these programs?<br>
</li><li>When Qualys, for example, logs into MS SQL, and I have MITM on that network, why can't I just take over the connection and be admin from then on?
</li></ul>
<br>
<a href="https://community.qualys.com/docs/DOC-4095">https://community.qualys.com/docs/DOC-4095</a><br>
<a href="http://static.tenable.com/documentation/nessus_credential_checks.pdf">http://static.tenable.com/documentation/nessus_credential_checks.pdf</a><br>
<br>
If these attacks work, it's a bit of a catch22. In order to achieve compliance, you must be out of compliance!<br>
<br>
I assume people are using authenticated scans, because without it, you're generally getting lots of false positives to weed through, which is annoying (and for which we sell CANVAS plugins :>).
<br>
<br>
-dave<br>
<br>
<pre class="moz-signature" cols="72">--
INFILTRATE - the world's best offensive information security conference.
April 2013 in Miami Beach
<a class="moz-txt-link-abbreviated" href="http://www.infiltratecon.com">www.infiltratecon.com</a></pre>
</div>
</div>
</span>
</body>
</html>