<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style>body{font-family:Helvetica,Arial;font-size:13px}</style>
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
Machines that invoke bash from httpd pose a risk. Same thing goes for</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
machines that have had a core dump of bash in the last few days. You </div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
can get that sort of data from a variety of methods, but in organizations </div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
where the scanner team doesn’t know the SIM/logging team, good luck. </div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
<br>
</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
I also find a strong correlation in security teams that were looking for </div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
a single non-credentialed “heartbleed” style check for this vulnerability</div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
and a lack of ability to get the creds to perform the scan or get the </div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
logs from the SIM guys. </div>
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
<br>
</div>
<div id="bloop_sign_1411771831775616000" class="bloop_sign">
<div style="font-family:helvetica,arial;font-size:13px"><b>Ron Gula</b> | CEO<br>
<b>Tenable Network Security </b></div>
<div style="font-family:helvetica,arial;font-size:13px"><b><span style="font-size:9.0pt;font-family:Arial;mso-fareast-font-family:
Calibri;mso-bidi-font-family:Arial;color:#435363;mso-ansi-language:EN-US;
mso-fareast-language:EN-US;mso-bidi-language:AR-SA">rgula@tenable.com</span></b></div>
</div>
<br>
<p style="color:#000;">On September 26, 2014 at 2:52:51 PM, Dave Aitel (<a href="mailto:dave@immunityinc.com">dave@immunityinc.com</a>) wrote:</p>
<blockquote type="cite" class="clean_bq"><span>
<div>
<div></div>
<div>So most of the bash bug solutions I've seen/talked to people about look <br>
at "Vulnerability Management" as just that: essentially an extension to <br>
your patching program. But in this case, nearly every machine is <br>
vulnerable. However, almost NO machines pose a real risk. Everyone has <br>
soap in their shower, and yet so few people slip to their death in the <br>
morning! <br>
<br>
This weird dichotomy between things that are vulnerable, and things that <br>
are at risk, is a real problem with the bash bug and right now it's <br>
being solved with consulting hours for most people. How do you go to the <br>
SEC and say "90% of our infrastructure is vulnerable"? Answer: You <br>
don't. Your Vulnerability Management tools is worthless right now. <br>
<br>
An authenticated or credentialed scan with a Vulnerability Management <br>
tool has always had this issue. Nobody knows whether they are in fact at <br>
risk for any issue found with that scan! Perhaps your AV protects you? <br>
Perhaps that port is blacklisted with the HIDS and nobody can touch it. <br>
But the bash bug really highlights this in a way that drives it home to <br>
executives, we've found. <br>
<br>
Basically, with external anonymous scanning you have a high false <br>
positive rate. That's bad. But with credentialed scanning, you have no <br>
false positives, but also a very low confidence that the results are <br>
meaningful. This is even worse, in some cases. ("Oh you wanted <br>
vulnerabilities that MATTERED? That's Risk Management, and it's extra!") <br>
<br>
Such a strange thing. <br>
<br>
-dave <br>
<br>
<br>
<hr>
_______________________________________________ <br>
Dailydave mailing list <br>
Dailydave@lists.immunityinc.com <br>
https://lists.immunityinc.com/mailman/listinfo/dailydave <br>
</div>
</div>
</span></blockquote>
</body>
</html>