Vulnerability Analysis Borrowed from the CLICS group.

Vulnerability Assessment Attack Overview –Gathering Information / Fingerprinting –Vulnerability Assessment –Attempt Exploit Defender –Fix Vulnerabilities To prevent exploits

Vulnerability Assessment Tools Collected Set of Tools for Determining Possible Security Holes Components –Port scanning –Additional checks on ports for: Software packages actually running Versions of those packages Possible vulnerabilities on these combinations –Vulnerability database to support above –Possibly other components Check for weak passwords Check for general patch levels Etc.

Example Going beyond port scanning –Port scanning may find port 21 listening, ftp –OS fingerprint – Linux 2.2 kernel –Service query – identifies ftp as wu-ftpd version –What specific vulnerabilities does wu-ftpd have?

Where To Position Vulnerability Assessment Tools? Don’t want them on bastion hosts, firewalls –Could be used against you Safer but less useful in secure zones Best may be to install on laptop –Connect to DMZ, insecure zone, secure zone when needed –Disconnect when not being used

Vulnerability Assessment Tools Linux –Nessus –SATAN/SAINT –SARA Windows –NeWT (Nessus for Windows) –ISS Internet Scanner –Cybercop Scanner (also Linux) –Microsoft Baseline Security Analyzer

Nessus Probably most well-known Unix/Linux VA tool Uses nmap for initial port scanning Two-level architecture –Server: runs scans –Client: control scans, view reports

Nessus Structure Uses plug-ins to abstract vulnerability tests –Tests further grouped into families Uses accounts for authorization Can configure through running server interactively –as opposed to running server in daemon state

Nessus Notes Prefs tab –Be careful with selecting ping –If ping refused, nessus may think system is down, not do further scans Plugins tab –Be careful with enabling all plugins Dangerous plugins can interrupt or even crash services on ports

Nessus results Good graphical interface Listing of findings with recommendations Example:

NeWT NeWT – Nessus Windows Technology Vulnerability database customized for Windows environments ewt.shtmlhttp:// ewt.shtml

Microsoft Baseline Security Analyzer Program that analyzes a Windows system for vulnerability Analyzes in several areas –OS and related utilities - patch levels HFNetChk – allows this to be done across network from central system (command line option) –Accounts – password content and expiration –Services – whether unneeded services present –Utility security settings (e.g. IIS, SQL Server) –Etc. Start/Programs/Microsoft Baseline Security Analyzer