Scanning with ISS Security-SIG 15 December 2005 David Taylor & John Lupton ISC Information Security ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security ISS - Internet Security Scanner Commercial product of Internet Security Systems Provides Windows-based scanning for vulnerabilities on hosts running all major PC operating systems –Windows –Mac OS X –Unix/Linux

Scanning with ISS 15 December 2005 ISC/Information Security Which Windows? Dave Taylor sez… –Windows 2000 or above, BUT… –Win 2003 and XP/SP2 have been problematic –Win 2000 or XP/SP1 seem to work best

Scanning with ISS 15 December 2005 ISC/Information Security Who’s Allowed to Scan? Anyone is permitted to scan their own system Penn Sysadmins and LSP’s are permitted to scan IP addresses/ranges for which they have responsibility

Scanning with ISS 15 December 2005 ISC/Information Security Scanning Etiquette The “Golden Rule”…you don’t appreciate someone else scanning your addresses without your knowledge or permission, right? “Let My People Know”…unless there’s a good reason to keep it secret, tell your users when you will be scanning, and from which IP address

Scanning with ISS 15 December 2005 ISC/Information Security Firewalls If you are scanning from inside a firewall, you will need to disable it to prevent problems with scan accuracy If your target(s) is/are behind a firewall, you will need to: –Disable the firewall during the scan, OR –Locate the scanning system inside the firewall

Scanning with ISS 15 December 2005 ISC/Information Security Downloading & Installing ISS Go to Set up an account (necessary, but free) Sign in to the Download Center Search for Internet Scanner 7.0 SP2 –Allows installation of SQL desktop engine as part of single installation –Dave sez: older versions require separate installations, and are “a pain in the bootie”. Click on colored “FULL INSTALLS” tab Download file (there’s only one) and install as per instructions

Scanning with ISS 15 December 2005 ISC/Information Security OK, what next?… The software “as is” will allow scanning of the localhost ( ) To scan other hosts, you need to obtain and install a “key” Send to - we will “cut” you a key and transmit it to you, along with instructions how to import it into ISS

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security Installing Updates After installing the ISS application, update the scanning modules by running “X-Press Update Install” –Located in ‘Start’ menu –Go to Starbucks…it will take a while Once the updated modules have been installed, you’re ready to roll

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security Scanning Credentials From a stand-alone, non-domain system: –Results similar to what outside hacker could see From a standard domain user account: –Results similar to what other domain users could see From a Domain Administrator account: –Results will show much more detail, e.g. patch level

Scanning with ISS 15 December 2005 ISC/Information Security Set Up a Session From ‘Start’ Menu… –Create a new session –Choose a template, OR start with a blank session and construct your own new policy –Give it a name, and click ‘OK’ –Edit the policy and select your scan target(s) Be Aware!…Plugins for Destructive Denial of Service vulnerabilities may cause a remote system to become unresponsive - or crash altogether

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security Set Up a Session (cont.) Save the policy and close the Policy Editor Select the policy, then name the session Enter a host range, or load from a list –Remember the “Golden Rule” - don’t scan anyone’s space but your own

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security To Ping, or not to Ping? You have an option to “ping” the hosts in your target range before the scan is performed Many hosts are configured to block all ICMP activity, but can still be scanned Generally better to NOT use the “ping” option –Scans take longer, but are usually more accurate –If hosts you know are present return “unreachable”: Use ‘Tools->Session Properties’ and choose ‘Scan Always’ Forces ISS to run all modules in the policy

Scanning with ISS 15 December 2005 ISC/Information Security Running the Scan Let ‘er rip… Go to Starbucks again

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security Result Reports Results can be presented in several escalating levels, e.g.: –Executive summary –Technically detailed, with step-by-step mitigation procedures Need help? Write to us at

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security

Scanning with ISS 15 December 2005 ISC/Information Security Useful Links Download: Support: Plug-in Info: xforce.iss.net/ SANS Internet Storm Center: isc.sans.org French Security Incident Response Team (known for releasing Zero-Day Advisories): Metasploit: