From: Craig Wright (cwright@bdosyd.com.au)
Date: Thu Mar 30 2006 - 16:11:00 EST
Pete stated: default banners ..."wouldn't be the threat, they would be
the vulnerability if you're talking Risk"
I would not even classify them as a vulnerability. They may form a part
of an attack vector or a link in an attack tree, but not a
vulnerability.
A vulnerability requires that the issue can be exploited in itself. In
other words it needs to be able to be attacked. Information gathering
(i.e. banners etc) can thus form a component of an attack and thus a
component of a vulnerability, but not a vulnerability in itself.
Knowing the structure of the web site is not in itself a risk or
vulnerability. It can comprise a branch in an attack tree, but can not
facilitate an attack in itself.
In response to "Risk is relative to the organization not to you." This
depends on the method used to determine risk. A "fluffy" qualitative
risk analysis (there are better or worse qualitative techniques) based
on opinion will fit this description. A detailed quantitative analysis
using Stochastically defined models and a Bayesian likelihood analysis,
maybe even integrating Bayesian linguistic techniques is fairly
definitive no matter where you are.
Regards
Craig
-----Original Message-----
From: Pete Herzog [mailto:lists@isecom.org]
Sent: 30 March 2006 9:10
To: Joel Jose
Cc: pen-test@securityfocus.com
Subject: Re: vulnerability scanners not effective? or just a
false-positive?
Hi,
> have been able to access them as a piece of cake. Ofcourse the network
> is safe as long as the attacker doesnt "learn" the name of the
> important directories. But i think it is a very "huge" vulnerability.
> and nessus didnt even give a hinch!!
Nessus, like many vulnerability scanners is a blacklist. These scanners
search for "known vulnerabilities". You cannot expect them to know of
all vulnerabilities in a timely fashion. Furthermore, how did you
configure the scanner? Was it set to crawl the website or did you tell
it how the website was structured? Did you tell it to try all exploits
or just try from what it thinks the OS/app is? While Nessus is a really
good scanner, there is also an element of human interaction that is
needed for it to work optimally for you.
>
> and one more quest. How many of you think that the existance of the
> default banners in services(eg apache default error pages) are a
> security threat, if not high, atleast medium?. I do.
First, they wouldn't be the threat, they would be the vulnerability if
you're talking Risk. Second, you do mean existence of correct and exact
banners, don't you? While the less Visibility and information you
provide, the better, there is sometimes a business need or an
established balance between having an Exposure (aka Information Leak)
and the cost of fixing it in a timely manner, most often before a
service is put in a hostile environment. Finally, I can agree with
neither your high, medium, or low mean nothing to other people. My wife
likes her shower really hot. But that's hot to me. She thinks it's
normal (her medium). Risk is relative to the organization not to you.
In the OSSTMM 3.0, banners are often an Exposure if they are true, which
is a level 4 calculation (1st being a vulnerability) and is defined as
simply that which provides information on a Visibility. If banners are
false or misleading on purpose to hide information on the service and
other measures are taken to truly disguise the operational work behind
the service, they are calculated under the Privacy loss control for that
Access point from that vector.
I know, I over-answered. Sorry. Ya'll can wake up now.
Sincerely,
-pete.
------------------------------------------------------------------------
------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
As attacks through web applications continue to rise, you need to
proactively protect your applications from hackers. Cenzic has the most
comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go
with a managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm).
Download FREE whitepaper on how a managed service can help you:
http://www.cenzic.com/forms/ec.php?pubid=10025
And, now for a limited time we can do a FREE audit for you to confirm
your results from other product. Contact us at request@cenzic.com
------------------------------------------------------------------------
------
Liability limited by a scheme approved under Professional Standards Legislation in respect of matters arising within those States and Territories of Australia where such legislation exists.
DISCLAIMER
The information contained in this email and any attachments is confidential. If you are not the intended recipient, you must not use or disclose the information. If you have received this email in error, please inform us promptly by reply email or by telephoning +61 2 9286 5555. Please delete the email and destroy any printed copy.
Any views expressed in this message are those of the individual sender. You may not rely on this message as advice unless it has been electronically signed by a Partner of BDO or it is subsequently confirmed by letter or fax signed by a Partner of BDO.
BDO accepts no liability for any damage caused by this email or its attachments due to viruses, interference, interception, corruption or unauthorised access.
------------------------------------------------------------------------------
This List Sponsored by: Cenzic
Concerned about Web Application Security?
As attacks through web applications continue to rise, you need to proactively
protect your applications from hackers. Cenzic has the most comprehensive
solutions to meet your application security penetration testing and
vulnerability management needs. You have an option to go with a managed
service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm).
Download FREE whitepaper on how a managed service can help you:
http://www.cenzic.com/forms/ec.php?pubid=10025
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request@cenzic.com
------------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:55:46 EDT