In the News

Are you Vulnerable to the IPv6 SLAAC Attack?

by Ron Gula
August 13, 2013

Recently, Neohapsis published a tool named “Sudden Six” to test if your network is vulnerable to the SLAAC attack. The tool leverages latent IPv6 connectivity that may be present in your IPv4 networked devices to alter the flow of traffic for collection and potential modification for targeted attacks.

Active and Passive Mandiant APT1 Detection

by Ron Gula
February 20, 2013

The Mandiant APT1 report contains a tremendous amount of detail about attacker techniques, indicators of compromise, and possible adversaries. Most interesting was the large amount of technical detail provided about the indicators of compromise – domain names, SSL certificates, file hashes, and more. Tenable's research team leveraged this information into a wide variety of reporting and detection tools which are now available in Nessus and SecurityCenter.

Monitoring the Life of a Java Zero-Day Exploit with Tenable USM

by Randal T. Rioux
October 25, 2012

Not too long ago, CVE-2012-4681 (US-CERT Alert TA12-240A and Vulnerability Note VU #636312) was issued for a flaw discovered in Oracle Java (JDK and JRE 7 U6 and before), as well as version 6 U34 and before.

This is a client-side vulnerability, which requires a user to initiate activity to be exploited. I will avoid dissecting the flaw in detail, as this information is widely available on the Web (a particularly good write-up is here).

Keep in mind that Java is platform independent, and so is this exploit. The example here uses Internet Explorer on Windows 7 (with Java SE 7u3). However, Linux and OS X users shouldn’t feel excluded on this one!

With Tenable's Unified Security Monitoring (USM) platform, comprised of SecurityCenter (SC), the Passive Vulnerability Scanner (PVS), and the Log Correlation Engine (LCE), we can track this exploit from start to finish.

Tenable Inks Deal With In-Q-Tel

by Dale Gardner
September 24, 2012

Tenable Network Security announced today it has established a strategic partnership and technology development agreement with In-Q-Tel. In-Q-Tel is the not-for-profit, strategic investment firm that works to identify, adapt, and deliver innovative technology solutions to support the missions of the U.S. Intelligence Community. Under the terms of the agreement, Tenable will develop secure audit and remediation capabilities that will assist intelligence agencies in continuously outpacing emerging cyber threats.

Tenable Recognized by Inc. Magazine for Outstanding Growth

by Dale Gardner
August 30, 2012

Earlier today, Tenable Network Security revealed it had been named as one of the fastest-growing private companies by Inc. Magazine in its annual Inc. 5000 ranking. We're proud to note Tenable's performance — 259% sales growth over a three year period — earned an overall ranking of #15 among security companies, and #19 in the metropolitan Baltimore area.

Tenable Receives Highest Rating of "Strong Positive" in Gartner Vulnerability Assessment MarketScope Report

by Dale Gardner
August 16, 2012

Late yesterday, Tenable announced SecurityCenter™ received a "Strong Positive" rating in Gartner's 2012 MarketScope for Vulnerability Assessment. The report provides guidance to security professionals evaluating options for vulnerability assessment. Gartner rates vendors based on evaluation criteria including market responsiveness and track record; product offering strategy; product functions such as base scanning methods, scope of vulnerability assessment, workflow and remediation support, and reporting capabilities; viability; and customer experience.

Tenable Releases SecurityCenter Continuous View

by Dale Gardner
August 9, 2012

Today, Tenable announced the availability of a new edition of SecurityCenter, called Continuous View.

This edition of SecurityCenter uniquely encompasses both scanning and monitoring, with the inclusion of Tenable's Passive Vulnerability Scanner (PVS). That makes SecurityCenter Continuous View uniquely capable of addressing vulnerability, configuration, and compliance management requirements for emerging technologies like mobile devices, cloud-based services, social applications, and virtual systems.

The flexible licensing approach provided by SecurityCenter Continuous View allows enterprise customers to deploy PVS in much the same way as they do with Nessus within SecurityCenter, pretty much as many as needed.

Existing SecurityCenter customers can upgrade to a ContinuousView license and begin to enjoy the benefits of continuous monitoring with PVS. These include:

  • Real-time identification of server and client vulnerabilities
  • Identification of mobile devices and their vulnerabilities
  • Passive discovery of all internal and external web servers and databases
  • Identification of trust and communication paths
  • Passive monitoring of virtual environments

Cyberwar: You're Doing It Wrong!

by Dale Gardner
May 21, 2012

Cyberwar remains a hot topic of conversation in both political and technology circles. But Tenable Chief Security Officer Marcus Ranum asserts that much of the discussion has been--and remains--misleading and inaccurate. In this presentation from the 2012 RSA Conference, Marcus outlines his thoughts on the multiple problems that comprise cyberwar to get past the hype and articulate what risks actually exist. Watch now on YouTube.

Debating Software Liability

by Dale Gardner
May 1, 2012

Combine equal parts of two of the industry's most outspoken experts, add in the controversial topic of software liability, and stand back to watch the ideas collide. The cameras were on hand at the recent RSA event to capture the debate between Tenable Network Security Chief Security Officer Marcus Ranum and BT Chief Security Technology Officer Bruce Schneier. Thought provoking doesn't begin to describe the encounter--and that's all before the audience gets involved. Watch now on our YouTube channel:

Scanning for pcAnywhere

by Ron Gula
January 30, 2012

Note -- this blog was updated on Feb 2, 2012 to highlight detection of the Symantec advisory SYM12-002 as well as new additional Nessus local checks to audit pcAnywhere installations.

With the recent news from Symantec that their source code theft has left pcAnywhere open to attack, it makes sense to audit your network for instances of this desktop sharing software. 

Nessus has many checks that identify the presence of pcAnywhere, the type of network access supported by it, and some vulnerabilties in the application. A current list is shown below for reference:

  • 10006   Symantec pcAnywhere Status Service Detection (UDP)
  • 10794   Symantec pcAnywhere Detection (TCP)               
  • 10798   Symantec pcAnywhere Service Unrestricted Access       
  • 20743   Symantec pcAnywhere Launch with Windows Caller Properties Local Privilege Escalation
  • 32133   Symantec pcAnywhere Access Server Detection Service
  • 35976   Symantec pcAnywhere CHF File Pathname Format String Denial of Service
  • 57795   Symantec pcAnywhere Installed (local check)
  • 57796   Symantec pcAnywhere Multiple Vulnerabilitities (SYM12-002)