#4 Nessus Licenses & Usage - Top Ten Things You Didn't Know About Nessus
by Paul Asadoorian on February 3, 2012
The video below is part 4 in our series of the top ten things you didn't know about Nessus and covers Nessus licensing and usage:
#5 Scheduling Nessus Scans - Top Ten Things You Didn't Know About Nessus
by Paul Asadoorian on February 1, 2012
The video below is part 5 in our series of the top ten things you didn't know about Nessus and covers how to schedule scans from within Nessus:
Further Reading:
- Nessus 4.4.0 Released! (This post quickly covers Nessus scan scheduling as it was introduced in version 4.4.0.)
New SCADA Plugins for Nessus and Tenable PVS
by Paul Asadoorian on January 31, 2012
Assessing the security of SCADA devices has always been a challenging task. SCADA devices are used in several critical infrastructure industries, including power plants, manufacturing, chemical processing, and nuclear reactors. Thus, the high availability and security of these devices are of the utmost importance. The challenge lies in assessing the security of SCADA devices without causing any adverse effects. The special purpose-built systems often operate within a limited scope and use protocols that are specific to the tasks being performed, such as Modbus, OPC, and DNP3.
In 2006, Tenable Network Security released the first Nessus® vulnerability scanner and Tenable Passive Vulnerability Scanner (PVS) SCADA plugins (you can read the original release notes for PVS in a post titled "SCADA Network Monitoring" and the original release for Nessus titled "SCADA Checks For Nessus 3"). In April 2011, a new round of SCADA plugins were released for Nessus (covering devices from Movicon, 7-Technologies, and more).
Tenable is now pleased to announce the availability of additional SCADA plugins for Nessus ProfessionalFeed, Tenable SecurityCenter, and PVS users. Tenable's research team worked alongside SCADA experts from Digital Bond to test and identify a wide variety of common SCADA devices. The plugins were announced at Digital Bond’s S4 Conference on SCADA security held on January 19, 2012. Note: Digital Bond’s Dale Peterson joined us on the Tenable Network Security podcast episode 110 and spoke about the new plugins and SCADA security.
Below is a sample of some of the new SCADA plugins:
#6 Scanning IPv6 - Top Ten Things You Didn't Know About Nessus
by Paul Asadoorian on January 30, 2012
The video below is part 6 in our series of the top ten things you didn't know about Nessus and covers information related to IPv6 scanning using Nessus:
Further Reading:
#7 Nessus Versus Malware - Top Ten Things You Didn't Know About Nessus
by Paul Asadoorian on January 27, 2012
Nessus has several different plugins and techniques for helping you with the fight against malware. The video below is part 7 in our series of the top ten things you didn't know about Nessus and covers 3 different ways Nessus can be used to help detect malware:
Below are a few more examples of how Nessus can detect malware:
1. Nessus Network Checks
Nessus plugins in the "Backdoor" plugin family detect certain types of generic behavior on listening services that are indicative of malware. For example, plugin #35322 detects the presence of an HTTP backdoor. Nessus detects the web server remotely and identifies a condition where the web server, regardless of the request, returns a Windows executable:
An introduction to Nessus - The Video
by Paul Asadoorian on December 19, 2011
Tenable has published a new video which covers the major features in the Nessus vulnerability scanner. You can view the video below:
Microsoft Patch Management Integration with Nessus - Part 1 WSUS
by Paul Asadoorian on December 16, 2011
This is the first post in a two-part series that will cover how to configure Nessus and/or SecurityCenter to integrate with Microsoft's patch management software.
WSUS Patch Management Integration
Windows Server Update Services (WSUS) is available from Microsoft to manage the distribution of updates and hotfixes for Microsoft products. WSUS server 3.0 SP2 supports management of patches for the products listed here, as well as Windows 7 and Windows server 2003 SP2 patches. If you are not familiar with WSUS it is freely available to Microsoft customers as part of your Windows server licensing agreement. A great article that covers all aspects of planning, deployment, and configuration is Windows Server Update Services Learning Roadmap Community Edition.
Nessus and SecurityCenter have the ability to query WSUS to verify whether or not patches are installed on systems managed by WSUS and display the patch information through the Nessus or SecurityCenter. When performing scans with the WSUS patch management plugins enabled and configured please note the following:
Credentials entered into the policy take priority - If you've entered credentials into the scan policy and they are valid for a target system, Nessus will login and perform credentialed scanning without querying the WSUS server data.
- WSUS is queried when credentials fail - If credentials are not valid for a target system, or credentials are not entered at all into the policy at all, the WSUS server will be queried to obtain patch information for those targets. This also applies to other policy settings that may cause a credentialed scan to fail, such as the remote registry or administrative shares settings.
- The WSUS plugin communicates only with the WSUS server - The WSUS plugin makes a connection to the WSUS server IP/hostname and port specified in the policy configuration (see below in the "Patch Management WSUS Preferences"). This is an important point, as the Nessus server(s) will require access to your WSUS server, which could mean making firewall rule changes to allow the connections. However, this is a significant advantage as your target systems do not need to communicate with the Nessus server directly, which means host firewalls and remote registry settings will not get in the way of a patch audit.
- Patch information is only as up-to-date as your WSUS server - The data returned to Nessus by WSUS is only as current as the most recent data that the WSUS server has obtained from its managed hosts.
Patch Management Integration with Nessus Released
by Paul Asadoorian on December 6, 2011
Today, Tenable Network Security announced integration between Nessus and a variety of patch management systems that will simplify scanning in cases where credentialed scans are difficult or impossible. The integration allows Nessus and SecurityCenter users to establish direct links to patch management systems. This simplifies patch audits as the systems in your environment do not all have to contain credentials in order to be scanned.
Mobile Devices, Your Network, and Passive Sniffing
by Paul Asadoorian on November 30, 2011
Do you know how many mobile devices reside on your network? Is your security architecture designed to secure the mobile platform and protect your users and the network from the threats they pose?
Mobile devices are a security concern for many reasons. Mobile devices are typically unmanaged – meaning they may or may not be running AV software, a firewall, or conform to enforceable security policies. Yet, whether they are provided to your employees as part of your operations or not, they are likely accessing resources on your network. To compound the problem, many mobile devices connect to your local network and the Internet directly on two separate mediums. For example, the device may associate to a wireless belonging to your organization and a 3G/4G connection to the Internet.
Discovering Dropbox On Your Network
by Paul Asadoorian on November 10, 2011
Why is "Cloud Storage" So Appealing?
Services such as DropBox use the cloud to enable users to share files with others and transfer work from office to home and back. The challenge is two-fold:
- Determine how this and other cloud-based technologies align with the organization’s security policies and compliance mandates.
- Monitor use of these solutions to ensure compliance and limit exposure while preserving benefit.
Users often turn from sanctioned file sharing methods when they reach the limits of email and internal file sharing capacity, performance, and functionality. Email was not intended to share large files, and very often restrictions are implemented on the size of an individual email and how large your inbox can grow. Users can put files on an internal file sharing service, but that limits access to local users and VPN connected users. Employees who travel or third-parties may not have access to the internal network to retrieve the files. Many IT departments do not offer an easy way to share files through more traditional methods such as public FTP servers because of security concerns.
Dropbox overcomes many of these issues and has become quite popular, as evidenced by a recent influx of $250 million additional dollars in funding. The price is right too, as you can get 2GB of storage for free and manage access to your files.
The problem is, DropBox security and usage often violate corporate policy and security best practice. Corporate policy must protect sensitive information, such as customer data and intellectual property. If this information is being transmitted insecurely to a service such as Dropbox your policies and network defenses should detect this behavior and monitor for violations and information leakage.
For example, Dropbox relies on SSL for encryption. Several attacks released this year have been reported that can circumvent SSL security, and SSL certificate authorities have been compromised, breaking down the trust that SSL relies upon for security and integrity. Client software can become the weakest link as well, even if SSL is implemented properly. The Dropbox client software has contained vulnerabilities that, when exploited, could lead to your data in the wrong hands.
To solve this problem we need to implement encryption at the file level to protect sensitive data. I have to admit, I am a Dropbox user. However, I use it with caution and implement my own security policy. Any sensitive data is sent to DropBox using file encryption (PGP in this case). Any non-sensitive information is not encrypted and I am careful to distinguish between the two.
The Unpatchables
by Jack Daniel on October 26, 2011
In a perfect world, there would be no vulnerabilities. In a perfect patching world there would be a patch for every vulnerability and we would always be able to patch all of our systems as soon as a patch was available. In the real world we do the best we can and struggle with testing cycles, incompatibilities, and legacy applications which means sometimes we have to leave insecure and unpatched systems in production.
There are a variety of situations that can cause exposure:
- Some patches break needed applications or cause compatibility problems
- Patches may not yet be available for a vulnerability but the systems must stay online and exposed Legacy applications or operating systems may still be required (for example Internet Explorer 6 may be required to access a legacy web application, probably running on a legacy web server)
- A maintenance window may not be immediately available when patches are released
- Systems in development environments may be vulnerable during development and testing phases
Dealing with "Untouchable" Systems
by Paul Asadoorian on October 25, 2011
"The Untouchables"
An untouchable system is one on which you cannot install software (such as agents) or apply security fixes regularly. I have come up with several different examples of such systems, and tried to use examples here from my own experiences to define why they may fall into the "untouchable" category:
- Select SCADA systems - This is a broad category, but it boils down to computers that are used in control systems networks. While many may be considered to be "air-gapped" (physically disconnected from any other types of systems), that may not actually be the case since connectivity is required to manage the devices (especially those deployed in the field). I was once approached to perform a vulnerability assessment against one such system. I was told that network access would be provided, but that the system in question was responsible for providing power to thousands of people. This is a scary endeavor, as not only could you put thousands of people in the dark, but potentially damage infrstructure if the power is turned on and off too quickly. This situation requires a different approach than a traditional network vulnerability assessment or penetration testing.
- Traveling Laptops - It can be difficult to control the software and patches on systems that rarely connect to the corporate network. The concern is what happens when a laptop that has been connected to airport, hotel and other potentially hostile networks comes back to home base and plugs into your network. It may already be infected, and may not be up-to-date with patches. You can try to force users to connect back to your network via a VPN, but not all users may do this on a regular basis. During the user’s travel, the system is "untouchable".
- Network Devices – Let’s face it, no matter how redundant your network is, you just can't blast out a firmware update to your network gear at will. This leaves a good percentage of network systems that are "untouchable" for certain time periods. Routers have a bit more flexibility, but the physical switches that your systems are connected to cannot be taken down at will, or users will lose connectivity as flashing the device with new firmware requires that the system become unavailable for short time period (or longer time period depending on the device and software).
Tenable Announces Nessus Auditor Bundles
by Paul Asadoorian on October 18, 2011
We are pleased to announce the release of four new Nessus Auditor Bundles to our product lineup. These bundles package together Nessus On-Demand Training & Certification with a ProfessionalFeed Subscription, a Perimeter Service Subscription or both, with savings up to $800!
Be among the first to take advantage of this great cost-saving option.
#8 Nessus Performs Web Application Scanning - Top Ten Things You Didn't Know About Nessus
by Paul Asadoorian on October 11, 2011
Next up on our Nessus top ten list is #8, which covers how to use Nessus to find web application vulnerabilities. I've broken out the process into four different methods supported by Nessus:
1. Test For Known Vulnerabilities
Nessus contains over 2,600 plugins that can fingerprint and detect known vulnerabilities in web applications. Any plugin listed in the "CGI Abuses" or "CGI Abuses: XSS" plugin families is written to enumerate vulnerabilities that have been publicly reported in a web application product, whether open source or commercial. To enable these plugins you must enable CGI scanning in a Nessus policy's "Preferences" section. Even if you enable the plugin families they will not execute unless CGI scanning is enabled.
Below is an example of one such plugin's output:
Click for larger image
Nessus Plugin Spotlight: SSL Certificates
by Brian Martin on September 29, 2011
During the past few weeks, the Tenable R&D team has created several plugins to enhance SSL certificate auditing capability. Nessus will identify SSL certificates regardless of port and launch dozens of plugins to check for a variety of weaknesses and vulnerabilities. Three new plugins expand that auditing capability to more effectively audit your organization.
SSL Certificate Fails to Adhere to Basic Constraints / Key Usage Extensions
Tenable has released a plugin titled “SSL Certificate Fails to Adhere to Basic Constraints / Key Usage Extensions” (ID# 56284) to help users verify X.509 / SSL certificate chains. Based on RFC 3280 guidelines, Nessus will examine an SSL certificate found on any port to verify that it adheres to all basic constraints and key usage extensions. If an X.509 certificate in a chain fails to adhere to constraints and usage extensions, Nessus will report that violations are present. This finding means that either a root or intermediate Certificate Authority (CA) signed a certificate incorrectly.
#9 Nessus Detects Misconfiguration - Top Ten Things You Didn't Know About Nessus
by Paul Asadoorian on September 21, 2011
The Nessus Top Ten List
This is the second post in a series of ten that will cover “The Top Ten Things You Didn’t Know About Nessus”. The first, starting with 10 in David Letterman top ten list fashion, is titled “There's More Than One Way To...” and covers the benefits of both credentialed and uncredentialed vulnerability scanning. Each item on the list will have a blog post and video associated with it. And now, on to number 9: “Nessus Detects Misconfiguration”.
Misconfiguration Leads To Compromise
Nessus helps you answer the question “Do my systems have uniform configuration settings?” Why is this important? Systems are increasingly more complex, and maintaining control of your configurations leads to systems that run smoother and are more resilient to attack. A recent case study that supports this concept was presented in a blog post titled "What do you mean privilege escalation is not HIGH RISK?".
#9 Nessus Detects Misconfiguration (Video) - Top Ten Things You Didn't Know About Nessus
by Paul Asadoorian on September 15, 2011
Next up on our Nessus top ten list is #9, which covers how to use Nessus configuration auditing to discover information about your system configurations. The following video presents use cases and examples, from PCI compliance to detecting viruses:
Please visit Tenable's YouTube channel for more Nessus and SecurityCenter videos!
Junos Local Patch Checking Support Added to Nessus
by Paul Asadoorian on August 29, 2011
Tenable has authored a collection of plugins to identify Juniper Junos devices and perform local patch checking. By providing SSH or SNMP credentials, Nessus will log into a device running Junos and check for missing patches, such as:
- Junos J-Web Weak SSL Ciphers (PSN-2011-01-147)
- Junos debug.php Unauthenticated Debug Access (PSN-2011-02-158)
- Junos 11.1R1 on EX Series Switches Causes Multiple sfid Daemon Crashes (PSN-2011-04-241)
- Junos PIM rpd DoS (PSN-2011-07-296)
- Junos ICMP Ping 'Composite Next-Hop' DoS (PSN-2011-07-297)
- Junos Fragmented ICMP Packets DoS (PSN-2011-07-298)
- Junos IPv6 Over IPv4 Security Policy Bypass (PSN-2011-07-299)
- Junos DHCP Relay Agent Traffic Redirection (PSN-2011-07-300)
You can enable these plugins by selecting the "Junos Local Security Checks" plugin family when creating policies in Nessus (or SecurityCenter) as shown below:
Junos Plugin Family Selection
Plugin ID 55392, Junos Version Detection, was added to identify the operating system version of the device being scanned:
Junos Version Detection
#10 There's More Than One Way... - The Top Ten Things You Didn't Know About Nessus
by Paul Asadoorian on August 25, 2011
Drum Roll Please...
Being the Product Evangelist for Tenable Network Security gives me some interesting insight into how the community views the features of our products. I meet some people who provide us with awesome suggestions for improvements and I also meet some people who scan their networks at semi-regular intervals using the default set of policies, unaware of the huge variety of features that Nessus includes.
Hence the project I have been working on: with help and support from the community and my fellow co-workers at Tenable, I have developed what we understand to be a list of the top ten things that people may not know about Nessus.
In part one, I want to explore the differences between traditional network-based scanning and scanning with credentials. So, in traditional David Letterman top ten fashion, we’ll start with number 10!
Nessus maintains a balance of speed, accuracy, and intrusiveness.
#10. There's More Than One Way To...
Using Nessus and Metasploit Together
by Paul Asadoorian on August 8, 2011
Security Tools Working Together
This is the third in a series of posts that describe the use of Nessus on BackTrack 5. Previous posts covered how to activate Nessus on BackTrack 5 and how to integrate Nmap, Hydra, and Nikto with Nessus. In this post we will cover initiating Nessus scans from within Metasploit. Beginning with Nessus 4, Tenable introduced the Nessus API, which lets users programmatically interface with a Nessus server using XMLRPC. Zate Berg took the initiative to write modules in Metasploit that, among other things, can launch a Nessus scan and import the results into the Metasploit database. From there, we can find which hosts are vulnerable to exploitation, exploit them, harvest the password hashes, and then use those password hashes to initiate credentialed Nessus scans.
Configuring Nessus
The first step needed to use Nessus with Metasploit is to log into Nessus and create a user for Metasploit. In this example, I created a user called "msf" with a password of "metasploit".