Tenable Blog

Have you ever been charged to perform a security audit for a set of hosts that has been turned off? If those hosts have been configured to be “woken up” with a “Wake-on-LAN” packet, you can now leverage this capability with your enterprise Nessus scans. This blog entry describes how organizations that leverage Nessus or SecurityCenter to scan their infrastructure can audit systems that have been powered off.

Welcome to the Tenable Network Security Podcast - Episode 73

Hosts: Paul Asadoorian, Product Evangelist, Carlos Perez, Lead Vulnerability Researcher and Ron Gula, Tenable CEO/CTO

Announcements

• Several new blog posts have been published this week, including:
  • Agentless FDCC, USGCB and CyberScope Reporting Webinar - March 23 2:00 PM EST
  • Event Analysis: Detecting Compromises, Javascript, Backdoors, and more!
  • The Nessus Port Scanning Engine: An Inside Look
• Check out our video channel on YouTube that contains the latest Nessus and SecurityCenter 4 tutorials.


• We're hiring! - Visit the Tenable web site for more information about open positions.


• You can subscribe to the Tenable Network Security Podcast on iTunes!


• Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make various announcements, provide Nessus plugin statistics and more!

Stories

• Outbound SSH Traffic from HP Blade Servers - In this case it appears to be a bug, but what if it wasn't? I believe we need to keep close tabs on network connections in our environment. I'm a huge fan of Netflow analysis, largely because if you are attacking anything on the network, you need to make a connection. It's a difficult thing to get around (provided you do not have physical access to a medium that is not being monitored, such as 3G or some other wireless protocol). Also, it raises a scary situation where devices are pre-owned, meaning that during the manufacturing process attackers placed backdoors on the systems. Network monitoring can help identify these channels. For example, you should be able to spot your networking gear's management interfaces attempting to make connections out to the Internet.

There are a variety of indicators that a system has been compromised, ranging from the obvious to the very subtle.

Less obvious indications of a compromise include increased bandwidth, subtle IDS alerts (such as those indicating anomalous behavior) and mysterious configuration changes on systems. The questions that are typically asked include "How did they get in?" and "What did they do?" Tenable's Passive Vulnerability Scanner (PVS) provides useful information for answering these questions. Following are some of the alerts PVS may generate during an intrusion:

Welcome to the Tenable Network Security Podcast - Episode 72

Hosts: Paul Asadoorian, Product Evangelist and Carlos Perez, Lead Vulnerability Researcher

Announcements

• Nessus 4.4.1 has been released! Includes several improvements and a new option for SYN port scanning.
• Check out our video channel on YouTube that contains the latest Nessus and SecurityCenter 4 tutorials.
• We're hiring! - Visit the Tenable web site for more information about open positions.
• You can subscribe to the Tenable Network Security Podcast on iTunes!
• Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make various announcements, provide Nessus plugin statistics and more!

Stories

• Throwing Star LAN Tap - I have to admit, I'm a big fan of ninjas. Ever since I was a kid (in some ways I still am) I've been fascinated with ninjas. It's a combination of things that fuel my fascination: smoke bombs, swords, poison and, of course, throwing stars. Any time I can arm myself with a ninja-like tool that pertains to my job, I'm in. The LAN tap throwing stars allow you to monitor network traffic passively (e.g. there is no send, only receive) between a host and the network. This comes in handy for troubleshooting, forensics, and even to collect some data using Tenable's Passive Vulnerability Scanner.

Welcome to the Tenable Network Security Podcast - Episode 71

Hosts: Paul Asadoorian, Product Evangelist and Carlos Perez, Lead Vulnerability Researcher

Announcements

• Several new blog posts have been published this week, including:
  • Analyzing the Compromise - without Going Hungry
  • Nessus "Exploitable With" Field Updated



• Check out our video channel on YouTube that contains the latest Nessus and SecurityCenter 4 tutorials.


• We're hiring! - Visit the Tenable web site for more information about open positions.


• You can subscribe to the Tenable Network Security Podcast on iTunes!


• Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make various announcements, provide Nessus plugin statistics and more!

Stories

• Security vulnerabilities galore in social networks - A new web site, www.socialnetworksecurity.org, has been created to document the ever increasing vulnerabilities present in popular social networking sites such as Facebook. It seems that many sites, as it will come to no great suprise, are vulnerable to things like XSS. I believe it's the nature of the beast, so many of these web sites are in a race to add features and functionality, and it's too time consuming for them to properly identify security vulnerabilities as they go along. I do hope that big web sites take a step back from the fast and furious pace and start to implement security, before they get too far down a path and end up with a site that requires a major overhaul to be "secure".