Tenable Network Security Podcast Episode 131 - "Botnet Hosts, Management from the Cloud"

Announcements

• We're hiring! - Visit the Tenable website for more information about open positions.
• Check out our video channel on YouTube which contains new Nessus and SecurityCenter 4 tutorials.
• Tenable Tweets - You can find us on Twitter at http://twitter.com/tenablesecurity where we make product and company announcements, provide Nessus plugin statistics, and more!
• Want to ask questions about Nessus, SecurityCenter, LCE, and PVS and get answers from the experts at Tenable? Join Tenable's Discussion Forum for custom scripts, announcements, and more!
• You can subscribe to the Tenable Network Security Podcast on iTunes!

New & Notable Plugins

Nessus

• Active Inbound Connection From Host Listed in Known Bot Database - The ability to identify whether a host is connecting to a host in a botnet, or a host in a botnet is connected to it, is important information.
• Cisco ASA 5500 Series DoS - I lost track of how many times I've been taunted with the words, "I'm gonna DoS your firewall!" Oh wait, that was just something I heard in the movies and on TV. Turns out it's a reality if you're using an ASA firewall configured with IPv6. I wonder just how many more vulnerabilities are going to crop up for IPv6 protocol stacks (we even see IPv4 vulnerabilities crop up now and again!).
• Malicious Process Detection: Potentially Unwanted Software - Nessus now makes the distinction between malware and software that could be used for "evil" but has a chance of not being malicious (like Netcat).
• MikroTik Winbox Less Than 5.17 File Download DoS - " An unauthenticated, remote attacker may make multiple requests to download a large file, resulting in the service becoming unresponsive." MikroTik makes some super cool hardware too, fantastic wireless access points. They have their own operating system called RouterOS, however, this vulnerability is in a utility called Winbox used to configure the operating system.
• Oracle iPlanet Web Server Between 7.0 and 7.0.15 Vulnerabilities - Looks like some XSS vulnerabilities and one bug called "Range Header DoS" are listed as "could not be reproduced."
• Winamp Less Than 5.63 Vulnerabilities - Winamp is still going strong with all kinds of software products for media. Turns out they have some vulnerabilities that have been corrected.
• ACDSee Pro Less Tan 5.2 Memory Corruption Vulnerabilities - No, not the great classic rock band, the image editing application! They have patched four heap overflows, and something about being a long way to the top if you want to heap overflow.
• HAProxy Trash Buffer Overflow Vulnerability - HAProxy is a load balancer, have to make sure this type of device is always patched as even DoS vulnerabilities can be severe (though this one happens to be a buffer overflow). There are some mitigating circumstances: "It requires that the global.tune.bufsize option is set to a value greater than default and that header rewriting is configured."
• Quagga Less Than 0.99.19 Vulnerabilities - For those that may not know: "Quagga is a routing software suite, providing implementations of OSPFv2, OSPFv3, RIP v1 and v2, RIPng and BGP-4 for Unix platforms, particularly FreeBSD, Linux, Solaris and NetBSD. Quagga is a fork of GNU Zebra which was developed by Kunihiro Ishiguro." We recently published quite a few plugins to detect vulnerabilities on this platform.

Passive Vulnerability Scanner

• RealNetworks Helix Server Between 14.x and 14.3.x Vulnerabilities
• Flash Player Version Detection
• Outlook Social Connector Version Detection

SecurityCenter Dashboards

• Enhanced Botnet Detection

Stories

1. Users enraged by Cisco's cloudy 'upgrade' to Linksys routers - This comment from a user sums it up nicely: "I was actually really looking forward to the potential for the cloud apps on the 4500. What I see now is a serious deficiency in having to be forced to go through the cloud for basic router functionality. The interface is pretty but functionally inferior and slow to do edits with. Honestly, it is a real let down. But to restrict functionality and access to functions UNLESS signed into the cloud? No way Jose. Cisco, you are a hardware manufacturer, NOT my network administrator by proxy."
2. Number of Serious Web Vulnerabilities Dropped in 2011 - My only question on this is if it comes from WhiteHat Security's customers only, who care enough about security to hire their services, wouldn't it make sense that these vulnerabilities went down?
3. Password Audit of a Domain Controller
4. Open Security Research: Hack Tips: CiscoWorks Exploitation - Nice little article covering how to perform some post-exploitation steps on CiscoWorks, such as dumping out device configuration.
5. Exploiting Windows 2008 Group Policy Preferences - Expanded
6. BMC Remedy Password Descrambling - "The BMC Remedy application scrambles the users password with client side javascript on the login.jsp page."
7. eHarmony Password Dump Analysis - Okay, I'm going to rant again about password length: "The most popular length of password was seven characters. Followed closely by six characters and eight characters. Expectedly, the percentages drop drastically as you go higher in length." 23% of the passwords were 7 characters, 0.5% were 14 characters.