NetForensics 3.1 - Defy the basics

One of the things that I'm doing is evaluating an enterprise forensic solution. For those who are doing the same, here is what I found right off the bat with NetForensics 3.1:

SETUP
==============================
RedHat Advanced Server 9
Dell PowerEdge 2650
2 GIG RAM
73GIG SCSI drives x 2

SNIFFER
==============================
Ethereal .9.11

INITIAL DISQUALIFYING RESULTS
==============================
The NetForensics box passes, username, password hash and user rights level in the clear.

Anyway, since this is supposed to be a security product and since it would be housing all of our logs, I'd have to say that this initial finding removes it from the list of viable solutions, at least for shops that take security seriously.

Hope this saves someone some time. I know that if we had this info from the start, we wouldn't have even bothered to ask for a demo.

PS
We pumped 8 records per second to the box and it was at about 98% utilization. Hate to see what would happen if I directed my firewall logs at this thing ;)

--Th13

Hoss: You are $hitting me, right?.... that info in clear on a security box..... :eek:

I suppose you have looked at their site and seen all the awards they have on the front page..... Makes you wonder how those people evaluate security products.....

Yes, no ****. I can throw the packet dump in here if anyone cares to take a peak. Also, after looking further, I see that with the proper XML code, I can monitor all events realtime because the database does not authenticate a damn thing.

LOL!!!

WooHOO!! Got my hammer out today!!! **EVIL grin*

It makes you wonder how they can put up a page like this really, doesn't it! Along with all the awards they list here I'd like to know if anyone has even done as basic a test as you have.......

If they had a clue as to the MO of a cracker they would know that step 2 after successful compromise is to cover your tracks. If the db authenticates nothing can I assume that it doesn't authenticate queries, delete queries to be precise? That being the case their phrase "Provides a SECURE, SCALABLE and FAULT TOLERANT solution for managing security data for key government infrastructures" is deeply rooted in BS.

Final question..... ;) They have been working with COACT for six months for the purpose of EAL2 designation - is there a chance they would get it with this build of the software? 'Cos if they can it doesn't say a lot for EAL2.

We should promote the W3C to deity status and pray to them to make bad people like these to go to the great big pit of discarded junkware in the ground.

I say this as a joke and with a smile.... but wouldn't it be nifty to get a list of their cutomer base and go to each one and charge 300 an hour to "clean" up their security holes????? :D

I have been wanting a new cutom built cycle.... hmmm :D

Im sure they would all agree

Here is a snip of the dump. I tried this 6 times and the password hash never changes. Note the username, password and access level are all here...clear text!

<password xsi:type="xsd:string">adpexzg3FUZAk</password>
<timeZone xsi:type="xsd:string">EST</timeZone>
<updatedBy xsi:type="xsd:string">none</updatedBy>
<userId xsi:type="xsd:string">admin</userId>
<userName xsi:type="xsd:string">Admin User</userName>
<userType xsi:type="xsd:int">1</userType>

So...... Correct me if I'm wrong here..... With a password hash that never changes all I need to do is have a packet crafted ready to insert into the stream and begin a normal login stream. At the appropriate moment I should be able to inject the authentication information and it would be accepted? From this point onwards I am an admin of the system for the remainder of the session?

That seems too easy..... I'm not really into the "breaking" part of this.... I work more on perimeter security than internal due to my user base.

LOL, you don't even have to do that. I just figured out that the database engine does not auth a damn thing. What does this mean? It means that I can monitor realtime events on the box as they happen. If I'm an evil mean hax0r, I can probe the network to see what is logged and what isn't. After some recon of this type, I can plan a stealthy attack and no one would know the better.

I have informed NetForensics about these problems. I have received no oral or written comment other than 4 bug tracking tickets from their helpdesk. Needless to say, my eval of the product is over :).

--TH13

Quote:

---

Originally posted here by RoadClosed
I say this as a joke and with a smile.... but wouldn't it be nifty to get a list of their cutomer base and go to each one and charge 300 an hour to "clean" up their security holes????? :D

---

I think I put an idea like this on the suggestion forum ;)

ROFL.... I always manage to complicate the issue.....

I can see why they call themselves NetForensics...... 'cos they have a lot of experience cleaning up their own security breaches....<s>