Now I'm curious.... And I need your help....

In this thread here I questioned the "ability" of securityspace.com to use their tools properly and to "reasonably" report their findings. I laid out what I had available and what they "discovered"/reported as problems.

I'm not out to cause them trouble, nor do I expect anyone to spend any money to see their "results". I am interested in seeing a "survey" of what they do and how well they do with it.

So here's the "challenge".......

Go here and sign up for the "No Risk" security audit, (the Basic is a portscan and nothing more). When you have the results post what OS, patch level, expected open ports, services running on the open ports including version and then what SecuritySpace came up with and how they categorized the "risk" in a similar fashion to the way I did in the thread mentioned above.

I am really interested to see how accurate they are, what they consider high, medium and low risk, and how big they manage to make what should be small reports into really bigs ones.

I'm running one test against this box as I type, it's behind a Linksys router, then I'll run another against this box with no attempt at securing it while it is in the DMZ of the router to se how the results differ.... I'll post both results.....

Anyone else up to seeing what we can determine here?

[Edit]

It has taken 2 hours again to do their survey..... Unfortunately I don't have time to assess their look at my Linksys right now..... I have to go out to dinner with friends.... I'll take a look at the report in the morning and report on it.....

[/Edit]

My box(es) are behind a d-link router, I haven't done any updates for about two weeks... antiVir and Sygate on my box, the other boxes have standard xXP firewall...

Here's my results (with IP obfuscated, of course)



Basic Port Scan Vulnerability Test

Report ID: 11xxx83372
Audit Queued: Apr 17, 2004 21:28 GMT
Audit Started: Apr 17, 2004 21:29 GMT
Audit Completed: Apr 17, 2004 21:37 GMT
Host address(es): xx.xxx.37.25
1. Open Ports on xxxxxxxxxxx





Number of open ports found by port scan:0

While having 0 ports open is very good, you should be aware that this does not guarantee you are secure. You need to consider the following items:
• The port scan did not include UDP ports
• Vulnerabilities such as trojans that "phone home" cannot be detected by a port scan
• You may not be protected from email viruses




That's it...the entire report. I suppose the router killed everything, which I didn't really expect. Now If I could just keep my brother-in-law from tweaking my wife's computer(remotely)...I'd really have something to giggle about.

Don't know if this helps or not.



EDIT: Scan took about 15 minutes...

My basic scan was the same:

Quote:

---

Number of open ports found by port scan:0

While having 0 ports open is very good, you should be aware that this does not guarantee you are secure. You need to consider the following items:
The port scan did not include UDP ports
Vulnerabilities such as trojans that "phone home" cannot be detected by a port scan
You may not be protected from email viruses

---

But I will use their full audit Tuesday when I am connected to cable (it is installed on Tuesday of next week). And then I will also be installing a D-Link wireless broadband router. I will run the test on the router in the default setting and then again after I harden it. (at this time I will not change my primary box though, but in the near future I am planning on a reformat and complete reinstall)

Try the "No Risk" Scan..... The "basic" is a simple portscan and isn't designed to tell you anything.... The "No Risk" uses NMap, Nessus etc to scan you and check for vulnerabilities.... Tell it not to try to DoS you.... I'm just interested in their OS/Service detection/identification.

Sorry if I wasn't clear....

Ok, Tiger...in the attachment you will find the intial report I have gotten back on my NO Risk Scan. They only found 2 low risks and one other (?). If they send me anything else I will post it.

Why not pop a Nessus box up on the outside of your network and then use the NMAP scan feature and see what you come up with. You can then compare the results against your "no risk" scan. If you want, I can assist you with this as I have many Nessus servers sitting on the open internet.

:)

--TH13

So here's the report. Apparently I have 1 high and 1 medium risk vulnerability but they won't tell me what it is unless I pay $49.95 (oooohhhh.. sounds serious). I will be attaching the tcpdump logs shortly. A little info about the system(s) in question. My router has deliberate ports open that point to (or used to since the box is down due to lack of fan for the CPU) my IDS/honeypot. I had set it up as a play box and also to use for demonstration purposes in class (remote access of ACID). The box is down but I left the ports open. When I started this scan I saw connections, through ettercap, by the scanning tool attempting to access the "remote box". I know that I've deliberately opened up 1434, 135, 137, 139, 445 for giggles and to see what worm activity existed (the old box was a FreeBSD).

Now, the ssh does come to a box inside and that's perhaps the only risk I see immediately (needs an update I suspect).

Quote:

---

No Risk Security Audit Synopsis
Report ID: 1100083429
Review Status: Pending
Audit Queued: Apr 18, 2004 10:39 GMT
Audit Started: Apr 18, 2004 10:40 GMT
Audit Completed: Apr 18, 2004 12:11 GMT
Host address(es): xxxxxxxxx
Report Contents
1. Risk Classification Summary
2. Baseline Comparison Control
3. Vulnerability Category Summary
4. Vulnerability Title Summary
5. Vulnerability Details
6. Open Ports

Appendix A: Risk Definitions
1. Risk Classification Summary
Vulnerabilities are classified according to the risk they present to the network/host on which they are found. The following chart summarizes how the 10 different issues we found are spread across the different risk classes. For a detailed explanation of how vulnerabilities are classified, see Appendix A: Risk Definitions

2. Baseline Comparison Control
Baselining allows you to compare the results of an audit to the results received in a previous audit. This provides for an easy way to see what is changing from one audit to the next. This section documents which audit was used as a baseline, allows you to select a different audit to use as a baseline, and allows you to mark the current audit as something that should be used when running future baseline comparisons.

Note that you have a fair bit of control over the types of baseline comparison information displayed in your report by using our Report Style Editor. The default is to display ALL test results in your current report, along with notes as to which results are different from the previous report.

According to your current report style, baseline comparisons are: Enabled
Comparisons have been done against the report: Report ID:
Most recent audit in your account.
Make this audit a preferred baseline for use in comparing to other audits:
3. Vulnerability Category Summary
The vulnerability category summary shows how the various issues that were reported are distributed across the different test categories.

Category High Med Low Other
CGI abuses
Windows
Denial of Service
Gain root remotely
General 4 3
Misc. 1
FTP
Gain a shell remotely
Remote file access
SMTP problems
Backdoors
CISCO
RPC
Default Unix Accounts
Firewalls
Windows : User management
Useless services
Peer-To-Peer File Sharing
SNMP
Finger abuses
Settings
Netware
Port scanners
NIS
Totals: 1 1 5 3


4. Vulnerability Title Summary
High Risk Vulnerabilities
Information omitted.
Medium Risk Vulnerabilities
Information omitted.
Low Risk Vulnerabilities
11002 General : DNS Server Detection
10882 General : SSH protocol version 1 enabled
10728 General : Determine if Bind 9 is running
10287 Misc. : Traceroute
10267 General : SSH Server type and version
Other Items to be Considered
12053 General : Host FQDN
11951 General : DNS Server Fingerprint
10881 General : SSH protocol versions supported
5. Vulnerability Details
Information omitted.
Information omitted.
11002 General: DNS Server Detection
Description
domain (53/udp)

A DNS server is running on this port. If you do not use it, disable it.

Risk factor : Low

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
10882 General: SSH protocol version 1 enabled
Description
ssh (22/tcp)

The remote SSH daemon supports connections made using the version 1.33 and/or 1.5 of the SSH protocol.

These protocols are not completely cryptographically safe so they should not be used.

Solution :
If you use OpenSSH, set the option 'Protocol' to '2'
If you use SSH.com's set the option 'Ssh1Compatibility' to 'no'

Risk factor : Low

Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2003, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
10728 General: Determine if Bind 9 is running
Description
domain (53/tcp)

It was possible to determine that the remote BIND server is running bind 9.x by querying it for the AUTHORS
map.

It is recommended you change the source code to prevent attackers from fingerprinting your server.

Risk factor : Low

Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2003, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
10287 Misc.: Traceroute
Description
general/udp
For your information, here is the traceroute to xx.yy.xx.zz :
69.28.227.212
69.28.226.193
216.187.68.5
216.187.68.218
xx.yy.xx.zz
xx.yy.xx.zz
xx.yy.xx.zz
?


Makes a traceroute to the remote host.

Risk factor : Low

Additional Information:
Traceroute is only a problem if the route shown above is revealing sensitive IP addresses internal to your network. If the addresses shown are all upstream to you, then you have no risk associated with this test. If, on the other hand, we are showing private addresses on the traceroute, you should consider filtering ICMP Destination Unreachable (Code 3) and ICMP Time Exceeded (Code 11) messages.

This implementation of traceroute works by sending UDP packets with a source port of 1025 and a destination port of 32768 with increasing TTL values.

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
10267 General: SSH Server type and version
Description
ssh (22/tcp)
Remote SSH version : SSH-1.99-OpenSSH_3.7.1p2


This detects the SSH Server's type and version by connecting to the server and processing the buffer received. This information gives potential attackers additional information about the system they are attacking. Versions and Types should be omitted where possible.

Solution: Apply filtering to disallow access to this port from untrusted hosts

Risk factor : Low

Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2003, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
12053 General: Host FQDN
Description
general/tcp
xx.yy.xx.zz resolves as msmittens.com.


This plugin writes the host FQDN as it could be resolved in the report. There is no security issue associated to it.

Risk factor : None

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
11951 General: DNS Server Fingerprint
Description
domain (53/udp)

Nessus was not able to reliable identify the remote DNS server type.
It might be :
ISC BIND 9.2.2
The fingerprint differs from these known signatures on 1 points.
If you know which DNS server this host is actually running, please send this signature to
[email protected] :
4q:5:5:1q:2:1q:1q:1q:1q:0TC:0AAXD:0X:0X:0X:0X:0X:4q:4q:4q:0X:0X:5:0AAXD:


This script attempts to identify the remote DNS server type and version by sending various invalid requests to the remote DNS server and analyzing the error codes returned.

See also : http://cr.yp.to/surveys/dns1.html
Risk factor : None

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
10881 General: SSH protocol versions supported
Description
ssh (22/tcp)
The remote SSH daemon supports the following versions of the
SSH protocol :

. 1.33
. 1.5
. 1.99
. 2.0



This plugin determines which versions of the SSH protocol the remote SSH daemon supports

Risk factor : None

Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2003, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
6. Open Ports on xxxxx
Number of open ports found by port scan:0

While having 0 ports open is very good, you should be aware that this does not guarantee you are secure. You need to consider the following items:

* The port scan did not include UDP ports
* Vulnerabilities such as trojans that "phone home" cannot be detected by a port scan
* You may not be protected from email viruses




Appendix A: Risk Definitions
Users should note that test classifications are subjective, although we do our best to make appropriate classifications. If you spot an inconsistency, please let us know so that we can make the appropriate corrections.



High Risk Vulnerabilities
We view this class as any test that can be used to breach the integrity of the system, or take the system or a service off line (DoS). These types of vulnerabilities are typically very easy for malicious users to take advantage of.

Medium Risk Vulnerabilities
We view this class as any test that may be able to access inappropriate data in the system, which may in turn be combined with other information to provide a subsequent compromise. Although more difficult to take advantage of, these problems should still be rectified.

Low Risk Vulnerabilities
We view these vulnerabilities as problems typically only if the information they provide or access granted can be used in conjunction with a one or more other vulnerabilities to compromise your system or network. These vulnerabilities are usually not problems in their own right, but could potentially lead to problems in conjunction with other services.

Other Items to be Considered
This class of problems is used both to display informational items that are usually not problems but that you should be aware of (e.g. the "traceroute" determined from our systems to your site), or problems that have not, for one reason or another, been categorized into one of the other risk levels.

==================================

Appendix B: CVE Versioning
CVE identifiers, an industry standard way of identifying tests, are maintained by Mitre. The current mapping of CVE/CAN identifiers to Test IDs is based on CVE Version Number 20030402, and CAN Version Number 20040406. These were verified on April 14, 2004 as being the latest available.

---

Here's the tcpdump file. I manually edited it for giggles so hopefully all the unnecessary material has been removed. Should give you a general idea to the type of scanning they are doing. But it doesn't look like much beyond nessus, which leads to the question of why would I pay for this if I can get the tool myself via Open Source?

Mine was basically the same as moxnix's. My review status is still pending so I will post back with any other info they send me. This is a home pc running linux and iptables enabled. No scare tactics to this home user, yet.

Hey Hey,

I have to head off to work in 10 minutes, but I've started the scan.. I just wanted to give you all a rundown of what's being scanned.... The IP I've pointed it to is a Lynksys WAP w/ a 4-port switch. Later I'll connection through my switch instead of the router and do a comparison scan. Behind the Router are three machines. There are two windows 98 boxes (one updated regularly.. neither in my control) and my XP Box. Running on my XP box is a Trustix VM. I'd have turned if off, but I'm having too much fun with it. My router is forwarding two ports, 12345 and 31337 (what can I say.... I thought they were humourous to choose.) Anyways the services running behind those ports are apache and ssh. Anyways the scan is under way and I'm off to work... It should be done by the time I get to work and I'll post the results.

Peace,
HT

Sorry Tiger..now that I reread your post, you were perfectly clear :D

Here's the results of the no risk scan:




3. Vulnerability Category Summary


The vulnerability category summary shows how the various issues that were reported are distributed across the different test categories.


Category High Med Low Other
CGI abuses
Windows
Denial of Service
Gain root remotely
General 1
Misc. 1
FTP
Gain a shell remotely
Remote file access
SMTP problems
Backdoors
CISCO
RPC
Default Unix Accounts
Firewalls
Windows : User management
Useless services
Peer-To-Peer File Sharing
SNMP
Finger abuses
Settings
Netware
Port scanners
NIS
Totals: 0 0 1 1



Low Risk Vulnerabilities
10287 Misc. : Traceroute
Other Items to be Considered
12053 General : Host FQDN


general/udp
For your information, here is the traceroute to xxxxxxxxxxx :
69.28.227.212
69.28.226.193
216.187.68.5
216.187.68.69
216.187.68.229
216.187.68.58
208.174.225.229
208.175.10.97
208.175.10.94
1x.123.6.666
1x.122.2.991
1x.728.2.297
1x.719.5.165
1x.xx.1x.1xx
?
?
?


Makes a traceroute to the remote host.

Risk factor : Low

Additional Information:
Traceroute is only a problem if the route shown above is revealing sensitive IP addresses internal to your network. If the addresses shown are all upstream to you, then you have no risk associated with this test. If, on the other hand, we are showing private addresses on the traceroute, you should consider filtering ICMP Destination Unreachable (Code 3) and ICMP Time Exceeded (Code 11) messages.

This implementation of traceroute works by sending UDP packets with a source port of 1025 and a destination port of 32768 with increasing TTL values.


general/tcp
xxxxxxxx5 resolves as xxxxxxx.client.mchsi.com.


This plugin writes the host FQDN as it could be resolved in the report.
There is no security issue associated to it.

Risk factor : None

That's still encouraging....

just a question. but what do you guys think about www.norton.com online vulnerability scan? I used it and it worked alright for me.

You mean SecurityCheck? Pretty sucky since I got this error:

Quote:

---

Error 001

Security Scan and Virus Detection do not work with your operating system. To run Security Scan and Virus Detection, you must be using Windows 98/ME, NT 4.0 Workstation/2000 Pro/XP, or Mac OS 8.1 or higher.

---

That's an interesting statement IMHO and seems to limit the scans through whatever is achieved with the browser. Specifically browsers that support ActiveX.

Quote:

---

Our web site consists of two methods that identify security risks on your computer.

The first method is to scan your computer from our server. This is called a server-side scan. It does not require running any software on your system, everything is happening from an external perspective.

The following scans are server-side scans:

* Hacker Exposure Check
* Windows Vulnerability Check
* Trojan Horse Check

ActiveX support is not required to run the server-side scans.

The second method is to download and run software directly on your computer to determine security aspects that would be impossible to detect from a server-side only scan. This type of scan is called a client-side scan. For example, it would not be possible to detect whether your computer has antivirus software installed from a server-side scan where a client-side scan can detect this.

The following scans are client-side scans:

* Antivirus Product Check
* Virus Protection Update Check
* Virus Detection

ActiveX support is required to run the client-side scans.

---

Quote:

---

The following scans are client-side scans:

* Antivirus Product Check
* Virus Protection Update Check
* Virus Detection

---

Whats the beting Nortan antivirus comes out at the top?

Hey Hey,

I got my results back.... I had 1 high, 1 medium, 6 low and 6 other.

Quote:

---

4. Vulnerability Title Summary
Low Risk Vulnerabilities
11935 General : IPSEC IKE detection
11919 General : HMAP
11919 General : HMAP
11765 Windows : scan for UPNP/Tcp hosts
10287 Misc. : Traceroute
10267 General : SSH Server type and version

Other Items to be Considered

12053 General : Host FQDN
11268 General : OS fingerprint
10881 General : SSH protocol versions supported
10330 Misc. : Services
10330 Misc. : Services
10330 Misc. : Services


5. Vulnerability Details

11935 General: IPSEC IKE detection
Description
isakmp (500/udp)
The remote host seems to be enabled to do Internet Key
Exchange. This is typically indicative of a VPN server.
VPN servers are used to connect remote hosts into internal
resources. In addition, The remote host seems to be configured
to force all communications across port 500 for both the source and
destination port. That is, we sent the machine a packet from a random
port greater than 1024. The machine sent the reply back to port 500.

NOTE: This sort of behavior has been observed on Microsoft machines.

Solution: You should ensure that:
1) The VPN is authorized for your Companies computing environment
2) The VPN utilizes strong encryption
3) The VPN utilizes strong authentication

Risk factor : Low

11919 General: HMAP

Description
http (80/tcp)
Nessus was not able to reliably identify this server. It might be:
Kazaa servent (not a real web server)
The fingerprint differs from these known signatures on 7 point(s)



This script tries to identify the HTTP Server type and version by
sending more or less incorrect requests.

An attacker may use this to identify the kind of the remote web server
and gain further knowledge about this host.

Suggestions for defense against fingerprinting are presented in
http://acsac.org/2002/abstracts/96.html

See also : http://ujeni.murkyroc.com/hmap/
http://seclab.cs.ucdavis.edu/papers/hmap-thesis.pdf

Risk factor : Low


11919 General: HMAP

Description
unknown (5000/tcp)
Nessus was not able to reliably identify this server. It might be:
webfs/1.20
The fingerprint differs from these known signatures on 5 point(s)



This script tries to identify the HTTP Server type and version by
sending more or less incorrect requests.

An attacker may use this to identify the kind of the remote web server
and gain further knowledge about this host.

Suggestions for defense against fingerprinting are presented in
http://acsac.org/2002/abstracts/96.html

See also : http://ujeni.murkyroc.com/hmap/
http://seclab.cs.ucdavis.edu/papers/hmap-thesis.pdf

Risk factor : Low



11765 Windows: scan for UPNP/Tcp hosts

Description
unknown (5000/tcp)

The remote host is running Microsoft UPnP TCP helper.

If the tested network is not a home network, you should disable
this service.

Solution : Set the following registry key :
Location : HKLM\SYSTEM\CurrentControlSet\Services\SSDPSRV
Key : Start
Value : 0x04


Risk Factor : Low
CVE : CVE-2001-0876
BID : 3723

CVE Description
Buffer overflow in Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to execute arbitrary code via a NOTIFY directive with a long Location URL.

Related Security Advisory Cross Reference(s)
BugTraq ID: 3723
Common Vulnerability Exposure (CVE) ID: CVE-2001-0876
Bugtraq: 20011220 Multiple Remote Windows XP/ME/98 Vulnerabilities (Google Search)
Microsoft Security Bulletin: MS01-059
Cert/CC Advisory: CA-2001-37
CERT/CC vulnerability note: VU#951555
XForce ISS Database: win-upnp-notify-bo(7721)


10287 Misc.: Traceroute

Description
general/udp
For your information, here is the traceroute to 6x.95.x.x :
69.28.227.212
69.28.226.193
216.187.68.5
216.187.68.69
216.187.68.229
216.187.68.58
208.174.225.229
208.175.10.97
206.24.194.100
206.24.207.178
206.24.194.39
208.173.135.186
206.108.103.193
206.108.99.189
6x.230.x.x
6x.230.x.x
6x.230.x.x
6x.230.x.x
6x.95.x.x


Makes a traceroute to the remote host.

Risk factor : Low

Additional Information:
Traceroute is only a problem if the route shown above is revealing sensitive IP addresses internal to your network. If the addresses shown are all upstream to you, then you have no risk associated with this test. If, on the other hand, we are showing private addresses on the traceroute, you should consider filtering ICMP Destination Unreachable (Code 3) and ICMP Time Exceeded (Code 11) messages.

This implementation of traceroute works by sending UDP packets with a source port of 1025 and a destination port of 32768 with increasing TTL values.


10267 General: SSH Server type and version

Description
unknown (12345/tcp)
Remote SSH version : SSH-2.0-OpenSSH_3.8p1

This detects the SSH Server's type and version by connecting to the server
and processing the buffer received.
This information gives potential attackers additional information about the
system they are attacking. Versions and Types should be omitted
where possible.

Solution: Apply filtering to disallow access to this port from untrusted hosts

Risk factor : Low

Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2003, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.


12053 General: Host FQDN

Description
general/tcp
6x.95.x.x resolves as Toronto-HSE-pppXXXXXXXX.sympatico.ca.


This plugin writes the host FQDN as it could be resolved in the report.
There is no security issue associated to it.

Risk factor : None


11268 General: OS fingerprint

Description
general/tcp
Remote OS guess : Windows XP Professional RC1+ through final release

CVE : CAN-1999-0454

This plugin determines which operating system
the remote host is running.

Guessing the remote operating system allows
an attacker to make more focuses attacks and
to achieve his goal more quickly
This plugin uses the code from Nmap - see www.nmap.org
Risk factor : None

CVE Description
A remote attacker can sometimes identify the operating system of a host based on how it reacts to some IP or ICMP packets, using a tool such as nmap or queso.

Related Security Advisory Cross Reference(s)
Common Vulnerability Exposure (CVE) ID: CAN-1999-0454

10881 General: SSH protocol versions supported

Description
unknown (12345/tcp)
The remote SSH daemon supports the following versions of the
SSH protocol :

. 1.99
. 2.0


This plugin determines which versions of the SSH protocol
the remote SSH daemon supports

Risk factor : None

Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2003, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.

10330 Misc.: Services

Description
http (80/tcp)
A web server is running on this port



10330 Misc.: Services

Description
unknown (12345/tcp)
An ssh server is running on this port




10330 Misc.: Services

Description
unknown (5000/tcp)
A web server is running on this port


6. Open Ports on 6X.95.X.X

Port
Protocol
Probable Service


80
TCP
http


It appears that you are running a web server. If you have not done so, we recommend that you run the latest version of a popular web server. Many "fringe market" web servers have known bugs that are slow to be fixed because few people care about the problems. These problems can often leave you open to someone accessing/modifying files on your system that they shouldn't. By running a popular web server, you lower the risk of this type of problem, and when problems are found, it is likely that a patch will be made available rapidly to fix the problem. Check our survey to see what the most popular web servers are.

5000
TCP
fics

No description available for this port at this time.

12345
TCP
NetBus

It appears that you may have NetBus installed on your system. NetBus is a popular trojan that allows for remote administration of your system. Although it may be used legitimately in some instances, if you didn't a) install it; or b) install something simulates NetBus, we strongly recommend you remove it.

To remove it, run the NetBus-client (NetBus.exe) yourself, connect to locahost, choose "Server admin" and click on the "Remove server" button. Alternatively, go out and buy some good virus removal software (such as Norton's AntiVirus) and have it remove it for you.

Number of open ports found by port scan:3

---

I find it quite humerous because they stated earlier that port 12345 was ssh and now in my port scan results they are saying that port 12345 is Netbus. I also find it odd that they never found port 31337 which is TCP and is open running an apache webserver. I'm trying to think right now if my XP box is in a DMZ and that's why it found it as the OS, but last time I checked I didn't have anything on the DMZ. Also it found SSH (and should have found Apache) both running on Trustix, that should at least make it slightly more interesting. If I hear any more from them when they do the high level security risks I'll let ya'll know..

Peace,
HT

Ok first off it took 2 hours and 5 mins to complete.

This is a home use family computer running Win2k Pro with Zone Alarm firewall (up to date) and AVG antivirus (Up to date 4 days ago)

First off we have 1 low risk and 1 other, the low was in the misc. catogory and the other was in the general catogory.

Low Risk vuln:
10287 Misc.: Traceroute
Description
general/udp
For your information, here is the traceroute to **.***.***.*** :
69.28.227.212
69.28.226.193
216.187.68.5
216.187.68.69
216.187.68.93
216.187.90.45
216.187.123.234
216.187.123.226
206.223.115.44
166.49.208.217
166.49.164.73
166.49.208.70
166.49.168.38
194.72.17.81
195.99.120.206
194.72.0.198
81.146.244.40
213.120.155.145
?


Makes a traceroute to the remote host.

Risk factor : Low

Additional Information:
Traceroute is only a problem if the route shown above is revealing sensitive IP addresses internal to your network. If the addresses shown are all upstream to you, then you have no risk associated with this test. If, on the other hand, we are showing private addresses on the traceroute, you should consider filtering ICMP Destination Unreachable (Code 3) and ICMP Time Exceeded (Code 11) messages.

This implementation of traceroute works by sending UDP packets with a source port of 1025 and a destination port of 32768 with increasing TTL values.


*my ip does NOT appear in this list anywhere*

Next the "other" security risk:

12053 General: Host FQDN
Description
general/tcp
**.***.***.*** resolves as host**-***-***-***.range**-***.btcentralplus.com.

^Above line edited however it was my address that appeared^

This plugin writes the host FQDN as it could be resolved in the report.
There is no security issue associated to it.

Risk factor : None <--So im running free then?

Number of open ports found by port scan:0

While having 0 ports open is very good, you should be aware that this does not guarantee you are secure. You need to consider the following items:

* The port scan did not include UDP ports
* Vulnerabilities such as trojans that "phone home" cannot be detected by a port scan
* You may not be protected from email viruses

Unfortunatly this only being a Home computer there are not many ports open (However there were when this scan was done some less common prots open) it is not much of a test but it still failed to pick up on several security risks that i am already aware of. after reading this thread i have no confidence in the reliability of this scan

I got the tracerout volnurability and the fqdn. I have a siemens speedstream router. it was a windowsXP box with all the recent updates. Its kinda suprising realy seeing as how port 80 is open and i have an apache web server running w/ permisions to be acsessed from the outside at the router. I figured that would have turned up atleast something related. I havent patched the server since install so there has to be a vuln for it.

They have "Private" and "reserved" confused. IIRC the 8x.x.x.x addresses were reserved until fairly recently (I've seen a lot of south american addresses in the 8x range). Until recently though, they were considered reserved and kept from active assignment.

Ok, sorry for the delay..... Long day rescuing a homing pigeon with a damaged wing, trying to locate it's owner, failing, taking it to the vet, buying a new grill, assembling it..... correctly too!!! Well, it didn't explode yet.... :D

The first test was run against this machine, WinXP SP1, missing the most recent patches, (Apr 2004), but "protected" by a Linksys router with a WAP.... (and a couple of pints of beer... :cool:). They report zero ports open but claim that there is a "low" and a point of note. The low is that they can tracert the machine to a point short of the IP address itself.... The point of note is that they can determine the FQDN.

I'm not going to comment yet on the "vulnerabilities".

Right now the scan against this machine in the DMZ of the router is taking place. Technically I'm unprotected....

Out of curiosity I will leave the machine in the DMZ and install the FTP server I have on the work machine and see what it says..... Then I'll put the Linksys back in the way and open a single port to the FTP server and see what happens. It'll probably take another day or two to complete otherwise I will have to sit here in the pub for several hours and there will be a really pissy lady waiting for me at home if I try it all today..... :eek:

The "wide open" scan is nearly finished.... I'll report that next.

Here's the report for a machine I have done nothing to secure that I placed "out there", (same box as above)

Quote:

---

11935 General: IPSEC IKE detection
Description
isakmp (500/udp)
The remote host seems to be enabled to do Internet Key
Exchange. This is typically indicative of a VPN server.
VPN servers are used to connect remote hosts into internal
resources. In addition, The remote host seems to be configured
to force all communications across port 500 for both the source and
destination port. That is, we sent the machine a packet from a random
port greater than 1024. The machine sent the reply back to port 500.

NOTE: This sort of behavior has been observed on Microsoft machines.

Solution: You should ensure that:
1) The VPN is authorized for your Companies computing environment
2) The VPN utilizes strong encryption
3) The VPN utilizes strong authentication

Risk factor : Low


*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
11919 General: HMAP
Description
unknown (5000/tcp)
Nessus was not able to reliably identify this server. It might be:
webfs/1.20
The fingerprint differs from these known signatures on 5 point(s)



This script tries to identify the HTTP Server type and version by
sending more or less incorrect requests.

An attacker may use this to identify the kind of the remote web server
and gain further knowledge about this host.

Suggestions for defense against fingerprinting are presented in
http://acsac.org/2002/abstracts/96.html

See also : http://ujeni.murkyroc.com/hmap/
http://seclab.cs.ucdavis.edu/papers/hmap-thesis.pdf

Risk factor : Low

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
11765 Windows: scan for UPNP/Tcp hosts
Description
unknown (5000/tcp)

The remote host is running Microsoft UPnP TCP helper.

If the tested network is not a home network, you should disable
this service.

Solution : Set the following registry key :
Location : HKLM\SYSTEM\CurrentControlSet\Services\SSDPSRV
Key : Start
Value : 0x04


Risk Factor : Low
CVE : CVE-2001-0876
BID : 3723


*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

CVE Description
Buffer overflow in Universal Plug and Play (UPnP) on Windows 98, 98SE, ME, and XP allows remote attackers to execute arbitrary code via a NOTIFY directive with a long Location URL.

Related Security Advisory Cross Reference(s)
BugTraq ID: 3723
Common Vulnerability Exposure (CVE) ID: CVE-2001-0876
Bugtraq: 20011220 Multiple Remote Windows XP/ME/98 Vulnerabilities (Google Search)
Microsoft Security Bulletin: MS01-059
Cert/CC Advisory: CA-2001-37
CERT/CC vulnerability note: VU#951555
XForce ISS Database: win-upnp-notify-bo(7721)


Edit Disposition
Corrected False Positive Non-Impacting Other
11157 Backdoors: Trojan horses
Description
unknown (1025/tcp)
An unknown service runs on this port.
It is sometimes opened by this/these Trojan horse(s):
Fraggle Rock
md5 Backdoor
NetSpy
Remote Storm

Unless you know for sure what is behind it, you'd better
check your system

*** Anyway, don't panic, Nessus only found an open port. It may
*** have been dynamically allocated to some service (RPC...)

Solution: if a trojan horse is running, run a good antivirus scanner
Risk factor : Low


Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2003, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
10884 General: NTP read variables
Description
ntp (123/udp)

A NTP (Network Time Protocol) server is listening on this port.

Risk factor : Low


*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
10859 Windows: SMB get host SID
Description
microsoft-ds (445/tcp)
The host Security Identifier (SID) can be obtained remotely. Its value is :

XXXXXLAPTOP : 5-21--1250595799--151089796-444131745

An attacker can use it to obtain the list of the local users of this host
Solution : filter the ports 137-139 and 445
Risk factor : Low

CVE : CVE-2000-1200
BID : 959


Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2003, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.

Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2002, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.

Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2001, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

CVE Description
Windows NT allows remote attackers to list all users in a domain by obtaining the domain SID with the LsaQueryInformationPolicy policy function via a null session and using the SID to list the users.

Related Security Advisory Cross Reference(s)
BugTraq ID: 959
Common Vulnerability Exposure (CVE) ID: CVE-2000-1200
Bugtraq: 20000201 Windows NT and account list leak ! A new SID usage (Google Search)
XForce ISS Database: nt-lsa-domain-sid(4015)


Edit Disposition
Corrected False Positive Non-Impacting Other
10785 Windows: SMB NativeLanMan
Description
microsoft-ds (445/tcp)
The remote native lan manager is : Windows 2000 LAN Manager
The remote Operating System is : Windows 5.1
The remote SMB Domain Name is : XXXXXX



This plugin attempts to determine what is the
remote native lan manager name (Samba, Windows...).

Risk factor : Low

Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2003, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
10398 Windows: SMB get domain SID
Description
microsoft-ds (445/tcp)
The domain SID can be obtained remotely. Its value is :

XXXXXX : 5-21-1659004503-1957994488-1060284298

An attacker can use it to obtain the list of the local users of this host
Solution : filter the ports 137 to 139 and 445
Risk factor : Low

CVE : CVE-2000-1200
BID : 959


Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2003, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.

Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2002, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.

Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2001, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

CVE Description
Windows NT allows remote attackers to list all users in a domain by obtaining the domain SID with the LsaQueryInformationPolicy policy function via a null session and using the SID to list the users.

Related Security Advisory Cross Reference(s)
BugTraq ID: 959
Common Vulnerability Exposure (CVE) ID: CVE-2000-1200
Bugtraq: 20000201 Windows NT and account list leak ! A new SID usage (Google Search)
XForce ISS Database: nt-lsa-domain-sid(4015)


Edit Disposition
Corrected False Positive Non-Impacting Other
10397 Windows: SMB LanMan Pipe Server browse listing
Description
microsoft-ds (445/tcp)
Here is the browse list of the remote host :

XXXXXLAPTOP -


This is potentially dangerous as this may help the attack
of a potential hacker by giving him extra targets to check for

Solution : filter incoming traffic to this port
Risk factor : Low



Additional Information:
This test is a member of the SANS/FBI Top 20 Security Threats for 2003, a list of vulnerabilities that are among the most most likely attack vectors used to compromise systems.

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
10287 Misc.: Traceroute
Description
general/udp
For your information, here is the traceroute to 68.248.39.14 :
69.28.227.212
69.28.226.193
216.187.68.5
216.187.68.69
216.187.68.229
216.187.68.58
206.223.119.79
151.164.188.161
151.164.191.177
151.164.241.42
151.164.188.30
151.164.242.38
XXX.XX.70.113
XXX.XX.70.235
XXX.XX.39.14


Makes a traceroute to the remote host.

Risk factor : Low

Additional Information:
Traceroute is only a problem if the route shown above is revealing sensitive IP addresses internal to your network. If the addresses shown are all upstream to you, then you have no risk associated with this test. If, on the other hand, we are showing private addresses on the traceroute, you should consider filtering ICMP Destination Unreachable (Code 3) and ICMP Time Exceeded (Code 11) messages.
This implementation of traceroute works by sending UDP packets with a source port of 1025 and a destination port of 32768 with increasing TTL values.


Edit Disposition
Corrected False Positive Non-Impacting Other
10201 General: Relative IP Identification number change
Description
general/tcp

The remote host uses non-random IP IDs, that is, it is
possible to predict the next value of the ip_id field of
the ip packets sent by this host.

An attacker may use this feature to determine traffic patterns
within your network. A few examples (not at all exhaustive) are:

1. A remote attacker can determine if the remote host sent a packet
in reply to another request. Specifically, an attacker can use your
server as an unwilling participant in a blind portscan of another
network.

2. A remote attacker can roughly determine server requests at certain
times of the day. For instance, if the server is sending much more
traffic after business hours, the server may be a reverse proxy or
other remote access device. An attacker can use this information to
concentrate his/her efforts on the more critical machines.

3. A remote attacker can roughly estimate the number of requests that
a web server processes over a period of time.


Solution : Contact your vendor for a patch
Risk factor : Low


Additional Information:
The only known vulnerability regarding this doesn't affect your network as much as it allows someone to use your machine to assist a malicious hacker in port scanning a third party.
The way it works is this: The hacker sends an innocuous packet to your server, to which you respond, providing the IP_ID value. The hacker then sends a spoofed packet to the maching being scanned, faking the origin to make it look like it came from you. Depending on whether or not the target system's port is open, it responds (or not) to YOU, because it thinks the packet came from you. If it responds back, YOU respond back to it. Now, the hacker sends another packet to you, and you respond back with the IP_ID. In this entire scenario, you will have sent either 2 packets, or 3, depending on the state of the scanned system, and the hacker will be able to tell this by the values of the IP_ID field. Note, this really only works if the system "cooperating" in the scan (yours) is not busy. A busy server will generate too much traffic and can prevent reliable IP_ID counts from being determined.


*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
10114 Firewalls: icmp timestamp request
Description
general/icmp

The remote host answers to an ICMP timestamp request. This allows an attacker
to know the date which is set on your machine.

This may help him to defeat all your time based authentication protocols.

Solution : filter out the ICMP timestamp requests (13), and the outgoing ICMP
timestamp replies (14).

Risk factor : Low
CVE : CAN-1999-0524


*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

CVE Description
ICMP information such as netmask and timestamp is allowed from arbitrary hosts.

Related Security Advisory Cross Reference(s)
Common Vulnerability Exposure (CVE) ID: CAN-1999-0524


Edit Disposition
Corrected False Positive Non-Impacting Other
12053 General: Host FQDN
Description
general/tcp
XXX.XX.39.14 resolves as whereIdrinkafewbeers.com


This plugin writes the host FQDN as it could be resolved in the report.
There is no security issue associated to it.

Risk factor : None

Edit Disposition
Corrected False Positive Non-Impacting Other
11268 General: OS fingerprint
Description
general/tcp
Remote OS guess : Windows Millennium Edition (Me), Win 2000, or WinXP

CVE : CAN-1999-0454

This plugin determines which operating system
the remote host is running.

Guessing the remote operating system allows
an attacker to make more focuses attacks and
to achieve his goal more quickly
This plugin uses the code from Nmap - see www.nmap.org
Risk factor : None

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

CVE Description
A remote attacker can sometimes identify the operating system of a host based on how it reacts to some IP or ICMP packets, using a tool such as nmap or queso.

Related Security Advisory Cross Reference(s)
Common Vulnerability Exposure (CVE) ID: CAN-1999-0454


Edit Disposition
Corrected False Positive Non-Impacting Other
10330 Misc.: Services
Description
unknown (5000/tcp)
A web server is running on this port


*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other

6. Open Ports on XXX.XX.39.14


Port Protocol Probable Service

139 TCP netbios-ssn
Port 139 is used on Windows machines for NetBios name resolution, WINS, etc. A problem with older unpatched versions of Windows is that they are susceptible to receipt of Out-Of-Band (OOB) data. This means that someone can remotely send you OOB data on port 139 and can cause numerous problems on your machine, including but not limited to machine lockups, blue screens, loss of internet connection.
You should do one of several things: a) upgrade/patch your operating system to make sure it is not susceptible to this attack; b) firewall your system so that port 139 is not visible from the internet c) configure your router to block port 139; d) Install one of several monitoring packages on your PC that block this denial of service.


445 TCP microsoft-ds
This service, used in Windows 2000, provides an alternative to NetBIOS name resolution. By default, both NetBIOS and direct hosting support are enabled during install time. No exploits or vulnerabilities are known at this point in time concerning this service. Nevertheless, we recommend that you treat this service the same way as NetBIOS: a) firewall the system, and/or b) configure your router to block port 445.

1025 TCP listen
No description available for this port at this time.

5000 TCP fics
No description available for this port at this time.

---

Hmm.... I'm not as "vulnerable" as I thought..... and they really didn't sensationalize an unprotected box...... Installing and FTP server..... Then we'll see what happens....

[Edit]

Hmmm... I installed the FTP server, forwarded the port, (I figured I'd do it before going back to the DMZ immediately), and retried the scan.... Error message was "you have already run a scan against this address already this _month_.... OOOPs...... I disconnected from the ISP and reconnected..... It's running now.... I hope it doesn't take too long or I might have to quit and try again tomorrow.... (it's that pissy lady thing rearing it's ugly head..... <LOL>)

[/Edit]

XP Home box with all updates/patches, behind a Linksys 802.11g router:

No open ports, 1 low Miscellaneous (Traceroute), 1 other General (Host FQDN) "vulnerability".

Ok the full skinny,
Two xp home box's one fully patched one owned by teanage daughter status unknown. Behind netgear router nat enabled and acting as dhcp. Port forwarding from 7224 to 7226 for Bittorrent, running at time of scan.



No Risk Security Audit Synopsis

Report ID:
1100083285
Review Status:
Pending
Audit Queued:
Apr 17, 2004 12:04 GMT
Audit Started:
Apr 17, 2004 12:05 GMT
Audit Completed:
Apr 17, 2004 13:41 GMT
Host address(es):
xxxxxxxxxxxxxxxxx
Report Contents

1. Risk Classification Summary
2. Baseline Comparison Control
3. Vulnerability Category Summary
4. Vulnerability Title Summary
5. Vulnerability Details
6. Open Ports
7. Complete Report Order Form
Appendix A: Risk Definitions

1. Risk Classification Summary

Vulnerabilities are classified according to the risk they present to the network/host on which they are found. The following chart summarizes how the 1 different issues we found are spread across the different risk classes. For a detailed explanation of how vulnerabilities are classified, see Appendix A: Risk Definitions

2. Baseline Comparison Control

Baselining allows you to compare the results of an audit to the results received in a previous audit. This provides for an easy way to see what is changing from one audit to the next. This section documents which audit was used as a baseline, allows you to select a different audit to use as a baseline, and allows you to mark the current audit as something that should be used when running future baseline comparisons.
Note that you have a fair bit of control over the types of baseline comparison information displayed in your report by using our Report Style Editor. The default is to display ALL test results in your current report, along with notes as to which results are different from the previous report.

According to your current report style, baseline comparisons are:
Enabled
Comparisons have been done against the report:
Report ID:
Most recent audit in your account.
Make this audit a preferred baseline for use in comparing to other audits:

3. Vulnerability Category Summary

The vulnerability category summary shows how the various issues that were reported are distributed across the different test categories.


Category
High__
Med__
Low__
Other__
CGI abuses




Windows




Denial of Service




Gain root remotely




General




Misc.


1__

FTP




Gain a shell remotely




Remote file access




SMTP problems




Backdoors




CISCO




RPC




Default Unix Accounts




Firewalls




Windows : User management




Useless services




Peer-To-Peer File Sharing




SNMP




Finger abuses




Settings




Netware




Port scanners




NIS




Totals:
0__
0__
1__
0__
This report is a synopsis of a security audit done on your system. You had 0 High Risk and 0 Medium Risk vulnerabilities that were not disclosed in the above report. To view the details of these vulnerabilities and solutions to fix them, please subscribe to one of the services below.

Low Risk Vulnerabilities
_10287__Misc. : Traceroute
5. Vulnerability Details

10287_Misc.: Traceroute
Description
general/udp
For your information, here is the traceroute to xxxxxxxxxxx
69.28.227.212
69.28.226.193
216.187.68.5
216.187.68.69
216.187.68.229
216.187.68.58
65.207.236.177
152.63.71.210
152.63.70.106
152.63.64.57
204.255.174.238
144.232.20.90
144.232.26.109
144.232.9.157
144.232.13.181
144.232.13.16
160.81.43.102
213.200.81.117
213.200.77.130
212.74.106.97
?


Makes a traceroute to the remote host.

Risk factor : Low
Additional Information:
Traceroute is only a problem if the route shown above is revealing sensitive IP addresses internal to your network. If the addresses shown are all upstream to you, then you have no risk associated with this test. If, on the other hand, we are showing private addresses on the traceroute, you should consider filtering ICMP Destination Unreachable (Code 3) and ICMP Time Exceeded (Code 11) messages.
This implementation of traceroute works by sending UDP packets with a source port of 1025 and a destination port of 32768 with increasing TTL values.

*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

Edit Disposition
Corrected False Positive Non-Impacting Other
6. Open Ports on xxxxxxx



Number of open ports found by port scan:0
_
While having 0 ports open is very good, you should be aware that this does not guarantee you are secure. You need to consider the following items:
The port scan did not include UDP ports
Vulnerabilities such as trojans that "phone home" cannot be detected by a port scan
You may not be protected from email viruses
_
Appendix A: Risk Definitions

Users should note that test classifications are subjective, although we do our best to make appropriate classifications. If you spot an inconsistency, please let us know so that we can make the appropriate corrections.

Low Risk Vulnerabilities
We view these vulnerabilities as problems typically only if the information they provide or access granted can be used in conjunction with a one or more other vulnerabilities to compromise your system or network. These vulnerabilities are usually not problems in their own right, but could potentially lead to problems in conjunction with other services.


Jinxy

I did the test from a lan with freebsd 5.2 p4 (cvsup/buildworld on april 13) as a firewall, proxy with no services running on the external nic. They came up with the trace route "vuln" and picked up my donkey filesharing but did not identify it as such as i have it on a non standard port, they also came up with 1 medium risk vuln which they seem to want me too pay $ for (not gonna happen) but damn i am curious now :(

Hey Hey,

Apparently they weren't sure about my results so they made them viewable.

Here's my High and Medium Level Vulns.

Quote:

---

10059 Denial of Service: Domino HTTP Denial
Description
http (80/tcp)

It was possible to perform a denial of service against the remote
HTTP server by sending it a long /cgi-bin relative URL.

This problem allows an attacker to prevent your Lotus Domino web
server from handling requests.

Solution : contact your vendor for a patch, or change your server.
Consider changing cgi-bin mapping by something impossible to guess
in server document of primary Notes NAB.

Risk factor : Serious
CVE : CVE-2000-0023
BID : 881


*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

CVE Description
Buffer overflow in Lotus Domino HTTP server allows remote attackers to cause a denial of service via a long URL.

Related Security Advisory Cross Reference(s)
BugTraq ID: 881
Common Vulnerability Exposure (CVE) ID: CVE-2000-0023
Bugtraq: 19991221 serious Lotus Domino HTTP denial of service (Google Search)
Bugtraq: 19991222 Lotus Notes HTTP cgi-bin vulnerability: possible workaround (Google Search)
Bugtraq: 19991227 Re: Lotus Domino HTTP denial of service attack (Google Search)


&lt;Add Note&gt;WorkSheet Notes

Edit Disposition
Corrected False Positive Non-Impacting Other
11047 Denial of Service: Jigsaw webserver MS/DOS device DoS
Description
http (80/tcp)
It was possible to crash the Jigsaw web
server by requesting /servlet/con about 30 times.

A cracker may use this attack to make this
service crash continuously.


Solution: upgrade your software

Risk factor : Medium
CVE : CAN-2002-1052
BID : 5258


*** Baseline Alert ***
This vulnerability is new to your system, based on the baseline comparison done.

CVE Description
Jigsaw 2.2.1 on Windows systems allows remote attackers to use MS-DOS device names in HTTP requests to (1) cause a denial of service using the "con" device, or (2) obtain the physical path of the server using two requests to the "aux" device.

Related Security Advisory Cross Reference(s)
BugTraq ID: 5258
Common Vulnerability Exposure (CVE) ID: CAN-2002-1052
Bugtraq: 20020717 KPMG-2002031: Jigsaw Webserver Path Disclosure (Google Search)
http://marc.theaimsgroup.com/?l=bugt...1753204392&w=2
http://archives.neohapsis.com/archiv...2-q3/0028.html
http://archives.neohapsis.com/archiv...2-q3/0031.html
Bugtraq: 20020717 KPMG-2002034: Jigsaw Webserver DOS device DoS (Google Search)
http://marc.theaimsgroup.com/?l=bugt...2936820193&w=2
http://www.securityfocus.com/bid/5258
http://www.iss.net/security_center/static/9587.php
http://www.iss.net/security_center/static/9586.php
BugTraq ID: 5251
http://www.securityfocus.com/bid/5251

---

Peace,
HT

Quote:

---

Hello,

A manual review of your audit results has been conducted
by SecuritySpace staff. As indicated by the current
report on-line, we were not able to find any High or
Medium Risk problems during the course of the audit.

Congratulations! We have marked the report as fully
viewable

---

The two probs the found were the traceroute wich doesnt even resolve all the way to my external IP. It stops one hop back.Of course that could be because i have my router set to drop ping packets and the like. The other one is the FQDn wich doesnt seem like a big deal to me. As mentioned in my previous post im running an unpatched apache webserver with the php module added. i do have the webserver acsessable from the outside. I glanced at the list of tests they do and it seems pretty comprehensive.

Running a linksys router and 2 computers behind it, one firewalled one not, I had 2 vulnerabilities. Tracert which doesnt seem like too big a deal to me and didnt actually resolve my ip. And FQDN which seems like more bs since they said this

Quote:

---

12053 General: Host FQDN
Description
general/tcp
XX.XX.XXX.XXX resolves as XXXXXXXX.
This plugin writes the host FQDN as it could be resolved in the report.
There is no security issue associated to it.
Risk factor : None

---

Why tell me its a risk and then continue to say there is no risk with it? Firewall is Tiny firewall with PCCillin AV. The Firewalled PC is a fully updated Windows XP home machine and the nonfirewalled is a halfway(prolly missing 15-20 critical patches) patched XP Pro machine.

Quote:

---

4. Vulnerability Title Summary
Low Risk Vulnerabilities
10287 Misc. : Traceroute
Other Items to be Considered
12053 General : Host FQDN

---

If you need the full report let me know. I would be glad to throw it into notepad

OK, I'm waiting for the results of the scan against this box, (WinXP, in DMZ of a linksys, no hardening and a proprietary FTP server added, same box as in the other two tests run during this thread. I don't think I want to go much further with this so I'll start with the questions.....

1. Moxnix: They said you had zero ports open..... but they say that you have an NTP server running..... Care to comment?

2. Ms M: Maybe I'm misunderstanding but you say that ports 1434, 135, 137, 139 and 445 were open to a non-existent box. They report nothing about the open ports but they found a DNS server... Any clue as to how?.... I can understand them not finding the WinX ports open since no response would imply it was firewalled.

3. HT: Trustix? What is it? Is it possible it shows as a WinX box? Were you in the DMZ. It never found your apache server on 31337 but it reported one on 80? Do you have Domino on that box..... Did it crash? They said "It _was_ possible".... That implies they tried it and it worked.... maybe I'm missing something but how can you determine that a box can be exploited without actually trying it, (other than version info etc. which they seem not to be able to provide).

4. Jinx: It missed 3 open ports, 7224-7226..... You sure they respond to any old connection attempt?

5. Zombie: They missed a port 80 HTTP server.... You mention permissions.... Do you permit by remote address..... 'cos then it wouldn't respond....

I got the results of my new scan with the FTP server added..... Two things that jumped out at me was that after seeing the results were:-

1. They found more OS issues than they found in the original "un-protected" scan before the FTP server install......

2. The thing that peeked my curiosity in the first place about this was that they couldn't ID the FTP server..... Well.... to be honest.... and I don't remember doing it.... I changed the banner to read "ftp.mydomain.com", 'cos the banner ID'ed this install with the exact name and version of the server.

I need a little time to look at the OS changes they found since I _only_ installed the FTP server before I summarize the results... that and get a couple of answers to the questions above......

It has been interesting so far.... They don't seem as bad as I first expected though I do have some "reservations" about their report/sales pitch..... I''ll look it over.... I'm not going to bother with the "protected but FTP open" scan.... I get the feeling that they will soon see me as abusing their system having had a couple of really "sales-heavy" emails from them.... ;)

Quote:

---

2. Ms M: Maybe I'm misunderstanding but you say that ports 1434, 135, 137, 139 and 445 were open to a non-existent box. They report nothing about the open ports but they found a DNS server... Any clue as to how?.... I can understand them not finding the WinX ports open since no response would imply it was firewalled.

---

Yup. I picked up there attempts to connect to those ports via Ettercap (it actually opened the connection). What's interesting is that 1) I don't have a firewall (just a little lame NetGear router that seems to be less lame now) 2) DNS isn't opened and there is NO dns server (save for the router perhaps acting as a "proxy dns" for NAT purposes but it's not deliberately open).

Quote:

---

1. Moxnix: They said you had zero ports open..... but they say that you have an NTP server running..... Care to comment?

---

I was running a XP Home laptop, 1.6 ghz AMD, Kereo firewall, and C.A. antivirus.....on dialup. There are no open ports, except when using IRC (which I wasn't at that time).
I have no idea what they are talking about with the NTP server. I don't have any servers running, and I don't even know what a NTP server would be for.

Quote:

---

These pages contain lists of Network Time Protocol (NTP) public time servers. They are provided for information purposes only and represent the best information available at the current date. The operators of the servers listed do not commit to provide time service other than on a volunteer basis and with no guarantee of accuracy or availability. Further information of a technical nature can be obtained from the www.ntp.org site or comp.protocols.time.ntp newsgroup.
http://www.eecis.udel.edu/~mills/ntp/servers.html

---

Quote:

---

NTP stands for Network Time Protocol, and it is an Internet protocol used to synchronize the clocks of computers to some time reference. NTP is an Internet standard protocol originally developed by Professor David L. Mills at the University of Delaware.
http://www.ntp.org/ntpfaq/NTP-s-def.htm

---

I can say, that I don't have a NTP server running on any of my equipment.

My system is Fedora Core 1 with latest kernel and updates.

42% of the vulns found were clasified low risk
57% were clasified other

Low Risk:

10287 Misc. : Traceroute
10263 General : SMTP Server type and version
10114 Firewalls : icmp timestamp request

Other:

12053 General : Host FQDN
11421 SMTP problems : smtpscan
11268 General : OS fingerprint
10330 Misc. : Services

10287 traceroute:
Does not reveal any ip address within my home network., only the gateway is seen.

10263
Sendmail likes to brag about who it is, telling everyone, I must learn to change this:
220 atapi103.domain.org ESMTP Sendmail 8.12.10/8.12.10

10114
My system responded to a ICMP timestamp request, Ive taken their advice and made changes to firestarter, my GUI to iptables.

12053
Host FQDN?
24.101.x.x resolves as CPE0080c6fe15a9-CM014480118888.domain.com.

This plugin writes the host FQDN as it could be resolved in the report.
There is no security issue associated to it.

11421 smtpscan:
This server could be fingerprinted as being Sendmail 8.11.2
Incorect, I run sendmail 8.12.10 as detected earlyer.

11268 (CVE : CAN-1999-0454)
Remote OS guess : Checkpoint SecurePlatform NG FP3
I must not be vulnerable because I run Fedora Core 1

10330 Misc. : Services only makes clear I am running a smtp deamon. Which is correct.

Ms. M: Your reply kind of looks like what I see.... The ports being scanned _tend_ to be "common" ports to scan for vulnerabilites.... I need to spend more time looking at the dumps but I get the impresssion they are using a port list to speed up the scan, (makes them look good, (quick scan), finds the huge holes, thus makes them money.... :cool:

My reply to you seems to link to the next to Moxnix and the fact that they found more on the last scan against my box that only had an FTP server added......

Moxnix: It seems to me that they _might be_ "throwing in" the odd "vulnerability..... That's a bad accusation to make and I'm not making it yet... I haven't had time to properly look at my own logs..... I'll do that.... But with Mittens response, yours, my new "results" and some questions that are yet unanswered I'm beginning to wonder.....

I'll be quiet for now and look properly at the information I have.....

Quote:

---

Your reply kind of looks like what I see.... The ports being scanned _tend_ to be "common" ports to scan for vulnerabilites.... I need to spend more time looking at the dumps but I get the impresssion they are using a port list to speed up the scan, (makes them look good, (quick scan), finds the huge holes, thus makes them money

---

Well given that the scans are Nessus and Nmap standard scans I'm not surprised that they are common ports. This isn't a unique scanning tool. Heck, GRC has more of a unique signature in his scans than these guys do. Also, their FAQ identifies that that Basic scan does 1500 ports and takes about 10 minutes (load of crap -- took a good hour on my setup).

I suspect that if the tcpdump logs I posted were analyzed they'd probably match one or both of those tools in patterns. To me, it strikes me as a scam to take advantage of those that don't understand and to further "FUD" with those that truly don't understand. Although I have to admit as to wonder which is worse: taking advantage of those who don't understand or being one of those unwilling to investigate and not understand.

Hey Hey

Quote:

---

3. HT: Trustix? What is it? Is it possible it shows as a WinX box? Were you in the DMZ. It never found your apache server on 31337 but it reported one on 80? Do you have Domino on that box..... Did it crash? They said "It _was_ possible".... That implies they tried it and it worked.... maybe I'm missing something but how can you determine that a box can be exploited without actually trying it, (other than version info etc. which they seem not to be able to provide).

---

Trustix = Secure Linux Server Solution. I was demoing it for some servers I maintain, but as they also need to be working shells, and trustix has too much removed I determined it wasn't effective for my purpose, but as a stand alone server it takes the cake.. http://www.trustix.net

As for showing as a Windows box, it shouldn't have. It's a Linux Distro. As for the DMZ, yes the box is on the DMZ, so Ports 12345 and 31337 should have directed to Trustix and everything else should have gone to WinXP. I suppose for that reason the fingerprint is accurate. Yet it still shocks me that it didn't find apache on port 31337. I don't have Domino on the box, so they didn't crash it.

Here are the results of an nmap scan against the box:

Quote:

---

The service scan took 81 seconds to scan 4 services on 1 host.
Interesting ports on Toronto-HSE-pppXXXXXXXX.sympatico.ca (6X.95.XX.XX):
(The 1648 ports scanned but not shown below are in state: filtered)
PORT STATE SERVICE VERSION
80/tcp open http?
113/tcp closed auth
135/tcp closed msrpc
137/tcp closed netbios-ns
138/tcp closed netbios-dgm
139/tcp closed netbios-ssn
445/tcp closed microsoft-ds
593/tcp closed http-rpc-epmap
5000/tcp open upnp Microsoft Windows UPnP
12345/tcp open ssh OpenSSH 3.8p1 (protocol 2.0)
31337/tcp open http Apache httpd
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
SF-Port80-TCP:V=3.50%D=4/19%Time=40845DFA%P=i686-pc-linux-gnu%r(GetRequest
SF:,40,"HTTP/1\.0\x20404\x20Not\x20Found\r\nConnection:\x20close\r\nX-Junk
SF::\x20xxxxxxxxx\r\n\r\n")%r(Help,E,"\xc9y\)t&gt;\xc8\x01f\xc0m\xa2\0G/")%r(
SF:LPDString,E,"%\x94\xe5\xae\xf9\xd3C\x98C\xa1\+\x9fW\xdd");

---

I'm honestly not real sure what is running on port 80. I'll have to check it out when I get home(currently I'm at work) -- (as well as disable UPnP which I thought I had done...)... I'm also not sure why they are open, I have zonealarm blocking them, maybe it's time to stop letting the gf play with my PC :) hehe... Anyways... i'll check out what's runnign on port 80 when I get home.

Peace,
HT

Hello,

A manual review of your audit results has been conducted
by SecuritySpace staff. As indicated by the current
report on-line, we were not able to find any High or
Medium Risk problems during the course of the audit.

Congratulations! We have marked the report as fully
viewable.

We hope you found this service useful. If you have any
recommendations on how we can improve it, or have any
questions, please feel free to contact us by any of
the following means:

Email: [email protected]
Telephone: 1-800-799-4831 (North America)
(905) 331-2260

--
SecuritySpace Support

I guess I am good to go, no major problems.

Hey Hey,

Here's the last update, port 80 is open on my PC, it's being used by Skype to accept connections. One of the options is use port 60000 and some, but since I have that blocked it's using the alternative which is port 80. That's prolly why they couldn't determine what it was.


As a side note, I highly recommend skype to people.. it's VoIP software and it's quite nice and works really well (http://www.skype.net.
Peace,
HT

Quote:

---

4. Jinx: It missed 3 open ports, 7224-7226..... You sure they respond to any old connection attempt?

---

Cant give you an answere to that as i don't know.

As MsM said

Quote:

---

just a little lame NetGear router that seems to be less lame now)

---

Although mine is firewalled. Rule is set to allow incoming connections allways service name Bittorrent. So is the router intelligent enough to no that connection attempt isn't bittorrent??

Ok, you have a software firewall, you have BitTorrent set to other than the default ports and the firewall set to accept connections to the process from the internet. That being the case the firewall should be recognizing the open ports as being managed by BitTorrent and allowing them in.

Thus, the implication is, the scan didn't include your ports..... Therefore the scan is incomplete proving again that the scan is incomplete..... I suspect they do this for speed to be honest.... When they hit a firewall it seems to take about 8 times as long as it does on an open box. That's fair I suppose.... If we all went and presented them with a firewalled box at the same time we could end up DoSing them.... ;)

Thanks.

Okay..... I took my entire logs for the day and time that the original scan was done against my Mailserver because that's the most complete set of logs in a format that I am Ohhhh so familiar with.....

To recap the box itself:

1. It's a standard Win2k server, SP2, all patches
2. It is only allowed to accept connections from anywhere on ports 21, 25, 80 and 3389 due to the IP filtering I have in place.
3. The firewall blocks all but 21 and 25 to that box from the public network.
4. Port 80 is closed on that box at present.
5. Port 3389 can only be accessed from a short list of machines on the trusted network, (this box is in the DMZ).
6. Port 25 is managed by Microsoft's SMTP server under IIS 5. No effort has been made to hide this.
7. Port 21 is managed by a proprietary FTP server, fully patched, no attempt made to obfuscate the system, (but apparently I did after further tests against a default install of the FTP server....)

I have attached just the Snort portions of the logs available to me so that you can see what they "threw" at me. The Snort box is outside the firewall so what it reports is the unfiltered "attacks"/areas of concern. I really don't want to post the entire log for the period since it shows only too well almost the entire security stance of the gateway itself which would be a cracker's dream..... It would take me too long to properly clean it up and I'd probably still miss some important things so you'll just have to trust me.... :p

Points I noted with the benefit of the input got from you good folks, Ms. M's dump and my logs:

1. The scan is far from thorough. It missed a web server on HT's box on port 31337. Funnily enough it didn't scan 31337 or 1337 on my box either. I dunno, but you would have to think that these ports should be included if only for the "joke factor", (read: skiddie). It missed Jinxy's ports 7224-7226 too. It didn't scan those on my box either. Snort's portscan preprocessor reported a total of 3753 ports scanned in three separate scanning attempts. Generously allowing for duplicates let's say it scanned 3500 unique ports - we are looking at around 5% of the total portspace... It's hardly surprising they miss some.....

2. Mox's NTP server isn't a "real" server. When I ran the scan against my XP box with no firewall, (Mox, you were in the DMZ you said so you are unfirewalled), it also found an NTP server.... I think the box is just responding with a request for it's system time and they report that as a server - Comments anyone.

3. They threw a lot of stuff at the box as the snort log shows. What doesn't show is a lot of the other stuff that snort doesn't pick up but that other systems did. Those systems mitigated the threat automatically in different ways that show up in my complete log. Interestingly enough some of the things that were mitigated they reported as having been successful. (Note: I take the phrase "It was possible to" to mean they succeeded). Attempted buffer overflows were clearly stripped out before reaching the server on several occasions but they reported it successful...... Hmmm.....

4. They reported a non-existent DNS server on Ms. M's box. If Ms. M. tells me there's no DNS server running I'll trust her. She speculates that the D-Link that she used may be proxying the requests. I have used D-Link and Linksys and have found that they operate in a similar fashion. I ran a test against my Linksys to determine if it will proxy the DNS requests from the public network... It timed out even when asked for it's own IP address. I have to guess that the D-Link would do the same, (Ms. M: Try sending some DNS queries at it if you like - it probably won't respond).

5. When they "hit" on something they aren't too bad at IDing it _if_ nothing has been done to hide it, (journy's Sendmail server), but it only takes a small deviation from the "norm" to have them befuddled..... Heck, I still can't think what I could possibly have done to the IIS Mail server that would leave them not being able to ID it unless they rely too heavily on the OS fingerprint which would cancel out the possibility of it being IIS, (they thought it was a linux box.... I'm not sure how but it does scan that way now when I ran a test).

6. If you look through the Snort log you will see several instances where Snort reports attacks in the DoS category.... I specifically said on all the tests I ran "No DoS". Snort IDed Stacheldraht, Trin00:MastertoDaemon(defaultpassdetected!, Teardrop and ath amongst some others. It would have come as something of a shock to lose my network..... When I say don't do something to my network I really do mean don't!!!!

6. Their reporting is a tad too "sensationalized" for my liking, but, to be fair, they are trying to make money.... They will be broke if they tell everyone "we found nothing of any importance so you have nothing to worry about"..... Personally, I could give a rats xxx whether you can tracert me or resolve my FQDN. Thats going to happen. The sensationalising comes from the fact that they assume that since they can connect to a service and "it was possible to" exploit it, (when they have no proof that the exploit was successful - heck, in many cases the service was still available after buffer overflow attempts and DoS attempts just milliseconds later thus implying that they had failed to exploit it).

/me trying to be fair.... but having a hard time doing it.... ;)

We have done a fairly comprehensive look at their product and, compared to some others I have seen in the past which do little more than a basic portscan against the well known ports, this "audit" is more thorough. OTOH, I would not consider this to be a useful security audit under any circumstances. Too little of the portspace is scanned - I could have a hundred instances of Sub-7 running on custom ports and still have a reasonable chance of going undetected. It certainly does it's best job against firewalled computers that have no ingress allowed - but then again it bloody well ought to be able to report that accurately. I really hate the fact that they attempted some DoS' even though they were asked not to... I consider that irresponsible - they probably figure that the small print you agree to when you start the audit covers their rear. IMO, it would be arguable in a court of law if they trashed my "mission critical" systems at a cost to me of $500,000 when I distinctly told them "no DoS" but the logs clearly show their DoS attempts.

I am still waiting for TheHorse13 to scan this same box using any non-destructive tools he likes to determine the available services etc. on this same box. I don't expect any startling news but it will be interesting to see if he is more accurate than SecuritySpace was. I'll post any alarming differences when I get them.

To conclude:

I find myself being unable to recommend this service to anyone. Not even for a "quick and dirty" look at a system. There are too many holes, too many false positives and a tad too much hype thrown in with a healthy dose of irresponsibility. The only thing anyone would come away with is a false sense of security should they be given a clean bill of health. It brings home 3 good points:-

1. You get what you pay for. A full blown security audit is in the thousands of dollars and takes a week or more. That doesn't include any "capture the flag" games - it's just a thorough scan. This service costs $49.... The difference is clear.

2. While it might fool the home user and many of the poor people that find themselves thrust into the position of "Network Administrator" because they know how to ping someone from a command prompt, it isn't going to work with genuine admins who are knowledgable about the field..... The danger there is obvious.

3. Lastly, and most importantly as far as I am concerned, I think we can all see that trusting someone else with your security may well be a very bad thing. There is no substitute where your security is concerned for doing it yourself - learning the tools, the threats and the mitigation techniques and applying them yourself. Yes, industry best practice says that independent security audits should take place on a regular basis but they should be used as confirmation of your own security rather than a determination of it.

Quote:

---

2. Mox's NTP server isn't a "real" server. When I ran the scan against my XP box with no firewall, (Mox, you were in the DMZ you said so you are unfirewalled), it also found an NTP server.... I think the box is just responding with a request for it's system time and they report that as a server - Comments anyone.

---

Nope....I was on a stand alone system, on dial up and using Kerio firewall.

Quote:

---

Originally posted here by HTRegz
Hey Hey,

I got my results back.... I had 1 high, 1 medium, 6 low and 6 other.




I find it quite humerous because they stated earlier that port 12345 was ssh and now in my port scan results they are saying that port 12345 is Netbus. I also find it odd that they never found port 31337 which is TCP and is open running an apache webserver. I'm trying to think right now if my XP box is in a DMZ and that's why it found it as the OS, but last time I checked I didn't have anything on the DMZ. Also it found SSH (and should have found Apache) both running on Trustix, that should at least make it slightly more interesting. If I hear any more from them when they do the high level security risks I'll let ya'll know..

Peace,
HT

---

That scan looks REALLY familiar. Remember when I scanned your box the other night?
I did a custom port/vuln scan and added 12345 and 31337 because I knew they were there.

Compare the scan results you got from them to what I put in your webroot directory...

You'll find that that they are almost EXACTLY alike...

Which is what tiger is saying. They're using a custom nessus scan. Which is what I did.

I can't believe that they are charging $50 for that crap... HT: you owe me $50. ;)