Network Vulnerability Assessment

The company I work net admin for (fresh out of college, so I'm far from being an expert) currently has no security auditing that takes place. Considering we're one of the top financial planning companies in the region, I think that's pretty darn scary. So, I'm trying to learn about info sec auditing and where to start, and just read an excellent tutorial that TheHorse13 wrote last year in reference to this article:

http://www.securityfocus.com/infocus/1697

While reading that, I started thinking about how I should start assessing possible network vulnerabilties here.

So my question to you, is where would you start? You're sitting behind an employee's computer, and now you have your chance to find out whatever you can. What are you going to do first? What tools are you going to use? How are you going to go about looking for network vulnerabilities?

I would recommend that you check out the OSSTMM to learn about security testing methodolgy first.

Then there is a pretty comprehensive, if a bit old, list of the top 75 tools used by security professionals that can be found over at Insecure.org.

Hope those two help you on your way.

Thanks, I've started checking it out. So does anybody know where any AO tutorials are on port scanning / vulnerability testing / etc.? I've been searching the forums but have had no luck, and knowing me it was probably staring right at me somewhere. I've asked about that topic a couple of times now already, but I still need more stuff to study. GIMME GIMME! :)

Can't find an AO tutorial that your looking for? Try Negative's Tutorial Index. :)

I saw a tutorial on nmap by thehorse13 in there somewhere,closes thing to port scanning I could get

After you have a clear idea what you will assess, you will choose a set of tools to do some of the job for you.
I would suggest nessus, that is good one (although a pain in the neck to install without linux expertise)
It has a client-server archicture, well documented and (usually) up-to-date to vulnerabilities
http://www.nessus.org/

People that passed the nightmare installation phase really like to tool.

Retina by eEye is awesome, but not free (trial with limitations).
I've used nessus, and I'm not sure it's as comprehensive as eEye, but I've only used it on my own machine. eEye makes nice reports for your boss, I hear.

Nmap, thehorse's tutorial are wonderful. Make sure you know what your users have access to, make sure you can respond properly to any breach or scenario.

Thanks guys, I'm reading all of Horse's tutorials and playing with Nmap as we speak. Currently trying to scan my home computer from work and getting nothing but interference. Yay! ;)

Hey, this is wierd though. Look what popped up while I was doing that:

Quote:

---

Commodore 64 with TFE Ethernet Card (u IP TCP/IP stack) (93%)

---

Is this a joke? How in the world...?

/edit...Ok, this is wierd. While I was port scanning my home computer from my work computer, our Internet went down. Figured it was just coincidence, so I restarted the router and got us back up. Then I got curious, repeated the same scan, and....Internet went down again. How can my port scanning an outside computer bring our entire Internet connection down?

Some thoughts. Warning: you are going to get a headache when you realize all that needs audited...take a deep breath and attack this systematically and logically...

1. Split up what you are trying to audit (targets) first:
* Servers, desktops, network gear

2. Then split up what you are auditing for:
* Network login passwords: LC4 by @Stake, Crack, etc
* O/S vulnerabilities: Nesus (freeware, *Nix platform), Retina is very good (as stated by Soda) but is very expensive, GFI LANGuard isn't bad
* O/S patch levels: M$ MBSA
* Trojans: port scan machines, trojan scanners such as The Cleaner and TDS3
* Web/FTP servers not allowed on network: port scan all devices for 80,21,etc
* Permissions: group memberships, file share permissions
* Open file shares: Shed, Enum, etc
* Internet web sites

3. Prioritize items based on your company's business priorities and anticipated exposures. For example if you run e-commerce on Internet exposed web servers you should focus on these targets FIRST.

4. Perform audit(s)

5. Evaluate results

6. Remediate issues/problems found

7. Re-audit

8. Repeat 4-7 for each area

NOTE: Be CAREFULL!!! You can DOS and even crash systems by simply running a vulnerability audit against them.

I noticed you mentioned about NMap bringing down your Internet connection - this could be caused by any number of reasons: Nmap creating more TCP connections for your client than is allowed, bandwidth causing DOS, etc. Try setting Nmap to a slower speed or fewer threads and try again. You may be filling up firewall connection pool - what kind of firewall/router you running? Do you have egress filtering turned on your firewall/router (re.; ports allowed outbound)? If not you should blocking ports such as M$ chatter (135,137,139,445,etc) and STMP from clients other than approved mail servers.....etc list goes on.

Hope these thoughts help you. Have fun.

<edit>
Forgot to ask: do you have explicit approval from your supervisor/boss to perform this work? You must also ensure you have approval from the people who own or manage the machines you are auditing! Get all of this in writing (email, paper, etc). VERY IMPORTANT!
</edit>

Thanks, you gave me a lot to think about!

This appeared in the firewall log shortly after my Nmap playing:

Quote:

---

The cache is full; 6144 open connections; some will be dropped

---

Does this explain the lost Internet connection?

Quote:

---

Originally posted here by AngelicKnight
This appeared in the firewall log shortly after my Nmap playing:

Does this explain the lost Internet connection?

---

Yep, you maxed out the connection pool on your firewall (not sure if that is EXACTLY what they call it but a firewall expert here will chime in if no). I've had the same problem when doing scanning from home to my work sitting behind a consumer firewall...not to mention my home ISP blocking/filtering ports!

yes be careful with the switch choices for nMap it can have some very "undesirable" output.

I currently use the following:

nmap -sT -vv -O -P0 -oN "log name goes here" log "IP addy goes here"

with no "undesireables". As far as the guess it gave you for your OS, that is based off of the number of ports open and the responses nMap gets back from those ports when it finds them. The fewer ports open the harder it is to guess what is really there.


Retina is a good, solid product. I use it here at work and yes it makes some really nice and colorful reports. The c-level execs like them a lot, and it looks pretty in board presentations too :)

I like Nessus though as my real scanner, even though eEye makes a great product, and I use it in conjunction with Retina when doing my vulnerability assessments. I just put in a PO for Core Impact though so I'll be adding something else to my tool belt. Oh yeah, both Retina and Nessus can have undesireable effects on your network also, so be careful what choices you use with either of those products.

As an aside I got a couple of mailings from eEye last week, one is about the new Enterprise Retina that seems to have patch management built in, and the other is for the new Retina 5.0 that is coming out in the near future. It's in beta right now, and I'm not real sure if it is public beta or not... I'll check on that and see.

Your production network is not a good place to learn how to do a vulnerability assessment. There are huge legal issues when running any security tools against a network, espically one in the financial industry. A lawyer can save your a$$, by drawing up your paper work!! You need written permission signed by some top level managment specifically defining all the tools your allowed to use and the ip space you are able to test.

Good Luck and Get it in Writing!!

Quote:

---

Good Luck and Get it in Writing!!

---

Ahem, it's his network to scan.... and he's doing his job.

Angelic: Since the data you hold is of "high value" and the potential for internal "abuse" is high you really need to split the audit into two distinct portions. You need to start with a risk assessment. It sounds fancy but all you are doing is listing your data sources and their locations. So if you have an SQL database on server A that contains data of "value" 10/10 about your customers finances then server A and the database are something that will require protection from both the outside world and the inside. If you have an employee database listing their attendance at the company party with nothing confidential it's value may be 3/10, (You don't want the employee list public but it won't cripple your company if it gets there). Once all the data are categorized by risk and documented along with the threat to each you can put it together in a nice pretty report and wander into the boss-man's office and gently drop it in his lap. When he gives you the blank check I would start on the outside.

The first question from the outside is does the public need direct access to the data? Hopefully the answer is no because it makes your life a lot easier. Assuming "no", you need to make sure that there is no direct access from the public network to the trusted through any conduit. We don't want to be hosting our pretty little web site in the trusted zone because it is too close to our high risk data..... Lets build a DMZ for things that the public need access to and allow the absolute minimum to pass from the DMZ to the truated network, (preferably Nothing!). If you _have_ to allow access, (remember, the business need must exceed the risk so, with the public's financial data it had better be an incredibly high business need to justify placing such data at such high risk and the cost of securing it will be high in dollars), then you need to work out how to secure that within budget and OS's. This will include a professional independent audit which will cost you good hard cash.

Once the perimeter is secured you need to look at the internal security. Determine what employess require what access to what parts of customer records and lock them to it. If they don't need to see customer pins let's not let them... ;). Let's make sure that they can't pull the entire database and take it home, (encrypt it), let's make sure they can't break it... But let's have a good backup system in place and make sure it gets tested regularly per policy. This is where you need to think like a thief.... Sit at their consoles and determine how you would steal money from the company or the customers. Go to higher level people with the knowledge of the accounting side and ask them how they would steal and how they would prevent it, then implement their suggestions.

This is all a rather big subject and I kinda glossed over it.... I'm just trying to give you a base for your methodology. Hope it helps.

Yep yep, I'm taking lots of notes, do keep going. :)

Quote:

---

The first question from the outside is does the public need direct access to the data?

---

Unfortunately, they do. Our prez wrote his own software that we give clients that allows them to connect to our database from the comfort of their own homes so that they can check up on the status of their trades and other account info. They put in their user name and password, and boom, in comes all their account info straight from our database server.

The passwords for each client are kept elsewhere in the same database. The potentially scary thing here is that all employees have full access to all of this information, whether it be the finanical planners, executives, or their assistants. The company's pretty close-knit, so there's a lot of trust between everyone, but I still fear there's a potential formula for disaster here.

Another big red flag that I'm looking at concerns trade monitoring. Because various employees can take turns monitoring the trades, it has it's own user account, and guess what? To make things simple, the username and password are the same! Considering our prez is very IT-educated, this really leaves me wondering what he's thinking...

I also think he's too confident in our firewalls. I've mentioned penetration testing to him before, and his response was that the SonicWALLS catch all such activity. Personally I think that's dangerously overconfident in that. The firewalls are tightly secure and configured well, but I think we need to be more prepared for someone who can still get past them.

That's just a few examples of what I'm dealing with. But all this advice is very helpful, I'm taking it all into serious consideration as I continue to examine this.

just tell him that whatever kind of security you have, you anyone have the "key" to enter, he will...
Firewall wont protect him against weak passwords..

I have to pipe in about that last post.

I agree!

I used to work for a really big university, and so performing vulernability assessments was a big, fun project. I mean, at a unversity you have a lot of different kinds of systems, a lot of hosts, and a lot of people wanking away at the soft spots. I learned a lot, but it got tiring after a few passes.

In the end I had to make a decision to back off on my hardware / software based analysis and actually talk to some people, and participate in committees, and preach about modifying the behavior of our users. Our network was pretty darn tight, but that just doesn't mean anything when you have an account system that doesn't require complex passwords or even password expiration. Or when you have professors who give all their students their account info "just so I can get class started in more quickly".

Oh, good point, and that brings up another question:

Our user account passwords do expire often, and our admin password is very complex so it's hard to crack (in theory). However, I've been reading suggestions about changing the name of the admin account and then setting up a decoy low-permission account named "admin", which I think is a really good idea.

So, in order to that, how much am I going to have to change? Will a simple account change within Active Directory do the job, or am I going to have to do this in multiple places or on multiple machines?

what about to start to write some policies?
like "password cannot be easly guessed, such as wife's name, dog's name, or equal userid"
If you have a well established environment, maybe it is time to implement "best pratices".
1. Take a look at IEC 17799 and see some "ideas"
2. Go to some place like CERT.ORG and take a look on some best pratices (a lot of guys here can give you a bunch of places to look)
3. do what you can at technicall stuff
4. Write policies.
5. Create mechanisms to enforce that policies

Rest in your chair on 7th day

Yeah, that all sounds good, think I might do just that.

Ok, I think I may be having trouble grasping this DMZ concept. "Demilitarized zones" are supposed to help created layered security, right? My understanding was that it creates a sort of border within the network so that those with lower permissions can't get past it to access the rest of the network with higher permissions.

However, boss is saying it's not a security tool, rather the opposite, that a DMZ allows the router to open all ports on a machine so that it is completely exposed to the Internet as if there was no firewall at all.

So, can anybody further educate me on this and clear this up?

DMZ isnt an open country that anyone can do whatever they want but the security is diferent from that you had applied to internal network.
DMZ "means" that you should allow SOME connection to be inbound (because you are serving someone out there). But all activities on DMZ must be controlled.
DMZ / Corporate network segregation is very good because it makes security manament easier than put all on the same network behind your firewall. I can say that because here its common that small companies (with no money) wants these kind of configuration (all behind, no segregation) and its harder to do than with DMZ segregation.

If you boss think that all ports should be open to DMZ, you may be suggest him to "refresh" his mind (very kindly pls). He is thinking about WAR, not IT

I administer my DMZ as a seperate network, with a seperate interface on the firewall and its own network policy. It is not a border, just a different subnet with its own physical topology that makes it easy for me to permit or deny whatever I want with affecting my office users. As a matter of fact, having a DMZ gives me the flexibility of having either tighter or looser security on that segment than on my office segment, depending on my needs.

Yeah, man, this isn't war. That would suck.

Okay first: DMZ

(I will type faster next time)

(quick ?: what database system are you using?)

For the Admin account, like posted in an earlier thread, chaning the admin accounts only makes trouble. I doen't matter if you lower the admin status and make a thousand dummy accounts and make a random admin account. If someone can use dos and use the command net localgroup, then they can find it. Just secure everything and you will be fine. Also, on the Admin account make the password big and full of crap. For example Th3D0gC4n7║╚RunRunRun L0pht crack gives up at 8, the best Rainbow table out (that I know of) gives up at 15. So that password will be pretty friggen safe.

For more about your server situation, I need to know what you are using for your database. Thankie and good luck.

::edit::
I remembered you had a firebox, So I found this. It is just kinda universal, but it will help you understand DMZs a little better:

http://www.avolio.com/columns/OptionalInterface.html

We use Filemaker 6.0 databases. We have a FM server, then all employees use FM on their machines that connects to that server. EVERYTHING goes through FM: account info, e-mail, down to copies of every fax we send out. The data the FM server uses is kept on a separate data server, so the two work together interactively. So, I think that data server is the most important to protect (we back up the crap out of it too). If that were compromised, we'd be in deep poop, since every account, password, e-mail attachment, and measely detail of corporate workings is on there.

Quote:

---

Originally posted here by Tiger Shark
Ahem, it's his network to scan.... and he's doing his job.

---

Any network admin that thinks it's "his network" to run a vulnerability scan on a whim is extremely ignorant. When he knocks the first server offline and thousands of dollars gets lost because he was "just testing", that isn't going to hold up very well with most executives. Pink slip time!!!

Angelic: Your boss just showed his level of computer knowledge by stating that the DMZ opens a machine to everything. His experience is that of Linksys, D-Link router/firewalls, ie: consumer grade which allows you yo place a box in the "DMZ" so that it is unfettered by the firewall rules. This isn't a DMZ since all packets will be received by the "DMZ"ed machine.

A proper DMZ is made up of, what is really, a separate network. This can be created by having two firewall devices. One controls access to the "half internal" network or DMZ and the other controls access from the "half internal" network, (or DMZ), to the trusted network. Many up to date firewalls have a built in DMZ, (WatchGuard, for example, calls the port the optional port). Rules can be set up for access from the public network to the DMZ, from the public network to the trusted network and from the DMZ to the trusted network. It creates a three network system, public, DMZ and trusted. The control can be extremely granular. Typically, in a DMZ enabled system no access is allowed directly from the public network to the trusted network. Incoming packets are routed to servers in the DMZ and no further, (web pages etc. are served from the DMZ). If packets are required to get to the trusted network then they are first received by a server in the DMZ and then forwarded to a specific server in the trusted network, email is a good example. I employ a "mail sentry" in the DMZ that uses one type of mail server which then forwards the incoming mail to a server on the trusted network that uses a different mail server. Thus, if you want to get to my trusted netwok by exploiting SMTP you need exploits for two different mail servers.

Hope that clears up the DMZ issue. Ask if you need more detail.

ianbigboy:

Quote:

---

Any network admin that thinks it's "his network" to run a vulnerability scan on a whim is extremely ignorant.

---

Let me start by thanking you for calling me extremely ignorant, that was very nice. I'm a network admin, heck I'm the Manager of Information Systems. It _is_ my network to run scans against whenever I please. I perform random scans and vulnerability checks at will.

If I get pink slipped for knocking production servers offline then the pink slip is for my incompetence _not_ for the fact that I chose to do my job. There's a whole world of difference. If you don't know the potential hazards of a particular tool/vuln scanner you should be using it on test boxes first. If you don't have test boxes then it should be done at 10:30pm on a friday night upon completion of a full backup and verify so that you have the weekend to fix your screw up.

Tiger Shark has a very good point about it being his network to run scans against at will. For you up and coming network admins keep that in mind -- know what you're doing as best you can (so you can restore from backup in case you fudge something), but don't hesitate to do everything you can to KNOW your network, no matter what that requires. Scanning overcomes ignorance.

And even if you are not the admin in charge, networks are run with policies, administrative overhead, and supervisory authority. Find out who's in charge and what the policies are, and then feel free to scan away if it's permitted. Some admins will be more open to this than others, but then you have at least gained that kind of knowledge.

Isn't this one of the primary mantras of this site: knowledge is power?