Re: vulnerability scanners not effective? or just a false-positive?

[Pete Herzog <lists () isecom org>]

Hi,

> have been able to access them as a piece of cake. Ofcourse the network is
> safe as long as the attacker doesnt "learn" the name of the important
> directories. But i think it is a very "huge" vulnerability. and nessus didnt
> even give a hinch!!

Nessus, like many vulnerability scanners is a blacklist.  These scanners 
search for "known vulnerabilities".  You cannot expect them to know of 
all vulnerabilities in a timely fashion. Furthermore, how did you 
configure the scanner?  Was it set to crawl the website or did you tell 
it how the website was structured?  Did you tell it to try all exploits 
or just try from what it thinks the OS/app is?  While Nessus is a really 
good scanner, there is also an element of human interaction that is 
needed for it to work optimally for you.

> and one more quest. How many of you think that the existance of the default
> banners in services(eg apache default error pages) are a security threat, if
> not high, atleast medium?. I do.

First, they wouldn't be the threat, they would be the vulnerability if 
you're talking Risk.  Second, you do mean existence of correct and exact 
banners, don't you?  While the less Visibility and information you 
provide, the better, there is sometimes a business need or an 
established balance between having an Exposure (aka Information Leak) 
and the cost of fixing it in a timely manner, most often before a 
service is put in a hostile environment.  Finally, I can agree with 
neither your high, medium, or low mean nothing to other people.  My wife 
likes her shower really hot.  But that's hot to me. She thinks it's 
normal (her medium).  Risk is relative to the organization not to you. 
In the OSSTMM 3.0, banners are often an Exposure if they are true, which 
is a level 4 calculation (1st being a vulnerability) and is defined as 
simply that which provides information on a Visibility.  If banners are 
false or misleading on purpose to hide information on the service and 
other measures are taken to truly disguise the operational work behind 
the service, they are calculated under the Privacy loss control for that 
Access point from that vector.

I know, I over-answered.  Sorry.  Ya'll can wake up now.

Sincerely,
-pete.

------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security? 
As attacks through web applications continue to rise, you need to proactively 
protect your applications from hackers. Cenzic has the most comprehensive 
solutions to meet your application security penetration testing and 
vulnerability management needs. You have an option to go with a managed 
service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). 
Download FREE whitepaper on how a managed service can help you: 
http://www.cenzic.com/forms/ec.php?pubid=10025
And, now for a limited time we can do a FREE audit for you to confirm your 
results from other product. Contact us at request () cenzic com
------------------------------------------------------------------------------