Penetration Testing mailing list archives
RE: Kaseya
From: "Kevin Reiter" <KReiter () insidefsi net>
Date: Tue, 27 May 2008 10:17:07 -0400
Actually, the Kaseya "agent" lives on the machine(s) to be monitored by the Kaseya server. There shouldn't be an appliance running anywhere on the LAN, unless they're actually using the product from LPI. The only appliance that would be attached to the LAN would be a server for storing backup images (Kaseya has partnered with Acronis for this.) As a former MSP who ran the Kaseya application for a number of years (and attended their training), I'm pretty familiar with it. They actually kept security in mind when creating this application, so I'd be interested to see if you come up with any findings in your research. You can view the feature set of the application on their website - http://www.kaseya.com Hope that helps, -Kevin -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]On Behalf Of M.B.Jr. Sent: Saturday, May 24, 2008 3:01 PM To: pen-test list Subject: Kaseya Hello list, there's this infrastructure tool set for automating managed services, named Kaseya (proprietary technology). Basically, the managed-services-provider controls one of his customers' remote LANs with two intercommunicating "appliances": * a Kaseya dedicated server located at the MSP data center; and * a "probe" equipment at the remote LAN. The audit team to which I belong is about to examine the probe-featured LAN. Right now, we're researching whether this "solution" can cause the LAN some weaknesses; the resulting research's report is going to shape the logical tests. So, the question is (I guess): does anyone know of any Kaseya-enhanced LAN security implication/vulnerability? Thank you, yours sincerely, -- Marcio Barbado, Jr. ------------------------------------------------------------------------ This list is sponsored by: Cenzic Top 5 Common Mistakes in Securing Web Applications Find out now! Get Webinar Recording and PPT Slides www.cenzic.com/landing/securityfocus/hackinar ------------------------------------------------------------------------ This message may contain confidential or proprietary information and is intended solely for the individual(s) to whom it is addressed. If you are not a named addressee you should not disseminate, distribute or copy this e-mail or act upon the information contained herein. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. ------------------------------------------------------------------------ This list is sponsored by: Cenzic Top 5 Common Mistakes in Securing Web Applications Find out now! Get Webinar Recording and PPT Slides www.cenzic.com/landing/securityfocus/hackinar ------------------------------------------------------------------------
Current thread:
- Kaseya M.B.Jr. (May 24)
- RE: Kaseya Shenk, Jerry A (May 26)
- RE: Kaseya Kevin Reiter (May 28)
- Re: Kaseya M.B.Jr. (May 28)
- Message not available
- Re: Kaseya M.B.Jr. (May 28)
- RE: Kaseya Shenk, Jerry A (May 26)
- RE: Kaseya Kevin Reiter (May 28)
- RE: Kaseya Utz, Ralph (May 28)
- Re: Kaseya H D Moore (May 28)
- Re: Kaseya M.B.Jr. (May 31)
- RE: Kaseya Kevin Reiter (May 29)
- Re: Kaseya H D Moore (May 29)
- Re: Kaseya M.B.Jr. (May 29)
- Re: Kaseya H D Moore (May 28)