Re: [Professional IT Security Providers - Exposed] PlanNetGroup ( F )

["SecReview" <secreview () hushmail com>]

Nate, 
    Your email was constructive and much appreciated. We'll go over 
the review a second time and incorporate some of your suggestions. 
Thank you for taking the time to provide so much good feedback.



On Mon, 21 Jan 2008 02:07:50 -0500 Nate McFeters 
<nate.mcfeters () gmail com> wrote:
> SecReview,
> My 2 cents on your review, although I will try to be nicer then 
> you were to
> the reviewee.  I'm completely skipping your section where you 
> talked to the
> non-technical person, that's not even fair... sorta like reviewing 
> a
> consulting group based on their website alone... oh shit, I forgot 
> you guys
> do that too.
>
> Your comments on Question 1:
>
> We're not impressed with Michael's answer. First off we have no 
> idea what
> the hell this means: "Depending on time and availability, we will 
> work on
> finding any new vulnerability if we generate an anomaly of 
> interest." And we
> totally disagree with "Currently, the focus is primarily on 
> discovering new
> Oracle vulnerabilities - as MS SQL 2K5 is more difficult to beat 
> on,
> compared to Oracle." In fact, whatever is being described above 
> doesn't
> sound anything like a vulnerability assessment, we're not sure 
> what kind of
> service it is.
>
> The first portion "Depending on time and availability..." I don't 
> understand
> what your confusion is.  Basically the responder is saying that 
> he's willing
> to do what the client will pay him for.  Consulting is not a 
> cookie-cutter
> gig, so sometimes clients want you to spend 5 minutes running 
> scans, some
> want you to fuzz a proprietary protocol for as long as it takes.  
> I
> personally don't think either end of the extreme is of value to 
> the client,
> but you can hardly fault the respondent for delivering what the 
> client asks
> for.
>
> The second, I don't agree the overall focus is on Oracle, but if 
> you read
> the new (ZDnet, eWeek), or if you follow the conferences (HITB 
> Malaysia 2007
> great Oracle presnetation), then you will know that Oracle is 
> catching a bit
> of the limelight.  Besides that, I don't think you are qualified 
> to say what
> exactly a vulnerability assessment is... if the client is paying 
> you to
> assess their database servers, then that is a vulnerability 
> assessment of
> their database servers and that is what the work is.  Different 
> clients have
> different needs, and their are different specialty consulting 
> groups to help
> meet those... can hardly fault him if his specialty is databases.
>
> Your Comments on Question 2:
>
> > > trying to be cute with your "Again, carefully!" bullshit?
>
> Come on guys... imagine you get called by a group of people asking 
> to assess
> your company and you don't know who they are, wouldn't you try to 
> befriend
> them if possible?  A little professionalism would go a long way to 
> improving
> your reviews.
>
> > > A penetration test is not "Anything Goes!"
>
> Umm... sorry guys, there is plenty of cause for performing a 
> Denial of
> Service test.  Keep in mind that availability is a large portion 
> of what
> security is about.  I don't think he's talking about using a bot 
> net to try
> to take them down.
>
> > > it doesn't sound like Michael knows how to perform IDS evasion 
> testing.
> Using a proxy is >>not going to help anyone evade detection, it 
> will just
> help them to hide their IP address.
>
> Hmm... well, you're partially right.  I suppose that if he had 
> enough proxy
> servers and kept his scans very focused, he "might" be able to get 
> around an
> IDS.  In any case, not all clients want IDS evasion performed... 
> for
> instance, they may want to test their incident response, or, they 
> may allow
> the consulting group through the IPS/IDS in an effort to save on 
> time and
> costs.
>
> Your response to question 3:
>
> > > From the answer above, it looks like they like the same tools as 
> most
> people. That said, >>we've seen no proof of talent from anyone at
> PlanNetGroup yet. So we're near certain that >>their deliverables 
> ARE the
> product of automation.
>
> If they are the same tools that everyone use, how can you knock 
> them for
> that?  It seems to me that a group starts with a score of 0 in 
> your book,
> and then if they impress you they get points.  If you don't ask 
> the right
> questions, I don't see how they could impress you.  I concede, it 
> is
> certainly possible that they have no skills, and that they use 
> automation,
> but I don't think it is fair to say that at this point of the 
> review.
>
> Your response to question 4:
>
> > > Woha, it takes too much time to create a fake deliverable? Well 
> that's one
> way to get out >>of it, but we don't buy it. Either way, at this 
> point we
> don't feel that a sample report would >>help this review, we've 
> seen nothing
> impressive yet.
>
> Ever tried to do so?  It does take awhile, and it is risky.  If 
> you miss
> sanitization and release results of one of your clients you could 
> get sued.
> Perhaps given the context of the investigation he didn't want to 
> give you
> an old report and it would take to long and too much of his 
> billable time to
> actually get this to you.  That's not unreasonable.  You aren't 
> paying him.
> Again with the comments of nothing impressive yet.  You are 
> asking generic
> questions, how could anything be impressive?  It's a phone call or 
> email and
> you are asking questions that almost all consulting groups should 
> have
> relatively the same answers to... I see nothing impressive in that 
> at all.
>
> Your response to question 5:
>
> > > It sounds like Michael has a difficult time sticking to the 
> scope of work.
> Any time anyone >>performs Distributed Metastasis it should be 
> built into a
> scope of work first. If it is not, >>then do not perform the 
> testing because
> it is invasive and will get you into trouble. This is >>a big 
> negative point
> in our eyes as its critical that providers are able to adhere to 
> the scope
> > > of work for each specific engagement.
>
> I actually agree with most of this, but then again, as long as he 
> doesn't go
> over the clients budgetary and time constraints and is providing 
> the
> customer with value, I have no problem with going outside of scope 
> as long
> as the client does not.  Also, I don't know that it is a big 
> negative as you
> say.
>
> Your response to question 6:
>
> > > It sounds like Michael is a corporate security guy and has no 
> experience
> as a hacker.
> Bit of a blanket statement I'd say, but OK, let's assume you are 
> correct
> > > Certifications hold little to no water when it comes to real IT 
> security.
> Agreed, but you are totally putting words into his mouth.  He 
> basically says
> the same thing by calling the CISSP a definition test.  Why do 
> that?  Most
> people in security have the certs... most realize they are worth 
> nothing and
> don't really test tech knowledge, but instead test business 
> knowledge.
> > > What does hold water is experience and from what we can tell, 
> Michael has
> no real hacker >>experience.
> Please define "no real hacker experience".  If you mean he isn't 
> 31337 like
> you guys, then OK.  BTW, most clients aren't just paying for "real 
> hacker
> experience" they're also paying for the business side, i.e. what 
> is my risk,
> how can I mitigate, etc.  A good team has both people.
>
> On your response to question 7:
>
> Do you resell third party technologies?
>
> > > We don't think that it is a good idea that Professional IT 
> Security
> Providers sell third party >>technologies. Specifically because 
> they become
> biased towards a specific technology and >>push that technology as 
> a method
> of remediation when better methods might already exist.
> Agreed.  But that said, what if your third-party tech. has nothing 
> to do
> with the main thrust of your consulting work?  The question is 
> pretty vague.
>
> On your response to question 8 and 9:
>
> Ok, I'll buy that you have cookie cutter definitions from google 
> of those
> flaws and that his definitions don't fit.  I'll even buy that you 
> make a
> good point when you say EIP overwrite is not the only method of 
> exploitation
> (especially these days), but I'm wondering what you expected.  
> Should he
> have rattled on and on about how to exploit b0f in an XP SP 2 
> environment?
> Talk to you at length about DEP?  Bit ridiculous expectations.  
> Hell, while
> your at it, why didn't you ask him about integer overflows?  Off-
> by
> one/few/many exploits?  Heap overflows?  Why not have him recite 
> the Heap
> Fung Sheui method to you?  What about double free flaws, dangling 
> pointers,
> etc. etc. etc.  Let's be serious here, unless you are contracted 
> by
> Microsoft or another major software vendor, you probably don't pay 
> the bills
> by doing your own research, so... does this really matter?  Sure, 
> it's
> great... I'd like to know that consultants I was paying top dollar 
> to knew
> about this, but if he comes on site and spends 3 weeks trying to 
> find an
> integer overflow, I'm going to be pissed.
>
> Disclaimer:
> I'm not a client of PlanNetGroup.  Also, I don't think what you 
> are trying
> to do is a terrible thing, there's lots of snake oil being sold in 
> the
> commoditized security market out there, but I disapprove of your
> professionalism and your methods.  Also, I believe the list is 
> still waiting
> for you to credentialize yourself/yourselves.  That still hasn't 
> seem to be
> grasped here.  Look, if you're someone people respect, then maybe 
> people
> will buy your reviews, but somehow I doubt that is the case.  I'm 
> basing
> that view off of the content of your website and the fact that you 
> still
> have not credentialized yourself as the list called for so long 
> ago.  Do
> that, and I will re-review my review of your reviews.
>
> Nate
>
> On Jan 20, 2008 7:17 PM, secreview <secreview () hushmail com> wrote:
>
> > The PlanNetGroup is a Professional IT Security Services Provider 
> located
> > at http://www.plannetgroup.com. <http://www.plannetgroup.com/> 
> One of our
> > readers requested that we perform a review of the PlanNetGroup, 
> so here it
> > is. It is important to state that there isn't all that much 
> information
> > available on the web about the PlanNetGroup, so this review is 
> based mostly
> > on the interviews that we performed.
> >
> > The PlanNetGroup was founded by Jim Mazotas of Ohio USA 
> according to this Affirmative
> > Action Verification Form<http://odnapps01.odn.state.oh.us/das-
> eod/EODBMSDev.nsf/d881c0c739c3c9b985257344004f1929/c3e323de1df5162b
> 8525735d00607a6d?OpenDocument>.
> > We called Mr. Succotash and spoke with him for about an hour 
> about his
> > company, here's what he had to say.
> >
> > When we spoke with Jim Mazotas we asked him how he defined a 
> Penetration
> > Test. His answer wasn't really an answer at all but rather was a 
> bunch of
> > technical words strung into sentences that made no sense. Here 
> is what he
> > said for the most part. We can't give you an exact quote because 
> he
> > requested that some of the information related to clients, etc 
> be kept
> > confidential.
> >
> > "We get to target object, where we go with that is based upon 
> the client's
> > comfort level. We grab banner information, backend support 
> information, and
> > other kinds of information. During a penetration test we most 
> will not
> > penetrate. Most mid level companies will not want penetration." 
> – Sanitized
> > Quote from Jim
> >
> > Not only do we not understand what Jim said, but he'd be better 
> off saying
> > "I don't know" next time instead of looking like an idiot and 
> making up an
> > answer. This goes for all of you people that get asked technical 
> questions.
> > If you say "I don't know" at least you won't look like a fool. 
> Anyway.
> > When we asked Jim to define a Vulnerability Assessment, we 
> became even
> > more flustered. Again his answer was like a politician trying to 
> evade a
> > question with a bunch of nonsensical noise. Again, we've 
> sanitized this at
> > Jim's request.
> >
> > " A Vulnerability Assessment is more a lab based environment 
> type test.
> > Analyze servers and all nodes that are a true vital asset to the 
> company and
> > assess the vulnerability In a very planned out manner. This is 
> done in a lab
> > based environment." – Sanitized Quote from Jim
> >
> > Again, next time say "I don't know" because now you look like an 
> idiot.
> > Nobody expects you to know everything, but when you make shit up 
> and try to
> > fool people, its insulting. To be fair to Jim, he did say that 
> he was not
> > technical, but we didn't get technical here. As the founder of 
> the business
> > he should at least know what his different service boundaries 
> are and how
> > his services are defined.
> >
> > When we asked Jim if his team performed Vulnerability Research 
> and
> > Development, he said that they did not have the time because 
> they were
> > "fully booked". His primary customer base includes state 
> government and a
> > few private sector businesses. Unfortunately, we can't disclose 
> who his
> > exact customers are. He did say that he provides Network 
> Management Services
> > and Wireless Management services for many of his clients. Sounds 
> more IT
> > related than Professional Security related.
> >
> > When we finished with our call to Jim we asked him if he'd be 
> kind enough
> > to give us contact information for someone more technical in his 
> company. He
> > told us that he'd be happy to arrange a call with someone. At 
> the end, we
> > didn't end up calling anyone but instead shot a few emails back 
> and fourth.
> > The rest of this review is based on those emails.
> >
> > We decided to ask the same questions to Jim's technical expert. 
> We know
> > who his expert is, but we assume that he wants to stay anonymous 
> because he
> > signed his email with "Jason Bourne". So for the sake of this 
> interview
> > we'll call him Michael. Here's the email from Michael:
> >
> > -) How do you perform your vulnerability assessments?
> >
> > "* Carefully! :) Typically, we will work with the customer to 
> define the
> > scope of the assessment; limitations to OS, Network Equipment, 
> Web
> > Server, etc. This could be a combination of components 
> (depending on
> > scope), the real goal ultimately with this is to assess the 
> patching
> > effort of a customer. Depending on time and availability, we 
> will work
> > on finding any new vulnerability if we generate an anomaly of 
> interest.
> > Currently, the focus is primarily on discovering new Oracle
> > vulnerabilities - as MS SQL 2K5 is more difficult to beat on, 
> compared
> > to Oracle. Within vulnerability assessments, we disregard any 
> attempts
> > to evade IDS, IPS, etc."
> >
> > We're not impressed with Michael's answer. First off we have no 
> idea what
> > the hell this means: "Depending on time and availability, we 
> will work on
> > finding any new vulnerability if we generate an anomaly of 
> interest." And we
> > totally disagree with "Currently, the focus is primarily on 
> discovering new
> > Oracle vulnerabilities - as MS SQL 2K5 is more difficult to beat 
> on,
> > compared to Oracle." In fact, whatever is being described above 
> doesn't
> > sound anything like a vulnerability assessment, we're not sure 
> what kind of
> > service it is.
> >
> > -) How do you perform your penetration testing?
> >
> > * Again, carefully! The definition that I use with customers is -
>
> > Anything Goes! In addition to attempting to locate missing 
> patches,
> > vulnerable IOS's, applications, etc - we will perform an 
> assortment of
> > timed attacks, attempt to spoof trusted connections, or even 
> perform
> > social engineering - like dropping a few pre-trojan'd usb data 
> sticks
> > outside of a customer service area, a data center, etc. The only 
> thing
> > that we do not perform, typically, is denial of service style or 
> type of
> > attacks. We have had only one customer that we felt was in the 
> position
> > to handle such a test and it was performed against their 
> disaster
> > recovery infrastructure, not production."
> >
> > Michael, why are you trying to be cute with your "Again, 
> carefully!"
> > bullshit? A penetration test is not "Anything Goes!", if that's 
> how you
> > define it then I don't want you anywhere near any of my 
> networks. And why
> > the hell would you perform a Denial of Service attack against 
> anyone?
> > Everybody can be knocked off line if you fill up their pipe. You 
> scare us
> > man!
> >
> >
> > -) How do you perform evasive IDS testing?
> >
> > "* We use a series of proxy servers to attempt to perform basic 
> hacking
> > techniques; port scans, blatant attacks, etc. We are typically 
> going to
> > look for TCP resets as a means to evaluate if IDS is present and
> > possibly to find if IDS performs blocking activity. Often times, 
> if a
> > system in a trusted DMZ can be compromised and used as a proxy
> > (exploiting a relationship or rule within a firewall) or an SSH, 
> SSL,
> > encrypted tunnel can be established to a server behind the IDS 
> sensor
> > than we can successfully pull off an attack without the 
> customers
> > security staff even knowing."
> >
> > It doesn't sound like Michael knows how to perform IDS evasion 
> testing.
> > Using a proxy is not going to help anyone evade detection, it 
> will just help
> > them to hide their IP address. If the target network or 
> application is being
> > protected by an IPS device, then the IP that they are attacking 
> from will be
> > shunned just the same. So, we understand that the PlanNetGroup's 
> expert
> > hasn't a clue as to how to evade IDS. (Michael, did you get your 
> answer from
> > Google?)
> >
> > -) What tools do you favor?
> >
> > "* We really do not favor any tools. The focus of our effort 
> (Assuming we
> > are performing a pen-test or assessment) is to analyze a 
> situation and
> > choose the best tool for the end result or compromise. I will 
> use commercial
> > applications, such as AppScan, WebInspect, even ISS. There are 
> however
> > plenty of freeware, low-cost tools that we use; nmap, nessus, 
> metasploit -
> > ultimately, I find that an internet browser and a telnet prompt 
> will suffice
> > for much of the testing. It ultimately gets back to interpreting 
> the results
> > and adjusting the testing accordingly. We make it a point to try 
> out new
> > freeware tools on every assignment. The more tools that we know 
> of and can
> > test with opens our options if in the future a situation best 
> suited for a
> > tool presents itself."
> >
> > Every business that delivers security services has a set of 
> tools that
> > they use. These tools change from business to business, but 
> common ones are
> > nessus, webinspect, CANVAS, Core Impact, Metaspoloit, etc. From 
> the answer
> > above, it looks like they like the same tools as most people. 
> That said,
> > we've seen no proof of talent from anyone at PlanNetGroup yet. 
> So we're near
> > certain that their deliverables ARE the product of automation.
> >
> > -) Can you provide us with sample deliverables? (sanitized)
> >
> > "* No, too much time. Even to sanitize creates an opportunity 
> for a
> > liability in the event that a customer name is exposed ... 
> accidents do
> > happen! I will say that we do not take dumps from applications 
> and
> > regurgitations the information on paper. We limit our executive 
> summary to 6
> > pages at most and attempt to keep the entire report limited to 
> 25 pages in
> > total. Our goal with a deliverable is to get the precise 
> information to the
> > key stake holders so that they can make a decision."
> >
> > Woha, it takes too much time to create a fake deliverable? Well 
> that's one
> > way to get out of it, but we don't buy it. Either way, at this 
> point we
> > don't feel that a sample report would help this review, we've 
> seen nothing
> > impressive yet.
> >
> > -) Do you offer the option of performing Distributed Metastasis?
> >
> > "* No, not really. This is my decision as in a previous life I 
> got walked
> > out of Bell Atlantic Mobile (Verizon Wireless) using this 
> technique when I
> > compromised their Unix infrastructure by compromising the rlogin 
> function
> > (on all Unix servers, across all data centers). There is no 
> substitute for
> > experience, especially bad ones!"
> >
> > It sounds like Michael has a difficult time sticking to the 
> scope of work.
> > Any time anyone performs Distributed Metastasis it should be 
> built into a
> > scope of work first. If it is not, then do not perform the 
> testing because
> > it is invasive and will get you into trouble. This is a big 
> negative point
> > in our eyes as its critical that providers are able to adhere to 
> the scope
> > of work for each specific engagement.
> >
> > -) What is your background with relation to information 
> security?
> > "* Too long, too boring. Yeah got the CISSP (nice vocabulary 
> test), but
> > had to as I worked for DOD. Got a number of Certifications (I 
> have a stack
> > almost an inch thick and only get into them about once a year to 
> throw
> > another couple on top of the previous ones - too much alphabet 
> soup for me,
> > but bosses and customers like it. Spoke at a number of
> > European conferences, but found too many people did not 
> understand a word
> > I was talking about, so I got tired of that and quit that scene. 
> My outlook
> > on security has changed, to the point that I will advise 
> customers of their
> > risk, attempt to make it practical - but if they make a 
> conscious choice not
> > to listen - I do not fret over it.?"
> >
> > It sounds like Michael is a corporate security guy and has no 
> experience
> > as a hacker. Certifications hold little to no water when it 
> comes to real IT
> > security. What does hold water is experience and from what we 
> can tell,
> > Michael has no real hacker experience.
> >
> > -) Do you resell third party technologies?
> >
> > "* No, but kind of wished that we would. I think that it would 
> help with
> > sales."
> >
> > We don't think that it is a good idea that Professional IT 
> Security
> > Providers sell third party technologies. Specifically because 
> they become
> > biased towards a specific technology and push that technology as 
> a method of
> > remediation when better methods might already exist.
> >
> > -) Can you tell me why the EIP is important?
> >
> > "* The EIP controls an applications execution. If an attacker 
> can modify
> > the EIP while it is being pushed on the stack then the attacker 
> *could*
> > execute their own code and create a thread (aka. a buffer 
> overflow condition
> > exists). I had a good refresher this past year at Blackhat with 
> a course run
> > by Saumil Shah - he had an interesting buffer overflow
> > for the Linked-In client."
> >
> > The EIP is the Instruction Pointer for the x86 architecture. The 
> purpose
> > of the EIP is to point to the next instruction in a particular 
> code segment.
> > If the EIP can be overwritten then the flow of control of an 
> application can
> > be changed. In most cases this can lead to the execution of 
> arbitrary code
> > on the targeted system. Hackers use this to penetrate vulnerable 
> systems.
> > -) Can you define a format string exploit?
> >
> > "* A format string exploit leverages what is considered a 
> programming
> > bug. If input is not sanitized, an attacker can perform calls to 
> the
> > stack; read, write, etc without knowing details about the EIP."
> >
> > Unfortunately this answer isn't accurate or detailed enough as 
> almost all
> > software vulnerabilities are the result of user input that is 
> not properly
> > sanitized or validated. A format string condition occurs when a 
> user inserts
> > a format token into a C based application and that input is not 
> properly
> > sanitized. Hence why it is called a format string vulnerability. 
> When that
> > input hits a function that performs formatting, such as printf() 
> the input
> > is interpreted in accordance with the format tokens. Sometimes 
> this can be
> > used to write arbitrary data to arbitrary memory locations. The 
> EIP isn't
> > the only valuable memory location.
> >
> >
> >
> >
> > If you've managed to get this far, then you've survived reading 
> Michael's
> > answers to our questions. We're not going to spend much more 
> time writing
> > this review because by now we've formed our opinion. We did take 
> a quick
> > look at the PlanNetGroup's website and as with their people, we 
> were not the
> > least bit impressed.
> >
> > Our opinion of the PlanNetGroup is that they'd have a hard time 
> hacking
> > their way out of a wet paper bag. Their security expert is not 
> an expert by
> > our standards, as he did not properly answer any of our 
> questions or help to
> > define any of their services. We're pretty sure that the 
> PlanNetGroup could
> > run nessus and offer basic vulnerability assessment services. 
> We're also
> > pretty sure that they could offer IT services at some level. But 
> we'd hardly
> > call them subject matter experts and wouldn't recommend their 
> services to
> > anyone.
> >
> > If you are using the PlanNetGroup services and feel that we have 
> not given
> > them a fair review then please comment on this post. We will 
> consider your
> > comments. We have to say that Jim and Michael were both very 
> polite,
> > friendly, and respectful, but we can't let their kind nature 
> impact our
> > opinion of their service delivery capabilities. We think that 
> they should
> > sit down and try to define their services properly. We also 
> think that they
> > should hire an ethical hacker with real world experience if they 
> intend to
> > protect anyone.
> >
> > Score Card (Click to Enlarge)
> <http://bp2.blogger.com/_VcwqM25xL9M/R5PxN8GqVTI/AAAAAAAAACU/D7T4RS
> QlSXs/s1600-h/96YV5X.jpeg>
> > --
> > Posted By secreview to Professional IT Security Providers - 
> Exposed<http://secreview.blogspot.com/2008/01/plannetgroup-
> f.html>at 1/20/2008 04:21:00 PM
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
Regards, 
      The Secreview Team
      http://secreview.blogspot.com

--
Love Graphic Design? Find a school near you. Click Now.
http://tagline.hushmail.com/fc/Ioyw6h4fQlBYaiWpFnhi7pQK25eSsGhZHGXMnUnkrTsYbFDu13WWSE/
      Professional IT Security Service Providers - Exposed

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/