flaky network devices, and how to solve the problem

[Byron Sonne <blsonne () rogers com>]

Hey All,

Whether you pentest for a living or are a vendor, I'm curious to find 
out what kind of gear you've come across that crashes rather easily.

I'm doing some research with the goal of making a business case for some 
kind of 'Enterprise VM tested' product certification, and seeing if I 
can get my employer to sponsor or make a push for it. It would take the 
form of a vendor neutral not-for-profit company/foundation of some kind.

The idea would be that all VM (and related product) vendors would be 
invited to pool their products. Care would be taken so that there's no 
way for any one foundation member (or subgroup thereof) to have undue 
influence, no leak of proprietary information between members, and it 
couldn't be abused as a marketing tool by the members.

So far I'd like to see the foundation consist of Qualys, eEye, nCircle, 
Nessus/Tenable, Foundstone, Rapid7, and I'm trying to think of others as 
well; c'mon, throw me some more names! We'd also test with utils like 
nmap, amap, etc. Anyone who wants in can get in, small or large. It 
should be friendly.

Then, submitter-vendors who make network enabled gear would submit it to 
the foundation for testing, and we'd scan the shit out of it and let 
them know if it got knocked over, and if so, how. Then the submitters 
could take this information and improve their product. Everyone wins, etc.

The most common crashing device I've come across are printers, most 
commonly HP, although maybe that's because they have a larger market 
share in my experience. I've seen Canon and Lexmark too. And a few other 
things here and there, of course, as has anyone in this field (and if 
they haven't, I suspect they aren't telling the whole truth).

Thoughts, opinions, suggestions are welcome, particularly those from 
other vendors.

Cheers,
Byron

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner: 

Hackers are concentrating their efforts on attacking applications on your 
website. Up to 75% of cyber attacks are launched on shopping carts, forms, 
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are 
futile against web application hacking. Check your website for vulnerabilities 
to SQL injection, Cross site scripting and other web attacks before hackers do! 
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------