% $Cambridge: hermes/doc/talks/2009-11-nessus/talk.tex,v 1.31 2009/11/11 08:44:29 dpc22 Exp $

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\DeclareUrlCommand\email{%
  \def\UrlLeft{<}%
  \def\UrlRight{>}%
  \urlstyle{tt}%
}

\title{The New Friendly Probing Suite}
\subtitle{
  \url{http://probing.csx.cam.ac.uk}
}

\author{
  David Carter\\
  \email{probing-support@ucs.cam.ac.uk}
}

\date{11th November 2009}

\begin{document}

\begin{frame}
  \titlepage
\end{frame}

\note{
Structure of talk:
\begin{itemize}
\item Background to old probing suite and Nessus
\item The daily scan
\item Web interface to results
\item Access control
\item Future work
\end{itemize}
}

\begin{frame}
\frametitle{Background}

\begin{block}{Old probing suite}
  \begin{itemize}
  \item Motivation
  \item Hand crafted (Made sense in 1999, not in 2009)
  \item Limited number of tests
  \item Unix bias, reflecting developers
  \end{itemize}
\end{block}

\begin{block}{Review of vulnerability scanners}
Nessus obvious choice from 2000 to 2005
\begin{itemize}
\item Reputation head and shoulders above anything else
\end{itemize}

Closed source in 2005
\begin{itemize}
\item OpenVAS fork of Nessus v2 code
\end{itemize}

Honourable mention to NMap for port scanning.
\end{block}

\end{frame}

\note{
  History:
  \begin{itemize}
  \item Summer of breakins
  \item rjd4, bjh21
  \end{itemize}
  Nessus:
  \begin{itemize}
  \item Lack of competition something of a surprise to me.
  \end{itemize}
  NMap
  \begin{itemize}
  \item Nessus can use nmap as port scanner, no real advantages.
  \end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{Nessus vs OpenVAS}

Nessus: \$1200 per scanner per year 
\begin{itemize}
\item 31.5k plugins
\item IPv6 support
\item Nessus v4 3 x faster
\item Commercial support
\end{itemize}

OpenVAS: free (Open Source. GPL license)
\begin{itemize}
\item 15k plugins (including 7k Nessus plugins released under GPL).
\item Less useful results. 
\item Doesn't appear to be gaining traction: hobbyist project
\end{itemize}

Eventually chose Nessus:
\begin{itemize}
\item Review if OpenVAS improves: output 100\% compatible.
\end{itemize}

\end{frame}

\note{
Nessus:
\begin{itemize}
\item Nessus single giant multithreaded process
\item Value of support still to be determined...
\end{itemize}
OpenVAS notes:
\begin{itemize}
\item OpenVAS misses a lot stuff that Nessus picks up.
\item More obvious false positives.
\end{itemize}
30k figure bit of a red herring
\begin{itemize}
\item 80\% credentialed scans
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]
\frametitle{Current Probing schedule}

\begin{verbatim}
  131.111.0.0/18     Monday
  131.111.64.0/18    Tuesday
  131.111.128.0/18   Wednesday
  131.111.192.0/18   Thursday

  172.16.0.0/14      Monday
  172.20.0.0/14      Tuesday
  172.24.0.0/14      Wednesday
  172.28.0.0/14      Thursday

  128.232.128.0/17   Friday
  192.153.213.0/24   Friday
  193.60.80.0/20     Friday
  2001:630:200::/48  Friday

See: http://probing.csx.cam.ac.uk/schedule
\end{verbatim}
\end{frame}

\note{
Split main CUDN into four chunks. Odds and ends on Friday.
\begin{itemize}
  \item Five day probing schedule, much better than expected.
  \item Takes 13 to 30k seconds to scan a host
  \begin{itemize}
    \item 192 hosts probed in parallel.
  \end{itemize}
  \item Test starts at 09:30. Mostly finished by 16:30.
  \item Modulo abort() hiccups
\end{itemize}

Optimisations:
\begin{itemize}
  \item slowscan list (more than 5k secs)
  \item Have blacklisted very slow hosts (more than 20k secs)
\end{itemize}

Optional Email messages summarising results:
\begin{itemize}
  \item Not currently sending notifications before probing starts
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{The Daily Scan}

1) Scans registered hosts listed in Jackdaw IP register database
\begin{itemize}
\item Was originally doing exhaustive scan of address space
\end{itemize}

2) Ping test:
\begin{itemize}
  \item ICMP echo ping
  \item TCP SYN ping
\end{itemize}

3) TCP Portscan
\begin{itemize}
\item 4500 commonly used ports (out of 65535 possible)
\end{itemize}

4) Runs plugin library against each target:
\begin{itemize}
\item Builds knowledge base of results as it goes.
\end{itemize}

5) Output dumped to database when probing finished for the day:
\begin{itemize}
\item Obsolete results marked as expired, not removed immediately.
\end{itemize}

\end{frame}

\note{
Exhaustive:
\begin{itemize}
\item Picks up unregistered hosts.
\item Doesn't work with IPv6 (/48: 2**80 hosts: 10**24)
\end{itemize}
TCP SYN ping:
\begin{itemize}
\item TCP connections to 30 commonly used ports (inc 135, 445, 80, 22)
\end{itemize}
Plugins:
\begin{itemize}
\item List of plugins updated once a week.
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]
\frametitle{Example Plugin: tftpd\_detect.nasl metadata}

\tiny
\begin{verbatim}
include("compat.inc");

if (description)
{
 script_id(11819);
 script_version ("$Revision: 1.17 $");
 
 script_name(english:"TFTP Daemon Detection");
 
 script_set_attribute(attribute:"synopsis", value:
"A TFTP server is listening on the remote port." );
 script_set_attribute(attribute:"description", value:
"The remote host is running a TFTP (Trivial File Transfer Protocol)
daemon.  TFTP is often used by routers and diskless hosts to retrieve
their configuration.  It is also used by worms to propagate." );
 script_set_attribute(attribute:"solution", value:
"Disable this service if you do not use it." );
 script_set_attribute(attribute:"risk_factor", value:"None" );
 script_set_attribute(attribute:"solution", value:"n/a" );
 script_end_attributes();
 
 summary["english"] = "Tries to retrieve a nonexistent file";
 script_summary(english:summary["english"]);
 
 script_category(ACT_GATHER_INFO);
 
 script_copyright(english:"This script is Copyright (C) 2003-2009 Tenable Network Security, Inc.");
 family["english"] = "Service detection";
 script_family(english:family["english"]);
 script_dependencies('external_svc_ident.nasl');
 exit(0);
}
\end{verbatim}
\end{frame}

\note{
NASL:
\begin{itemize}
\item Nessus Attack Scripting Language.
\end{itemize}

Interesting bits:
  \begin{itemize}
  \item script\_id: in range 10,000 to 41,500
  \item Will see Synopsis, Description, Risk factor again in a minute
  \item script\_dependencies creates plugin dependency tree
    \begin{itemize}
    \item Plugins can depend on output from other plugins
    \end{itemize}
  \end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]
\frametitle{Example Plugin: tftpd\_detect.nasl actual probe}

\tiny
\begin{verbatim}
file = string("nessus" + rand());
foreach mode (make_list("netascii", "octet"))
{
  req = raw_string(0x00, 0x01) + file + raw_string(0x00) + mode + raw_string(0x00);
  sport = rand() % 64512 + 1024;                     

  ip = forge_ip_packet(ip_hl : 5, ip_v: 4,  ip_tos:0, ip_len:20,
                       ip_id:rand(), ip_off:0, ip_ttl:64, ip_p:IPPROTO_UDP,
                     ip_src:this_host());
  myudp = forge_udp_packet(ip:ip, uh_sport: sport, uh_dport:69,
                           uh_ulen: 8 + strlen(req), data:req);

  filter = 'udp and dst port ' + sport + ' and src host ' + get_host_ip() + ' and udp[8:1]=0x00';

  rep = NULL;
  for ( i = 0 ; i < 3 ; i ++ )
  {
   rep = send_packet(myudp, pcap_active:TRUE, pcap_filter:filter, pcap_timeout:1);           
   if ( rep ) break;
  }
  if ( rep ) break;
}

if(rep)
{
 data = get_udp_element(udp:rep, element:"data");
 if(data[0] == '\0' && (data[1] == '\x03' || data[1] == '\x05'))
 {
  security_note(port:69, proto:"udp");
  register_service(port: 69, ipproto: 'udp', proto: 'tftp');
 }
}
\end{verbatim}
\end{frame}

\note{
Interesting bits:
\begin{itemize}
\item Forge UDP packet and throw at target server (2*3 attempts)
\item PCAP library used to filter results
\item Registers TFTP service in Knowledge base if found.
  \begin{itemize}
  \item Will trigger further tests
  \end{itemize}
\end{itemize}
General notes about NASL:
\begin{itemize}
  \item Sandbox environment: can only poke at nominated target
  \item Vaguely Perl/PHP syntax. Rather limited/ad hoc.
  \item Main advantage is existing plugins library.
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]
\frametitle{Example Plugin: tftpd\_detect.nasl output}

\tiny
\begin{verbatim}
Synopsis :

A TFTP server is listening on the remote port.

Description :

The remote host is running a TFTP (Trivial File Transfer Protocol)
daemon. TFTP is often used by routers and diskless hosts to retrieve
their configuration. It is also used by worms to propagate.

Solution :

Disable this service if you do not use it.

Risk factor :

None 
\end{verbatim}
\small
Risk factor converted into number for summary screens:
\tiny
\begin{verbatim}
0  None/Info
1  Low
2  Medium (Low/Medium, Medium, Medium/Low)
3  High
4  Critical
\end{verbatim}

\end{frame}

\note{
Raw output is 360k lots of the above.
\begin{itemize}
\item Very verbose compared to old probing suite
\end{itemize}
Risk factors:
\begin{itemize}
\item I have assigned risk factors so they can be filtered, summarised
\item Nessus classify plugins into 11 categories, 47 families
  \begin{itemize}
  \item My experience classification not much use for remote scans
  \end{itemize}
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{Web Interface to results}

Interface influenced by (abandoned) Inprotect tool.
\begin{itemize}
\item Risk factor summary screens
\item Host and plugin black lists
\item Access controls
\end{itemize}

Requirements:
\begin{itemize}
\item Linked to Raven + IPregister database.
\item Must scale to 50k hosts
\item Delegated management
\item History for each IP address:
  \begin{itemize}
  \item Track new vulnerabilities
  \item Can get at old/expired vulnerabilities.
  \end{itemize}
\end{itemize}
\end{frame}

\note{
IPregister:
\begin{itemize}
\item Better than evil DNS zone transfers
\item IP register has information about who owns each IP address
\end{itemize}
Speed:
\begin{itemize}
\item Lots of materialised views to speed Postgres along.
\end{itemize}
Implementation: Apache/mod\_perl/Mason + Postgres database
\begin{itemize}
\item First pass was Groovy on Grails.
\item Native IP address objects
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{User summary page}
\includegraphics[height=7.4cm]{user.jpg}
\end{frame}

\note{
Interesting things:
\begin{itemize}
\item Host tab only shows subnet of hosts that user has access to.
\item IPv4 and IPv6 listed separately: different services.
\item Risk factors:
  \begin{itemize}
  \item Can suppress results to hide from summary
  \end{itemize}
\item Sort orders: Default by risk factor
\item Next slide: CS summary link
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{Host summary page}
\includegraphics[height=7.4cm]{hosts_summary.jpg}
\end{frame}

\note{
Summary pages for each axis (next three slides, will cover rest later).
\begin{itemize}
\item Hosts
\item Ports
\item Plugins
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{Ports summary page}
\includegraphics[height=7.4cm]{ports_summary.jpg}
\end{frame}

\note{
Same results
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{Plugins summary page}
\includegraphics[height=7.4cm]{plugins_summary.jpg}
\end{frame}

\note{
Same results
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{Running Probes}
\includegraphics[height=7.4cm]{probes.jpg}
\end{frame}

\note{
Probing currently running against machines on this axis:
\begin{itemize}
\item Queued for Nessus
\item Queued in Nessus
\item Probe underway
\end{itemize}
13 secs to 10 hours to complete
\begin{itemize}
\item Used to have percent complete
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{Results for my workstation}
\includegraphics[height=7.4cm]{ipaddr_detail.jpg}
\end{frame}

\note{
My workstation not very interesting:
\begin{itemize}
\item 9 risk factor 0 results. Breakdown by port.
\item Nessus can still work out that it is running Ubuntu 8.04
\end{itemize}
Notes:
\begin{itemize}
\item Can sort results by port or first seen
\item Describe Filters: min risk, show suppressed and expired
\item Will come back to plugin summary, blacklist in a moment.
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]
\frametitle{More interesting results: Example 1}
\tiny
\begin{verbatim}
Plugin ID: 26918 

 ...

Synopsis :

It is possible to log into the remote host.

Description :

The remote host is running one of the Microsoft Windows operating
systems. It was possible to log into it using the administrator
account with a blank password.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2\#AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE : CVE-1999-0504, CVE-1999-0505, CVE-1999-0506,
      CVE-2000-0222, CVE-2005-3595
BID : 990, 11199
Other references : OSVDB:297, OSVDB:10050 
\end{verbatim}
\end{frame}

\note{
22 of these across CUDN. IPaddress: 128.232.237.67. 
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]
\frametitle{More interesting results: Example 2}
\tiny
\begin{verbatim}
Plugin ID: 24741

 ...

Synopsis :

Arbitrary code can be executed on the remote CISCO device.

Description :

The remote version of IOS contains a flaw which may cause the remote router
to crash when processing specially malformed IP packets.

An attacker might use these flaws to execute arbitrary code on the remote
routers.

Solution :

http://www.nessus.org/u?f4359412

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE : CVE-2007-0480
BID : 22211
Other references : OSVDB:32092 
\end{verbatim}
\end{frame}

\note{
29 of these across CUDN. IPaddress: 131.111.11.190. 
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}[fragile]
\frametitle{False positive example}
\tiny
\begin{verbatim}
Plugin ID: 20747

    * Summary for inst CS
    * Summary for domain csi.private.cam.ac.uk
    * Blacklist this plugin for 172.28.10.74

Synopsis :

Arbitrary code can be executed on the remote web server.

Description :

The remote host is running Novell Remote Manager HTTP service
for SuSE Enterprise or Open Enterprise Server.

The remote version of this software is vulnerable to a heap overflow
attack that may be exploited by sending a negative value for the
'Content-Length' field.

Since the 'httpstkd' service runs with the root privileges, an
attacker can leverage this issue to gain full control of the remote
host.

Solution :

Novell has released a patch for the novell-nrm service :
http://www.novell.com/linux/security/advisories/2006_02_novellnrm.html

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P) 
\end{verbatim}
\end{frame}

\note{
IPaddress: 131.111.11.141  (suppressed). Notes:
\begin{itemize}
\item Remote view of host not accurate
\item If you know that host has been patched, Nessus probably wrong
\item Backport list for OpenSSH and Apache
\item ``Summary for inst CS'' link to next slide
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{Summary for specific plugin}
\includegraphics[height=7.4cm]{plugin_summary.jpg}
\end{frame}

\note{
Interesting things:
\begin{itemize}
\item Batch updates for single plugin
\item Show detail link shows output from plugin
\item Blacklist versus suppress:
  \begin{itemize}
  \item Filter: input/output. Both useful?
  \item Suppressed results still show up on summary: temporary.
  \item Blacklist removed entirely from future runs.
  \item False positives or bad side effects
  \end{itemize}
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{Plugins blacklist}
\includegraphics[height=7.4cm]{plugins_blacklist.jpg}
\end{frame}

\note{
Plugins blacklist summary for inst/domain axis:
\begin{itemize}
\item Remove/(Un)Suppress/(Un)delete line for each plugin
\item Promoting plugins blacklist
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{Hosts blacklist}
\includegraphics[height=7.4cm]{hosts_blacklist.jpg}
\end{frame}

\note{
Blacklisting hosts
\begin{itemize}
  \item Blacklist if scan causing problems.
  \item User interface for IP address
  \item Netblock/Domain/Instid
  \item Can add entries on this page or ipaddr Options tabs
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{Scan options}
\includegraphics[height=7.4cm]{options.jpg}
\end{frame}

\note{
Queue host for immediate rescan
\begin{itemize}
\item Can take a few hours to complete
\item Overrides Host blacklist
\end{itemize}

Options:
\begin{itemize}
\item Safe checks useful in OpenVAS, less so in Nessus.
\item CGI scanning/Web application tests. Disable for embedded devices.
\item Scan fragile devices: Printers/Netware 
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{Access control for Institution Managers}

Results aren't secret (anyone could run Nessus scanner!)
\begin{itemize}
\item Are at least a little sensitive.
\item (Mostly) restrict results to COs
\end{itemize}

IP register database has MZONES (InstID)
\begin{itemize}
\item Each IPv4 address belongs to MZONE
\item Each IPv6 subnet belongs to MZONE
\item Each domain (e.g: csi.cam.ac.uk) registered against MZONE
\end{itemize}

\end{frame}

\note{
Each MZONE has list of updaters:
\begin{itemize}
\item Managers for probing suite
\item Can add extra managers through Web interface
\end{itemize}
}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{Access control for end users}

IPregister ENDUSER and SYSADMIN records:
\begin{itemize}
\item May contain CRSids or @cam.ac.uk email addresses
\item Not designed for this purpose!
\item Institution Managers can add to access list
\end{itemize}
\end{frame}

\note{
Access rights tied to hostname rather than IP address:
\begin{itemize}
\item Access should be revoked when IP address recycled.
\end{itemize}
}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\begin{frame}
\frametitle{Future work}

Better summary pages would be nice
\begin{itemize}
\item Open to ideas!
\end{itemize}

Credentialed scans?
\begin{itemize}
\item 80\% of Nessus plugins designed to run on remote systems
\item Results much more reliable than remote view
\item SSH to Unix platforms (including Mac OS X)
\item SMB to Windows platforms
\end{itemize}
\end{frame}

\note{
Credentialed scans?
\begin{itemize}
\item SSH to Unix platforms (including Mac OS X)
  \begin{itemize}
  \item SSH key pair. Target account doesn't have to be root
  \end{itemize}
\item SMB to Windows platforms:
  \begin{itemize}
  \item Various challenge response schemes
    \begin{itemize}
    \item NTLMv2 default, preferred
    \end{itemize}
  \item Target account admin (read only access to everything)
  \end{itemize}
\item Q: What do COs think about opt in credentialed scan?
\end{itemize}
}
      
\begin{frame}
\frametitle{Any Questions?}

Web site (including help text and schedule)
\begin{itemize}
\item http://probing.csx.cam.ac.uk
\end{itemize}

Email:
\begin{itemize}
\item probing-support@ucs.cam.ac.uk
\end{itemize}
\end{frame}

\end{document}

