Tag Info

Hot answers tagged

8

Running SystemInfo against your server (systeminfo /s $SERVER) should also list installed hotfixes. Hotfix(s): 333 Hotfix(s) Installed. [161]: IDNMitigationAPIs - Update [162]: NLSDownlevelMapping - Update [163]: KB929399 [164]: KB952069_WM9 [165]: KB968816_WM9 [166]: KB973540_WM9L [167]: KB936782_WMP11


5

rpm -q <package name> will give you the software version number as well as the package release number, but you will need to investigate the contents of rpm --changelog <package name> in order to determine which patches have been applied.


4

Sturgeon's Law of IT ("90% of everything is snakeoil") applies to this as much as it does to any other aspect of IT. We all know that PCI is just a flaming hoop/bag-of-dog-poo you need to jump through to process credit cards (a "cost of doing business", like paying off your local neighbourhood mobster for "protection"), and not an actual security audit; ...


4

If it is a condition of doing business with them, sure (and you should be doing this yourself anyway ... ) if not talk to the sales/account rep who handles them and see if they can read on how much saying no would hurt the relationship. As far as legal agreements before hand I would say at a minimum you should have the following: NDA specifying that they ...


4

What you're doing is generally ill-advised, however you can take some steps to make it safer. I'm assuming you're using a distribution that old because you have some unsupported application that "requires" that platform. If you don't have to use that old distro then, as @HTTP500 suggests, dump it for a newer distro. @HTTP500 recommends a web application ...


4

HP does indeed offer a vulnerability scanning service as part of its Enterprise Security Services. Their whitepaper seems to imply that it's required. Unfortunately, HP's web site is in a persistent state of disarray, (and has been for years) and information is rather hard to find. But it seems that they do indeed offer (and mandate) this service.


3

Polcies -> Preferences -> Do not scan fragile devices -> Scan Network Printers Bear in mind that this may result in pages of random characters/service fingerprints being printed, and the printer may end up crashing. This is the default setting for a reason.


3

In addition to ClamAV, consider using Maldet for additional malware detection. According to the docs, it has the ability to integrate with ClamAV, though I haven't personally set this up.


3

First of all you should update the distribution you are running. Fedora 8 went end-of-life over 3 years ago and does not provide security updates anymore. Once you have updated your system to a recent/supported version you can run a web application scanner like Nikto against it to determine your exposure. Remediate based on its recommendations. There are ...


3

I run PSinfo -h against the server to show installed hotfixes.


3

Another alternative if you can't use pstools and find yourself stuck with native Winder tools: reg query hklm\software\microsoft\windows\currentversion\uninstall /s | findstr "KB[0-9].*" > %TEMP%\Installed.txt & notepad %TEMP%\Installed.txt


2

From the gotroot.com forums: You can use nginx with our rules by putting a reverse proxy apache with mod_security in front of nginx. Thats actually very lightweight and something we will be adding post 3.0 as an option for sites running alternative web servers like nginx, etc. As Scott said, nginx does not have any WAF module or capability, so ...


2

To list all packages: rpm -qa To list all packages matching a simple pattern: rpm -qa 'kernel*'


2

Your PCI auditor is an idiot (quel surprise). They just run an automated tool like nessus, which does nothing but compare the service's reported version against a list of vulnerabilities against the upstream version -- they don't say "hey, this is patchlevel N of this package, RedHat already patched that for all known vulnerabilities". Ultimately, you'll ...


2

Have you considered OpenVAS? It forked from Nessus when they closed source. Nessus and OpenVAS as opposed to SkipFish are less Web application focused and intended to cover a variety of daemons. What are the requirements you're trying to meet?


2

Skipfish and Nessus have different objectives (although they share some checks). skipfish is web vulnerability scanner: its mission is to find web apps vulnerabilities. On the lines of w3af and webscarab (but different). Nessus is a vulnerability port scanner: its mission is to find vulnerabilities on open ports on a system. Besides, Nessus can also do ...


2

script kiddies swear by metasploit


2

For locating vulnerabilities, I tend to prefer the more classic approach by default. Bugtraq and announcement lists for the particular software. Change logs, et cetera. Scanners such as OpenVAS can be used for automated verification and testing. With verifying the scope of impact, it depends on the vulnerability. When attempting to verify scope of ...


2

I can't tell you for certain what it is, but I can tell you what it isn't: It isn't a Kaminsky / cache poisoning attack. Kaminsky attacks require a random "nonce" on the front of the queried domain name Your server is authoritative, not caching It's not high enough volume to be a reflection attack against the third party IP addresses For what it's ...


2

You have a dev/qa instance of your site, right? Let them hit that! EDIT: If you're running a multi-tenant service, allowing a customer to run security scanning software that actively attempts to exploit security vulnerabilities is a really bad idea. It's especially bad if the customer wants you to contractually agree to hold them harmless for damage ...


2

WMIC can list installed hotfixes: C:\>wmic qfe get hotfixid, installedon HotFixID InstalledOn KB2605658 11/30/2011 KB2608610 9/1/2011 KB2608612 9/26/2011 KB2614194 9/26/2011 ...(more)... It can also search for a specific hotfix. Here I show two searches - one successful, one unsuccessful: C:\>wmic qfe where (hotfixid = 'KB2608610') get ...


2

On windows 7 You do a custom rule and you can pick a port, followed by a source / destination IP. You'll find the GPO location in "Policies\computer\windows settings\security settings\windows firewall and advanced secruity\" choose inbound rules and then create a custom rule. On windows XP you can add a port rule, and then change the scope. Here is an ...


2

I recommend you to try using Linux Malware Detect (http://www.rfxn.com/projects/linux-malware-detect/). Put it to cron to run periodic scans: 0 * * * * /usr/local/sbin/maldet -r ~ >output


2

Snort can detect while the malware is being uploaded. Also, use Cloud Linux or SELinux etc. This prevents many works from compromising the site, if configured to do so. You can run Kaspersky Scan on the web server too, it detects some things, but not always disinfect it properly. Above all, you can implement policy the way, that anything uploaded has to be ...


2

Clam AntiVirus is the tool you want. It sees common duty in mail systems, but there's no reason you couldn't monitor the uploads that come in through your web application. Just remember that you'll probably need changes to application code to use this effectively. It will need to deal with the fact that ClamAV will scan, detect, and possibly remove/obstruct ...


2

The part of chkrootkit you are looking at is this: ### ### Suspect PHP files ### if [ "${QUIET}" != "t" ]; then printn "Searching for suspect PHP files... "; fi files="`${find} ${ROOTDIR}tmp ${ROOTDIR}var/tmp ${findargs} -name '*.php' 2> /dev/null`" fileshead="`${find} ${ROOTDIR}tmp ${ROOTDIR}var/tmp ${findargs} -type f -exec head -1 {} \; | ...


1

This is, frankly, beneath caring about, however... Set up the default site on the server to point to a blank directory, or static files, or something you don't care about getting hammered by "malicious scanners". [booga booga] Don't map any blank host headers to your sites in IIS.


1

Is the web-site open to the internet? If so, i hardly see how you can prevent them, or anyone else, from probing the web-site. In fact, if you wrote your site badly enough even Google's page crawler can delete everything. But to answer your specific question "Should we let them..." Yes. You want to learn where the flaws are so you can grow as a ...


1

Ask them to kindly run it during an "off peak" time for your site. Appscan can put a massive load on the web and app servers. The extent of the load depends on your specific enviroment it might not be much of an impact or it might be extreamly high, note a low or high load is not a good or bad thing. If your have serious configuration problems there is a ...


1

Maybe a better approach would be to run this sort of stuff yourself so you can proactively test and improve your application security and availability, and share the results with interested customers?



Only top voted, non community-wiki answers of a minimum length are eligible