Feeds

Most SNMP vulns quietly lurking

All quiet - not all clear

  • alert
  • submit to reddit

Designing a Defense for Mobile Applications

It's been over a week since CERT released a seemingly endless list of devices and software products containing SNMP vulnerabilities discovered by Finnish University of Oulu researchers, and to date very little bad has happened, no doubt to the disappointment of most news agencies. As the story drops off the media radar screen, it's important to keep in mind that threats to your system can't be measured by the amount of mainstream press coverage they receive.

The PROTOS auditing suite developed by the Finnish researchers has been available for download at least since the original CERT advisory, and possibly longer. This means that while things are quiet, there's no question that industrious members of the blackhat development community are using it to advantage.

For example, the PROTOS tool doesn't include a buffer overflow exploit, but researchers working with SANS were able to come up with a working buffer overflow to get root access to several versions of Linux in about two hours, Counterpane Security Architect Tina Bird remarked receltly.

"It's safe to say that they're not the only people who were able to do that," she added wryly.

Linux and Solaris are definitely vulnerable to root access exploits, primarily via buffer overflows. But this won't always be easy to detect.

"Most messages in SNMP manager logs indicate test cases that don't jam the system up, but don't fit what the listener is expecting. It [merely] creates an error message that it can't understand the data," Bird says.

"An attacker who actually knows which test cases are causing the problem is going to write an exploit that only uses those. He's not going to take the system down."

For this reason there may be serious SNMP attacks that go unnoticed for some time, until everyone gets accustomed to looking for the signs.

"One of the problems with system monitoring is that it's generally much easier to see attacks that fail than it is to see attacks that succeed," Bird notes.

Another useful tip from Counterpane: if SNMP is disabled on Solaris and the system is subsequently patched, it's possible that the patch will re-enable it, so this has to be checked.

There's another free SNMP scanner available, called SNScan from Foundstone. It will take lists of IPs, but apparently not machine names. It also runs only on Windows, like SNMPing from SANS. Both tools will scan a wide range of equipment, however.

Again, the best single source of information and links to vendor bulletins is the CERT advisory, which has been updated over forty times since it was created last week. ®

Related stories

SNMP exploit causes printers to jam
Why your vendor has no SNMP fix
Scanning for SNMP vulnerabilities
The SNMP fiasco: steps you need to take
Serious network security holes surface

Boost IT visibility and business value

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Do YOU work at Microsoft? Um. Are you SURE about that?
Nokia and marketing types first to get the bullet, says report
Microsoft takes on Chromebook with low-cost Windows laptops
Redmond's chief salesman: We're taking 'hard' decisions
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
EU dons gloves, pokes Google's deals with Android mobe makers
El Reg cops a squint at investigatory letters
Chrome browser has been DRAINING PC batteries for YEARS
Google is only now fixing ancient, energy-sapping bug
Big Blue Apple: IBM to sell iPads, iPhones to enterprises
iOS/2 gear loaded with apps for big biz ... uh oh BlackBerry
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.