Non-Intrusive Vulnerability Detection
The Internet at large has witnessed an uneasy calm over the past three months. Although there has been a number of very serious security vulnerabilities discovered, there have been no catastrophic worms or attack storms. Perhaps the computer security old-timers can "feel it in their bones", as the figurative barometric pressure drops and hints of an upcoming storm increase in likelihood. Whatever the case may be, all security professionals are feeling an increased pressure now to protect more machines, more thoroughly, and more quickly than ever before. With the frequency and volume of threats on the rise, the fair-weather days of occasional attention to vulnerabilities are drawing to a close.
Fortunately, vulnerability assessment has adapted to follow suit. Security professionals can now scan their networks essentially in real-time for new vulnerabilities as they are discovered, and resolve them well in advance of the threats that exploit them. In a sense, there exists a much more sophisticated way of boarding up your Windows.
Vulnerability assessment – which involves testing each device on a network for known bugs or misconfigurations that could allow it to be the victim, or unwitting accomplice, in an attack – in fact originated as a collection of weakened attacks that administrators could perform to test the security of their networks. The idea was that, if the "low dosage" version of the attack could not succeed (often evidenced by whether or not the machine was disrupted following the test), then neither would the full-strength version that could otherwise be used to gain control. Many vulnerability assessment tools and solutions adopted this approach, finding it straightforward and easy to implement with many sample attacks readily available. The downside, however, was that this type of "intrusive" scanning could cause serious disruptions. The test attacks were, after all, still attacks, and were therefore not suitable to perform very often or during business hours.
As the size of networks and the importance of uptime both began to increase tremendously, the concept of non-intrusive scanning grew with it. Now vulnerability scanning is reaching the point where it must be performed as routinely as virus scanning, and that concept is becoming compulsory.
Looking back, the need for non-intrusive scanning seems obvious, so why is it an evolution – rather than a standard – of the original vulnerability assessment paradigm? Most likely, the answer would be that the technology used in scanning non-intrusively represents a shift in thinking from the previous "attack" methodology for the engineers who design the solution. Non-intrusiveness places a premium on keeping the network completely intact, gathering information to ascertain the presence of a vulnerability while avoiding behavior that might have adverse side effects for the host – analogous to the difference between an MRI and exploratory surgery.
In order to construct a non-intrusive test (commonly referred to as an audit), an engineer typically searches for discrepancies between vulnerable and patched instances of the software that can be consistently reproduced. After this, the engineer must find a way to automate the process so that the vulnerability scanner can perform it reliably.
Accomplishing this feat often requires a lot of resourcefulness on the engineer's part, since the audit must never crash or even significantly impact any version of the software, and it must avoid heavy network traffic and intensive computation. If an attack can be performed without disrupting the target machine – for instance, in cases where the vulnerability involves inappropriate access to certain information – then a non-intrusive vulnerability scanner might attempt the attack directly; if not, the engineer may need to resort to any number of techniques in order to infer the presence or absence of the vulnerability.
Sometimes the best way is simply to check the version reported by the software itself (its "banner"); other times, attack behavior can be emulated almost exactly, with just enough of a difference to get an idiosyncrasy to show without disrupting the software at all. Even methods as unconventional as invoking separate functionality that was silently changed by a patch may need to be considered, and these and other techniques may have to be dynamically combined based on the conditions present at the time of the scan. Engineering an audit that meets these standards can be a very painstaking project, but considering its importance to the people who depend on it to defend their networks, the effort is more than justified.
It is the level of sophistication described above that marks non-intrusive scanning as an advancement of vulnerability assessment technology, allowing it to keep pace with the complex task of securing a network and the evolving threats that shape it. Non-intrusive vulnerability assessment helps prevent – and not present – more threats to the network through frequent and benign scanning, a vital part of both thwarting the small attacks, and weathering the big ones to come.
Derek Soeder
eEye Engineering |
News & Articles
Reader Q&A
Announcements
Tech Talk
Etcetera