ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    So you want to build a Security Program? Part 1 - Vulnerability Scanning

    IT Discussion
    13
    72
    6.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      DustinB3403 @hobbit666
      last edited by

      @hobbit666 Internal assessments only, you shouldn't be scanning the open internet. . .

      I 1 Reply Last reply Reply Quote 0
      • I
        IRJ
        last edited by

        It can work for either. There are plenty of people who have VPS setup with OpenVAS to do their external scans.

        https://www.digitalocean.com/community/tutorials/how-to-use-openvas-to-audit-the-security-of-remote-systems-on-ubuntu-12-04

        This is a full hosted external security solution, but you can build all the included tools in your own VPS
        https://hackertarget.com

        1 Reply Last reply Reply Quote 0
        • I
          IRJ @DustinB3403
          last edited by IRJ

          @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

          you shouldn't be scanning the open internet. . .

          You most certainly should be. What do you think hackers are doing every minute on large networks?

          D 1 Reply Last reply Reply Quote 0
          • D
            DustinB3403 @IRJ
            last edited by

            @IRJ As in, you shouldn't be scanning everything on the open internet.

            The FBI, NSA and other 3 letter government agency's will come knocking down your door.

            I N 2 Replies Last reply Reply Quote 0
            • I
              IRJ @DustinB3403
              last edited by

              @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

              @IRJ As in, you shouldn't be scanning everything on the open internet.

              The FBI, NSA and other 3 letter government agency's will come knocking down your door.

              No they wont. It's like walking or driving up to a house and looking and casing it out for a robbery. You aren't doing anything illegal until you breach the house.

              D D 2 Replies Last reply Reply Quote 1
              • D
                DustinB3403 @IRJ
                last edited by

                @IRJ Sure they can, it's called premeditation.

                Planning to break in is as illegal as breaking in so long as you are committed to it.

                S 1 Reply Last reply Reply Quote 0
                • S
                  StrongBad @DustinB3403
                  last edited by

                  @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                  @IRJ Sure they can, it's called premeditation.

                  Planning to break in is as illegal as breaking in so long as you are committed to it.

                  But there is no way to know if someone is premeditating breaking it or doing a school report on safety concerns in the neighborhood.

                  1 Reply Last reply Reply Quote 0
                  • N
                    NDC @DustinB3403
                    last edited by

                    @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                    @IRJ As in, you shouldn't be scanning everything on the open internet.

                    The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                    They have neither the resources nor the inclination to go after everyone that runs a simple scan. They don't in fact have the resources to go after all the people who have committed significantly damaging illegal acts let alone anything else.

                    I 2 Replies Last reply Reply Quote 2
                    • I
                      IRJ @NDC
                      last edited by

                      @NDC said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                      @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                      @IRJ As in, you shouldn't be scanning everything on the open internet.

                      The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                      They have neither the resources nor the inclination to go after everyone that runs a simple scan. They don't in fact have the resources to go after all the people who have committed significantly damaging illegal acts let alone anything else.

                      I see about 10 scans a minute from all over the world on our external servers on a slow day!

                      1 Reply Last reply Reply Quote 1
                      • I
                        IRJ @NDC
                        last edited by

                        @NDC said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                        @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                        @IRJ As in, you shouldn't be scanning everything on the open internet.

                        The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                        They have neither the resources nor the inclination to go after everyone that runs a simple scan. They don't in fact have the resources to go after all the people who have committed significantly damaging illegal acts let alone anything else.

                        Exactly and if US law cannot do anything then what are countries like China and Russia going to do? lol

                        S 1 Reply Last reply Reply Quote 0
                        • S
                          scottalanmiller @IRJ
                          last edited by

                          @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                          @NDC said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                          @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                          @IRJ As in, you shouldn't be scanning everything on the open internet.

                          The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                          They have neither the resources nor the inclination to go after everyone that runs a simple scan. They don't in fact have the resources to go after all the people who have committed significantly damaging illegal acts let alone anything else.

                          Exactly and if US law cannot do anything then what are countries like China and Russia going to do? lol

                          Execute you?

                          I 1 Reply Last reply Reply Quote 0
                          • I
                            IRJ @scottalanmiller
                            last edited by

                            @scottalanmiller said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                            @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                            @NDC said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                            @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                            @IRJ As in, you shouldn't be scanning everything on the open internet.

                            The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                            They have neither the resources nor the inclination to go after everyone that runs a simple scan. They don't in fact have the resources to go after all the people who have committed significantly damaging illegal acts let alone anything else.

                            Exactly and if US law cannot do anything then what are countries like China and Russia going to do? lol

                            Execute you?

                            Yeah I am sure China's focus is to find everyone running nmap scans on American servers so they can execute them.

                            S 1 Reply Last reply Reply Quote 0
                            • S
                              scottalanmiller @IRJ
                              last edited by

                              @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                              @scottalanmiller said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                              @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                              @NDC said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                              @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                              @IRJ As in, you shouldn't be scanning everything on the open internet.

                              The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                              They have neither the resources nor the inclination to go after everyone that runs a simple scan. They don't in fact have the resources to go after all the people who have committed significantly damaging illegal acts let alone anything else.

                              Exactly and if US law cannot do anything then what are countries like China and Russia going to do? lol

                              Execute you?

                              Yeah I am sure China's focus is to find everyone running nmap scans on American servers so they can execute them.

                              You never know.

                              I 1 Reply Last reply Reply Quote 0
                              • I
                                IRJ @scottalanmiller
                                last edited by

                                @scottalanmiller said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                @scottalanmiller said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                @NDC said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                @IRJ As in, you shouldn't be scanning everything on the open internet.

                                The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                                They have neither the resources nor the inclination to go after everyone that runs a simple scan. They don't in fact have the resources to go after all the people who have committed significantly damaging illegal acts let alone anything else.

                                Exactly and if US law cannot do anything then what are countries like China and Russia going to do? lol

                                Execute you?

                                Yeah I am sure China's focus is to find everyone running nmap scans on American servers so they can execute them.

                                You never know.

                                They could always build another ghost city.

                                1 Reply Last reply Reply Quote 1
                                • D
                                  Dashrender @IRJ
                                  last edited by

                                  @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                  @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                  @IRJ As in, you shouldn't be scanning everything on the open internet.

                                  The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                                  No they wont. It's like walking or driving up to a house and looking and casing it out for a robbery. You aren't doing anything illegal until you breach the house.

                                  actually this is now illegal in some country - not this exactly, but I can't recall where, some country (Japan maybe) just passed a law where it's illegal to plan something illegal.

                                  I S 2 Replies Last reply Reply Quote 0
                                  • I
                                    IRJ @Dashrender
                                    last edited by

                                    @Dashrender said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                    @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                    @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                    @IRJ As in, you shouldn't be scanning everything on the open internet.

                                    The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                                    No they wont. It's like walking or driving up to a house and looking and casing it out for a robbery. You aren't doing anything illegal until you breach the house.

                                    actually this is now illegal in some country - not this exactly, but I can't recall where, some country (Japan maybe) just passed a law where it's illegal to plan something illegal.

                                    It's impossible to police

                                    D 1 Reply Last reply Reply Quote 0
                                    • D
                                      Dashrender @IRJ
                                      last edited by

                                      @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                      @Dashrender said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                      @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                      @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                      @IRJ As in, you shouldn't be scanning everything on the open internet.

                                      The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                                      No they wont. It's like walking or driving up to a house and looking and casing it out for a robbery. You aren't doing anything illegal until you breach the house.

                                      actually this is now illegal in some country - not this exactly, but I can't recall where, some country (Japan maybe) just passed a law where it's illegal to plan something illegal.

                                      It's impossible to police

                                      Of course it is - it's just like another gun law - just one more thing to through at people after they are caught.
                                      Like Capone and taxes..

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        scottalanmiller @Dashrender
                                        last edited by

                                        @Dashrender said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                        @IRJ said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                        @DustinB3403 said in So you want to build a Security Program? Part 1 - Vulnerability Scanning:

                                        @IRJ As in, you shouldn't be scanning everything on the open internet.

                                        The FBI, NSA and other 3 letter government agency's will come knocking down your door.

                                        No they wont. It's like walking or driving up to a house and looking and casing it out for a robbery. You aren't doing anything illegal until you breach the house.

                                        actually this is now illegal in some country - not this exactly, but I can't recall where, some country (Japan maybe) just passed a law where it's illegal to plan something illegal.

                                        It's illegal most places, but impossible to prove.

                                        1 Reply Last reply Reply Quote 0
                                        • momurdaM
                                          momurda
                                          last edited by

                                          I have installed using the hyperv image on my workstation. Have run a scan.
                                          The scan results don't make any sense.
                                          It is showing I am running about 10 different insecure versions of linux kernel, none of which I am running on the machine I scanned.
                                          0_1498164745454_18784078-6253-4249-812b-2d0080ce5b85-image.png
                                          Above is a snippet of a pdf report of the scan showing me a list of kernels which are not on this server as far as I know.
                                          uname -r
                                          returns
                                          0_1498164802671_93cf14bc-7db8-4554-8f84-e0b3bd49b518-image.png

                                          I 1 Reply Last reply Reply Quote 0
                                          • momurdaM
                                            momurda
                                            last edited by

                                            Running
                                            rpm -qa | grep kernel
                                            showed 5 or 6 kernels still installed. whoops.
                                            package-cleanup --oldkernels --count=2 removed all but the current and next oldest one.

                                            BRRABillB 1 Reply Last reply Reply Quote 2
                                            • 1
                                            • 2
                                            • 3
                                            • 4
                                            • 2 / 4
                                            • First post
                                              Last post