Slashdot Mirror
MIT Working On Network Vulnerability Analysis
An anonymous reader writes "Researchers at MIT have created a method for analyzing networks to detect exploitable vulnerabilities using attack graph analysis which can be done in near real time. The new Lincoln Labs tool will allow admins of large networks to detect their most vulnerable areas and also model zero day attacks. 'NetSPA (for Network Security Planning Architecture) uses information about networks and the individual machines and programs running on them to create a graph that shows how hackers could infiltrate them. System administrators can examine visualizations of the graph themselves to decide what action to take, but NetSPA also analyzes the graph and offers recommendations about how to quickly fix the most important weaknesses. NetSPA relies on vulnerability scanners to identify known weaknesses in network-accessible programs that might allow an unauthorized person access to a machine. But simply being aware of vulnerabilities is not sufficient; NetSPA also has to analyze complex firewall and router rules to determine which vulnerabilities can actually be reached and exploited by attackers and how attackers can spread through a network by jumping from one vulnerable host to another.'"
How long before there's a hacker tool version of this to spot vulnerabilities that exist because the sys admin isn't using it to defend his network?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
Will it also create a powerpoint presentation so they can show it off to their boss about how they probably need a raise?
Anything and Everything about the Net
MIT Professors have been giving guest lectures on this for over two years. Not news
The software sound sweet. But there are a few details missing.
1. Is it available for public use?
2. When will it be available?
3. What does it cost?
4. What platform(s) does it run on?
5. Where can I get it?
Or was this just bragging rights to say, "Look! We did something really, really cool, but you can't have it."
Great civilizations have lived and died on false theories. Don't mess up mine with a few facts.
script kiddies the world over have tools to create vulnerability maps and visualize networks. these kids end up at MIT and write master's theses about their custom visualizers and then sell them to government types for your tax dollars. The MIT guy spends this money on the kinds of services advertised on astalavista, which is incidentally where the government guy could have found this sort of thing for free.
This article sounds like it is 25 years ago and we might want to map vulnerabilities on the internet, I guess you'd only really need to visualize them if you wanted a GUI for point-and-click pwning
Beware of bugs in the above code; I have only proved it correct, not tried it.
Automated tools to find security vulnerabilities is ok. However, until automated tools are created to find stupid users and stop them then the battle will never be over. You can fully patch a system, reduce system privledges, etc but if that stupid user clicks on a link, visits a bad website, or opens trojanized attachment because it said "open me" the same effect will take place and the end result will still be the same. The battle of good vs evil will still continue on while stupid users are around and I'm pretty sure those are a lot harder to get rid of.
How is this different from what is already being done with vuln scanners? How does this find 0-days? The test comes from a particular vector which finds KNOWN vulnerabilities. This will only find Access problems if the limitations of the systems is known. It does nothing to determine trust problems like spoofing, MITM attacks, and attacks from other vectors. What they needed to do is look at it in a new way like in the SCARE project (Source Code Analysis Risk Evaluation) from ISECOM which determines all interactive points, how they are interactive (memory, user, disk), and what controls are there. Since every interactive point will have risk of some sort (like a potential real 0-day), this will tell you not only the Access problems but the Trust ones as well. Take the same methodology in SCARE and apply it to a scanner to look at all interactive points in a network per vector (run it inside, outside, and each perimeter side) and then have a program correlate where the interactive points match. You can get fancy and draw maps of this but really what you want to know is the priority of what you need to close, separate, and add missing controls to. All of this is already outlined in OSSTMM 3 already. I just don't see how MIT can get away with announcing a tool that is not innovative and leads people down the false path of endless patching.