Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 2 Feb 1999 23:16:05 -0500
From:      Adam Shostack <adam@homeport.org>
To:        Yuan John Jiang <yjj@cw.net>, freebsd-security@FreeBSD.ORG
Subject:   Re: How to do DOS checking without crashing the system?
Message-ID:  <19990202231605.A20526@weathership.homeport.org>
In-Reply-To: <199901170358.WAA29400@cletus.cw.net>; from Yuan John Jiang on Sat, Jan 16, 1999 at 10:58:13PM -0500
References:  <199901170358.WAA29400@cletus.cw.net>

next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Jan 16, 1999 at 10:58:13PM -0500, Yuan John Jiang wrote:
| I'm think of using a vulnerability scanner, e.g. ISS, CyberCop, SATA
| or a homemade, 
| to automate part of my security auditing of the boxes in service.
| However, how should I check for denial-of-service type of vulnerabilities,
| such as Land or Teardrop without crashing boxes and disrupting the service?
| 
| I guess a simple thing to do is to check the OS version.  However, I hope
| someone can suggest something more reliable.

	You can learn a certain amount using tcp fingerprinting; eg,
this host is not vulnerable to this problem.  However, you can't learn
that something is vulnerable to teardrop without either having some
sort of agent or login on the machine to reliably get patch
information, or with a 'live fire' test.

	(If you can think of a way to do this, it would make a
fascinating paper, and/or you could sell it.  I'm confident that
Netect would pay for such a technique, since we want to encourage
customers to do DOS testing, and encounter exactly the above problem.)

	Let me point out also that keeping up with the new techniques
out there and adding tests for them is more than a full time job.  The 
Nessus project is gathering speed, and if you're thinking of
homegrowing something, you may want to consider supporting them
instead. See www.nessus.org.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume



To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?19990202231605.A20526>