Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Software Your Rights Online

Son of SATAN? Weighing Security Software's Risks 128

Posted by timothy from the guns-don't-kill-people dept.
ryanr writes "Rob Lemos put out an article on the new metasploit relese. The article reminds me of the furor over the original SATAN being released. H.D. Moore, who wrote it, rightly points out that there are commercial tools that do it better, and it's known that the kiddies have copies of those. Why pick on the open-source tool? I think Rob is being a bit provocative." Despite the headline ("Security tool more harmful than helpful?"), the article is actually pretty balanced.
This discussion has been archived. No new comments can be posted.

Son of SATAN? Weighing Security Software's Risks More

Son of SATAN? Weighing Security Software's Risks

Comments Filter:

  • Y'know (Score:5, Insightful)

    by FrYGuY101 ( 770432 ) on Monday April 12, 2004 @03:26PM (#8840337) Journal
    I've always thought the comparison of security tools to invasion tools like the idea of security through obscurity.

    Simply because there's not an automated tool which allows you to properly determine the security of your own systems, doesn't mean somebody else couldn't do it manually, or create their own tools.

    • Sure, but ... (Score:5, Insightful)

      by s20451 ( 410424 ) on Monday April 12, 2004 @03:35PM (#8840445) Journal
      There's no substitute for a secure box. But what's lost on a lot of people is that security through obscurity is only bad if it's your only security method. True security doesn't mean that you paint a bull's eye on your forehead and taunt the crackers to come after you.

      If cracking tools are widely available, they will be used to more quickly exploit whatever vulnerabilities exist, giving the author less time to patch. It's better for everyone if these tools are hard to come by.

      • Re:Sure, but ... (Score:5, Insightful)

        by FrYGuY101 ( 770432 ) on Monday April 12, 2004 @03:44PM (#8840530) Journal
        Conversely, if cracking tools like this are widely available, authors will be somewhat forced to at least use them to test before they release insecure software.

        Saying that these tools in and of themselves being widely available is a bad thing I'm still not sold on. Yes, Script Kiddies can now possibly attack a system in a manner which they would not have been able previously, but sysadmins can also do the same, and then secure whatever holes appear as a result, meaning that not only can the script kiddie not get in, but a Black-hat can't use that avenue either. That is why these tools exist, after all.

        • Re:Sure, but ... (Score:4, Insightful)

          by David Hume ( 200499 ) on Monday April 12, 2004 @04:34PM (#8841065) Homepage

          Yes, Script Kiddies can now possibly attack a system in a manner which they would not have been able previously, but sysadmins can also do the same, and then secure whatever holes appear as a result, meaning that not only can the script kiddie not get in, but a Black-hat can't use that avenue either.


          I suspect the concerns (which I personally don't agree with) are that: (a) for every sysadmin who is trying to protect "his" system (while performing other tasks) there are numerous script kiddies who are trying to break into his system; and (b) particularly given the economy, and shrinking corporate IT budgets, the script kiddies have far more time on their hands. The question one might ask is, Who does the no-cost and low-barrier dissemination of the tool most empower?

          The alternatives are not necessarily limited to no dissemination. Some might argue for taking steps to try to limit dissemination of the tools to the "good guys" -- even is such steps would be imperfect.

          Further, if we are concerned about the externalities caused by 24/7 connected broad band home users who are unknowingly spewing spam, well, 24/7, we might have to recognize that few if any of them will ever use such tools to protect their systems, while the script kiddies will surely use such tools to hack them.

          Of course, the counter-argument re: home users is that "surely" somebody (Microsoft????) will use the tool to test the underlying software... and "surely" the home users will download the resulting patch. :)

          • Re:Sure, but ... (Score:3, Interesting)

            by stevey ( 64018 )
            for every sysadmin who is trying to protect "his" system (while performing other tasks) there are numerous script kiddies who are trying to break into his system;

            It's also worth saying that that each sysadmin has to make sure that each of his boxes is fully patched, and all the software, infrastructure and daily maintainence of them is carried out.

            A kiddie only has to find one flaw to penetrate a system - maybe even in a system the admin didn't know about, or which is looked after by somebody else.

          • You are mostly right, if by "script kiddies" you mean those who really just want to "play".
            Any kiddie worth 1/2 his, or her, bragging rights would have long ago downloaded one of the commercial applications that does pretty much the same thing.
          • Further, if we are concerned about the externalities caused by 24/7 connected broad band home users who are unknowingly spewing spam, well, 24/7, we might have to recognize that few if any of them will ever use such tools to protect their systems, while the script kiddies will surely use such tools to hack them.

            Good. If enough SKs hack enough boxes, perhaps people will start to patch early and often, or MS will start releasing more secure software, or people who don't patch will get too scared and stay of
        • What about this [knoppix-std.org] and
          this [dmzs.com]?

          They've both been around for some time now.

          Is it just that they haven't been written about on ZDNet?

      • Full Disclosure vs. Security Through Obscurity (Score:5, Insightful)

        by Glamdrlng ( 654792 ) on Monday April 12, 2004 @04:12PM (#8840784)
        If cracking tools are widely available, they will be used to more quickly exploit whatever vulnerabilities exist, giving the author less time to patch. It's better for everyone if these tools are hard to come by.


        I disagree. If those tools are available to whitehats then security professionals can run them in lab environments and develop countermeasures like Layer 7 firewall filters and IDS rules. Furthermore, if I'm aware of an exploit that's serious enough of a risk, I have the option of killing a port on the firewalls until the risk has been mitigated. But I can't do any of those things if I'm not aware of the vulnerability andif don't know how the tool works. Not only that, but if these cats have made good on their promise to communicate with IDS vendors about ways to detect metasploit in action, then I honestly don't see how someone could make a more benign tool. I haven't seen anything on snort.org yet, but then again I'd imagine many of the exploits run by metasploit already have signatures available.

        Security professionals are inherently disadvantaged compared to blakhats. They have more time on their hands, and they have more numbers. At the end of the day, if security professionals don't have access to tools like this, then we're at even more of a disadvantage.

      • Re:Sure, but ... (Score:3, Informative)

        by AftanGustur ( 7715 )

        If cracking tools are widely available, they will be used to more quickly exploit whatever vulnerabilities exist, giving the author less time to patch. It's better for everyone if these tools are hard to come by.

        There are a number of things wrong with your last statement. The biggest is that most people don't patch at all, and if they do, it is often only after some news media has reported major exploitation going on in the wild.

        Another thing is that software companies don't release patches unless th

      • Security through wishful thinking. (Score:5, Insightful)

        by Chris Burke ( 6130 ) on Monday April 12, 2004 @04:55PM (#8841299) Homepage
        If cracking tools are widely available, they will be used to more quickly exploit whatever vulnerabilities exist, giving the author less time to patch. It's better for everyone if these tools are hard to come by.

        Cracking tools are and will be widely available. How effective were the courts at stopping the spread of DeCSS? Tools already exist. They will either be written or pirated, and passed around on IRC. You can't stop them from existing. You can use them yourself, for your own benefit.

        Attempting to get rid of widely available free tools that white hats could use to their benefit so that black hats won't have them isn't Security through Obscurity. It's Secruity through Wishful Thinking.

        The only reasonable way to go forward with security is that your machine must be secure in spite of the existence of cracking tools. The best way to do this is to use the tools yourself, not to try to prevent them from existing. "Outlaw cracking tools, and only outlaws will have cracking tools" may be cliche, but poor prose can still be true.

    • Re:Y'know (Score:5, Insightful)

      by David Hume ( 200499 ) on Monday April 12, 2004 @03:39PM (#8840486) Homepage

      I've always thought the comparison of security tools to invasion tools like the idea of security through obscurity.

      Simply because there's not an automated tool which allows you to properly determine the security of your own systems, doesn't mean somebody else couldn't do it manually, or create their own tools.


      I think the concern may be that the widespread, no-cost dissemination of tools like this decrease the costs and barriers to entry to malicious hacking. Many (if not most) of the script kiddies who may wind up using this and similar tools couldn't possibly "create their own." Simlarly, many (if not most) would not purchase, or even be pirate, commercial tools.

      Your analogy of software security to (presumably) physical world "invasion" tools (e.g., lock picks, etc.) causes me to make a prediction. The prediction is that, like lock picks, the use and possession of software security tools may in the future be licensed and regulated. Just as the unlicensed possession and use of "burlar tools" is in some jurisdictions criminal, we may get to the point that the unlicensed use or possession of "software entry" tools is regulated and licensed.

      Please don't misunderstand; I am not suggesting that this ought to occur, or that I want it to occur. I am simply suggesting that as a pure matter of fact it may occur.

      • Re:Y'know (Score:5, Informative)

        by Milo Fungus ( 232863 ) on Monday April 12, 2004 @04:09PM (#8840760)

        Your analogy of software security to (presumably) physical world "invasion" tools (e.g., lock picks, etc.) causes me to make a prediction. ...we may get to the point that the unlicensed use or possession of "software entry" tools is regulated and licensed.

        RMS already made that prediction, in The Right To Read [gnu.org] (which is a really interesting read, by the way). The relevant passage:

        There were ways, of course, to get around the SPA and Central Licensing. They were themselves illegal. Dan had had a classmate in software, Frank Martucci, who had obtained an illicit debugging tool, and used it to skip over the copyright monitor code when reading books. But he had told too many friends about it, and one of them turned him in to the SPA for a reward (students deep in debt were easily tempted into betrayal). In 2047, Frank was in prison, not for pirate reading, but for possessing a debugger.

        Dan would later learn that there was a time when anyone could have debugging tools. There were even free debugging tools available on CD or downloadable over the net. But ordinary users started using them to bypass copyright monitors, and eventually a judge ruled that this had become their principal use in actual practice. This meant they were illegal; the debuggers' developers were sent to prison.

        Programmers still needed debugging tools, of course, but debugger vendors in 2047 distributed numbered copies only, and only to officially licensed and bonded programmers. The debugger Dan used in software class was kept behind a special firewall so that it could be used only for class exercises.

        His version of the prediction is a bit different, but it's the same idea. If you read through the entire story you will find an astonishing list of seemingly absurd predictions which are coming true one at a time. It's a bit unnerving to read, really.

      • Re:Y'know (Score:3, Insightful)

        by Kaa ( 21510 )
        Your analogy of software security to (presumably) physical world "invasion" tools (e.g., lock picks, etc.) causes me to make a prediction. The prediction is that, like lock picks, the use and possession of software security tools may in the future be licensed and regulated. Just as the unlicensed possession and use of "burlar tools" is in some jurisdictions criminal, we may get to the point that the unlicensed use or possession of "software entry" tools is regulated and licensed.

        Like, for example, a compi
      • Your analogy of software security to (presumably) physical world "invasion" tools (e.g., lock picks, etc.) causes me to make a prediction. The prediction is that, like lock picks, the use and possession of software security tools may in the future be licensed and regulated.

        Last I heard, the possession of lockpicks was generally NOT regulated - no matter what the locksmithing industry would like you to believe.

        Like crowbars, the crime is possession with intent to use illegally. (Unlike crowbars, it's a l
        • How do you evalulate "intent" as a law enforcement officer?

          With narcotics, "intent to sell" is defined by posessing more than some arbitrary quantity defined by law.
      • It also decreases the costs and barriers to entry to productive hacking. Many (if not most) of the administrators couldn't possibly "create their own".

        Same argument, right?

  • This could be a good tool if.... (Score:5, Interesting)

    by millahtime ( 710421 ) on Monday April 12, 2004 @03:26PM (#8840341) Homepage Journal
    This could be a good tool if admins actually used it (or some tool to look for holes) and patched the holes and watched their security. But, I have only worked at one place that has done this and the others were under the impression they didn't have to do it very often.

    Those hacking into systems will love this tool though. I'm gonna go home tonight and check my network out. Although, I don't have a thing someone would want to hack.

  • SATAN -> SAINT (Score:5, Funny)

    by stonebeat.org ( 562495 ) on Monday April 12, 2004 @03:29PM (#8840372) Homepage
    The common wisdom in the security world is that easy-to-use scripts to circumvent security--called "exploits"--are a threat to the Internet.
    The Metasploit Project and its founder, HD Moore, hope to change that perception.

    I thought changing the name from SATAN to SAINT, fixed that perception. I mean, how many attackers wanna use a tool called "SAINT", no matter how good it is.

  • Nothing like testing security in the real world. (Score:5, Interesting)

    by blcamp ( 211756 ) on Monday April 12, 2004 @03:32PM (#8840401) Homepage

    H.D. Moore, who wrote it, rightly points out that there are commercial tools that do it better, and it's known that the kiddies have copies of those. Why pick on the open-source tool?


    I don't care who has what exploit^H^H^H^H^H^H^Htesting tool, or what knowledge about hacking. It's a better "real-world" way to test your security anyway.

    Keep your stuff patched, because you never know where, when, how or by whom the next attack is going to come from.

    • Keep your stuff patched, because you never know where, when, how or by whom the next attack is going to come from.

      For people whose livelihood doesn't directly involve keeping said stuff patched, or people whose aspirations in life aren't affixed solely to notions of uptime, this is easier said than done.

      I'm sick and tired of people claiming that patching their system's software is a negligible task.

      I'm also tired of people saying "I'm sick and tired of [insert unspeakably minor issue here]", but that's

  • Don't kid yourselves... (Score:1, Informative)

    by Anonymous Coward
    This is nothing more than a API for hackers. It could be used as a security tool but the vast, overwhelming, majority of people who download this will be using it to hack people.

    • Re:Don't kid yourselves... (Score:5, Insightful)

      by Adriax ( 746043 ) on Monday April 12, 2004 @03:52PM (#8840618)
      Funny, when this exact argument is being used against kazaa and the like, everyone throws up their arms in protest, claiming it still has legit uses.

      I don't use this or kazaa, no reason, but I sure as hell wouldn't want to see either shot down just because they ave illegal uses along with legal ones (once that happens, how long till computers themselves are heavily restricted, if not banned because someone claims it's "painfully obvious computers are the tools of criminals and terrorists").
      • Exactly.
        I get tired of people attacking the tools rather than the individuals using them for whatever purpose. It's the old "guns don't kill people, people kill people" argument. If there were no guns, someone would still find a way to do harm if they wanted. Whether you shoot me, stab me or beat me over the head repeatedly with a baseball bat, i'm still dead. Gee, lets ban all pointy or heavy things and make the world out of NERF.
      • Take my car for example - it allows me to drive dangerously fast, and do burnouts, and ram-raid shops, and other cool, antisocial stuff. Should we ban cars?

    • You are kidding yourself (Score:1, Informative)

      by Anonymous Coward
      Hang out on the IRC channels where hackers congregate. Get to know them. Gain their trust. See what kinds of tools they use.

      Admittedly, most of these script-kiddies can't write the tools they use. But when they find a good tool they spread it around quickly. They ARE using commercial tools that have been hacked. If this particular tool seems better for their hacking than what they have, they'll use it too. Does that mean we have to take the tool out of white hats' hands because the black hats might get it
    • This is modded Informative, geez.

      How do you know this is fact AC? Ready here's the counter argument pulled from someone's butt that carries just as much weight.

      The vast, overwhelming, majority of people who download this will be using it to secure their networks.

      I'm one of them.

  • Many insightful comments... (Score:5, Funny)

    by Anonymous Coward on Monday April 12, 2004 @03:34PM (#8840431)
    Please read my comments which I posted here [slashdot.org]. Thanks! :)

  • For the /. crowd (Score:5, Funny)

    by Prince Vegeta SSJ4 ( 718736 ) on Monday April 12, 2004 @03:36PM (#8840447)
    the original SATAN being released

    When was Bill Gates Arrested?

  • Moore rightly points out that there are commercial tools that do it better, and it's known that the kiddies have copies of those

    There are commercial tools that allow you to run exploits and install shellcode or deliver payloads?

    I couldn't find this quote anywhere in the article...

    • Re:What commercial tools? (Score:5, Informative)

      by daveaitel ( 598781 ) on Monday April 12, 2004 @03:50PM (#8840592) Homepage Journal
      There are in fact commercial tools that allow you to run exploits and include shellcode. For example:

      This one. [immunitysec.com]

      Dave Aitel
      Immunity, Inc.

    • Re:What commercial tools? (Score:1, Informative)

      by Anonymous Coward
      Dameware [dameware.com] is a good example of a commercial tool, albeit not designed specifically for security probing, it is for remotely controlling (if maliciously: exploiting) machines. I've seen examples used "in the wild" to take over machines to serve as warez sites, and it is "standard" enough that you can often monitor plenty of dameware-specific traffic on an infested network. Versions have also been modified or grafted onto other programs to do malicious probes. So, by themselves, no, there aren't necessarily
    • Canvas and CORE Impact. I don't have a lot of info about Impact, but Canvas is regularly maintained, and Dave is known to release some new exploits there before you'll read about them elsewhere. If you have any kind of income from doing penetration testing, Canvas is pretty reasonably priced.

      • Re:What commercial tools? (Score:1, Informative)

        by Anonymous Coward
        I've tried all of them: metasploit, CANVAS and CORE IMPACT. CORE IMPACT is by *FAR* the best.

        http://www.corest.com/products/coreimpact/
        htt p ://www.metasploit.org/
        http://www.immunitysec.com /CANVAS/

        core impact: (i've tried v3.2 & v3.3): very well polished, lot of exploits (remote,locals,client side) (reliable exploits), full of information gathering tools. Weekly updates of exploits. nice GUI. very nice reports.
        exploits are in python.
        Ask for a demo, buy it or use edonkey.

        metasploit (I've tried 2.0): f

  • What's the controversy? (Score:5, Insightful)

    by awkScooby ( 741257 ) on Monday April 12, 2004 @03:37PM (#8840462)
    Is the question, "should tools exist which allow system administrators to scan their boxes for known holes?" That's an easy one to answer: YES.

    A quick glance through my log files shows that someone is scanning my boxes. Not distributing scanning tools just makes it a one sided battle (with us admins on the loosing side). Not knowing about a hole does not mean that the hole doesn't exist. So, I think that it's far better to make a level playing field, and let hackers and admins have equal opporunity for knowing the status of a box. Sure, some people won't check their systems, but that's a lost cause no matter what.

    • If a scanning tool is out for a certain hole... then it's safe to say that the whole world knows that hole exists. If you're at risk for it, you better have closed it up somehow. Patch or replace the application!

      Just pretending the hole doesn't exist and wishing the scanning tool would go away isn't security... making holes go away is security.
    • I understand that security by obscurity isn't the same as good security; however, there is a need to eliminate software identification information commonly seen in the bottom of the page of web applications. It makes googling for an exploit trivial.

  • mirror (Score:3, Informative)

    by ebilhoax ( 609649 ) on Monday April 12, 2004 @03:37PM (#8840469)
    Here [deprived.org] is a mirror just incase their site gets /.'d.

  • To use the gun analogy: (Score:5, Insightful)

    by normal_guy ( 676813 ) on Monday April 12, 2004 @03:37PM (#8840470)
    Companies that create software to exploit security vulnerabilities in common software in order to get commandline access to any system don't kill systems. Script kiddies do.
    • Wow! That one kinda ran away with you!

      Shouln't that be "Security tools don't kill systems, script kiddies do"? Although I do like sound of it when turned back on the original gun analogy...

      "A device created to strike a primer, causing a chemical reaction to propel a projectile (typically lead) at high velocity through a rifled cylinder, striking flesh and/or bone, and creating a high probability of systemic failure due to hydrostatic shock doesn't kill, people do."

      : )
    • I like the analogy, in as far as it goes, but it really doesn't hold up too well.

      Consider that the real problem here is with admins leaving machines unpatched, unconfigured (or badly configured), and generally unprotected. That would then be analagous with blaming the person getting shot for not wearing a Level III body armor with steel vitals inserts, which would be ludicrous indeed. Just a thought.

      Oh, and I do support RKBA fully and I believe security scanners/toolkits are a godsend, not a menace.

  • It's a dual edge sword (Score:5, Insightful)

    by Anonymous Coward on Monday April 12, 2004 @03:37PM (#8840471)
    Having tools to help in identification of weaknesses is not a bad idea (one side) - OTOH - the same tools can also help a hacker use that information to exploit your system (other side). Not that they couldn't do it anyway -- but hey -- this is faster. It was stated in the article that "The problem today is that many organizations do not patch systems until a working exploit is released". How true this as well as the comment that "The bottom line is that exploits are not only useful but are (also) required for many types of legitimate work." Brings to mind some of the restrictions that are placed on useful processes such as the remote commands, snmp, and other features built into the OS. Nice to know where problems are so that they can be locked down ... but what if you really need them ...
    • Waiting to patch until a working exploit has been released is not very wise. How do you know that there is no working exploit? Just because one hasn't been posted to bugtraq or elsewhere doesn't mean that it's not out there. I can understand ignoring DoS related security issues, but holes that allow the remote execution of code are really, really bad and should not be ignored.

      What legitimate need do you have to leave a hole? That makes no sense to me at all. That's like saying "we need the DCOM RPC h

  • Its Simple... (Score:5, Insightful)

    by trp642 ( 551059 ) * on Monday April 12, 2004 @03:42PM (#8840508) Homepage
    If guns are outlawed, only outlaws will have guns...

    If security scanning tools are outlawed, only outlaws will have security scanning tools...
  • Blaming the author of this tool because it might be used by hackers is like blaming a gun manufacturer because the gun they make might kill someone.

  • Leveling the field (Score:5, Interesting)

    by Anonymous Coward on Monday April 12, 2004 @03:42PM (#8840517)
    Lets just assume that most 'bad' hackers have more knowledge of security flaws and holes than most system administrators.

    I this scenario, a set of 'hacking' tools made availble to those administrators can help them find vulnerabilities, fix them, and then test if their solution is working properly.

    If these tools were only available to people with the intention to abuse them, it would be much harder to secure a system.

    Personally, I believe that currently the knowlegde of security flaws is greater among the hackers, since they specialize in exploiting them. Most administrators have many tasks besides system security. With a set of proper tools to diagnose their systems, security could be maintained with less effort.
    • ...by night are white hat "system administrators" by day? Or even better, how many white hat system administrators have NEVER engaged in a little "sport"? And where is the line crossed exactly between harmless sport and looking and maybe a little... whatever?

      Remember when back orifice was released? All the people I knew personally who were running it were employed in the IT world in some manner, ie, they were societally assumed to be "whitehats".

      Personally, I think "the industry" is a lot more an over-all

  • Suspicious Source (Score:4, Funny)

    by MicroBerto ( 91055 ) on Monday April 12, 2004 @03:46PM (#8840558)
    Roblimo + Hemos = Rob Lemos

    Hmmmmm....

  • Blah (Score:4, Informative)

    by Anonymous Coward on Monday April 12, 2004 @03:47PM (#8840564)
    Some sleepy thoughts before I crash...

    This is the time-old argument of gun's dont kill people, people kill people. Except, it is now being applied against electronic "tools". Another saying comes to mind "if you outlaw xyz, then only outlaws will have xyz".

    A decade ago, black-hat hackers and security administrators did not have the same access to information and tools that we have today. Crackers are no longer working in the dark, reverse engineering operating systems and applications/services from scratch. Operating system source code is readily available for both the open-source systems (Linux/BSD), along with most of the commercial variants (HP/Solaris/etc) in the black-hat community. With access to this information, they're able to literally scan the code for bad programming practice (grep sprintf) to quickly identify vulnerabilities.

    This open-source transparency has been both a blessing and a curse for the open OS's - in that vulnerabilities can quickly be found by an enterprising auditor, but likewise can be quickly closed by any decent programmer. This is not the case however with the closed platforms, because the source is not available.

    Likewise with penetration tools. When a vulnerability comes out, such as the infamous PHF bug, a cracker can within a few minutes put together a crude scanner to identify these systems for exploitation. Likewise a security administrator can and needs to use a similar tool to audit his network for any sign of the vulnerability.

    However, there should be some industry self-policing going on regarding the public release of certain tools. For example, if a vulnerability emerges and you want to scan and actively "test" whether you are vulnerable (instead of soley checking a service banner - you try to exploit the vulnerability), the test does not need to grant you uid 0. Instead, you can release a binary tool which simply created a root-owned file on the server, in / , called "YOU_ARE_VULN_TO_X". Both tools will confirm whether or not you are vulnerable - but one is significantly less vulnerable to abuse (by the average script kiddy) than the other.

    However, in the long run, the security industry is a very profitable one, and one way to get a head start is to be prolific and vocal in releasing high-quality exploits (and hoping to get noticed by a security company). This is as much about ego as it is about getting a cool job, and while that attraction is there, you're going to keep seeing security tools with no restrictions emerge.
    • Quoth the parent:

      However, in the long run, the security industry is a very profitable one, and one way to get a head start is to be prolific and vocal in releasing high-quality exploits

      And quoth the article:

      "There will be about 10 academics and serious researchers who may find this interesting and about 10,000 kiddies who will blow each other's virtual brains out, with enterprise security folks caught in the middle," said Peter Lindstrom, the director of research for security consultancy Spire Secu

    • Re:Blah (Score:3, Insightful)

      by duffbeer703 ( 177751 ) *
      There is no magic about exploiting security vulnerabilities. I have actually discovered or re-discovered exploits in the course of day-to-day Unix sysadmin duties.

      One of the biggest problems that we face is that the boundary between expert and uninformed observer is very blurry when it comes to technical issues.

      Ignorant "experts" litter the television and radio airwaves, and have a nasty habit of publishing themselves on the internet and in print.

      To a gun owner, the "guns don't kill people, people kill p

  • Could it beeeeee... (Score:4, Funny)

    by Manhigh ( 148034 ) on Monday April 12, 2004 @03:48PM (#8840574)
    This headline apparently written by the Church Lady

  • What's the difference? (Score:4, Insightful)

    by LostCluster ( 625375 ) * on Monday April 12, 2004 @03:51PM (#8840602)
    A hole scanner just finds holes. It's a hacking tool if used by a hacker, a security tool if used by an admin... the only diffence is what the user intends on doing after the hole is discovered.

  • I'm the one you fear is going to be using this (Score:5, Interesting)

    by Anonymous Coward on Monday April 12, 2004 @03:52PM (#8840610)
    I've known about and been exploiting the ms-its vulnerability for a full week and then some now. I had a Proof-of-Concept within the first 2 hours of the original post by a concerned IRC user on bugtraq.

    While this tool doesn't test for IE vulnerabilities like the one I have been exploiting, it covers a lot of commonly used attacks that have already been done by script kiddies for (in some cases like the apache chunked vulnerability) upwards of two years!

    It also tests a lot of "duh" kinds of exploits that any serious web, mail, and NT/2000/2003 administrator would want to test. Admins and security consultants have been using Nessus for the last three years or so and people don't question that anymore.

    I think the issue here with Metasploit's Framework is that it's modular, so script-kiddies like me can sit back and develop and trade exploits. My response to that is: get over it.

    I've been trading exploits for so long now with my *own* PERL code that the only thing this program does is maybe cut my time down in half. And why would I want to release a module for Metasploit when I can make my own EXE's using perlcc and Cygwin?

    If anything, perlcc and Cygwin contribute more to proliferation. And I kind of doubt they are going the way of the dodo anytime soon.

  • Bad logic (Score:1, Insightful)

    by Anonymous Coward
    This is some sort of convoluted question - 'do security tools make things worse'. Rather than explaining word for word why I feel its worse, I'll offer an analogy.

    Should brightly lit streets at night be banned because they allow muggers to see us more clearly? Surely not.
    Knowledge is power, and I'd much rather have as much knowledge available to me as possible, rather than have none and some an attacker has none either. The fact is, exploiters will always try to develop their own ways to get in, their own

  • DUPE! DUPE! (Score:1, Informative)

    by Anonymous Coward
    how is this post any better than The original story posted a couple of days back [slashdot.org]?

    sheesh! you guys are seriously losing it when an AC like myself can come along and whoop your sorry posting asses!

    maybe Slashdot can have a new points system where proven dupes can get points taken from their posters!
    • how is this post any better than The original story posted a couple of days back?

      It's the newest version.

      Sorry, I didn't see the original. My bad.
      • Not really "your bad". Its not up to /. readers to know every story that gets posted, thats what editors are for. Maybe someone needs to review their "daddy pants" system or whatever its called?

  • Another Good Site (Score:4, Funny)

    by suwain_2 ( 260792 ) on Monday April 12, 2004 @03:57PM (#8840660) Journal
    Another site I visit frequently, Slashdot [slashdot.org], covered this a few days back. You can view their coverage on the same article here [slashdot.org].

    Oh, wait...

  • How to detect bullshit (Score:4, Interesting)

    by Monkelectric ( 546685 ) <[moc.cirtceleknom] [ta] [todhsals]> on Monday April 12, 2004 @03:59PM (#8840668)
    Anytime anyone says you don't need security information/tools they're making money and you're getting the shaft. The argument "hackers could use this" translates to "our product is insecure and our admins are lazy". Security auditing is necessary in any network you'd like to be reasonably secure.

  • Security tools = Trouble? Perhaps... (Score:1, Insightful)

    by Anonymous Coward
    Of course, any time you release a tool that can be used for good or evil, there will be people that use it for good and those who use it for evil. I would much rather at least have the tools exist than be stuck when some evil person creates a supervirus using a tool they stole because we can't get that tool publicly.

  • Oh know, will this create a new breed? (Score:4, Insightful)

    by DR SoB ( 749180 ) on Monday April 12, 2004 @04:07PM (#8840740) Journal
    Is it possible this will create a new breed of mega elite hackers that don't need to know much about the inner workings of computers to hack, they can just run automated tools to do it for them? Maybe we can call them script-kiddies or something? What's that you say, they already have these? OH!

    Of course these tools are good, the script kiddies already have k-rad tools from CodC and what-nots. News flash: many admins already use actually HACKER tools to try and find 'sploits on their pwn machines!

    I remember when I was a youngin and to be classified at all as a hacker you had to have at least _some_ knowledge of machine code. Ahh, those were the days..

  • relese??? (Score:1, Funny)

    by Anonymous Coward
    WTF is a "relese"?

    Where are Click and Clack with that dopeslap?

  • For the record... (Score:3, Informative)

    by rmpotter ( 177221 ) on Monday April 12, 2004 @04:16PM (#8840842) Homepage
    The original SATAN [fish.com] was introduced by Dan Farmer back in 1995.

    The article reminds me of the furor over the original SATAN being released. H.D. Moore, who wrote it, rightly points out that there are commercial tools that do it better, and it's known that the kiddies have copies of those. Why pick on the open-source tool? I think Rob is being a bit provocative." Despite the headline ("Security tool more harmful than helpful?"), the article is actually pretty balanced.
    • Interesting to see how few slashdot'ers been around long enough to remmeber this. Let alone slashdot'ers with mod since you didn't get a +5 (get a fucking memory)

      • I do. I thought it was 94. I can't believe SGI fired him for makeing Security through obscurity impossible? Sigh.

        My friend had a 286 or 386 with SCO Openserver. He hacked the original perl script to run Satan on it. It was fun.

  • I haven't really used nessus or metasploit, but what is the difference between the two?
    • Nessus is a scanning tool which identifies insecure aspects of a system, but is generally harmless, although some tests may crash the remote system.
      Metasploit Framework is a toolkit which allows you to build modules which exploit those insecure aspects to deliver a payload.

  • These tools just help hackers (Score:4, Insightful)

    by skintigh2 ( 456496 ) on Monday April 12, 2004 @04:29PM (#8841016)
    Also, binoculars should be banned because they just help terrorists look for physical security vulnerabilities.

    We need strong laws to protect people who are too lazy and incompetent to protect themselves. Security through court-ordered obscurity is the only way to freedom.

  • as much as i love reading /. (Score:4, Insightful)

    by neoThoth ( 125081 ) on Monday April 12, 2004 @04:59PM (#8841348) Homepage
    The story really was toned to stir the pot. the tool is a great help to those of us in the infosec community whose jobs it is to SECURE networks. Other tools like CANVAS (and a host of others I can't think of right now) do the same thing and most aren't even open source. Any one can run Nessus but the biggest issue with any vuln Scanner is *false positives*. This tool allows verification of vulnerability.
    Rob I want you to apologize to HD Moore and go sit in the corner and think about what you've done.

    (crap there goes my karma)
  • How is this different from Nessus?

  • My first lesson with hacking back in 94 (Score:3, Interesting)

    by Billly Gates ( 198444 ) on Tuesday April 13, 2004 @12:42AM (#8844736) Journal
    I remember in highschool back in 94. He was an SGI programer then. I had a friend who had a SCO box( shudder) and hacked the perl script so it could run.

    He released it to help Irix system admins secure their networks. SGI having their heads up there butts, fired him believing security through obscurity was the most effective measure. After all he now made Irix insecure??

    Irix remained the most unsecure Unix for many years untill managment made a recent change.

    Nmap is hell of alot more powerfull now and there are many clones.

    Satan is a relic of old and I just looked at some of the screenshots via a search on google. I thought it was really awesome in 94, but its quite primptive today.

  • I just saw a banner ad on /. where MS is handing out free security management tools on their website. I have a strong suspicion that, if one could reverse engineer the code, much of it has been translated, probably illegally verbatim, from commonly available open source security management code like Nmap, Satan, ethereal, tcpdump, etc.

    But who could afford to challenge them about it?

Slashdot Top Deals

Thus spake the master programmer: "After three days without programming, life becomes meaningless." -- Geoffrey James, "The Tao of Programming"

Close