Demarc Puresecure v1.6 - Plaintext password issue -

[Ryan Purita]

According to Demarc Puresecure's Website;
=20
Demarc PureSecureTM is a one of a kind, Total Intrusion Detection
System (TIDS), which provides an unsurpassed level of comprehensive
security. For the first time you will be able to reliably prevent,
detect, and deter internal and external threats to your organization's
valuable assets with complete confidence, 24 hours a day. Advanced cross
platform compatible technology means PureSecure can be deployed and
scaled in a wide variety of network infrastructures

#PROBLEM
Demarc Puresecure v1.6 stores plaintext password and login information
for the central/remote logging server. (And some spelling mistakes)

<--SNIP-->
#------------------------------------------------------------------
# Database Variables
#------------------------------------------------------------------
# You MUST change these to match a valid account on your database.=20
# The database user must have insert/update and drop priviledges.

db_user =3D "puresecure"
db_password =3D "abc123"
db_host =3D "192.168.1.254"
db_name =3D "IDS"
db_port =3D "3306"
<--SNIP-->

Granted this is a restricted user and not root, but any access is
bad access. The account could be used to flood the logging server with
bogus information, update previous information, or drop tables,
compromising the integrity of the SQL database.=20
=20
Tested on Demarc Puresecure Professional and Personal editions
v1.6.

Ryan Purita, CISSP
Senior Security Consultant
www.totally-connected.com

[David Barroso]

On Wed, 21 May 2003 12:17:57 -0700
"Ryan Purita" <ryan@totally-connected.com> wrote:

The file psd.conf should be owned by root and its mode 600. Only if a person gets root access in that box, she could read the password. Lots of applications relay on that, for instance, snort, which is used by Demarc PureSecure, stores the SQL password in
plain text in snort.conf.

[Kurt Seifried]

>"Ryan Purita" <ryan@totally-connected.com> wrote:

>The file psd.conf should be owned by root and its mode 600. Only if a
person gets root access in that box, she could read the password. Lots of
applications relay on that, for instance, snort, which is used by Demarc
PureSecure, stores the SQL password in plain text in snort.conf.

-------

But why do the agents need "DROP" privileges on the database? In my mind for
any "secure" logging system the agents should have append only access, that
is the ability to create new entries. Not modify or remove old ones. If an
attacker breaks into a Puresecure agent they can now flush out any traces of
their attack and future attacks on the server. Seeing as how this product is
aimed at major deployment (i.e. multiple sensors) including installation on
end systems (running all sorts of potentially vulnerable services, or simply
having hostile users with local access already....) this creates a huge
number of oppurtunities for an attacker.

Is it just me or does anyone else think such as system where the agents have
the ability to remove any trace of an attack once they are compromised is a
bad thing?

Kurt Seifried, kurt@seifried.org
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/