Another Low Blow From Microsoft: MBSA Failure!

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Another Low Blow from Microsoft.

Within the last few weeks at our company we have been doing testing to
find out total number of patched machines we have against the latest
Messenger Service Vulnerability. After checking few thousand computers
we have found several hundred were still affected even though patch has
been applied. We have scanned with Retina, Foundstone and Qualys tools
which they all showed as “VULNERABLE”, however when we scanned with Microsoft
Base Security Analyzer it showed as “NOT VULNERABLE”. This was at first
confusing; one would think an assessment tool released by the original
vendor would actually be accurate. On the flipside it really didn’t make
sense to us why would three different commercial scanners show as vulnerable
if they are truly patched. So we decided to do the ultimate test. We
ran messenger service exploit against the machines that MS Base Analyzer
showed as “Not Vulnerable” and 3rd party vulnerability scanners that
showed as “Vulnerable”. Results were as expected, machines were exploited
and Microsoft Base Analyzer failed to detect the vulnerable machines
properly.

We have concluded that, although the patch was installed on these machines,
the patch management script failed to reboot those few hundred systems,
therefore these machines were vulnerable until the next successful reboot.
After a successful reboot all 3rd party tools showed the machines as
not vulnerable and the exploit tool did not successfully exploit the
machines. 3rd Party tool assessments were accurate the machines were
truly vulnerable prior reboot.

Had we trusted Microsoft Base Analyzer we would still be vulnerable.


To prove this, I have captured screen shots and converted them in pdf
format for your viewing pleasure. The screenshots shows exact same scan
conducted with Foundstone tool and MBSA.

Screenshots: http://www.elusiveworld.com/scanshots.pdf


I would love to see if there are any more like us out there who encountered
this problem. If you had similar problems our recommendation to you do
not fully depend on MBSA, since the tool is just as buggy as the company
itself.

Questions comments email me at dotsecure@hushamail.com
or Aim: Evilkind.


-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.3

wkYEARECAAYFAkApIjwACgkQHxPzbxnt5HTNtQCfd6xpi2Vasn Z33/6saPNfqyMgukMA
nj85QSec1HrAe9aYeSMHiOqcI1Zk
=ORo8
-----END PGP SIGNATURE-----




Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program:
https://www.hushmail.com/about.php?subloc=affiliate&l=427

[Drew Copley]

=20

> -----Original Message-----
> From: dotsecure@hushmail.com [mailto:dotsecure@hushmail.com]=20
> Sent: Tuesday, February 10, 2004 10:21 AM
> To: full-disclosure@lists.netsys.com;=20
> bugtraq@securityfocus.com;=20
> patchmanagement@listserv.patchmanagement.org
> Subject: Another Low Blow From Microsoft: MBSA Failure!
>=20
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>=20
> Another Low Blow from Microsoft.
>=20
> Within the last few weeks at our company we have been doing=20
> testing to find out total number of patched machines we have=20
> against the latest Messenger Service Vulnerability. After=20
> checking few thousand computers we have found several hundred=20
> were still affected even though patch has been applied. We=20
> have scanned with Retina, Foundstone and Qualys tools which=20
> they all showed as "VULNERABLE", however when we scanned with=20
> Microsoft Base Security Analyzer it showed as "NOT=20
> VULNERABLE". This was at first confusing; one would think an=20
> assessment tool released by the original vendor would=20
> actually be accurate

<snip>


>=20
> Had we trusted Microsoft Base Analyzer we would still be vulnerable.

Retina has the same potential functionality as MBSA. We can also do
registry and file checks. And, sometimes we do. But, we try to do remote
checks that are non-intrusive and that do not use these. A big reason
for this is that remote registry and file checks are very unreliable.
(Far beyond just the fact that someone could fake out the scanner by
putting a dummy file or registry entry up there intentionally).

I don't know anyone that uses MBSA only for their network. It is an
interesting toy, but it surely isn't capable of replacing a true
vulnerability assessment solution.





> Questions comments email me at dotsecure@hushamail.com or=20
> Aim: Evilkind.
>=20
>=20

<snip>

[Joe DeMarco]

Maybe it's just me but, I wouldn't consider a patch successfully applied
until the machine is rebooted. Registry changes usually require this
process.

-----Original Message-----
From: dotsecure@hushmail.com [mailto:dotsecure@hushmail.com]
Sent: Tuesday, February 10, 2004 1:21 PM
To: full-disclosure@lists.netsys.com; bugtraq@securityfocus.com;
patchmanagement@listserv.patchmanagement.org
Subject: Another Low Blow From Microsoft: MBSA Failure!


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Another Low Blow from Microsoft.

Within the last few weeks at our company we have been doing testing to
find out total number of patched machines we have against the latest
Messenger Service Vulnerability. After checking few thousand computers
we have found several hundred were still affected even though patch has
been applied. We have scanned with Retina, Foundstone and Qualys tools
which they all showed as "VULNERABLE", however when we scanned with
Microsoft Base Security Analyzer it showed as "NOT VULNERABLE". This was
at first confusing; one would think an assessment tool released by the
original vendor would actually be accurate. On the flipside it really
didn't make sense to us why would three different commercial scanners
show as vulnerable if they are truly patched. So we decided to do the
ultimate test. We ran messenger service exploit against the machines
that MS Base Analyzer showed as "Not Vulnerable" and 3rd party
vulnerability scanners that showed as "Vulnerable". Results were as
expected, machines were exploited and Microsoft Base Analyzer failed to
detect the vulnerable machines properly.

We have concluded that, although the patch was installed on these
machines, the patch management script failed to reboot those few
hundred systems, therefore these machines were vulnerable until the
next successful reboot. After a successful reboot all 3rd party tools
showed the machines as not vulnerable and the exploit tool did not
successfully exploit the machines. 3rd Party tool assessments were
accurate the machines were truly vulnerable prior reboot.

Had we trusted Microsoft Base Analyzer we would still be vulnerable.


To prove this, I have captured screen shots and converted them in pdf
format for your viewing pleasure. The screenshots shows exact same scan
conducted with Foundstone tool and MBSA.

Screenshots: http://www.elusiveworld.com/scanshots.pdf


I would love to see if there are any more like us out there who
encountered this problem. If you had similar problems our recommendation
to you do not fully depend on MBSA, since the tool is just as buggy as
the company itself.

Questions comments email me at dotsecure@hushamail.com
or Aim: Evilkind.


-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.3

wkYEARECAAYFAkApIjwACgkQHxPzbxnt5HTNtQCfd6xpi2Vasn Z33/6saPNfqyMgukMA
nj85QSec1HrAe9aYeSMHiOqcI1Zk
=ORo8
-----END PGP SIGNATURE-----




Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program:
https://www.hushmail.com/about.php?subloc=affiliate&l=427

[Drew Copley]

BTW, I should note that one user did respond back to my pseudo-challenge
and noted that small businesses like his can not afford professional
vulnerability assessment solutions.=20

I apologize for alienating these users.=20

To such users: please start using the free Nessus tool. Use MBSA as a
back-up. Check in-person on any suspicious anomalies.




> -----Original Message-----
> From: Drew Copley [mailto:dcopley@eeye.com]=20
> Sent: Tuesday, February 10, 2004 11:08 AM
> To: dotsecure@hushmail.com; full-disclosure@lists.netsys.com;=20
> bugtraq@securityfocus.com;=20
> patchmanagement@listserv.patchmanagement.org
> Subject: RE: Another Low Blow From Microsoft: MBSA Failure!
>=20
> =20
>=20
> > -----Original Message-----
> > From: dotsecure@hushmail.com [mailto:dotsecure@hushmail.com]
> > Sent: Tuesday, February 10, 2004 10:21 AM
> > To: full-disclosure@lists.netsys.com; bugtraq@securityfocus.com;=20
> > patchmanagement@listserv.patchmanagement.org
> > Subject: Another Low Blow From Microsoft: MBSA Failure!
> >=20
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >=20
> > Another Low Blow from Microsoft.
> >=20
> > Within the last few weeks at our company we have been doing=20
> testing to=20
> > find out total number of patched machines we have against=20
> the latest=20
> > Messenger Service Vulnerability. After checking few=20
> thousand computers=20
> > we have found several hundred were still affected even though patch=20
> > has been applied. We have scanned with Retina, Foundstone=20
> and Qualys=20
> > tools which they all showed as "VULNERABLE", however when=20
> we scanned=20
> > with Microsoft Base Security Analyzer it showed as "NOT=20
> VULNERABLE".=20
> > This was at first confusing; one would think an assessment tool=20
> > released by the original vendor would actually be accurate
>=20
> <snip>
>=20
>=20
> >=20
> > Had we trusted Microsoft Base Analyzer we would still be vulnerable.
>=20
> Retina has the same potential functionality as MBSA. We can=20
> also do registry and file checks. And, sometimes we do. But,=20
> we try to do remote checks that are non-intrusive and that do=20
> not use these. A big reason for this is that remote registry=20
> and file checks are very unreliable.
> (Far beyond just the fact that someone could fake out the=20
> scanner by putting a dummy file or registry entry up there=20
> intentionally).
>=20
> I don't know anyone that uses MBSA only for their network. It=20
> is an interesting toy, but it surely isn't capable of=20
> replacing a true vulnerability assessment solution.
>=20
>=20
>=20
>=20
>=20
> > Questions comments email me at dotsecure@hushamail.com or
> > Aim: Evilkind.
> >=20
> >=20
>=20
> <snip>
>=20
>=20

[Frank Knobbe]

--=-uUTpFoy7u7CpFI8+bnv7
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Tue, 2004-02-10 at 13:26, Joe DeMarco wrote:
> Maybe it's just me but, I wouldn't consider a patch successfully
> applied
> until the machine is rebooted. Registry changes usually require this
> process.

I would go even further and question the reliability of just checking
for the presence of Registry keys that claim a patch has been installed.
Anything short of verifying the MD5 hash of a given DLL, driver file or
executable just makes assumptions about a patched version being present
or not. Those assumptions tend you come back to haunt you, and I believe
there are enough people that had exactly that happening. I remember some
patch (a year or so ago) that overwrote a previously patched DLL with a
vulnerable version. Anything checking Registry keys, like Windows Update
I believe, made the assumption that the system was patched when in fact
the defective DLL rendered the system vulnerable.

Any tool, Windows Update, MBSA, or 3rd party should check the actual
files in question, not just logfiles or Registry keys (or anything that
makes historical statements rather than actual statements).

Regards,
Frank




--=-uUTpFoy7u7CpFI8+bnv7
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)

iD8DBQBAKYRQJjGc5ftAw8wRArDYAJ9zOd6lRjEt/hwpPLibMZ/TtqhmlwCePrQQ
FgBVGpcg4UWrBlO8RELnynA=
=hjFa
-----END PGP SIGNATURE-----

--=-uUTpFoy7u7CpFI8+bnv7--

[Drew Copley]

=20

> -----Original Message-----
> From: Joe DeMarco [mailto:demarcoj@comcast.net]=20
> Sent: Tuesday, February 10, 2004 11:27 AM
> To: bugtraq@securityfocus.com
> Subject: RE: Another Low Blow From Microsoft: MBSA Failure!
>=20
> Maybe it's just me but, I wouldn't consider a patch=20
> successfully applied until the machine is rebooted. Registry=20
> changes usually require this process.

Not all patches require a reboot. This has never been the case with this
system's upgrades.=20

If the process is inusage, if the dlls and/or executable are in usage --
a reboot is required.

If the process is in some other way locked -- a reboot is required.

Some low level operations may only be performed outside of the OS.

I upgrade software all the time without rebooting. So does anyone else
that uses a lot of software and likes to keep everything up to date. No
way would I reboot because my trillian or ultraedit was just patched --
or my outlook or media player. Not usually, anyway.




>=20
> -----Original Message-----
> From: dotsecure@hushmail.com [mailto:dotsecure@hushmail.com]
> Sent: Tuesday, February 10, 2004 1:21 PM
> To: full-disclosure@lists.netsys.com;=20
> bugtraq@securityfocus.com;=20
> patchmanagement@listserv.patchmanagement.org
> Subject: Another Low Blow From Microsoft: MBSA Failure!
>=20
>=20
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>=20
> Another Low Blow from Microsoft.
>=20
> Within the last few weeks at our company we have been doing testing to
> find out total number of patched machines we have against the latest
> Messenger Service Vulnerability. After checking few thousand computers
> we have found several hundred were still affected even though=20
> patch has
> been applied. We have scanned with Retina, Foundstone and Qualys tools
> which they all showed as "VULNERABLE", however when we scanned with
> Microsoft Base Security Analyzer it showed as "NOT=20
> VULNERABLE". This was
> at first confusing; one would think an assessment tool released by the
> original vendor would actually be accurate. On the flipside it really
> didn't make sense to us why would three different commercial scanners
> show as vulnerable if they are truly patched. So we decided to do the
> ultimate test. We ran messenger service exploit against the machines
> that MS Base Analyzer showed as "Not Vulnerable" and 3rd party
> vulnerability scanners that showed as "Vulnerable". Results were as
> expected, machines were exploited and Microsoft Base Analyzer=20
> failed to
> detect the vulnerable machines properly.
>=20
> We have concluded that, although the patch was installed on these
> machines, the patch management script failed to reboot those few
> hundred systems, therefore these machines were vulnerable until the
> next successful reboot. After a successful reboot all 3rd party tools
> showed the machines as not vulnerable and the exploit tool did not
> successfully exploit the machines. 3rd Party tool assessments were
> accurate the machines were truly vulnerable prior reboot.
>=20
> Had we trusted Microsoft Base Analyzer we would still be vulnerable.
>=20
>=20
> To prove this, I have captured screen shots and converted them in pdf
> format for your viewing pleasure. The screenshots shows exact=20
> same scan
> conducted with Foundstone tool and MBSA.
>=20
> Screenshots: http://www.elusiveworld.com/scanshots.pdf
>=20
>=20
> I would love to see if there are any more like us out there who
> encountered this problem. If you had similar problems our=20
> recommendation
> to you do not fully depend on MBSA, since the tool is just as buggy as
> the company itself.
>=20
> Questions comments email me at dotsecure@hushamail.com
> or Aim: Evilkind.
>=20
>=20
> -----BEGIN PGP SIGNATURE-----
> Note: This signature can be verified at=20
> https://www.hushtools.com/verify
> Version: Hush 2.3
>=20
> wkYEARECAAYFAkApIjwACgkQHxPzbxnt5HTNtQCfd6xpi2Vasn Z33/6saPNfqyMgukMA
> nj85QSec1HrAe9aYeSMHiOqcI1Zk
> =3DORo8
> -----END PGP SIGNATURE-----
>=20
>=20
>=20
>=20
> Concerned about your privacy? Follow this link to get
> FREE encrypted email: https://www.hushmail.com/?l=3D2
>=20
> Free, ultra-private instant messaging with Hush Messenger
> https://www.hushmail.com/services.php?subloc=3Dmessenger&l=3D434
>=20
> Promote security and make money with the Hushmail Affiliate Program:=20
> https://www.hushmail.com/about.php?subloc=3Daffiliate&l=3D427
>=20
>=20
>=20