Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

8/15/2014
10:25 AM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Test Drive: GFI LanGuard 2014

LanGuard worked well in the lab and may prove more beneficial to IT operations than security teams.

[One in an occasional series of IT security product reviews by John Sawyer, a security professional who has worked both as a penetration tester at InGuardians and as a member of the security team in a large enterprise.]

Vulnerability scanners are nothing new. They've been used for years as a part of the security team's toolset for identifying network security issues, by operations to validate patch management, and leveraged by auditors performing compliance audits. Scanners look for outdated software, known vulnerabilities, and misconfigurations so that companies can clean up the low hanging fruit that is easily exploitable by attackers.

I've used quite a few different vulnerability scanners since I first started working as a systems administrator in the late '90s and then transitioned in to security in 2002. Some of them no longer exist, while others have changed owners, gone from open-source to closed-source, or sprung up as new products.

When GFI contacted me about taking a look at its LanGuard 2014 vulnerability scanner, I was immediately interested. For one, I'm a sucker for trying out new tools and products. If it's something that might make my life easier as a penetration tester and security researcher, then I want to take it for test drive to see if it lives up to the hype. Secondly, I'm constantly being asked what tools I would use if I were in someone else's shoes -- and I wouldn't dare make a recommendation for something that I haven't used myself or heard good things about from someone I trust.

Quick and easy install
Since I'm notorious for jumping right in without reading the documentation, I spun up a Window Server 2008 R2 instance, downloaded the installer, and launched it. The install was quick and easy with the only real decision being whether or not I wanted to use a Microsoft Access or SQL Server for the database backend. I opted for the Access database because I only planned to interact with around a dozen endpoints and didn't need the additional performance provided by MS SQL Server.

After the installation, I opened up the LanGuard 2014 interface and it recommended that the local Windows server be scanned. The dashboard began to display the server's current health status after a few minutes and indicated there were a couple of missing patches and configuration issues. Before getting too deep into the scan details, it's worth mentioning that the LanGuard interface is a Windows application. This distinction may be important for some. The scanners that I use on a regular basis use a web interface. Personally, I don't have much of a preference of one interface over the other, as long as they do their job well presenting the information and options I need while still being responsive while in the middle of large scans.

It wasn't until after I'd scanned the local server and started looking at the missing updates that I realized that LanGuard included remediation capabilities -- something that's definitely not in the vulnerability scanners I'm used to. At this point, I started digging into the documentation to see what other fun could be had... uninstalling unwanted software, pushing custom software packages, mobile device scanning, and a few more things that sounded interesting. I quickly pushed the missing patches to my server, rebooted it when the prompt came, and then began scanning other systems in my lab in order to try out the new features I'd just read up on.

I installed the LanGuard agent on a couple of Windows systems to see if there was much of a difference between agent-based scans and agentless ones. Other than the fact that agents are supported only on Windows and other systems (Linux, OSX, mobile devices) require agentless scans, there wasn't a difference in results. However, this was across only a few systems compared to a large corporate network. When scanning hundreds or thousands of systems, agents would certainly be a requirement because they can perform scanning independently of the server and report back their findings as scheduled.

Automated uninstallation
A quick scan of various systems turned up results that allowed me to test out some of the features I'd found in the documentation. The first was uninstalling unwanted software. Nmap seemed like a good target for automated uninstallation since it was on a few different systems. Following the documentation, it took about four steps and less than five minutes to configure Nmap as unwanted, validate that it could be uninstalled automatically on one system, and start a scan on my other systems. Of course, the software I 

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
theb0x
50%
50%
theb0x,
User Rank: Ninja
8/15/2014 | 9:39:53 PM
To scan or not to scan
Great post John and very informative. I have used Rapidfire Tools and I feel that in comparison it too is more of remedation than a security tool. On an internal scan it requires the Remote Registry service to be running on all the target systems. That is how the application determines what patches are missing. The exploit itself is never actually verified by any means. Also, both GFI and RapidFire are very noisy making them practically useless in a pentest even if just used for reconnaissance.

 

 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
The Yellow Brick Road to Risk Management
Andrew Lowe, Senior Information Security Consultant, TalaTek,  11/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: He hits the gong anytime he sees someone click on an email link.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-14190
PUBLISHED: 2020-11-25
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to achieve Regex Denial of Service via user-supplied regex in EyeQL. The affected versions are before version 4.8.4.
CVE-2020-29074
PUBLISHED: 2020-11-25
scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which allows access by actors other than the current user.
CVE-2020-14191
PUBLISHED: 2020-11-25
Affected versions of Atlassian Fisheye/Crucible allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the MessageBundleResource within Atlassian Gadgets. The affected versions are before version 4.8.4.
CVE-2020-29070
PUBLISHED: 2020-11-25
osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.
CVE-2020-26212
PUBLISHED: 2020-11-25
GLPI stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.3, any authenticated user has read-only permissions to the planning of ever...