Paws Studio 2.3.1 Released

Below you can find a couple of new features included in the most recent maintenance release of Paws Studio, Titania’s compliance auditing software. The additions to this new version 2.3.1 are designed to help make the compliance auditing process even quicker and easier. 

Here at Titania we know about penetration testing. We know the job has its upsides - the appeal for trespassing "forbidden" grounds, the methodical research of known vulnerabilities, the hunt for a new weakness and the ultimate achievement of coming up with the patch for it. However, we also know there are less exciting sides. Compliance auditing and reporting is not among top preferences for information security professionals and that's why Paws Studio does all the routine checks against the most used compliance policies, as well as allowing for a personalised audit check-list. 

We've now added a interactive "Submit a Query" option. Just go the ‘Help’ tab at the top of the screen, select ‘Submit a Query’ and follow the wizard. Select ‘finish’ and your question will be sent off to our support team who will get back to you as soon as possible. This speeds up the process as it allows the user the send the query without leaving the system at all. 

Also, to give you the right support, our team  require license information such as product details: type, version and serial no. as well as machine details: platform, memory etc. Previously users would have to locate this information and structure it into an email along with their support query. Now with "Submit a Query" this information can be identified and supplied instantly, with no further user input. 

Another addition is Automated Updates.  Previously, users could check for updates to the software by going to the ‘Tools’ tab at the top of the screen and selecting ‘Update Check’. This would tell you if there was a new version of the software. You could then go and download this from the website. Now, like Nipper Studio, this function is automated in Paws Studio so you can make sure you’re up to date, with just the click of a button.

Small details make the difference when it comes to time. These new features will speed up compliance auditing even more.

Exhibition Review: Infosecurity Europe

by Nicola Whiting (COO, Titania)

About the Author

Nicola Whiting is Titania’s Chief Operations Officer and has a solid reputation for increasing revenues and profitability within technology based SME environments. She joined the team in 2011 and has overseen a period of intense growth and change. Now Nicola’s focus is on extending the organizational capabilities and workforce skills, in order to continue to embrace innovation.

Infosecurity Europe is an annual show which takes place every April at Earls Court in London (2014’s show is later than normal and the scheduled dates are 29 April - 01 May).

Figure 1. Outside Earls Court during Infosecurity Europe. Photograph provided by Reed Exhibitions (Oct. 2013)

Titania will be exhibiting for its fourth year and we would recommend Infosecurity Europe as a key show for both independent and corporate Penetrations Testers. Not only will it give you a good overview of the tools your customers are using to manage their systems, but you will also gain invaluable information on the latest business critical issues and hot topics.

You can register for FREE entry and there’s plenty of value in attending:

The security professionals “intelligence boot camp”

Seminars are delivered at all levels and include industry focussed topics in both business and technical areas. The keynote theatre is a great place to update on global trending topics and you’ll find both high level guest speakers and strategic end-user panel discussions.

Hot topics for 2013 included application security, business continuity and digital forensics, encryption, managing the human factor, compliance, identity access management, network infrastructure and secure transactions. Whatever current problems are keeping your customers awake at night, you can be sure that the seminars, workshops and keynote theatre will leave you armed with both the issues at hand AND the industry’s best practice advice.

Hundreds of key vendors, thousands of products and services

Infosecurity Europe is on a growth streak and had over 13,000 visitors last year (ABC audited). 

Figure 2. Inside Infosecurity Europe: Photograph provided by Reed Exhibitions (Oct. 2013)

Visitors range from SME’s to large multinationals and from diverse market sectors.

It’s no surprise that leading security vendors choose InfoSec to showcase their latest and greatest innovations.

In a fast paced industry it’s important that, as a security professional, you are able to review your security choice, method and message against the current security marketplace.

Are you getting best value, is there a leaner more efficient way of achieving your current requirements, are you still “ahead of the curve”?

If you’re happy with your current choices it’s also a great opportunity to get an update on the latest features from your current product vendors AND iron out any niggling operability questions! In 2013 there were over 350 key security vendors at Infosecurity Europe, so there’s no better opportunity to see what’s on offer and build some new business contacts.

Multiple Networking Opportunities

Through the exhibition, seminars and workshops, you’ll have the opportunity to network with peers from other sectors, often gaining new and fresh insights into common threat areas.

Many of Titania’s customers are Penetration Testers (who use Nipper Studio to improve their ROI on configuration reviews). Their first-hand experience is that InfoSec is a great B2B opportunity and not to be missed.

If you make it to Infosecurity Europe this year, stop by our stand (G25). We’d love to hear what you think of the show and would be happy to show you our latest products and updates!

Listening to the Network

by Ian Whiting (Titania, CEO)

About the Author 

Ian has been working with leading global organizations and government agencies to help improve computer security for more than a decade. He has previously been accredited by CESG for his security and team leading expertise for over 5 years. In 2009 Ian Whiting founded Titania with the aim of producing security auditing software products that can be used by non-security specialists and provide the detailed analysis that traditionally only an experienced penetration tester could achieve.


My favourite tool for monitoring network traffic with a graphical environment is Wireshark, on a command line then I would commonly use TCPDump. Both tools are mature products that have been around for years, and if you are a penetration tester you have most likely already used either one or both of them.

Many years ago now, when network hubs were used, the quantity of network traffic arriving at my laptop used to be huge. In today’s modern switched networks you usually no longer get to see network traffic that was sent to a specific network address. However it is still worth checking to see if you can see traffic that should not be visible in a switched environment. I have had to report to clients on a number of occasions, instances where I have been watching network packets that I simply should not have seen. I have recently seen a network hub still being used on a network that should have long since been replaced. In this case the company being tested was a financial organisation supplier and the network traffic on the hub contained data from several competing financial clients.

A common network protocol I see used on networks is Link Layer Discovery Protocol (LLDP), which is used for advertising the capabilities of the sender. LLDP is useful when combined with network management software, but it is also useful information for an attacker. The screenshot from Wireshark (see Figure 1) highlights a captured LLDP packet. You can clearly see that it contains information such as the make, model and software version from the switch; in this case it is a Brocade ICX running IronWare 7.4.00T311. Using that information it would be trivial for an attacker to review a vulnerability database and then download any exploit code for vulnerabilities. The information could also be used to obtain default passwords and other configuration settings that may not have been changed by the network administrator.

Figure 1. LLDP packet

Some manufacturers have developed their own variation of LLDP, the most prevalent of which is the Cisco Discovery Protocol (CDP). Although CDP is a Cisco proprietary protocol it has appeared on other manufacturer’s equipment too. You can see from the Wireshark CDP packet capture screenshot (see Figure 2), that the information in CDP also includes the software platform and version. You may have noticed that both LLDP and CDP include the management address of the devices, very useful.

Figure 2. CDP packet

The Cisco CDP also includes VLAN Trunking Protocol (VTP) domain information, which is also included in the Dynamic Trunking Protocol (DTP) packets (see Figure 3).

Figure 3. DTP packet

VTP is designed to make network administration easier by enabling the propagation of changes to the VLANs on the network, such as adding and removing VLANs over multiple network switches. VTP can be configured in server, client or transparent /off modes. If a switch is in server or client mode it is possible to modify the VLAN configuration on the switch if you can determine the VTP password. Therefore the presence of VTP could potentially pose a serious risk to a network, especially when a weak password has been set. 

The VTP password is not easily tested over the network without modifying the VLAN configuration (or destroying it), Nipper Studio can be used to review the actual configuration in order to determine its state without jeopardising the network (see Figure 4). It certainly would not make you a very popular penetration tester if you took down a customer’s network by removing all their VLANs.

Figure 4. Nipper Studio

A tool called Yersinia can be used to monitor the network in a similar manner to Wireshark, but it separates out protocols such as CDP, DTP and VTP in easy to review sections. However I would recommend using this tool with caution as it includes a number of network attacks such as using VTP (see Figure 5).

Figure 5. Yersinia

It is sometimes possible to audit the routing protocols present on the network by passively listening to the network traffic. Even though I should not be seeing routing protocol traffic when plugging in to a standard network port, at least the following Open Shortest Path First (OSPF) packet capture shown in the next example (see Figure 6) shows that MD5 authentication has been configured.

Figure 6. OSPF packet

However I have often seen routing protocols where either no authentication is configured or default credentials are transmitted with no encryption. In the next example (see Figure 7), Routing Information Protocol (RIP) version 1 is being used which has no support for authentication.

Figure 7. Vulnerable Routing Information Protocol

There are a huge number of other interesting protocols that have not been covered in this article, such as Dynamic Host Configuration Protocol (DHCP). However hopefully this article has bestowed a renewed understanding that simply listening to what the network has to communicate can highlight some security issues. These are issues which can be, and are too often, missed when security assessments place too great a focus on the results of network scanners.

Impressions of CRESTCon & IISP Congress 2014

CRESTCon & IISP Congress 2014 was a great opportunity for our CEO, Ian Whiting, to catch up with industry friends, meet lots of attendees who are keen advocates of our products, as well as speaking to several exhibitors who are also users of our software including HP, Ernst & Young, Nettitude, GDS and BT.

The exhibition was a good opportunity for us to provide inofsec professionals with a preview of some new major features soon to be releases in Nipper Studio. Our stress ball giveaway also proved quite popular with the pentesters – it seems they are a stressed bunch, who would've thought?

But instead of just giving you our own opinion of how the show went, this post brings together the views of those who attended, exhibited and kindly expressed themselves via the live news stream – Twitter. 

...Quite!

Andrea Simmons from HP also highlights in her presentation the amusing results of a much-debated 'study' by VoucherCloud: 

Adrian Davis (ISC2) makes a valid point about insider threats. Morrison's breach was indeed caused by a disaffected member of staff.

Selex ES steered people towards 'their very own' Robin Frewster security expert:

... and here's the consensus.

The Nettitude team

'Fuzzing' with Andy Davis of NCC Group:

Simon Clow puts it into context...

... and PwC agrees...

... while introducing James Campbell's stories on threat detection and response.

Finally, our own team - Ian Whiting below - shares a word, and a stress ball, with Gotham Digital Science

Hope this has inspired you to book tickets for next year's event. The CRESTCon & IISP Congress is definitely the right place to be for any infosec professional; whether beginners or more experienced, the conference has something to offer everyone.

A Tool That Tells a Tale

Richard Hatch, IT Security Consultant at Portcullis

About the Author

Richard Hatch is a software engineering graduate who joined Portcullis in 2011. As an IT security consultant he carries out penetration testing, writes reports, develops tools and supports in-house capabilities. He has an interest in reverse engineering.

Portcullis is committed to providing a comprehensive IT security consultancy for our clients to ensure that their networks and websites are secure from threat of attack. As a leading UK service provider, we assist our clients through penetration testing, digital forensic services, incident response, training and bespoke consultancy services to ensure they have a true sense of security.

Portcullis can complete tests under the CREST and CESG CHECK schemes. www.portcullis-security.com

At Portcullis we understand the benefits of automating data gathering and parsing data with tools to quickly extract pertinent information. Such information can be used to automatically run additional targeted checks against certain network services for example. This enables a penetration tester to be quickly alerted about known security issues and provides references to related vulnerability information, e.g. matching Metasploit exploits to Nessus output.

When it comes to performing security assessments of network devices such as firewalls, routers or switches then Nipper Studio is the first tool we reach for.

After running a Nipper Studio audit, the report is presented (as HTML) within an embedded browser. Nipper Studio also allows the user to export that report in a number of easily selectable formats (CSV, txt, HTML, XML etc.). A nice feature of the presented report is the cross-linked references to issues, tables, etc. which enables the user to drill down in to logical names present in rules (such as object groups). Any passwords, some of which are decoded from the obfuscated forms, can either be displayed inside the report or masked.

Additionally, Nipper Studio reports on known software vulnerability issues for the device firmware version, without the need for an active Internet connection. This saves time that can then be spent reviewing the issues identified or considering the device within the business context. For example does the device adequately fulfill the role it is supposed to play, or should additional rules be present to address specific needs or concerns of our customer?

The options to perform checks against different compliance policies, as well as differential comparisons (a “before” and “after” review to highlight changes), makes what would be a time-consuming and challenging task a quick and straight-forward one.

The output formats supported by Nipper Studio enables our penetration testers to use bespoke tools to process the report output and process references such as CVE numbers. These are then imported in to our own custom reporting tools.

The explanation of the issue findings in Nipper Studio also serve as both an insight and a reminder when encountering some of the more obscure issues or features present on a device. For instance a configuration file command that starts “glbp” may not be immediately recognised by a tester as the Gateway Load Balancing Protocol, a proprietary Cisco protocol. The issue help text from Nipper Studio expands such acronyms and enables the tester to recall their understanding of the technology invoked by the “glbp” technology.

The benefits of using Nipper Studio for security analysts mirror those for the client: It offers a faster, potentially more in-depth review with more technical detail available. Furthermore is has the ability to determine if a device adheres to necessary compliance policies, documented design rules, or what configuration changes are present against a known baseline. For example, imagine a company detects that their internal network has been compromised, but are unsure if the attacker gained access to a router and changed the configuration (to breach network segregation). They can quickly compare the current
configuration against the Nipper Studio report of a known-good configuration that could not have been affected by a hacker, (e.g. stored on a backup CD that is held in a safe at another location).

In one case, a client had asked for a security assessment of a firewall, with specific consideration given to the protection of key network assets. The firewall had a large number of rules configured and there was a chance that the assessment could not have been completed in the time available. By using Nipper Studio to automate the time consuming process of manually identifying issues, the tester was able to take a “step back”. With the help of a network diagram they determined that, although access to key assets was prevented from the Internet, there were no such restrictions in place to prevent access from an internal network area. The client was then able to add additional filtering to prevent access to the sensitive data held within those key assets. The client commented that none of the previous firewall assessments undertaken had identified this issue which when pointed out seemed obvious.

In conclusion, Portcullis use Nipper Studio to quickly identify potential security concerns arising from the configuration of network devices, in a way that provides those findings in formats that can be processed by scripts. The consultants save time, allowing more in-depth assessments even in environments were internet access is not permitted. These assessments take into account the environment in which a device will operate, allowing better (and more detailed) information to be provided to clients. Any technical team that have a need to review, assess or compare the configurations of firewalls, routers or switches would do well to consider Nipper Studio.

What Is Penetration Testing?

Pentesting or penetration testing is a means of evaluating computer and network security by identifying and exploiting vulnerabilities that a real attacker would attempt.

Pentesting will usually include a research stage (collecting information), identifying vulnerabilities, entry points (scanning), attempt to break in (exploiting) and feedback on the findings (reporting).

Strategies include:

Targeted testing sometimes referred to as the “lights-on” approach and is performed in collaboration with the organization’s IT team.

External testing targets the visible servers or devices (DNS, email servers, web servers, firewalls) an outside attacker would have access to normally in order to determine how far they could break in.

Internal testing would be conducted from the inside – behind the firewall – with authorised access, in order to establish what damage could be done if an employee directed or assisted the attack.

Blind testing implies only a limited amount of information (i.e. name of the company) is available before the test takes place. This strategy requires extensive research and it may involve higher costs.

Double blind testing means not only the information of the target company is limited but also limits the number of people aware that the test is taking place. This is done in order to test the company’s security, attack identification and response policies.

For application testing: 

White-box testing the tester is given specific knowledge about the programming code in order to understand whether the program performs the intended purpose or not.

Black-box testing tests whether the tester has information on the input and output of the program but is not aware of the inner workings of the software.

Grey-box testing (translucent testing) is a combination of white-box and black-box testing.