Home page logo
/

basics logo Security Basics mailing list archives

Re: "Attacks" from lax.qualys.com
From: לירן כהן <liran () rct co il>
Date: Sun, 19 Apr 2009 23:50:51 +0300

Jeremy - by what you're saying I would consider any traffic from such service - a security hazard and do my best to block that subnet\s or perform a back resolve and block those hosts.

I agree with all the rest, indeed assumptions do not exist when talking about security, if you assume=you are not sure=there is a risk=not safe, the equation is simple and the conclusion is take action.


Liran

http://www.rct.co.il

http://www.icon-a.com



ציטוט Jeremi Gosney:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

No, Qualys is not known for "playing with their tools," and its never safe to assume anything. Anyone with a Qualys account can scan any external IP addr, it 
doesn't necessarily have to be someone in your corporation. In fact I'd wager that it isn't someone within your corporation. Qualys doesn't do 
vulnerability assessments per se, they offer vulnerability management SaaS. You simply obtain an account, and they give you access to a web console that hosts vulnerability 
management tools. Its essentially the same as someone sitting at home with Nessus scanning your external IP space; the only difference is they're paying to scan from 
someone else's box, and they're paying for a high level of anonymity as Qualys can't actually tell which user is scanning which IP. They don't even have 
to be paying, in fact, they could be scanning you with their 30-day free trial.


- -----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of The Security Community
Sent: Monday, April 13, 2009 10:07 AM
To: security-basics () securityfocus com
Subject: "Attacks" from lax.qualys.com

For several days now our IDS has been telling us we're being "attacked" by a host resolving to 
scanner[number].lax.qualys.com.

Considering the source, is it safe to assume "someone" purchased a vulnerability assessment without informing the 
Security Department?

Nobody's talking, but it wouldn't be the first time.

Otherwise, is Qualys known for playing with their tools just for the heck of it?

- ------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Find the source of cybercrime! Almost every crime today involves a computer or mobile device. Learn how to become a Computer 
Forensics Examiner in InfoSec Institute's hands-on Computer Forensics Course. Up to three industry recognized certs 
available, online computer forensics training available.

http://www.infosecinstitute.com/courses/computer_forensics_training.html
- ------------------------------------------------------------------------

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)

iEYEARECAAYFAknkwBwACgkQIBHDN8vm6zu37ACgmVtqHlWWV5KR2qqH+qVW8xzl
gO4An3161celli0Fev0HIGBEFYDNbuyK
=+odi
-----END PGP SIGNATURE-----


--
ìéøï ëäï
RCT Internet Solutions
http://www.rct.co.il
+972-54-5617070

------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Find the source of cybercrime! Almost every crime today involves a computer or mobile device. Learn how to become a Computer 
Forensics Examiner in InfoSec Institute's hands-on Computer Forensics Course. Up to three industry recognized certs 
available, online computer forensics training available.

http://www.infosecinstitute.com/courses/computer_forensics_training.html
------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]