Home page logo

pen-test logo Penetration Testing mailing list archives

Re: IPSO/Secure Platform audit
From: Volker Tanger <vtlists () wyae de>
Date: Thu, 18 Aug 2005 23:55:47 +0200


On Thu, 18 Aug 2005 13:00:50 +0100
Dan Rogers <pentestguy () gmail com> wrote:
I'm currently reviewing a Check point/Nokia box and a Secure Platform
manager. The settings in Voyager are all good, and likewise the Web
GUI of the SPLAT manager is fine, they're both patched and the policy
is also clean - but I want to ensure the o/s themselves are ok. 

I assume you already checked the rulebase e.g. for SSH-Allow from
outside and VPN- or SecureClient rules, did you?

Unless you have the possibility to check that all binaries (esp. SSH and
other listening servers) are 100% genuine there is no way to ensure
that. IPSO and SPLAT are just plain BSD and Linux after all, so creating
custom binaries is not that much of a problem.

I am concerned that a previous administrator may have left himself
access by the back-door somehow - but am not in a position to rebuild
them to be sure. What else would you lot check for?

Are you *concerned* or do you have no reason to worry and just do "a
proper handover". If you have reason to torry, you really should do a
reinstall and do a thorough audit of the ruleset. 

If management does not allow that, let them give you that order in
writing ("We have received your warning of DATE about a possible
compromise of the firewall system(s) by the former administrator NAME,
but decided against your proposal...") to cover your butt.




Volker Tanger    http://www.wyae.de/volker.tanger/
vtlists () wyae de                    PGP Fingerprint
378A 7DA7 4F20 C2F3 5BCC  8340 7424 6122 BB83 B8CB

FREE WHITE PAPER - Wireless LAN Security: What Hackers Know That You Don't

Learn the hacker's secrets that compromise wireless LANs. Secure your
WLAN by understanding these threats, available hacking tools and proven
countermeasures. Defend your WLAN against man-in-the-Middle attacks and
session hijacking, denial-of-service, rogue access points, identity
thefts and MAC spoofing. Request your complimentary white paper at:


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]