HP to hack customers' networks

Hewlett-Packard is taking a cue from hackers to help protect corporate systems.

The company plans to launch a penetration-testing service for businesses in October that will use the same techniques as hackers to gain access to its customers' machines. However, the exploit code it will use will be controlled and will not propagate itself as a worm would, HP said on Tuesday.

"We use hacking techniques to gain access to the system, but once we have control we make the system safe," said Richard Brown, the threat management department manager at HP Labs. "We don't unleash a worm. We don't use worm-propagation techniques."

The HP Active Countermeasures (HPAC) service will use a single server and between eight and 10 scanning clients per 250,000 connected devices. Each of the clients will be given a range of IP (Internet protocol) addresses to scan, and will move through the range scanning for particular flaws.

"We try to exploit vulnerabilities by sending malformed protocol messages to open ports. For example, Code Red exploited a vulnerability in MS IIS Web service software. We would exploit the same vulnerability," Brown said.

The HPAC team will use hacking techniques to create buffer overflows, heap overflows and stack overflows to gain control of clients' systems. They will use exploit code for known vulnerabilities published on the Internet or write their own.

"If the code is unavailable, we will generate our own exploit code," Brown said.

The HPAC team won't fix any problems found themselves, but will alert customers and work with them if necessary until the issue is resolved.

"If we do manage to get control of a machine, we will do mitigating actions (such as) supply a temporary fix until a patch can be applied in a proper manner. We could do as little as pop up a window saying, 'This machine is vulnerable to Sasser.' But we can escalate the mitigation, if necessary, to take the system completely offline," Brown said.

"In the worst case, we can shut the machine down so it's no longer a threat to the infrastructure," he added.

HP, based in Palo Alto, Calif., has been using these techniques to test its own networks since 2001. Within HP, the corporate IT team already monitors bulletin boards and alerts from computer emergency response teams and vendors.

As new threats are reported, the HPAC team will conduct a risk assessment and investigate the most serious vulnerabilities.

"There are thousands of vulnerabilities, but in most cases they can be dealt with through normal patch management. We're most concerned with 'wormable' vulnerabilities--ones that can be exploited using worms, as they have the largest impact on business," Brown said.

Customers must give permission for HP to scan their systems. They can specify that certain servers or devices are not included in the scan, if they are concerned that it would cause disruption.

HP promised "aggressive pricing" for the service, saying its fixed price would cost "a few dollars per user per year" for customers with fewer than 20,000 active IP addresses.

Tom Espiner of ZDNet UK reported from London.

[s0ndra]

HP to hack but not fix? Sweet!

why anyone would pay HP to hack their network but NOT FIX it is beyond me - that's just dumb. If there are potential vulnerabilities existing, its because there are not ENOUGH RESOURCES to fix the network.

5 days of penetration testing training can educate you to SCAN YOUR OWN and FIX THEM with free tools, or commercial tools from vendors like Tenable Security and Core Impact.

so many compromises, so little time to fix.

[s0ndra]

HP to hack but not fix? Sweet!

why anyone would pay HP to hack their network but NOT FIX it is beyond me - that's just dumb. If there are potential vulnerabilities existing, its because there are not ENOUGH RESOURCES to fix the network.

5 days of penetration testing training can educate you to SCAN YOUR OWN and FIX THEM with free tools, or commercial tools from vendors like Tenable Security and Core Impact.

so many compromises, so little time to fix.

[wbenton]

It could backfire!

This could backfire on them. All any hacker has to do is to spoof HP's IP address and the customer will feel safe thinking it's HP doing the hacking when in fact it's a real hacker... (* LOL *)

It's easy to poison a DNS server or overwrite a lmhosts or hosts file to re-direct packets which should otherwise be deliverd to HP to the culprits whom are spoofing HP.

Walt

[wbenton]

It could backfire!

This could backfire on them. All any hacker has to do is to spoof HP's IP address and the customer will feel safe thinking it's HP doing the hacking when in fact it's a real hacker... (* LOL *)

It's easy to poison a DNS server or overwrite a lmhosts or hosts file to re-direct packets which should otherwise be deliverd to HP to the culprits whom are spoofing HP.

Walt

[eitanc]

Looks like a recycled PR spin of a tool that was introduced in 2004...

Look at this press release by HP from March 2004
<a class="jive-link-external" href="http://www.hpl.hp.com/news/2004/jan-mar/pato_rsa.html" target="_newWindow">http://www.hpl.hp.com/news/2004/jan-mar/pato_rsa.html</a>

"Active Countermeasures uses the same vulnerabilities exploited by attackers to protect against a potential threat and prevent widespread damage to network systems."

I can't see any significant changes since 2004, maybe only that now is will become an official services that customers can buy.
Two years. It must be a very, very, solid service.

Goggling a little before posting PR "news" is always a good idea&
<a class="jive-link-external" href="http://www.google.com/search?hl=en&#38;lr=&#38;safe=off&#38;rls=GGLG%2CGGLG%3A2006-07%2CGGLG%3Aen&#38;q=%22HP+Active+Countermeasures%22+2004" target="_newWindow">http://www.google.com/search?hl=en&#38;lr=&#38;safe=off&#38;rls=GGLG%2CGGLG%3A2006-07%2CGGLG%3Aen&#38;q=%22HP+Active+Countermeasures%22+2004</a>


Eitan Caspi
Israel

Professional Blog (Hebrew): <a class="jive-link-external" href="http://www.notes.co.il/eitan" target="_newWindow">http://www.notes.co.il/eitan</a>
Personal Blog (Hebrew): <a class="jive-link-external" href="http://blog.tapuz.co.il/eitancaspi" target="_newWindow">http://blog.tapuz.co.il/eitancaspi</a>
Blog (English): <a class="jive-link-external" href="http://eitancaspi.blogspot.com" target="_newWindow">http://eitancaspi.blogspot.com</a>
"Technology is like sex. No Hands On - No Fun." (Eitan Caspi)

[eitanc]

Looks like a recycled PR spin of a tool that was introduced in 2004...

Look at this press release by HP from March 2004
<a class="jive-link-external" href="http://www.hpl.hp.com/news/2004/jan-mar/pato_rsa.html" target="_newWindow">http://www.hpl.hp.com/news/2004/jan-mar/pato_rsa.html</a>

"Active Countermeasures uses the same vulnerabilities exploited by attackers to protect against a potential threat and prevent widespread damage to network systems."

I can't see any significant changes since 2004, maybe only that now is will become an official services that customers can buy.
Two years. It must be a very, very, solid service.

Goggling a little before posting PR "news" is always a good idea&
<a class="jive-link-external" href="http://www.google.com/search?hl=en&#38;lr=&#38;safe=off&#38;rls=GGLG%2CGGLG%3A2006-07%2CGGLG%3Aen&#38;q=%22HP+Active+Countermeasures%22+2004" target="_newWindow">http://www.google.com/search?hl=en&#38;lr=&#38;safe=off&#38;rls=GGLG%2CGGLG%3A2006-07%2CGGLG%3Aen&#38;q=%22HP+Active+Countermeasures%22+2004</a>


Eitan Caspi
Israel

Professional Blog (Hebrew): <a class="jive-link-external" href="http://www.notes.co.il/eitan" target="_newWindow">http://www.notes.co.il/eitan</a>
Personal Blog (Hebrew): <a class="jive-link-external" href="http://blog.tapuz.co.il/eitancaspi" target="_newWindow">http://blog.tapuz.co.il/eitancaspi</a>
Blog (English): <a class="jive-link-external" href="http://eitancaspi.blogspot.com" target="_newWindow">http://eitancaspi.blogspot.com</a>
"Technology is like sex. No Hands On - No Fun." (Eitan Caspi)

[Razzl]

Wait, we're the enemy!

I will be more amused than the HP folks when they discover that the package of adware/spyware they include in the PC's they sell, even to institutional customers (think Realarcade, etc.), is the foremost source of insecurity on their client's machines. Think the marketing department will listen to the security department after the dirt is dug up? Me neither...

[Razzl]

Wait, we're the enemy!

I will be more amused than the HP folks when they discover that the package of adware/spyware they include in the PC's they sell, even to institutional customers (think Realarcade, etc.), is the foremost source of insecurity on their client's machines. Think the marketing department will listen to the security department after the dirt is dug up? Me neither...