Tenable Blog

Tenable Network Security | Senior Full Stack Web Developer | Columbia, MD | Onsite or Remote | Full Time | https://www.tenable.com/ We are looking for a full stack web developer who loves building impressive web applications. Quality, best practices and "wow factor" are very important to you. User experience is paramount. You have the ability to identify UX pain points and resolve them without direction. You like to stay current with technology and are a self starter. The team is small so we have high ownership of our software. We are responsible for the full software development cycle, starting at design and ending with deployment. It has always been important to us to stay current with the latest technology and use as needed. Tech Stack: Ruby on Rails, Node, PHP, AWS, React, Docker, MySql, Postgres https://careers.tenable.com/?p=job/oFof4fw6&__jvst=JobBoard&__…

> There is a place for C, where there's no alternative. Alternatives to C have started appearing for a long while, and they are quite mature now. > because they are not doing kernel development FluentBit, where this error occurred, is a userspace application. > there is no reflection when they fuck up a codebase C does not support runtime reflection, that is correct. It's one of the reasons why it's a programming and debugging nightmare. > If you are using some tricks for type casting to implement your ideas into code There seem to be no casting issues involved in https://www.tenable.com/security/research/tra-2024-17. > The best code is the code that is safe and easy to read, and doesn't need to use "clever tricks" that beginners cannot understand. It's just a pile of truisms. Is your whole post even related to this article?

Honestly, I'm sure there are better sources - but this might be worthwhile just for the irony: https://www.tenable.com/blog/why-you-need-to-stop-using-cvss-for-vulne…

I observed something similar that began earlier this year. I wrote about it on the Tenable blog. They impersonate many of the people following Trump and engaging with his tweets, irrespective of party affiliation. https://www.tenable.com/blog/cryptocurrency-scams-fake-giveaways-imper…

Tenable (https://tenable.com) (creators of Nessus) | Senior Software Engineer - Python| REMOTE Looking for a remote (or New York / Baltimore / Dublin) python engineer to join our team at Tenable working in vulnerability & security space. Email me if you have any questions at abell at tenable.com. Tenable development team is distributed all over the world and the work we are doing is pretty exciting. http://app.jobvite.com/m?376OMiwA (US / Remote) http://app.jobvite.com/m?3s7OMiwW (Dublin)

Nessus is probably (still) the best for Linux in this field (certainly in the "free for home use" category): http://www.tenable.com/products/nessus Lots of vendors have offerings in this area. The quality is ... variable. If you are thinking of getting into this market, then the hard part is not the scanning engine per se. The more difficult parts are: * Keeping the policy rule set in sync with reality (changing business policy, attack and vulnerability landscape) * Maintaining the rule set (are DSLs for non-specialists feasible? service model?) * Interpreting and actioning the results in a timely fashion (eg http://measurablesecurity.mitre.org for some background) * Intrusiveness (intrusive validation of a test platform requires careful change control -- is test identical to production? intrusive validation of production may lead to shot feet) * Application, domain-related and physical security (as opposed to system security captured by this document). These things are harder to scan for automatically.

WebIQ 2.15.9 Runtime on Windows - Directory Traversal Vulnerability[2024] https://www.tenable.com/security/research/tra-2024-38

PyPI, May 11. [1] Crates.io, May 22 [2] Composer, May 22 [3] [1] https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-question… [2] https://socket.dev/blog/trapdoor-crypto-stealer-npm-pypi-crates [3] https://phoenix.security/laravel-lang-composer-supply-chain-compromise…

This is totally on-brand for Apple. "Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS." That's an RCE, but nowhere near as bad as other recent exploits (CVE-2023-41064 and CVE-2023-41061) that include device and account takeover from an iMessage that you don't have to read. Also these typically don't rate highest severity (7.5/High) probably due to the limited scope of the targets. https://www.tenable.com/cve/CVE-2025-31200

What the article calls a "vunerability" is something they found internally. Looking at vulnerabilities that were found from attacks, it looks different. [1] Most vulnerabilities are fixed in the first weeks or months. But ones that aren't fixed within a year hang on for a long time. About 18% of reported vulnerabilities are never fixed. [1] https://www.tenable.com/blog/what-is-the-lifespan-of-a-vulnerability

For some distributions, CIS benchmarks (also used by various other security tools) now include guidelines for SELinux. I couldn't find it in the Debian spec (probably because it uses AppArmor), but the RHEL benchmark has these. Currently, server level 1 only requires permissive mode: https://www.tenable.com/audits/items/CIS_Red_Hat_Enterprise_Linux_9_v2… CIS Red Hat Enterprise Linux 9 v2.0.0 L1 Server — 1.3.1.4 Ensure the SELinux mode is not disabled ... While server level 2 specifies enforcing mode: https://www.tenable.com/audits/items/CIS_Red_Hat_Enterprise_Linux_9_v2… CIS Red Hat Enterprise Linux 9 v2.0.0 L2 Server — 1.3.1.5 Ensure the SELinux mode is enforcing

Outside of external cloud providers and actual fluent-bit installations on-premise, any other products/infra on-premise/internally, that an org would need to look at? From the tiles of products that could potentially embed fluent-bit listed here, https://www.tenable.com/blog/linguistic-lumberjack-attacking-cloud-ser… .. I'm thinking self-hosted Splunk might be at the top of the list for an org to investigate internally for potential vulnerability?

i think it’s because he was running an extortion group: https://www.tenable.com/blog/brazen-unsophisticated-and-illogical-unde…

First problem with entire article: Secured and hardened Linux have /var mount option with 'noexec'. https://www.tenable.com/audits/items/CIS_Red_Hat_EL9_v1.0.0_L1_Server.…

Probably this zero day: https://www.tenable.com/blog/cve-2023-34362-moveit-transfer-critical-z…

Sadly this looks like "industry standard" to me. I have seen many embedded Linux devices using mostly C applications and a lot of usage of the system() function with no or very poor input validation before. When you want to exploit embedded Linux devices always look for calls to system() first. The "strncmp(saved_pwd,pass0,strlen(pass0))" looks equally bad. Probably someone did not understood the advice "always check the length first" and just did it everywhere. Intel AMT checked the password in a similar way some time ago: https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability

Tenable.SC ( https://www.tenable.com/products/tenable-sc ) uses SQLite as the only type primary db.

Seems to be a bit more info here with CVE's etc - https://www.tenable.com/blog/cve-2021-30116-multiple-zero-day-vulnerab…

This has been posted on /r/sysadmin on Reddit: https://www.reddit.com/r/sysadmin/comments/i7yh5d/cve20201472_netlogon… Twitter post explaining it: https://twitter.com/RyanLNewington/status/1293444151644626944 Blog post explaining it: https://www.tenable.com/blog/cve-2020-1472-zerologon-vulnerability-in-… POC: https://infinitelogins.com/2020/09/15/abusing-cve-2020-1472-zerologon/

Blog post with a little more explanation and links to exploits: https://www.tenable.com/blog/cve-2020-1472-zerologon-vulnerability-in-…

This is one of the reasons why I always join a Zoom call from my phone, by calling their international numbers [1]. Recruiters sometimes ask me to turn my video on during interviews… I politely decline and move on to other opportunities. Their app is so privacy invasive, I cannot understand why people keep using it, specially considering 2018 vulnerability [2]. Feross Aboukhadijeh talks about Zoom security problems in Stanford’s CS253 Web Security course [3][4]. [1] https://zoom.us/zoomconference [2] https://www.tenable.com/blog/tenable-research-advisory-zoom-unauthoriz… [3] https://web.stanford.edu/class/cs253/ [4] https://feross.org/

As stated in the initial bug report by Zerons, an unauthenticated remote attacker could send a malicious SNI ending in a backslash-null sequence during the initial TLS handshake, which causes a buffer overflow in the SMTP delivery process. This would allow an attacker to inject malicious code that Exim then arbitrarily executes as root. This vulnerability does not depend on the TLS library in use, so both GnuTLS and OpenSSL are affected. https://www.tenable.com/blog/cve-2019-15846-unauthenticated-remote-com…

From https://en.wikipedia.org/wiki/Exim: Exim is a mail transfer agent (MTA) used on Unix-like operating systems. [...] In August 2019 [...] approximately 57% of the publicly reachable mail-servers on the Internet ran Exim. Yikes. edit: This might be a better summary of the vulnerability: https://www.tenable.com/blog/cve-2019-15846-unauthenticated-remote-com…

I was re-reading the 2017 AMT story, it is so strange. How is this even possible? https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability

> Do these scanners ever work? See https://www.tenable.com/blog/apache-struts-jakarta-remote-code-executi… Yes, they do. Detecting the flaw is not a problem, but often operationally patching can be a big deal.

Well, if you sent an email to `|program` it didn't execute program. Seriously[1] [1]: https://www.tenable.com/plugins/index.php?view=single&id=10261 Indeed, many sysadmins of the time lauded qmail's lack of supporting "standard features" in the name of "security" which sadly was still a new concept on the Internet. Something to consider: SMTP over TLS offers some privacy and confidentiality between two mail servers that have established a trust relationship, but it offers no protection against an upstream network (who can simply fake some DNS records and get a letsencrypt certificate) or a state actor (who simply threatens the CA). I think referring to "SMTP over TLS" as "secure" is dangerous because it leads us to equate "more code" as providing security.

I see the point especially with foreign addresses. It can be bit of a challenge to communicate addresses like "Nándorfejérvári út 4" or "Kısıklı Büyük Çamlıca Cd. No:9" over the phone. Coordinates are of course alternative, but for most of us, few words and number are easier to keep in mind for few minutes. The given notation is hard to decode inside the head, but if you can memorize it for 30 seconds then you can fire up an app to do the decoding. Pictogram is clever idea for the checksum. Probably something that sticks to your head. Reminds me of the Lotus Notes login dialog [1], [2] [1] https://blog.codinghorror.com/the-dramatic-password-reveal/ [2] http://www.tenable.com/pvs-plugins/1305

Vulnerability scanners are usually premium (paid) products. Some offer free trials such as Qualys: https://www.qualys.com/forms/freescan/ Other famous tools are nessus, and accunetix: https://www.tenable.com/products/nessus-vulnerability-scanner, http://www.acunetix.com/vulnerability-scanner/ These scanners are usually used by security consultants to test a complete internal network of a client. For a full list, some of which are open source, check this link: https://www.owasp.org/index.php/Category:Vulnerability_Scanning_Tools

If you're concerned your NTP servers may have the monlist command enabled and therefore be available for attackers to use to mount these reflection attacks there is a Nessus plugin to check for this: http://www.tenable.com/plugins/index.php?view=single&id=71783

ZmEu @ WhiteHat Team – www.whitehat.ro is probably one of the more common ones. nessus http://www.tenable.com/products/nessus looks for published vulnerabilities as well, but that would be more along the lines of using an exploitable pop3 daemon or having phpmyadmin visible from your site. Zmeu does some of those scans, but, will also try to do SQL injection.