full-disclosure - Re: Resolved - NNT Change Tracker - Hard-Coded Encryption Key - Originally posted as http://seclists.org/fulldisclosure/2011/May/460

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <BANLkTi=OfX5XLRFn7p9O=H4tP9-ETp+cEQ@mail.gmail.com>
Date: Wed, 29 Jun 2011 22:22:18 +0100
From: Dennis Brunnen <dennis.brunnen@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Resolved - NNT Change Tracker - Hard-Coded
 Encryption Key - Originally posted as
 http://seclists.org/fulldisclosure/2011/May/460

As is probably obvious to other readers, I did indeed notify NNT by
email of the vulnerability before making it public - as mentioned in
my initial disclosue. I'm not sure what possible reason anyone would
have to say that if it were not true.

Glad to see you apparently did the right thing and eventually fixed it though.

On Wed, Jun 29, 2011 at 3:34 PM, NNT Support <support@...ws.com> wrote:
> Background
> -----------------
>
> The product employs a portion of legacy code as referenced in the original
> post. This is used for the product key and some database entries but whilst
> the strength of the encryption being used here may be a problem for the NNT
> licensing team, there is no genuine security risk for device data. This
> portion of code has subsequently been replaced in Versions 5 and patches are
> available from www.nntws.com
>
> Change Tracker works on the principle of layered, multi-dimensional security
> in line with the PCI DSS that it is commonly used to underpin. The secure
> commissioning process should include standard lockdown and
> access-restriction procedures for the Change Tracker server and database
> server used for device and configuration data storage. Access security
> should also  be complemented with monitoring using a SIEM solution such as
> NNT Log Tracker, so any access to the Change Tracker server, the Change
> Tracker console program or the database will be logged and alerted as
> unusual activity.
>
> NNT take security of our customer systems extremely seriously. Anyone with
> any concerns regarding best practise in Production System security should
> contact us for further assistance.
>
> Regarding any vulnerabilities discovered by independent security researchers
> in the future, we would prefer these are reported to us at support@...ws.com
> before being published. This was not the case in this instance, delaying our
> opportunity to respond. Thank you.
>
> Company Homepage
> ------------------------------
>
> http://www.newnettechnologies.com
>
>
>
> Regards
>
> NNT Support
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/