MIT Working On Network Vulnerability Analysis

An anonymous reader writes "Researchers at MIT have created a method for analyzing networks to detect exploitable vulnerabilities using attack graph analysis which can be done in near real time. The new Lincoln Labs tool will allow admins of large networks to detect their most vulnerable areas and also model zero day attacks. 'NetSPA (for Network Security Planning Architecture) uses information about networks and the individual machines and programs running on them to create a graph that shows how hackers could infiltrate them. System administrators can examine visualizations of the graph themselves to decide what action to take, but NetSPA also analyzes the graph and offers recommendations about how to quickly fix the most important weaknesses. NetSPA relies on vulnerability scanners to identify known weaknesses in network-accessible programs that might allow an unauthorized person access to a machine. But simply being aware of vulnerabilities is not sufficient; NetSPA also has to analyze complex firewall and router rules to determine which vulnerabilities can actually be reached and exploited by attackers and how attackers can spread through a network by jumping from one vulnerable host to another.'"

Hacker Tool

[Nom du Keyboard]

How long before there's a hacker tool version of this to spot vulnerabilities that exist because the sys admin isn't using it to defend his network?

Re:Hacker Tool

[BitterOldGUy]

How long before there's a hacker tool version of this to spot vulnerabilities that exist because the sys admin isn't using it to defend his network?

Done!

Next question.

Re:

[fuzzyfuzzyfungus]

I nominate you for director of marketing for whatever company ends up commercializing this.

Not long

[Crazy Taco]

How long before there's a hacker tool version of this to spot vulnerabilities that exist because the sys admin isn't using it to defend his network?

Probably not that long. This technology isn't overly groundbreaking or original. I don't want to take anything away from those who worked on this, because I'm sure they did a great job, but they weren't the only ones who thought of this. I was working on a similar project at Iowa State three years ago. I haven't followed the project since I left the university

Re:

[Deanalator]

There have been tons of projects like this in the past, and I don't think there will be any serious traction until people start releasing code.

By the way, shameless plug for my current project (as seen in my sig). It's a security visualization framework designed to make it very easy for security auditors to write data gathering modules, and visualization experts to write modules for visualizing data.

I will be giving a demo of my project at vizsec in a couple weeks (http://www.vizsec.org/workshop2008/), so

Charts

[nickswitzer]

Will it also create a powerpoint presentation so they can show it off to their boss about how they probably need a raise?

Re:

[Deanalator]

You laugh now, but most modern security analysis systems have this feature. Especially the expensive ones designed for large corporate networks.

Old news

[Anonymous Coward]

MIT Professors have been giving guest lectures on this for over two years. Not news

Bragging rights?

[knarfling]

The software sound sweet. But there are a few details missing.

1. Is it available for public use?
2. When will it be available?
3. What does it cost?
4. What platform(s) does it run on?
5. Where can I get it?

Or was this just bragging rights to say, "Look! We did something really, really cool, but you can't have it."

Re:Bragging rights?

[Yvanhoe]

Or was this just bragging rights to say, "Look! We did something really, really cool, but you can't have it."

The MIT does that a lot. And /. likes to be used as a PR agency.

Re:

[electrojoker]

http://www.cyberanalytix.com/ [cyberanalytix.com]

Re:

[electrojoker]

As far as availability and the comercialization concerns brought up there are a few articles referring to cyberanalytix and dev. of netspa in a platform http://www.masshightech.com/stories/2008/05/05/story11-CyberAnalytix-takes-a-7-year-path-to-$100K.html [masshightech.com] http://www.outlookseries.com/news/Science/3420.htm [outlookseries.com]

Same old same old.

[the_pete]

How is this different from what is already being done with vuln scanners? How does this find 0-days? The test comes from a particular vector which finds KNOWN vulnerabilities. This will only find Access problems if the limitations of the systems is known. It does nothing to determine trust problems like spoofing, MITM attacks, and attacks from other vectors. What they needed to do is look at it in a new way like in the SCARE project (Source Code Analysis Risk Evaluation) from ISECOM which determines all in