Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

One of our web servers that is managed by a service provider (completely in their control, we have no login access) just failed PCI-DSS vuln. scan by TrustKeeper. The vuln scan detected the box as a Windows Server 2003 SP1 OS (extremely out of date).

I submitted the report to our service provider (along with an angry email). They responded with a simple cropped screenshot of sysinfo screen showing SOME windows 2k3 sp2 box. I have no way of knowing if that screenshot is from our box or not, and based on history with the provider, I'm inclined to think they just grabbed it from another one of their boxes to cover their butts.

With no AD or login access, it's impossible for me to know for sure the SP level of this box.

Question:

  1. Is a simple sysinfo page screenshot enough for PCI-DSS compliance evidence? I can't imagine it being since as stated, it could be from any system. But then how to get evidence from this box that shows it really is our box and really is SP2?

  2. How to remotely verify the SP level of a box. I've had no luck with nmap.. is there another way to prove it's not updated?

See this Server Fault question for my OP.

share|improve this question
1  
I don't know the details of your web-server, but if it has access to something like PHP/ASP functionality, why don't you upload a remote access web-shell and running: > systeminfo | findstr /B /C:"OS Name" /C:"OS Version" –  NULLZ May 9 '13 at 2:00
1  
Depends on the restrictions placed on the user account that's executing these permissions. In theory though, yeah it should be possible. I've never had to personally call systeminfo via a web-shell though, so your results may vary\ –  NULLZ May 9 '13 at 6:40
1  
Yeah, be careful about that, review the TOS. most 'off the shelf' backdoors are (obviously) flagged by AV. You could also try running NMap or something against your host to see what OS it fingerprints it as... –  NULLZ May 9 '13 at 6:54
1  
Okay. Well it sounds like they're locking down permissions somewhat which is good. But Honestly the best thing you can do in this case is switch to a more helpful hosting provider. If you dont trust them to tell you basic facts, why are you trusting them with PCI data?? –  NULLZ May 9 '13 at 22:21
1  
they responded by saying they are now going to move our stuff to a brand new server. I think I caught them in a cover-up for sure. –  SnakeDoc May 9 '13 at 22:52

3 Answers 3

In order for such evidence to be accepted, it needs to be possible to tie the information in the image showing the Service Pack level to the system (IP address/URL) being scanned by Trustkeeper. A screenshot that has different windows open that shows you're providing appropriate evidence for the correct system should do the trick.

Do you know if the Service Provider is performing internal vulnerability scans on those systems? Perhaps you could get access to those results.

You could try running an online tool such as http://www.yellowpipe.com/yis/tools/craftnet/ though you're unlikely to get a different result to nmap.

As you'll have been running external vulnerability scans every 3 months, has this system ever failed before?

share|improve this answer
    
1) that's a good idea on the ip address/hostname in the same screenshot as the sysinfo page. 2) Probably not. They get "certified" once a year by two different companies. I doubt there's much more than that, other than their normal IDS stuff on perimeter, standard stuff. 3) You're probably right, likely won't be much different than nmap, and they're probably based on nmap or similar. 4) We run our scans every month, and it has failed several times before. Although, not all for this box, and not recently. I think they have moved one of our boxes to a new setup and installed from old media... –  SnakeDoc May 9 '13 at 6:43

Honestly, based on whats been discussed in the comments, this doesn't sound like a hosting provider you trust at all. If that's really the case, the PCI auditor was right to fail you on this count. Why are you trusting them with PCI data?

You need to either move these assets in house or move them to a different provider that you trust.

In addition, rather than running on a shared environment that you don't have control over, get a dedicated box, or at least a VPS with root access. You can still pay someone to manage it (managed services or whatever) but YOU can also check that the managed service provider is doing their job from time to time and not pulling something dodgy.

Yes, based on your comments it sounds like they've tried to cover their asses and in the process have created a headache for you. The best long term solution is to move, because if they are indeed doing this, they are reducing YOUR and your CUSTOMERS data security.

share|improve this answer

If you have to have this type of interaction with the Service Provider, you have a bigger security risk than Windows Server 2003 SP1... that bigger security risk IS the security provider.

Fire them as quickly as you can, and find another.

share|improve this answer
    
Oh if it were only that simple lol. We are pretty heavily integrated with this provider with all sorts of custom middleware and integration software our team has written over the past few years. Switching now is really not much of an option, unfortunately. –  SnakeDoc May 9 '13 at 14:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.