6 ms·

Flan Scan: Lightweight Network Vulnerability Scanner

156 points by 0xmohit 7y ago

internobody 7y ago
Having had to deal with heavy duty, expensive, vendor-supplied scans in a previous life (Qualys, yuck) this seems a very nice breath of fresh air.
- ejcx 7y ago
  This is really our use case. A little bit of packaging around a pretty good vuln scanner you can set up in 10 minutes I’ve managed Nessus in a past life and it was a nightmare.
derpherpsson 7y ago
The article essentially reads as "we payed lots of monies for a mediocre scanner, and then we discovered that the FOSS nmap did everything we needed. So we took nmap and added a little bit of extra, a web interface, and gave it the name Flan Scanner." . . . The corporate world is so facepalm sometimes
- dewey 7y ago
  > added a little bit of extra, a web interface Sometimes that's the difference between people using it not using it. The classic rsync and a bunch of scripts vs. Dropbox HN comment.
  - DjangoReinhardt 7y ago
    https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224 For people new to HN, this is the comment dewey is referring to, I think. 'dhouston' is Drew Houston, the founder of Dropbox.
- jgrahamc 7y ago
  And that's how people miss the opportunity to make a lot of money because they don't understand the needs of corporations.
kylek 7y ago
TLDR; they use nmap + vulners (nmap script). Their wrapper outputs those low/medium/high-risk cve reports that no one likes to look at
0xmohit 7y ago
Flan Scan is a thin wrapper around Nmap that converts this popular open source tool into a vulnerability scanner with the added benefit of easy deployment.
ejcx 7y ago
Feel free to ask any questions you have. We have quite a few folks from Cloudflare's security team here.
- ignoramous 7y ago
  Vulners.com isn't a free service, are there other cheaper alternatives (perhaps less comprehensive) that maintain database of vulnerabilities? Interestingly, the very impressive infosec people behind Vulners are employed (?) by QIWI, a Russian payments company. That isn't an issue now that you publicly claim to use their service, but were there any reservations raised by legal or otherwise? How much in relative terms were the cost savings when Cloudflare did switch to in-house audits via Flan Scan given the requirements / development / operational / maintenance effort expended + licensing service from Vulners? Does Flan Scan also scan network equipment (like switches, routers etc)? Given the complex heterogeneous nature of the global Cloudflare network, what did the deployment process look like? Will there a follow-up blog post on how that was automated/accomplished? What are the other big cloud / CDN providers doing to scan for vulns / compliance at scale if you're privy to it? Have any of them shown interest in contributing to and/or using Flan Scan? What does the short-term and long-term roadmap for Flan Scan look like? Why "Flan Scan"? :) Thanks a lot.
hannob 7y ago
I ran it against a few servers I'm responsible for. I'm not impressed. I got a large number of reports for a Debian system running Apache. These were all old vulnerabilities where fixes were backported to Debian's packages, so these are false positives. Also got a warning for another server about the recent XMSS issue in OpenSSH, which is code that is disabled by default (and disabled on the scanned server). It seems all this tool does is some kind of version matching (i.e. "a CVE has been reported for version x.y.z of software A, so a server running x.y.z is vulnerable"). This is a poor proxy for the actual existence of a vulnerability. It's not a "vulnerability scanner" in a sense that it actually tests for the presence of a vulnerability. (Full disclosure: Just copied over my comment I posted on reddit earlier today)
- justin66 7y ago
  > It seems all this tool does is some kind of version matching (i.e. "a CVE has been reported for version x.y.z of software A, so a server running x.y.z is vulnerable"). This is a poor proxy for the actual existence of a vulnerability It sounds as though it's illustrative of a problem with either the index the scanner software is referring to or the update methodology the distro relies on. Debian don't really fix the software without incrementing the version number in some fashion, do they?
  - zerocrates 7y ago
    It's pretty typical for these "backported" packages to have version numbers that only differ from the original by a suffix, and that suffix often only appears in the package manager. For example, the Debian stable Apache package is currently version 2.4.38-3+deb10u3, but Apache will typically report something less than all that information, like just 2.4.38. If it's really just looking at exposed version numbers, there's plenty of other problems, like servers that are configured to not expose their version numbers.
- thaumaturgy 7y ago
  This has been my experience with similar tools (mostly openvas / greenbone) and companies peddling vulnerability tests for compliance purposes. There doesn't seem to be a lot of "functional scanning" in this space, like you're talking about. So I agree the false positives are a pain in networks with patched systems but this also seems to be standard behavior.
humtum 7y ago
Cool project. I'd be interested in using the scan data to automate workflows. Is Cloudflare hooking this into some security automation engine to make the data actionable?
bloblaw 7y ago
Remember: This is a 50 line Python script that is a wrapper for nmap + vulners NSE script. It's not a product, but some simple automation around existing tooling. Better than paying $$$ for a full fledged scanner? Maybe, but depends on your use case.
- peterwwillis 7y ago
  Yeah, this is someone's two-week project which somehow became a blog post, and they're trying to look good to their execs for it. I made scripts like these at a previous company in about two weeks. One prints a network map based on traceroutes gathered from nmap scans: https://github.com/psypete/public-bin/blob/public-bin/src/networking/print_network_map.pl https://github.com/psypete/public-bin/blob/public-bin/src/ne... Another set checks all TLS certs found in an nmap scan: https://github.com/psypete/public-bin/tree/public-bin/src/networking/check-ssl https://github.com/psypete/public-bin/tree/public-bin/src/ne... But I wouldn't write a <edit> public-facing company-product-announcing </edit> blog post about them.
  - jgrahamc 7y ago
    and they're trying to look good to their execs for it. That’s unnecessarily mean to Nadin who worked on this and misreads how this got created and written up.
    - peterwwillis 7y ago
      I apologize sincerely to Nadin, I didn't mean to imply this was their personal goal. I meant the team/team lead/department lead/etc that approved this public blog post. Probably there's been some grumbling from above about not showing the value of said team, so somebody said, hey Nadin, can you write up a blog post of that security work you did? The end result is the team gets some public recognition and their bosses (& execs) are now happy. Meanwhile, the internet is like, why are they showing us somebody's two-week project like it's a new VPN or something?
  - ignoramous 7y ago
    That's fair, but since Cloudflare has the reach and cred, it makes sense for them to: 1. Call BS on expensive compliance solutions. 2. Show they're relentlessly resourcesful and how other upstarts could be, too. 3. Prefer the scrappy, get-the-job-done over NIH. Personally, I'm glad they blogged abt it, and generally too, in that they engage with the news.yc community despite having grown so large.
deleted 7y ago
[deleted]
microcolonel 7y ago
That LaTeX report output is hot. It'd be cool if the bar could be raised for scanners like this, which mostly just try to get services to respond with a version number. It is always funny seeing how less than a hundred lines of code can replace six or seven digits in licensing, negotiation, lawyering, and time.
trhaynes 7y ago
Every good vuln scanner needs a custom typeface — excited to hear about Flan Scan Sans!

156 points by 0xmohit 7y ago

Having had to deal with heavy duty, expensive, vendor-supplied scans in a previous life (Qualys, yuck) this seems a very nice breath of fresh air.

ejcx 7y ago
This is really our use case. A little bit of packaging around a pretty good vuln scanner you can set up in 10 minutes I’ve managed Nessus in a past life and it was a nightmare.

derpherpsson 7y ago

The article essentially reads as "we payed lots of monies for a mediocre scanner, and then we discovered that the FOSS nmap did everything we needed. So we took nmap and added a little bit of extra, a web interface, and gave it the name Flan Scanner." . . . The corporate world is so facepalm sometimes

dewey 7y ago
> added a little bit of extra, a web interface Sometimes that's the difference between people using it not using it. The classic rsync and a bunch of scripts vs. Dropbox HN comment.
- DjangoReinhardt 7y ago
  https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224 For people new to HN, this is the comment dewey is referring to, I think. 'dhouston' is Drew Houston, the founder of Dropbox.
jgrahamc 7y ago
And that's how people miss the opportunity to make a lot of money because they don't understand the needs of corporations.

kylek 7y ago

TLDR; they use nmap + vulners (nmap script). Their wrapper outputs those low/medium/high-risk cve reports that no one likes to look at

0xmohit 7y ago

Flan Scan is a thin wrapper around Nmap that converts this popular open source tool into a vulnerability scanner with the added benefit of easy deployment.

ejcx 7y ago

Feel free to ask any questions you have. We have quite a few folks from Cloudflare's security team here.

ignoramous 7y ago
Vulners.com isn't a free service, are there other cheaper alternatives (perhaps less comprehensive) that maintain database of vulnerabilities? Interestingly, the very impressive infosec people behind Vulners are employed (?) by QIWI, a Russian payments company. That isn't an issue now that you publicly claim to use their service, but were there any reservations raised by legal or otherwise? How much in relative terms were the cost savings when Cloudflare did switch to in-house audits via Flan Scan given the requirements / development / operational / maintenance effort expended + licensing service from Vulners? Does Flan Scan also scan network equipment (like switches, routers etc)? Given the complex heterogeneous nature of the global Cloudflare network, what did the deployment process look like? Will there a follow-up blog post on how that was automated/accomplished? What are the other big cloud / CDN providers doing to scan for vulns / compliance at scale if you're privy to it? Have any of them shown interest in contributing to and/or using Flan Scan? What does the short-term and long-term roadmap for Flan Scan look like? Why "Flan Scan"? :) Thanks a lot.

hannob 7y ago

I ran it against a few servers I'm responsible for. I'm not impressed. I got a large number of reports for a Debian system running Apache. These were all old vulnerabilities where fixes were backported to Debian's packages, so these are false positives. Also got a warning for another server about the recent XMSS issue in OpenSSH, which is code that is disabled by default (and disabled on the scanned server). It seems all this tool does is some kind of version matching (i.e. "a CVE has been reported for version x.y.z of software A, so a server running x.y.z is vulnerable"). This is a poor proxy for the actual existence of a vulnerability. It's not a "vulnerability scanner" in a sense that it actually tests for the presence of a vulnerability. (Full disclosure: Just copied over my comment I posted on reddit earlier today)

justin66 7y ago
> It seems all this tool does is some kind of version matching (i.e. "a CVE has been reported for version x.y.z of software A, so a server running x.y.z is vulnerable"). This is a poor proxy for the actual existence of a vulnerability It sounds as though it's illustrative of a problem with either the index the scanner software is referring to or the update methodology the distro relies on. Debian don't really fix the software without incrementing the version number in some fashion, do they?
- zerocrates 7y ago
  It's pretty typical for these "backported" packages to have version numbers that only differ from the original by a suffix, and that suffix often only appears in the package manager. For example, the Debian stable Apache package is currently version 2.4.38-3+deb10u3, but Apache will typically report something less than all that information, like just 2.4.38. If it's really just looking at exposed version numbers, there's plenty of other problems, like servers that are configured to not expose their version numbers.
thaumaturgy 7y ago
This has been my experience with similar tools (mostly openvas / greenbone) and companies peddling vulnerability tests for compliance purposes. There doesn't seem to be a lot of "functional scanning" in this space, like you're talking about. So I agree the false positives are a pain in networks with patched systems but this also seems to be standard behavior.

humtum 7y ago

Cool project. I'd be interested in using the scan data to automate workflows. Is Cloudflare hooking this into some security automation engine to make the data actionable?

bloblaw 7y ago

Remember: This is a 50 line Python script that is a wrapper for nmap + vulners NSE script. It's not a product, but some simple automation around existing tooling. Better than paying $$$ for a full fledged scanner? Maybe, but depends on your use case.

peterwwillis 7y ago
Yeah, this is someone's two-week project which somehow became a blog post, and they're trying to look good to their execs for it. I made scripts like these at a previous company in about two weeks. One prints a network map based on traceroutes gathered from nmap scans: https://github.com/psypete/public-bin/blob/public-bin/src/networking/print_network_map.pl https://github.com/psypete/public-bin/blob/public-bin/src/ne... Another set checks all TLS certs found in an nmap scan: https://github.com/psypete/public-bin/tree/public-bin/src/networking/check-ssl https://github.com/psypete/public-bin/tree/public-bin/src/ne... But I wouldn't write a <edit> public-facing company-product-announcing </edit> blog post about them.
- jgrahamc 7y ago
  and they're trying to look good to their execs for it. That’s unnecessarily mean to Nadin who worked on this and misreads how this got created and written up.
  - peterwwillis 7y ago
    I apologize sincerely to Nadin, I didn't mean to imply this was their personal goal. I meant the team/team lead/department lead/etc that approved this public blog post. Probably there's been some grumbling from above about not showing the value of said team, so somebody said, hey Nadin, can you write up a blog post of that security work you did? The end result is the team gets some public recognition and their bosses (& execs) are now happy. Meanwhile, the internet is like, why are they showing us somebody's two-week project like it's a new VPN or something?
- ignoramous 7y ago
  That's fair, but since Cloudflare has the reach and cred, it makes sense for them to: 1. Call BS on expensive compliance solutions. 2. Show they're relentlessly resourcesful and how other upstarts could be, too. 3. Prefer the scrappy, get-the-job-done over NIH. Personally, I'm glad they blogged abt it, and generally too, in that they engage with the news.yc community despite having grown so large.

deleted 7y ago

[deleted]

microcolonel 7y ago

That LaTeX report output is hot. It'd be cool if the bar could be raised for scanners like this, which mostly just try to get services to respond with a version number. It is always funny seeing how less than a hundred lines of code can replace six or seven digits in licensing, negotiation, lawyering, and time.

trhaynes 7y ago

Every good vuln scanner needs a custom typeface — excited to hear about Flan Scan Sans!