Working towards passing our PCI Compliance scan. I've got everything good to go except this "Scan Interference Detected" issue. Right now, the latest scan report is telling me that "Excessive number of open TCP ports (65453) during port scan." Here's the kicker - they (Trustwave) asked us to "whitelist" their IP range on our firewall (Cisco ASA5510). Could this be the cause? Anyone encounter this issue?
Posted Aug 26, 2014, 7:56 PM UTC
I work with Trustwave in over 20 restaurants.
You didn't need to "whitelist" anything on your ASA5510. Remove the changes you made and run the scan again.
Their suggested remediation to pass the scan - after 3 attempts - was to "whitelist" their IP range. Going to remove them today and rescan and go from there.
they had you white list their ip range? wtf would you do that?
It's temporary and was required to complete the scan. I don't like it, either. It's also exceedingly common with PCI compliance scans to request this.
required to complete the scan.
It also completely defeats the purpose; if they've been whitelisted (anywhere) then they have a leg up on an actual attacker, which leads to a useless report fixing things that aren't actually a risk, and quite possibly missing actual risks.
We frequently had this request at $JOB-1 (Managed Security Provider) from third-parties performing penetration testing. We considered it a social engineering attack and denied the requests.
I would look at another vendor, I never once have had an outside company request access like that.
Yeah, in all of them I've done they specified that nothing should be done with their traffic. It should be treated like any other traffic.
This seems to be a common problem/request from Trustwave. I will definitely look into other vendors.
Same here we had some that asked crap like that and when told to fuck off they said that is the correct answer.
Yeah, in all of them I've done they specified that nothing should be done with their traffic. It should be treated like any other traffic.
We had one fail us for using fail2ban...
Do you have an IVS in the environment? I think they mean to white list their IPs to that IVS device (443,22,53(udp/tcp)) then you allow the IVS to see the local subnets on all ports. Your system firewalls should remain restrictive to the IVS.
Thanks! I will check into this.
we regularly have scans conducted, but have never been requested to whitelist any IP.
That's bullshit. Whatever you did to "whitelist" their IPs - take it out. Then tell them to scan again - you'll pass.
When they scan it should be a scan of however your network is configured normally. If you do anything else special/by request, that's just cheating.
Their suggested remediation to pass the scan - after 3 attempts - was to "whitelist" their IP range.
You should whitelist them on any intrustion detection systems or web application firewall you have, but not just open all ports for them at the firewall.
We use Qualys for our scans and that's all we do for them.
If you don't whitelist them on your IDS/IPS or WAF they're likely to be quickly blocked because it'll detect them doing attempts at stuff and block them from scanning other ports or other vulnerabilities.
On the offchance this is also an issue with Cisco firewalls, here's how I resolved this on a PaloAlto500:
"In the Zone Protection Profile we had our response to SYN Attacks set to "SYN COOKIE". By changing this to "Random Early Drop" (which PA asserts is just as effective) I was able to successfully do both a PCI Vulnerability Scan and a "Full Scan", no more interference or excessive port open errors.
I could make a whole Hitler "Downfall" parody about Trustwave, but I won't.
Seriously. I've been trying to get ahold of someone - anyone - to talk to and so far nada in two weeks. It's such a finicky process. I've dealt with a lot of crap projects and scenarios, but dealing with this PCI compliance crap is awful. This is my last little "honey-do" to check off their fraking list and I can move on to other things.
Sounds about par for my experience with many PCI compliance vendors - they're not there to help you, or be your friend, or point out problems or best practices, or troubleshoot your equipment. There just there to pass/fail you, and collect a check for the privilege - that's the business.
If you pass, you've proven your marginally smarter than them when it comes to network security - nothing more.
The whole thing is a bad joke/money maker if you ask me.
Is this a quarterly scan done by an automated system or is this a pentest?
Quarterly scan. Our first one, in fact.
I think they only want you to whitelist against the ips, so they can port scan open ports without being blocked
Yep. That's what we've done.
In my experience, you have to get in touch with someone that works there and they will waive false positives like this manually. Obviously you're probably not running a service on almost every single port available... I would also not whitelist them, that's absurd.
I've been attempting to speak with someone for nearly two weeks now. I certainly wouldn't be asking the interwebs about this issue if I had further guidance from Trustwave.
Every time a PCI compliance scanner asked me to "whitelist" their IP range in the firewall I've just said "Yeah, I did it, for reals" and done nothing.
If you have an IDS/IPS you may have to whitelist their IP range there, as it could start blocking their scan when it sees an "attack" (ie, they scan 3-4 ports, find nothing vulnerable but then the IPS kicks in and blocks them completely, so they don't find the wide open RDP session to the world one port up).
While we're on the subject, does anyone have any recommendations for a Approved Scanning Vendor (ASV) other than Trustwave?
I'm having exact same issue. We've been with Trustwave for 2 years but this just started happening this quarter. Against better judgement I did their remediation suggestion (whitelist full TW ranges) but of course that did nothing. Repeated disputes have been met with "you haven't provided enough information". I'm also trying to find someone at TW to talk to about this.
Our firewall does have a Port Scan detector but it was set to 'alert' only, so I just changed it to block port scans entirely in the hope that maybe then TW won't register all the ports as open.
** and yes I realize I am actively interfering in their scanning in order to avoid the false positive port interference error. Common sense left the room when they asked me to lower my security in order to prove we are secure.
We finally just decided to go with a different vendor. I did a scan with Comodo / Hackerguardian and the scan report was far more informative. Turns out we just had to explain how our VPN was securely implemented and we passed the second go around. Trustwave = never again!
Lucky! We are preparing for a lvl 1 audit, performed BY TRUSTWAVE so switching ASV isn't an option.
I've just put in my 2nd ticket with them and basically telling them if they can't perform a scan to let me use an alternate ASV. We also use Saint Corp for external pen testing and they've never had any of these issues.
If I ever do get an answer to this stupid "Excessive number of open TCP ports (65453) during port scan." will update but glad you got past it with Comodo.
From my understanding of the PCI Compliance guidelines, a company has a right to choose the ASV (approved scanning vendor) it uses.
We got hooked up with Trustwave because we use FirstData for our processing. FirstData sent a "helpful" email with our Login to their Trustwave site and reminded us that we needed to update our password and complete our first scan. No mention that we had a choice in vendor anywhere. It took some serious back tracking to figure out that we'd been railroaded into using them through clever marketing.
Thanks Ash, that's good to know. We are doing this as part of a larger deal and the company we've partnered with selected TW but maybe I can get that changed. I've since been escalated to TW tier 2, where they have had me undo the whitelisting that their tier 1 remediation told me to do so we are back at square 1.
My latest ticket update was "other users resolved this issue by switching ASV's, is that your recommendation as well?"
I am having this issue, too, with Trustwave Scans. I have a Fortigate firewall, and I am going to try to find a similar setting to what bobdobbs242 recommended. We also just started failing this quarter.
The biggest frustration with Trustwave is their lack of further information and ridiculous canned responses every time you ask for clarification.
We are stuck with them, due to an agreement with our processor.
Thank for the helpful info, and I will post here when we get it sorted out.
Your firewall may have an anti-scan feature built into it that responds with all ports being open. This is pretty common, actually. This will most likely report the ports open even if a rule says things are allowed.
We're looking into that.
Some of our firewalls are configured to block for port scanning. This pretty quickly renders a pci scan mute so we have to set an exception to permit a valid view of open ports.
That said, their view is still horrible and I've seen them pass sites that permit credit information on http so clearly they don't pay much attention outside reported software versions which on Linux usually means they don't see patches that don't impact version numbers.
They are good for marketing I guess.
The last time a client got one of these done they just harped about outdated .NET installations on webservers (I mean, that's a valid complaint...) and ignored the part that the client ran their Citrix login page over HTTP. .NET framework out of date? FAIL! Send credentials for system in clear text over the internet? No probalo!
Glad I'm not the only one.