VulnDetect

Tom

It seems that the Flexera guys didn't like that we, as a new user, posted about the VulnDetect project, despite them discontinuing the beloved Secunia PSI.

We would very much appreciate if you would gently the spread the word and a few links to vulndetect.org / https://vulndetect.com/?1, it is much needed, so we have a lot of testers once the alpha is ready.

We also feel that it is important to invite all the PSI forum users to come here and join the VulnDetect forum.

We are also very open to creating new Categories and Sub-categories here, where different, related subjects can be discussed and provide moderator privileges to those who want to contribute.

/Tom

Tom

group multiple instances of a vulnerable program in the listing and allow me to expand that section when I want

Suggested by @CTaylor

Tom

At this point, we believe that we have developed approx. 80% of the core functionality, this includes:

Binary to collect data on the client system
Scheduling of the binary
Data collection and parsing from the binary
Authentication and account management
Backend for curating data about software and vulnerabilities
Infrastructure

ToDo:

Processing of the collected data / matching with the curated data
UI
Optimisation and testing of the binary
Curating data

And loads of more stuff, but first we need to finish the above and get an alpha version out to you.

/Tom

Tom

This thread is a summary of all user contributed suggestions that were posted in this forums.
It will be updated with links to new suggestions and also reflect the status of suggestions.

Please make one new thread for each feature suggestion were other users can vote and discuss about the suggested features.
Thank you for sharing your ideas!

Notes:

At the time of writing (May 2018) the SecTeer Personal CARMA is only in Tech Preview. A beta version is not due before late 2018.
Inclusion on this list does not imply that we will implement it, nor does it indicate any sort of priority.
We may rewrite suggestions (titles) to fit with the terminology that we intend to use or to fit how we believe that feature should be designed.

List of Applications:

Configuration:

Local Agent / app:

Application detection:

Other:

Business Users:

Tom

@ted OK, this explains, the agent did not yet do an inspection. With the current schedule it will take 10 hours.
Btw. you may want to delete / modify the picture / comment, since it displays your IP.

Tom

What you mean is that there should be a notification on the Windows system and not just in the Web UI?

Tom

The agent already has support for this. How we display this, is decided in each rule. Thus, we may treat this independently for each program, but it seems most likely, that we will report individually, since most programs require separate updates for 32 and 64-bit versions.
It is something that we will pay attention to and if you see errors in the results, then it should be reported individually for each program.

Tom

If initialization takes longer than a few seconds, show a progress bar to indicate program is still initializing and not hung

Suggested by @Alex-Connolly

Tom

Categorize programs that have security vulnerabilities separately from those that are just bug fixes and feature updates. Best would be a simple filter. I could look at just security vulnerabilities normally, but would flip a switch to see bug fixes/ feature updates

Suggested by @CTaylor

Tom

report on programs with security vulnerabilities for which a patch is not yet available (zero-days). This should be categorized separately from other things (patches available or bugfix/feature updates.

Suggested by @CTaylor

Tom

UI should be GUI not line

Suggested by @Alex-Connolly

Tom

option of having updates installed automatically

Suggested by @CTaylor

Tom

This is detected because it also is an independent program, which you may download and install.
We will not detect system components that are not accessible as standalone programs.
But I suppose we need to add OpenSSH to the list of products that needs contextual rules, so only the user managed versions will be reported and not the one managed by Windows.
Thank you for highlighting this.

Tom

LibreOffice has been added. It has been added as one product, since the vendor doesn't seem to support the individual apps with individual updates.

Tom

Nitro PDF Reader and Nitro Pro has been added.

You should note that version 5 went End-of-Life long ago and should be considered insecure.

Tom

Secunia includes both an Installed version number and (if different), a Secure version number of each program. The latter is useful for when I need to find the update myself.

Suggested by @HempOil

Tom

Hi Zian,
Thanks for reporting this.
This is a known issue, if you read this post:
https://vulndetect.org/post/1310

However, GIMP seems to be vulnerable to this old vuln:
CVE-2017-17789 in file-psp.exe
There is no immediate announcements or entries in the changelog about this being fixed.

As soon as we get some pointer to a changelog or other statement about this being fixed in a specific version, then we will update the rules to reflect this.

Tom

@gregalexandre Yes, this is due to the way we detect programs. One of the upcoming features of our rules, will be the ability to "group" based on what program it was bundled with. 7-zip is bundled with a lot of different apps, including certain Nvidia packages, so, in the future, you should only see Nvidia, and then when you expand Nvidia, you will see that it also includes 7-zip (which can't be updated). But again, that is part of the many things we are still working on, so please be patient.

Tom

@Anselm See this:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19857

Tom

Hi Ascendor,

Did you read this, we do link to this during installation:
https://secteer.com/privacy-policy-personal-carma/

SecTeer will collect the following information for CARMA consumer accounts:

Name (optional)
Email / Username (mandatory)
Password (mandatory)
Other personal information is not required to use the product, but you may be encouraged to supply this
IP addresses used to log in and submit data

The SecTeer CARMA products will collect the following information from your PC or device:

Program file names (NOT data files)
Meta data of program files, including, but not limited to size, version information, date, hashes, digital signatures, and other header / meta information
Directory structure i.e location of program files
Registry information related to installed software
Hostname or other unique identifier, to ensure correct correlation in reporting

Unfortunately, we do not offer a way around this nor do we have any plans to offer a different way of detected this and providing the results.

If you are concerned about this, then you can achieve a bit more anonymity, by registering using an alternative email address and perhaps send your data via a VPN (we do not support a proxy yet, but that may be implemented at a later stage).

And, soon, we will start anonymizing the data further i.e. by using placeholders for usernames in e.g. "c:\Users<yourusername>". However, this has NOT been implemented yet.

We've also planned another feature, which will allow you to exclude certain folders or drives.

Best posts made by Tom