Nessus Scanning Windows 8 Hosts
The new Windows 8 interface provides a very different user experience than past Microsoft operating systems. Nessus can enumerate and detect vulnerabilities on Windows 8 hosts.
Recently, Microsoft made several announcements surrounding new technology, including a new operating system (Windows 8) and a new tablet platform called "Surface." Windows 8 will present a new interface and several new changes under the hood. They're an offshoot of the new platform called Windows RT, a small, fast, and lightweight version designed to run on ARM-based tablets. In fact, this is much of the reason behind the concept of Windows 8 -- it’s meant to run on tablets and touch screens. Windows Phone 8 is the new OS for Windows-based phones, such as those from Nokia.
In the mean time, users and administrators may become excited about the new OS and upcoming features. Magically, Windows 8 will appear on your network, as new PCs will inevitably have it pre-installed, phones will get upgraded, and tablets will begin making their way onto the network. On top of it all, a new server OS is being introduced in the form of Windows Server 2012.
The good news is that Nessus can already identify Windows 8 desktop and server in your environment:
An example of Nessus correctly identifying a Windows 8 host on the network, taken from the new HTML5 Beta interface for Nessus. (Click for larger image)
More good news: Nessus can already detect missing patches when given credentials (potentially bad news if they're missing patches!). For example, Nessus detects some missing Adobe Flash updates, a certificate revocation update, and a missing security bulletin:
Vulnerability results as displayed in the Nessus HTML5 Beta interface for a Windows 8 target host. Note the HTML5 interface allows you to run a quick search against the results, and searching for "MS" in the title provides a list of Windows security bulletins. (Click for larger image)
Local patch auditing for new Microsoft OSes, such as Windows 8 and Windows Server 2012, is a great way to stay ahead of the curve with respect to system deployment. Patch checking allows you to be certain your patch management process is working correctly before widespread deployment of new Windows OSes. On the mobile device platform, Microsoft has only just recently made phones available running Windows Phone 8. Nessus mobile device scans currently support Windows Phone 7, and support for Windows Phone 8 will be released in the coming months.
Related Articles
Study: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog
October 23, 2023Tenable ranked first in multiple vulnerability management categories, including the most comprehensive coverage and quickest detection of CISA's Known Exploited Vulnerabilities, according to a Miercom report commissioned by Tenable.
Tuning Network Assessments for Performance and Resource Usage
September 13, 2022Using the correct tool for the job and optimizing scanner placement will have a large impact on scan efficiency with Nessus, Tenable.io and Tenable.sc.
Terrascan Joins the Nessus Community, Enabling Nessus To Validate Modern Cloud Infrastructures
May 17, 2022The addition of Terrascan to the Nessus family of products helps users better secure cloud native infrastructure by identifying misconfigurations, security weaknesses, and policy violations by scanning Infrastructure as Code repositories.
CVE-2024-7593: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
August 14, 2024Ivanti released a patch for a critical severity authentication bypass vulnerability and a warning that exploit code is publicly available
Microsoft’s August 2024 Patch Tuesday Addresses 88 CVEs
August 13, 2024Microsoft addresses 88 CVEs with seven critical vulnerabilities and 10 zero-day vulnerabilities, six of which were exploited in the wild.
Compromising Microsoft's AI Healthcare Chatbot Service
August 13, 2024Tenable Research discovered multiple privilege-escalation issues in the Azure Health Bot Service via a server-side request forgery (SSRF), which allowed researchers access to cross-tenant resources.
- Nessus