HP to hack customers' networks

The company plans to launch a penetration-testing service for businesses in October that will use the same techniques as hackers to gain access to its customers' machines. However, the exploit code it will use will be controlled and will not propagate itself as a worm would, HP said on Tuesday.

"We use hacking techniques to gain access to the system, but once we have control we make the system safe," said Richard Brown, the threat management department manager at HP Labs. "We don't unleash a worm. We don't use worm-propagation techniques."

The HP Active Countermeasures (HPAC) service will use a single server and between eight and 10 scanning clients per 250,000 connected devices. Each of the clients will be given a range of IP (Internet protocol) addresses to scan, and will move through the range scanning for particular flaws.

"We try to exploit vulnerabilities by sending malformed protocol messages to open ports. For example, Code Red exploited a vulnerability in MS IIS Web service software. We would exploit the same vulnerability," Brown said.

The HPAC team will use hacking techniques to create buffer overflows, heap overflows and stack overflows to gain control of clients' systems. They will use exploit code for known vulnerabilities published on the Internet or write their own.

"If the code is unavailable, we will generate our own exploit code," Brown said.

The HPAC team won't fix any problems found themselves, but will alert customers and work with them if necessary until the issue is resolved.

"If we do manage to get control of a machine, we will do mitigating actions (such as) supply a temporary fix until a patch can be applied in a proper manner. We could do as little as pop up a window saying, 'This machine is vulnerable to Sasser.' But we can escalate the mitigation, if necessary, to take the system completely offline," Brown said.

"In the worst case, we can shut the machine down so it's no longer a threat to the infrastructure," he added.

HP, based in Palo Alto, Calif., has been using these techniques to test its own networks since 2001. Within HP, the corporate IT team already monitors bulletin boards and alerts from computer emergency response teams and vendors.

As new threats are reported, the HPAC team will conduct a risk assessment and investigate the most serious vulnerabilities.

"There are thousands of vulnerabilities, but in most cases they can be dealt with through normal patch management. We're most concerned with 'wormable' vulnerabilities--ones that can be exploited using worms, as they have the largest impact on business," Brown said.

Customers must give permission for HP to scan their systems. They can specify that certain servers or devices are not included in the scan, if they are concerned that it would cause disruption.

HP promised "aggressive pricing" for the service, saying its fixed price would cost "a few dollars per user per year" for customers with fewer than 20,000 active IP addresses.

Tom Espiner of ZDNet UK reported from London.