HP to hack its customers

HP is to launch a penetration-testing service for businesses in October but has denied reports it will unleash worms on its customers.

The company said on Tuesday it would use the same techniques as hackers to gain access to its customers' machines. However, the exploit code it will use will be controlled and will not propagate itself, HP said.

Richard Brown, threat management department manager at HP Labs, said: "We use hacking techniques to gain access to the system but once we have control we make the system safe. We don't unleash a worm - we don't use worm-propagation techniques."

The penetration-testing service, HP Active Countermeasures (HPAC), will use a single server and eight to 10 scanning clients per 250,000 connected devices. Each of the clients will be given a range of IP addresses to scan, and will move through the range scanning for particular vulnerabilities.

Brown said: "We try to exploit vulnerabilities by sending malformed protocol messages to open ports. For example, Code Red exploited a vulnerability in MS IIS web service software - we would exploit the same vulnerability."

The HPAC team will use hacking techniques such as the use of malformed code to create buffer overflows, heap overflows, and stack overflows to gain control of clients' systems. They will use exploit code for known vulnerabilities found on the internet, or write their own exploit code.

Brown said: "If the code is unavailable we will generate our own exploit code."

The HPAC team won't fix problems themselves but will alert customers and work with them if necessary until the issue is resolved.

Brown said: "If we do manage to get control of a machine, we will do mitigating actions - supply a temporary fix until a patch can be applied in a proper manner. We could do as little as pop up a window saying 'this machine is vulnerable to Sasser' but we can escalate the mitigation if necessary to take the system completely offline.

"In the worst case we can shut the machine down, so it's no longer a threat to the infrastructure."

The company has been using these techniques to test its own networks since 2001, and has now decided to offer HPAC as a service. Within HP, the corporate IT team already monitors bulletin boards and alerts from computer emergency response teams and vendors.

As new threats are reported, the team will conduct a risk assessment and investigate the most serious vulnerabilities.

Brown said: "There are thousands of vulnerabilities but in most cases they can be dealt with through normal patch management. We're most concerned with 'wormable' vulnerabilities - ones that can be exploited using worms, as they have the largest impact on business."

Customers must give permission for HP to scan their systems, and can specify that certain servers or devices are not included in the scan, if concerned the scan will cause disruption.

HP promised "aggressive pricing" for the service, saying its fixed price would cost "a few dollars per user per year" for those customers with fewer than 20,000 active IP addresses.

Tom Espiner writes for ZDNet UK