How to remediate – Network Notary Server Detection

1. Introduction

A network service is listening on a remote host, identified as a Perspectives Network Notary Server. Perspectives is a framework for authenticating public keys used by various network services; a Network Notary monitors and records these keys. This could allow an attacker to monitor network key usage or potentially intercept communications if the notary server is compromised. Confidentiality, integrity, and availability may be affected depending on the wider use of Perspectives within the environment.

2. Technical Explanation

The vulnerability exists because a Perspectives Network Notary Server is running on the network. This service listens for connections and records public keys. An attacker could potentially exploit this by monitoring key exchanges or attempting to manipulate the notary server’s records, though direct exploitation paths are not widely documented. There is no known CVE associated with simply *running* the service; risk comes from its presence and potential misuse.

• Root cause: The Perspectives Network Notary Server process is active and listening for network connections.
• Exploit mechanism: An attacker could passively monitor traffic to identify public keys or attempt to actively interact with the server, depending on its configuration.
• Scope: Systems running the Perspectives Network Notary Server software are affected. Specific versions were not provided in the context.

3. Detection and Assessment

Confirming a system is vulnerable involves identifying whether the Perspectives Network Notary Server service is running. A quick check can show listening ports, while thorough methods involve examining process lists and configuration files.

• Quick checks: Use netstat -tulnp or ss -tulnp to identify processes listening on standard ports (no specific port was provided).
• Scanning: Nessus plugin ID 16298 may detect the service, but results should be verified.
• Logs and evidence: Examine system logs for entries related to the Perspectives Network Notary Server process or associated configuration files in default locations.

netstat -tulnp | grep perspectives

4. Solution / Remediation Steps

Fixing this issue involves stopping and disabling the unnecessary Perspectives Network Notary Server service, or ensuring it is properly secured if required for business purposes.

4.1 Preparation

• Dependencies: Determine if other services rely on the notary server. A roll back plan involves restarting the service.
• Change window needs and approval may be required depending on internal policies.

4.2 Implementation

1. Step 1: Stop the Perspectives Network Notary Server service using systemctl stop perspectives-notary (or equivalent for your OS).
2. Step 2: Disable the service to prevent it from starting automatically with systemctl disable perspectives-notary.

4.3 Config or Code Example

Before

systemctl status perspectives-notary 
● perspectives-notary.service - Perspectives Network Notary Server
   Loaded: loaded (/lib/systemd/system/perspectives-notary.service; enabled; vendor preset: disabled)
   Active: active (running) since ...

After

systemctl status perspectives-notary 
● perspectives-notary.service - Perspectives Network Notary Server
   Loaded: loaded (/lib/systemd/system/perspectives-notary.service; disabled)
   Active: inactive (dead) since ...

4.4 Security Practices Relevant to This Vulnerability

Practices that directly address this vulnerability type include least privilege and secure defaults.

• Practice 1: Least privilege – only run services absolutely necessary for business function, reducing the attack surface.
• Practice 2: Secure Defaults – Ensure all software is configured with strong security settings by default.

4.5 Automation (Optional)

#!/bin/bash
# Stop and disable Perspectives Network Notary Server on remote hosts
for host in $(cat /path/to/hostlist); do
  ssh $host "sudo systemctl stop perspectives-notary && sudo systemctl disable perspectives-notary"
done

5. Verification / Validation

Confirm the fix by checking that the service is no longer running and listening on network ports. A smoke test should verify any dependent services still function correctly.

• Post-fix check: Run systemctl status perspectives-notary; expected output should show “inactive (dead)”.
• Re-test: Re-run the netstat -tulnp | grep perspectives command from section 3, which should now return no results.
• Smoke test: Verify any applications relying on Perspectives key authentication still function as expected.
• Monitoring: Monitor system logs for unexpected restarts of the Perspectives Network Notary Server process (example query: “perspectives-notary” in syslog).

systemctl status perspectives-notary 
● perspectives-notary.service - Perspectives Network Notary Server
   Loaded: loaded (/lib/systemd/system/perspectives-notary.service; disabled)
   Active: inactive (dead) since ...

6. Preventive Measures and Monitoring

Update security baselines to prevent unnecessary services from running, and add checks in CI pipelines to enforce secure configurations.

• Baselines: Update a system security baseline or policy to disallow the installation of Perspectives Network Notary Server unless specifically approved.
• Pipelines: Add configuration scanning tools (SAST) to deployment pipelines to identify and block insecure service configurations.
• Asset and patch process: Review installed software regularly, removing unused or unnecessary applications.

7. Risks, Side Effects, and Roll Back

Stopping the Perspectives Network Notary Server may impact any services that rely on it for key authentication. Roll back involves restarting the service.

• Roll back: Step 1: Restart the service using systemctl start perspectives-notary.

8. References and Resources

• Vendor advisory or bulletin: http://www.cs.cmu.edu/~perspectives/index.html