Do nessus leak some information from (paranoid user)?

[imported_capron]

Do nessus leak some information ?

In order to run updated plugins nessus demands a registration. This and all the use of hash and certs makes me paranoid. Cud it be possibel for a IDS too collect use full information from the nessus demon when it detect a scan?

[Archangel-Amael]

Do nessus leak some information ?

In order to run updated plugins nessus demands a registration. This and all the use of hash and certs makes me paranoid. Cud it be possibel for a IDS too collect use full information from the nessus demon when it detect a scan?

One may never know what some one else's tools are doing so there are a few options.
1. Don't use the tools
2. Find source code for all the tools one uses and look at said code and understand everything it is doing.
3. Code your own tools.
4. Don't use tools on networks in which you do not have explicit written permission to use said tools on.

There are probably others but that should help get you started.
Your question is kind of like asking is an encryption scheme secure.
Well yes some are but all of them are only temporarily secure in that they have not been attacked long enough, Eventually they will fold but it may take thousands of years for that to happen.
So the question then goes back to is it really secure?


As for nessus you don't have to give any real info in order to register.
However one may have to worry about email/ip address info when doing so but there are ways to mitigate this. Then there is the question do the tools have usage tracks that are combined with registration /email/ip address

Good luck

[hhmatt]

Do nessus leak some information ?

In order to run updated plugins nessus demands a registration. This and all the use of hash and certs makes me paranoid. Cud it be possibel for a IDS too collect use full information from the nessus demon when it detect a scan?

If your not doing anything wrong then there shouldn't be anything to worry about.

If you want to know what nessus is doing and how the information is being sent and to where, then use a packet sniffer/network analyzer like wireshark and watch the packet streams.