Doing the grading at the server end, such as those offered by the agentless mode of StillSecure's product (thanks to Roger for the ref) does increases the bar, and I think should be considered for now until NAC/NAP matures enough.
For ISA/RRAS, one could write an rqs.exe replacement that initializes remote scanning tools (i.e. mbsacli.exe) against the quarantined machine's IP, and made the decision based on the result.
Cheers, MemetSide note to 3APA3A: admin access is not required to modify files from user's CM profile.
----- Original Message ----- From: "Mark Senior" <senatorfrog@xxxxxxxxx>To: "Memet Anwar" <mmta.gm@xxxxxxxxx> Cc: <bugtraq@xxxxxxxxxxxxxxxxx> Sent: Tuesday, May 23, 2006 11:24 PM Subject: Re: Circumventing quarantine control in Windows 2003 and ISA 2004
Any such quarantine control can be circumvented. the Checkpoint VPN has a similar feature, which can be enabled if you pay a pound of flesh per annum. It can be circumvented in a similar way - you have to replace a Checkpoint DLL with a custom compiled one, such that the local checks will always return true. I think the specifics were posted either here or to FD a while ago. There is just no way of verifying these things reliably. You can raise the bar somewhat by doing the grading at the server end, rather than telling the client the passing answers, but an attacker who can figure out a reasonable set of answers will always win. Cheers Mark