CIT 380: Securing Computer SystemsSlide #1 CIT 380: Securing Computer Systems Scanning

War Driving Finding wireless access points CIT 380: Securing Computer SystemsSlide #2

NetStumbler Sends out ESSID any Waits for Access Points to respond (free) Figure 6.1 on page 244 CIT 380: Securing Computer SystemsSlide #3

Wellenreiter Passively discovers wireless systems Linux Figure 6.2 on page 246 CIT 380: Securing Computer SystemsSlide #4

ESSID-Jack Figure 6.3 page 248 CIT 380: Securing Computer SystemsSlide #5

Defenses Use WPA protocol Use ESSID that does not identify you Use VPN Detecting Rogue Access Points CIT 380: Securing Computer SystemsSlide #6

War Dialing Attacker dial range of numbers looking for modems THC-Scan Figure 6.4 on page 255 Random dialing Random waiting time Nudging to discover the system from banners and login prompt CIT 380: Securing Computer SystemsSlide #7

War Dialing Look for systems without passwords Look for default passwords Run list of passwords CIT 380: Securing Computer SystemsSlide #8

Why Modems To allow access to routers, etc. To bypass VPNs (Rogue Modems) CIT 380: Securing Computer SystemsSlide #9

Defenses Modem Policy Test for rogue modems CIT 380: Securing Computer SystemsSlide #10

CIT 380: Securing Computer SystemsSlide #11 Topics 1.Port Scanning 2.Stealth Scanning 3.Version Identification 4.OS Fingerprinting 5.Vulnerability Scanning

CIT 380: Securing Computer SystemsSlide #12 Port Scanning Method of discovering exploitable communication channels by probing networked hosts to find which TCP and UDP ports they’re listening on.

nmap Fyodor Table 6.2 on pages CIT 380: Securing Computer SystemsSlide #13

CIT 380: Securing Computer SystemsSlide #14 nmap TCP connect() scan > nmap -sT at204m02 (1645 ports scanned but not shown are in state: closed) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 111/tcp open rpcbind 443/tcp open https 515/tcp open printer 2049/tcp open nfs 4045/tcp open lockd 5432/tcp open postgres 5901/tcp open vnc /tcp open X /tcp open sometimes-rpc13 Nmap run completed -- 1 IP address (1 host up) scanned in seconds

CIT 380: Securing Computer SystemsSlide #15 Scanning Techniques 1.TCP connect() scan 2.TCP SYN scan 3.TCP FIN scan 4.TCP Xmas scan 5.TCP Null scan 6.TCP ACK scan 7.Fragmentation Scan 8.FTP bounce scan 9.Idle Scan 10.UDP scan

CIT 380: Securing Computer SystemsSlide #16 TCP connect() scan Use connect() system call on each port, following normal TCP connection protocol (3-way handshake). connect() will succeed if port is listening. Advantages: fast, requires no privileges Disadvantages: easily detectable and blockable.

CIT 380: Securing Computer SystemsSlide #17 TCP SYN Scan Send SYN packet and wait for response –SYN+ACK Port is open Send RST to tear down connection –RST Port is closed Advantage: less likely to be logged or blocked Disadvantage: requires root privilege

CIT 380: Securing Computer SystemsSlide #18 TCP FIN scan Send TCP FIN packet and wait for response –No response Port is open –RST Port is closed. Advantages: more stealthy than SYN scan Disadvantages: MS Windows doesn’t follow standard (RFC 793) and responds with RST in both cases, requires root privilege.

CIT 380: Securing Computer SystemsSlide #19 Xmas and Null Scans Similar to FIN scan with different flag settings. Xmas Scan: Sets FIN, URG, and PUSH flags. Null Scan: Turns off all TCP flags.

CIT 380: Securing Computer SystemsSlide #20 TCP ACK Scan Does not identify open ports Used to determine firewall type –Packet filter (identifies responses by ACK bit) –Stateful Send TCP ACK packet to specified port –RST Port is unfiltered (packet got through) –No response or ICMP unreachable Port is filtered

CIT 380: Securing Computer SystemsSlide #21 Fragmentation Scan Modify TCP stealth scan (SYN, FIN, Xmas, NULL) to use tiny fragmented IP datagrams. Advantages: increases difficulty of scan detection and blocking. Disadvantages: does not work on all Oses, and may crash some firewalls/sniffers.