Full Disclosure mailing list archives
Re: New Security News Website
From: Paul Schmehl <pauls () utdallas edu>
Date: Mon, 16 Feb 2004 17:28:15 -0600
--On Monday, February 16, 2004 1:49 PM -0800 "Gregory A. Gilliss" <ggilliss () netpublishing com> wrote:
You're kidding, right? Me thinks you *need* some hacker intel!
So you think a simple nmap scan is sufficient to determine if a host is insecure? Interesting.
If you scanned my Windows XP boxes, you'd find a bunch of juicy ports open. What you wouldn't find is a hackable daemon. All the open ports feed a program that captures the packets for analysis later. The boxes are running no Internet-addressable services. Yet, from an nmap scan you might (wrongly) assume that those boxes were grossly insecure.
This is the Internet. Things are not always what they seem. And open ports don't always mean negligence.
For example: bash-2.05b# telnet www.hackerintel.com 113 Trying 216.92.170.7... Connected to hackerintel.com. Escape character is '^]'. Connection closed by foreign host. bash-2.05b# telnet www.hackerintel.com 543 Trying 216.92.170.7... Connected to hackerintel.com. Escape character is '^]'. Connection closed by foreign host. bash-2.05b# telnet www.hackerintel.com 544 Trying 216.92.170.7... Connected to hackerintel.com. Escape character is '^]'. Connection closed by foreign host. Looks suspiciously like tcpwrappers to me.And just because you *can* get a login prompt or banner on a particular port, *even if* it appears to be a "normal" service for that port, does not necessarily mean you are addressing that actual service. (The program I refer to would make you *think* you were talking to a compromised machine running NetBus, for example - as well as MyDoom, Slammer and a few other nasties, if all you did was telnet to that port.)
Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- New Security News Website Pr0 Curve (Feb 16)
- Re: New Security News Website Gregory A. Gilliss (Feb 16)
- Re: New Security News Website Paul Schmehl (Feb 16)
- Re: New Security News Website Gregory A. Gilliss (Feb 16)
- Re: New Security News Website Valdis . Kletnieks (Feb 16)
- Re: New Security News Website Paul Schmehl (Feb 16)
- Re: New Security News Website Paul Schmehl (Feb 16)
- Re: New Security News Website Paul Schmehl (Feb 16)
- Re: New Security News Website g0d (Feb 16)
- Re: New Security News Website Benjamin Meade (Feb 16)
- Re: New Security News Website Ron DuFresne (Feb 16)
- Re: New Security News Website Paul Schmehl (Feb 17)
- Re: New Security News Website Gregory A. Gilliss (Feb 16)
- Re: New Security News Website Paul Schmehl (Feb 16)