Re: New Security News Website

[Paul Schmehl <pauls () utdallas edu>]

--On Monday, February 16, 2004 1:49 PM -0800 "Gregory A. Gilliss" 
<ggilliss () netpublishing com> wrote:

> You're kidding, right? Me thinks you *need* some hacker intel!

So you think a simple nmap scan is sufficient to determine if a host is 
insecure?  Interesting.

If you scanned my Windows XP boxes, you'd find a bunch of juicy ports open. 
What you wouldn't find is a hackable daemon.  All the open ports feed a 
program that captures the packets for analysis later.  The boxes are 
running no Internet-addressable services.  Yet, from an nmap scan you might 
(wrongly) assume that those boxes were grossly insecure.

This is the Internet.  Things are not always what they seem.  And open 
ports don't always mean negligence.

For example:

bash-2.05b# telnet www.hackerintel.com 113
Trying 216.92.170.7...
Connected to hackerintel.com.
Escape character is '^]'.
Connection closed by foreign host.
bash-2.05b# telnet www.hackerintel.com 543
Trying 216.92.170.7...
Connected to hackerintel.com.
Escape character is '^]'.
Connection closed by foreign host.
bash-2.05b# telnet www.hackerintel.com 544
Trying 216.92.170.7...
Connected to hackerintel.com.
Escape character is '^]'.
Connection closed by foreign host.

Looks suspiciously like tcpwrappers to me.

And just because you *can* get a login prompt or banner on a particular 
port, *even if* it appears to be a "normal" service for that port,  does 
not necessarily mean you are addressing that actual service.  (The program 
I refer to would make you *think* you were talking to a compromised machine 
running NetBus, for example - as well as MyDoom, Slammer and a few other 
nasties, if all you did was telnet to that port.)

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html