RE: nmap reveals trinoo_master on router

["Dario Ciccarone (dciccaro)" <dciccaro () cisco com>]

Hi there:

        It is always useful to attach the output of a "show tech" from
the router under test, and also the command line used while invoking
nmap :)

        I would recommend for you to go and read the nmap documentation
- specifically, the "Port scanning basics" section - available at
http://insecure.org/nmap/man/man-port-scanning-basics.html. And quoting
from said documentation:

filtered

    Nmap cannot determine whether the port is open because packet
filtering prevents its probes from reaching the port. The filtering
could be from a dedicated firewall device, router rules, or host-based
firewall software. These ports frustrate attackers because they provide
so little information. Sometimes they respond with ICMP error messages
such as type 3 code 13 (destination unreachable: communication
administratively prohibited), but filters that simply drop probes
without responding are far more common. This forces Nmap to retry
several times just in case the probe was dropped due to network
congestion rather than filtering. This slows down the scan dramatically.

        So what nmap is trying to tell you is that, when probing those
ports, it got either an ICMP unreachable or nothing at all - ie, instead
of getting a SYN+ACK (if the port was open) or a RST (if the port wasn't
listening - actuall, if no process was listening on that port)

        The reason for those ports showing up as 'filtered' is because
you have an ACL applied to the external, Internet facing interface on
the router - probably blocking those specific ports.

        You also talk about a PIX firewall behind the router - as we
don't know your setup, we have no idea if the router is forwarding all
traffic to the firewall, if the router is doing NAT/PAT, etc.

        Thanks,
        Dario

 

> -----Original Message-----
> From: listbounce () securityfocus com 
> [mailto:listbounce () securityfocus com] On Behalf Of fahimdxb () gmail com
> Sent: Wednesday, October 18, 2006 7:36 AM
> To: incidents () securityfocus com
> Subject: nmap reveals trinoo_master on router
>
> On my Cisco Router, I do a nmap scan from outside on the 
> Internet. The result is:
>
> " Interesting ports on *.*.50.1:
>
> Not shown: 1676 closed ports
> PORT      STATE    SERVICE
> 23/tcp    filtered telnet
> 135/tcp   filtered msrpc
> 1524/tcp  filtered ingreslock
> 27665/tcp filtered Trinoo_Master
>
> I am worried about the last two entries. The last nmap was 
> done in Feb this year and I have confirmed that the two port 
> entries (tcp 1524/27665) did not exist then.
> Though the port state "filtered" is a solace but I am still 
> concerned. How can I be sure that the system has not been compromised?
>
> Also the current IOS Version of my Router 2811 is 12.4. It 
> was the same case with open ports when I was using older 
> Router Series 1700 v 12.2, so I thought maybe, it's an IOS 
> issue and I upgraded my Router to 2811 with IOS v 12.4 
> yesterday. But as soon as I plugged it into the circuit and 
> did a re-scan, I realised the nmap again gives the 
> trinoo_master entry with state as filtered.
>
> Where could lie the problem. Is it with my firewall (PIX 515) 
> configuration behind the router?
> Please Advise!!
>
> I have seen Cisco's tech doc that exists here:
> http://www.cisco.com/en/US/partner/tech/tk59/technologies_whit
> e_paper09186a0080174a5b.shtml
>
> One of the solutions suggested therein is to implement "ip 
> verify unicast reverse-path" on the serial interface, but am 
> not sure what will it serve? Also, I suspect that I had other 
> problems when I gave this command so I reversed it.
>
> "sh process cpu" only shows cpu utilisation of about 5-6%.
> Please advise!!
>
> --------------------------------------------------------------
> ----------------
> This List Sponsored by: Black Hat
>
> Attend the Black Hat Briefings & Training USA, July 29-August 
> 3 in Las Vegas. 
> World renowned security experts reveal tomorrow's threats 
> today. Free of 
> vendor pitches, the Briefings are designed to be pragmatic 
> regardless of your 
> security environment. Featuring 36 hands-on training courses 
> and 10 conference 
> tracks, networking opportunities with over 2,500 delegates 
> from 40+ nations. 
>
> http://www.blackhat.com
> --------------------------------------------------------------
> ----------------

------------------------------------------------------------------------------
This List Sponsored by: Black Hat

Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas.
World renowned security experts reveal tomorrow's threats today. Free of
vendor pitches, the Briefings are designed to be pragmatic regardless of your
security environment. Featuring 36 hands-on training courses and 10 conference
tracks, networking opportunities with over 2,500 delegates from 40+ nations.

http://www.blackhat.com
------------------------------------------------------------------------------