Re: RIM Devices not detected as blackberry

[David Fifield <david () bamsoftware com>]

On Sat, Oct 22, 2011 at 03:07:35PM +0100, Knightmare wrote:
> Hey Guys,
>
> I have recently been scanning various types of smart phone to see how OS
> detection compares.  When scanning a Blackberry Curve 8520 (
> http://uk.blackberry.com/devices/blackberrycurve8500/) which seems to be
> reporting as everything except s blackberry or smart phone device.
>
> The setup is as follows: 1 x DDWRT Linksys WRT54GL router using WPA2
> Blackberry out of the box with no changes on O2 UK connected via wireless
> setting
> laptop running ubuntu 10.04 LTS with nmap x86_64 compiled from SVN. revision
> r26922
> I used the command: sudo nmap -sV -O -T5 10.1.10.46
>
> The output from nmap -V is:
>
> Nmap version 5.61TEST2 ( http://nmap.org )
> Platform: x86_64-unknown-linux-gnu
> Compiled with: liblua-5.1.4 openssl-0.9.8k libpcre-7.8 libpcap-1.0.0
> nmap-libdnet-1.12 ipv6
> Compiled without:
>
> And the output from the scan is:
>
> Nmap scan report for 10.1.10.46
> Host is up (0.14s latency).
> Not shown: 988 closed ports
> PORT      STATE    SERVICE    VERSION
> 99/tcp    filtered metagram
> 987/tcp   filtered unknown
> 1060/tcp  filtered polestar
> 1236/tcp  filtered bvcontrol
> 1580/tcp  filtered tn-tl-r1
> 3052/tcp  filtered powerchute
> 3306/tcp  filtered mysql
> 3689/tcp  filtered rendezvous
> 4005/tcp  filtered pxc-pin
> 6969/tcp  filtered acmsoda
> 9080/tcp  filtered glrpc
> 40193/tcp filtered unknown
> MAC Address: 70:D4:F2:BA:BE:00 (RIM)
> Warning: OSScan results may be unreliable because we could not find at least
> 1 open and 1 closed port
> Aggressive OS guesses: XAVi Technologies X7721r+ DSL router (95%), Atcom
> AT-320 VoIP phone (91%), Bluebird SuperDOS (91%), Brother HL-5070N printer
> (91%), Brother MFC-7820N printer (91%), Brother MFC-9420CN printer (91%)
> No exact OS matches for host (test conditions non-ideal).
> Network Distance: 1 hop

This is because there is no open port. OS scan really needs an open port
to get any kind of accuracy; that's why a warning is printed.

Try scanning with -p1-65535 to scan more ports and see if one of them is
open.

Since you are scanning different types of phones, please contribute any
new or incorrect signatures you get to http://nmap.org/submit.

David Fifield
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/