Small Business Attack – Network Reconnaissance
Suppose an attacker gets into your network. Last week, we discussed a few tools that they might use to profile different systems, but we didn't look that deeply into network scanning. Once they've done some of the more-basic and subtle checks, they may go on to more active exploration. The advantage of more active exploration is that an attacker can identify all services on all systems in a very short period of time. The disadvantage, of course, is that they are more likely to be detected.
However, since this is an attack day, let's look at what the attacker can do here. Once they have control of a system, they can use namp to scan the system. Suppose you have an internal file server, other workstations and printers. In seconds, the attacker will have a list of all systems and what's running on them. For example, here is a (slightly altered) list of systems available from a wireless network.
# nmap 192.168.4.* Starting Nmap 4.75 ( http://nmap.org ) at 2009-09-04 14:01 CDT Interesting ports on 192.168.4.21: Not shown: 997 closed ports PORT STATE SERVICE 22/tcp open ssh 111/tcp open rpcbind 8654/tcp open unknown Interesting ports on 192.168.4.249: Not shown: 997 closed ports PORT STATE SERVICE 6006/tcp open X11:6 9220/tcp open unknown 16001/tcp open unknown MAC Address: 00:40:63:99:58:E2 (VIA Technologies) Interesting ports on 192.168.4.254: Not shown: 997 closed ports PORT STATE SERVICE 22/tcp open ssh 111/tcp open rpcbind 2000/tcp open callbook MAC Address: 00:B0:D0:C0:54:11 (Dell Computer) Nmap done: 256 IP addresses (5 hosts up) scanned in 12.61 seconds
So here, an attacker would know that 192.168.0.254 and 192.168.0.21 are running ssh, and therefore are likely Linux or Unix servers as well as the brands. For example, a Dell Computer that is running ssh may well be a server worth attacking (in this case, it's not... but it could be). So, in twelve seconds, the attacker will know exactly what to target. Sure, it's a noisy and noticeable way to profile a network, but if you don't notice the attack, it's well worth the risk.
But what can you do about it?
