| What is
nmap and what can it do?
(This was taken from a report done by the Shadow Intrusion
Detection team and released to
the public domain by NSWC Dahlgren - Author John Green)
Summary
Nmap was the source of strange new scan patterns started
being detected by the SHADOW ID Systems located throughout the Internet.
The reported traffic varies from incident to incident.
However, it can generally be categorized into two distinct groups.
The first group is denoted as the "random scan" category.
This scan’s signature is characterized by SYN packets sent to apparently
random destination (or service) ports over some discreet range of values.
At the end of these scans we typically see several packets to high numbered
tcp and udp ports, followed by a small number of packets to a common destination
port. (See Figure 1)
The second class of traffic is called (for the lack of
a better term) "exploits plus". Although the signature of these probes
can vary with respect to the service ports accessed, the basic characteristics
closely resemble the random scan discussed above. The primary difference
is the exclusion of random destination ports in favor of well-known (and
highly exploited) service ports. (See Figure 4)
Details, Details… The "Random
Scan"
Let’s take a closer look at a real-life example from the
"random scan" category. This sanitized excerpt was taken
from an actual incident report that was filed by the Army Research Laboratory
– Adelphi Md.
Timestamp Source >
Destination Flag Sequence Numbers Window size
18:42:25.241999 hostile.org.42558 >
victim.mil.688: S 3596953827:3596953827(0) win 4096
18:42:25.251999 hostile.org.42558 >
victim.mil.451: S 3596953827:3596953827(0) win 4096
18:42:25.481999 hostile.org.42558 >
victim.mil.185: S 3596953827:3596953827(0) win 4096
18:42:25.491999 hostile.org.42558 >
victim.mil.41: S 3596953827:3596953827(0) win 4096
18:42:25.651999 hostile.org.42558 >
victim.mil.721: S 3596953827:3596953827(0) win 4096
18:42:25.661999 hostile.org.42558 >
victim.mil.122: S 3596953827:3596953827(0) win 4096
18:42:25.681999 hostile.org.42558 >
victim.mil.883: S 3596953827:3596953827(0) win 4096
18:42:25.681999 hostile.org.42558 >
victim.mil.567: S 3596953827:3596953827(0) win 4096
18:42:25.731999 hostile.org.42558 >
victim.mil.331: S 3596953827:3596953827(0) win 4096
18:42:25.731999 hostile.org.42558 >
victim.mil.880: S 3596953827:3596953827(0) win 4096
18:42:25.731999 hostile.org.42558 >
victim.mil.752: S 3596953827:3596953827(0) win 4096
18:42:25.741999 hostile.org.42558 >
victim.mil.358: S 3596953827:3596953827(0) win 4096
18:42:25.741999 hostile.org.42558 >
victim.mil.957: S 3596953827:3596953827(0) win 4096
18:42:25.751999 hostile.org.42558 >
victim.mil.206: S 3596953827:3596953827(0) win 4096
18:42:25.751999 hostile.org.42558 >
victim.mil.248: S 3596953827:3596953827(0) win 4096
18:42:25.761999 hostile.org.42558 >
victim.mil.208: S 3596953827:3596953827(0) win 4096
18:42:25.771999 hostile.org.42558 >
victim.mil.300: S 3596953827:3596953827(0) win 4096
18:42:25.791999 hostile.org.42558 >
victim.mil.999: S 3596953827:3596953827(0) win 4096
18:42:25.951999 hostile.org.42558 >
victim.mil.354: S 3596953827:3596953827(0) win 4096
18:42:25.951999 hostile.org.42558 >
victim.mil.376: S 3596953827:3596953827(0) win 4096
18:42:25.951999 hostile.org.42558 >
victim.mil.618: S 3596953827:3596953827(0) win 4096
18:42:25.881999 hostile.org.42558 >
victim.mil.24: S 3596953827:3596953827(0) win 4096
18:42:26.151999 hostile.org.42558 >
victim.mil.741: S 3596953827:3596953827(0) win 4096
18:42:26.151999 hostile.org.42558 >
victim.mil.165: S 3596953827:3596953827(0) win 4096
18:42:26.151999 hostile.org.42567 >
victim.mil.13: SFP 1769772146:1769772146(0) win 4096 urg 0
18:42:26.151999 hostile.org.42558 >
victim.mil.33119: udp 300
18:42:26.151999 hostile.org.42558 >
victim.mil.33119: udp 300
18:42:26.171999 hostile.org.42564 >
victim.mil.13: S 1884246333:1884246333(0) win 4096
18:42:26.171999 hostile.org.42563 >
victim.mil.13: S 1884246332:1884246332(0) win 4096
18:42:26.171999 hostile.org.42562 >
victim.mil.13: S 1884246331:1884246331(0) win 4096
18:42:26.221999 hostile.org.42561 >
victim.mil.13: S 1884246330:1884246330(0) win 4096
18:42:26.221999 hostile.org.42560 >
victim.mil.13: S 1884246329:1884246329(0) win 4096
(Figure 1. Example "Random Scan")
Author’s note: The traffic examples throughout this
paper have been beautified in an attempt to isolate the signatures created
by nmap. Therefore, the packets sent by nmap have been retained, while
responses from the victim hosts have been removed. In addition, responses
from the hostile system (i.e. RSTs sent in response to SYN/ACKs from the
victim) have also been removed for the sake of signature clarity.
A quick analysis of the traffic can yield some important
clues that can helpful in determining what might have caused it. For example,
the timestamp fields of this scan reveal that it was automated. This also
indicates that the host "victim.mil" was not part of a larger parallel
scan by "hostile.org". A review of the ports used in this scan show a fixed
source port of 42558 with some minor deviations at the end. The destination
ports that were accessed seem to have a random distribution, again, showing
some variation at the end of the activity. The variation is comprised of
a packet with the SYN/FIN/PUSH flags set, followed by udp datagrams destined
for high-numbered ports. The scan concludes by sending several more SYN
packets to a fixed destination port (in this case, port 13).
A New Version of Nmap
The prominent features of the scan discussed in the previous
section indicate an automated process for constructing packets and scanning
a target host with them. We can infer from the widespread incident reporting
that the agent is a tool that is readily available to the hacker community.
The obvious way to begin testing this theory is by looking
for scan tools that produce a similar signature. The question is "What
is the tool and what exactly is it doing?" A search of the exploit archives
reveals a release of "Nmap V2.02" in late December of 1998. The next step
in the discovery process is to use nmap to perform a test on a limited
number of ports for a particular machine. Given the appropriate set of
arguments, the resulting pattern (Figure 2, below) correlates beautifully
with the real scan seen in Figure 1.
Timestamp Source
Destination Flag Sequence Numbers Window size
01:41:25.180240 nmap.mil.54548 >
victim.mil.24: S 1301162276:1301162276(0) win 1024
01:41:25.180274 nmap.mil.54548 >
victim.mil.12: S 1301162276:1301162276(0) win 1024
01:41:25.180305 nmap.mil.54548 >
victim.mil.1: S 1301162276:1301162276(0) win 1024
01:41:25.180336 nmap.mil.54548 >
victim.mil.25: S 1301162276:1301162276(0) win 1024
01:41:25.180380 nmap.mil.54548 >
victim.mil.11: S 1301162276:1301162276(0) win 1024
01:41:25.180411 nmap.mil.54548 >
victim.mil.10: S 1301162276:1301162276(0) win 1024
01:41:25.180455 nmap.mil.54548 >
victim.mil.16: S 1301162276:1301162276(0) win 1024
01:41:25.180499 nmap.mil.54548 >
victim.mil.4: S 1301162276:1301162276(0) win 1024
01:41:25.180942 nmap.mil.54548 >
victim.mil.21: S 1301162276:1301162276(0) win 1024
01:41:25.180977 nmap.mil.54548 >
victim.mil.6: S 1301162276:1301162276(0) win 1024
01:41:25.181007 nmap.mil.54548 >
victim.mil.7: S 1301162276:1301162276(0) win 1024
01:41:25.183345 nmap.mil.54548 >
victim.mil.17: S 1301162276:1301162276(0) win 1024
01:41:25.183375 nmap.mil.54548 >
victim.mil.15: S 1301162276:1301162276(0) win 1024
01:41:25.183420 nmap.mil.54548 >
victim.mil.23: S 1301162276:1301162276(0) win 1024
01:41:25.183461 nmap.mil.54548 >
victim.mil.3: S 1301162276:1301162276(0) win 1024
01:41:25.183834 nmap.mil.54548 >
victim.mil.8: S 1301162276:1301162276(0) win 1024
01:41:25.183867 nmap.mil.54548 >
victim.mil.20: S 1301162276:1301162276(0) win 1024
01:41:25.184060 nmap.mil.54548 >
victim.mil.18: S 1301162276:1301162276(0) win 1024
01:41:25.184091 nmap.mil.54548 >
victim.mil.22: S 1301162276:1301162276(0) win 1024
01:41:25.184122 nmap.mil.54548 >
victim.mil.19: S 1301162276:1301162276(0) win 1024
01:41:25.184165 nmap.mil.54548 >
victim.mil.9: S 1301162276:1301162276(0) win 1024
01:41:25.184195 nmap.mil.54548 >
victim.mil.5: S 1301162276:1301162276(0) win 1024
01:41:25.184239 nmap.mil.54548 >
victim.mil.13: S 1301162276:1301162276(0) win 1024
01:41:25.184281 nmap.mil.54548 >
victim.mil.2: S 1301162276:1301162276(0) win 1024
01:41:25.184324 nmap.mil.54548 >
victim.mil.14: S 1301162276:1301162276(0) win 1024
01:41:25.187237 nmap.mil.54555 >
victim.mil.1: S 1815095948:1815095948(0) win 1024
01:41:25.187310 nmap.mil.54557 >
victim.mil.1: SFP 1815095948:1815095948(0) win 1024
01:41:25.187388 nmap.mil.54559 >
victim.mil.40289: S 1815095948:1815095948(0) win 1024
01:41:25.188223 nmap.mil.54548 >
victim.mil.40289: udp 300
01:41:25.402977 nmap.mil.54549 >
victim.mil.1: S 1815095949:1815095949(0) win 1024
01:41:25.413377 nmap.mil.54550 >
victim.mil.1: S 1815095950:1815095950(0) win 1024
01:41:25.433429 nmap.mil.54551 >
victim.mil.1: S 1815095951:1815095951(0) win 1024
01:41:25.453555 nmap.mil.54552 >
victim.mil.1: S 1815095952:1815095952(0) win 1024
01:41:25.473427 nmap.mil.54553 >
victim.mil.1: S 1815095953:1815095953(0) win 1024
01:41:25.493411 nmap.mil.54554 >
victim.mil.1: S 1815095954:1815095954(0) win 1024
(Figure 2. Tcpdump output of nmap test run)
As indicated above, only the correct set of arguments
produces this signature. In an effort to answer the question "What’s going
on here?", I will explain the pertinent arguments used to generate this
signature. Of course, other command line arguments will produce varied,
and in some cases, completely different signatures.
commandline_prompt> ./nmap –v –sS –P0 –O –p1-25 victim.mil
The –sS argument tells nmap to use a SYN half-open stealth
scan. The –P0 argument tells nmap not to ping the destination host. Perhaps
the most crucial argument in this example is the –O option. This activates
the TCP/IP fingerprinting routines that try to guess what operating system
and version the victim host is running. This operating system identification
is responsible for the strange (even by nmap standards) signature at the
end of the scan. Finally the –p1-25 tells nmap to use destination ports
one though twenty-five.
Nmap provides a surprising amount of information (using
–v for verbose) about the targeted host. Below are the results from the
test run of nmap seen in figure 2.
Starting nmap V. 2.02 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)
Initiating SYN half-open stealth scan against victim.mil (xxx.xxx.xxx.xxx)
Adding TCP port 9 (state Open).
Adding TCP port 1 (state Open).
Adding TCP port 7 (state Open).
Adding TCP port 21 (state Open).
Adding TCP port 22 (state Open).
Adding TCP port 25 (state Open).
Adding TCP port 19 (state Open).
Adding TCP port 13 (state Open).
Adding TCP port 23 (state Open).
The SYN scan took 0 seconds to scan 25 ports.
For OSScan assuming that port 1 is open and port 35401
is closed and neither are firewalled
Interesting ports on victim.mil (xxx.xxx.xxx.xxx):
Port State Protocol Service
1 open tcp tcpmux
7 open tcp echo
9 open tcp discard
13 open tcp daytime
19 open tcp chargen
21 open tcp ftp
22 open tcp unknown
23 open tcp telnet
25 open tcp smtp
TCP Sequence Prediction: Class=64K rule
Difficulty=1 (Trivial joke)
Sequence numbers: 584D7800 584E7200 584F6C00 58506600
58516000 58525A00
Remote operating system guess: IRIX 6.2 - 6.5
OS Fingerprint:
TSeq(Class=64K)
T1(Resp=Y%DF=N%W=EF2A%ACK=S++%Flags=AS%Ops=MNWNNT)
T2(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=N%W=EF2A%ACK=O%Flags=A%Ops=NNT)
T4(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=
148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
Nmap run completed -- 1 IP address (1 host up)
scanned in 0 seconds
(Figure 3. Nmap output)
The output of a Nmap scan provides crucial information
to the hacker. First, it provides a list of services that are active on
the remote host. Second, by sending invalid tcp packets, nmap performs
a TCP stack analysis of the remote system. Since these anomalous packets
are not covered by the RFCs, each operating system handles them differently.
Nmap compares the responses to these packets against an internal database
and provides a ‘best guess’ as to the operating system and version number
running there. This combination allows the hacker to target the specific
vulnerabilities on a given host, providing a higher success rate and a
much lower attack signature. Finally, Nmap tells the user how difficult
tcp sequence number prediction is for the remote host. This information
can be used to target hosts that have a high potential for session hijacking.
Such measures might be employed when a remote system has no vulnerable
services running, or when it is shielded behind a firewall.
Details, Details… The
"Exploits Plus Scan"
As mentioned earlier SHADOW sensors have detected another
scan that appears to be a variation of the random scan detailed above.
This scan probes commonly exploited service ports and concludes with the
signature of the fingerprinting process. Figure 4 is also a sanitized
excerpt from a real incident reported by the SHADOW Team at NSWC, Dahlgren.
Timestamp Source >
Destination Flag Sequence Numbers Window size
01:07:37.870000 hostile.org.23035 >
victim.mil.12345: S 2443641632:2443641632(0) win 512
01:07:37.870000 hostile.org.23053 >
victim.mil.143: S 1849709624:1849709624(0) win 512
01:07:37.870000 hostile.org.23112 >
victim.mil.635: S 1979681472:1979681472(0) win 512
01:07:37.880000 hostile.org.23174 >
victim.mil.53: S 2831594802:2831594802(0) win 512
01:07:37.880000 hostile.org.23225 >
victim.mil.31337: S 200714632:200714632(0) win 512
01:07:38.160000 hostile.org.23243 >
victim.mil.143: S 4224441585:4224441585(0) win 512
01:07:38.160000 hostile.org.23302 >
victim.mil.635: S 3131164300:3131164300(0) win 512
01:07:38.160000 hostile.org.23353 >
victim.mil.53: S 27440843:27440843(0) win 512
01:07:38.460000 hostile.org.23366 >
victim.mil.143: S 2018442450:2018442450(0) win 512
01:07:38.460000 hostile.org.23417 >
victim.mil.635: S 3598088389:3598088389(0) win 512
01:07:38.460000 hostile.org.23430 >
victim.mil.53: S 3603076159:3603076159(0) win 512
01:07:38.790000 hostile.org.23479 >
victim.mil.53: S 942548711:942548711(0) win 512
01:07:38.790000 hostile.org.23497 >
victim.mil.635: S 1558966803:1558966803(0) win 512
01:07:38.800000 hostile.org.23559 >
victim.mil.143: S 1627652454:1627652454(0) win 512
01:07:39.090000 hostile.org.23608 >
victim.mil.53: S 2308481275:2308481275(0) win 512
01:07:39.090000 hostile.org.23610 >
victim.mil.635: S 375730554:375730554(0) win 512
01:07:39.090000 hostile.org.23614 >
victim.mil.143: S 2363444754:2363444754(0) win 512
01:07:39.390000 hostile.org.23623 >
victim.mil.53: S 2983142263:2983142263(0) win 512
01:07:39.390000 hostile.org.23672 >
victim.mil.635: S 2931404189:2931404189(0) win 512
01:07:39.390000 hostile.org.23674 >
victim.mil.143: S 30889188:30889188(0) win 512
01:07:39.720000 hostile.org.35959 >
victim.mil.42721: S 2995015889:2995015889(0) win 4096
01:07:39.730000 hostile.org.35961 >
victim.mil.42721: FP 2995015889:2995015889(0) win 4096 urg 0
01:07:39.730000 hostile.org.35948 >
victim.mil.42721: udp 300
01:07:40.150000 hostile.org.35948 >
victim.mil.42721: udp 300
01:07:42.590000 hostile.org.35959 >
victim.mil.33621: S 495516404:495516404(0) win 4096
01:07:42.590000 hostile.org.35961 >
victim.mil.33621: FP 495516404:495516404(0) win 4096 urg 0
01:07:42.600000 hostile.org.35948 >
victim.mil.33621: udp 300
01:07:43.060000 hostile.org.35948 >
victim.mil.33621: udp 300
01:07:45.340000 hostile.org.35959 >
victim.mil.41663: S 1550032560:1550032560(0) win 4096
01:07:45.340000 hostile.org.35961 >
victim.mil.41663: FP 1550032560:1550032560(0) win 4096 urg 0
01:07:45.350000 hostile.org.35948 >
victim.mil.41663: udp 300
01:07:45.910000 hostile.org.35948 >
victim.mil.41663: udp 300
(Figure 4. Example "Exploits Plus" Scan)
At first glance, this attack bears only a minor semblance
to the random scan activity. Examining the pertinent features of this probe,
one might notice several distinctions. First, exploits plus employs random
(within a range) source ports. Second, as its name implies, this scan focuses
on service ports with well-known vulnerabilities. Third, the sequence numbers
appear more realistic, as compared to those in the random scan. Finally,
the end of the scan appears to be three separate OS fingerprinting attempts.
One might be inclined to think that this is the result
of a second tool. However, by coding a simple shell script with multiple
calls to nmap, this signature can be easily duplicated as shown in the
following script:
#!/bin/sh
nmap –v -sS -P0 -p12345 victim.mil & # SYN half-open stealth probe for netbus
nmap –v -sS -P0 -p143 victim.mil & # SYN half-open stealth probe for imap
nmap –v -sS -P0 -p635 victim.mil & # SYN half-open stealth probe for linux mountd
nmap –v -sS -P0 -p53 victim.mil & # SYN half-open stealth probe for domain
nmap –v -sS -P0 -p31337 victim.mil & # SYN half-open stealth probe for back orifice
nmap –v -sS -P0 -p143 victim.mil &
nmap –v -sS -P0 -p635 victim.mil &
nmap –v -sS -P0 -p53 victim.mil &
nmap –v -sS -P0 -p143 victim.mil &
nmap –v -sS -P0 -p635 victim.mil &
nmap –v -sS -P0 -p53 victim.mil &
nmap –v -sS -P0 -p53 victim.mil &
nmap –v -sS -P0 -p635 victim.mil &
nmap –v -sS -P0 -p143 victim.mil &
nmap –v -sS -P0 -p53 victim.mil &
nmap –v -sS -P0 -p635 victim.mil &
nmap –v -sS -P0 -O -p143 victim.mil & # S h-o probe for imap PLUS OS fingerprinting
When this script is run, tcpdump shows the resulting network
traffic. This matches the detected probe.
Timestamp Source
Destination Flag Sequence Numbers Window size
03:50:28.255696 nmap.mil.58893 >
victim.mil.12345: S 3529719230:3529719230(0) win 4096
03:50:28.255696 nmap.mil.45313 >
victim.mil.635: S 1289452862:1289452862(0) win 4096
03:50:28.255696 nmap.mil.40444 >
victim.mil.143: S 1053163340:1053163340(0) win 4096
03:50:28.265696 nmap.mil.37458 >
victim.mil.53: S 2174813682:2174813682(0) win 4096
03:50:28.285696 nmap.mil.45830 >
victim.mil.143: S 1208327640:1208327640(0) win 4096
03:50:28.295696 nmap.mil.46840 >
victim.mil.53: S 2484113855:2484113855(0) win 4096
03:50:28.295696 nmap.mil.33736 >
victim.mil.31337: S 3316743593:3316743593(0) win 4096
03:50:28.305696 nmap.mil.43105 >
victim.mil.143: S 2743618682:2743618682(0) win 4096
03:50:28.315696 nmap.mil.42914 >
victim.mil.635: S 2564506522:2564506522(0) win 4096
03:50:28.335696 nmap.mil.43127 >
victim.mil.635: S 2522641932:2522641932(0) win 4096
03:50:28.345696 nmap.mil.45102 >
victim.mil.53: S 2127702081:2127702081(0) win 4096
03:50:28.375696 nmap.mil.54256 >
victim.mil.53: S 3126700193:3126700193(0) win 4096
03:50:28.375696 nmap.mil.42342 >
victim.mil.635: S 3932342401:3932342401(0) win 4096
03:50:28.395696 nmap.mil.60042 >
victim.mil.143: S 1863130126:1863130126(0) win 4096
03:50:28.415696 nmap.mil.53612 >
victim.mil.53: S 3665870250:3665870250(0) win 4096
03:50:28.425696 nmap.mil.44699 >
victim.mil.635: S 1882012961:1882012961(0) win 4096
03:50:28.465696 nmap.mil.63497 >
victim.mil.143: S 2634475111:2634475111(0) win 4096
03:50:28.465696 nmap.mil.63508 >
victim.mil.31576: S 3872554032:3872554032(0) win 4096
03:50:28.465696 nmap.mil.63510 >
victim.mil.31576: FP 3872554032:3872554032(0) win 4096
urg 0 03:50:28.465696 nmap.mil.63497 > victim.mil.31576: udp 300
03:50:30.685696 nmap.mil.63508 >
victim.mil.31181: S 229752757:229752757(0) win 4096
03:50:30.685696 nmap.mil.63510 >
victim.mil.31181: FP 229752757:229752757(0) win 4096
urg 0 03:50:30.685696 nmap.mil.63497 > victim.mil.31181: udp 300
03:50:32.905696 nmap.mil.63508 >
victim.mil.30523: S 1585272933:1585272933(0) win 4096
03:50:32.905696 nmap.mil.63510 >
victim.mil.30523: FP 1585272933:1585272933(0) win 4096
urg 0 03:50:32.905696 nmap.mil.63497 > victim.mil.30523: udp 300
(Figure 5. Tcpdump output of the scripted nmap run)
A quick look at the output from the nmap script reveals
some interesting tidbits that help us to understand the resulting network
traffic. In the script, each call to nmap (except the last one) generates
a block of output as shown below:
Starting nmap V. 2.02 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)
Initiating SYN half-open stealth scan against victim.mil (xxx.xxx.xxx.xxx)
The SYN scan took 0 seconds to scan 1 ports.
No ports open for host victim.mil (xxx.xxx.xxx.xxx)
Nmap run completed -- 1 IP address (1 host up) scanned in 0 seconds
This tells us that none of the services that we are looking
for are running on this machine. In contrast, the output from the last
call to nmap produces the following output.
Starting nmap V. 2.02 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)
Initiating SYN half-open stealth scan against victim.mil (xxx.xxx.xxx.xxx)
The SYN scan took 0 seconds to scan 1 ports.
Warning: No ports found open on this machine,
OS detection will be MUCH less reliable
Warning: No ports found open on this machine,
OS detection will be MUCH less reliable
Warning: No ports found open on this machine,
OS detection will be MUCH less reliable
No ports open for host victim.mil (xxx.xxx.xxx.xxx)
No OS matches for this host. TCP fingerprints:
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=0%ACK=S%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=0%IPLEN=38%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
Nmap run completed -- 1 IP address (1 host up) scanned in 5 seconds
What we discover is that nmap is unable to find the specified
port open. It tries three times to find an open tcp/udp port for the purposes
of fingerprinting the operating system. This is the activity responsible
for the three fingerprinting signatures at the end of the scan. Finally
the fingerprinting attempt fails, reporting that it was unable to identify
the operating system.
If the host had been running the imap service on port
143, the signature of the scan would have been slightly different, as shown
below. For the sake of brevity, we will only show the output for a successful
fingerprint attempt.
04:49:24.845696 nmap.mil.47997 >
victim.mil.143: S 1746270164:1746270164(0) win 4096
04:49:24.845696 nmap.mil.48004 >
victim.mil.143: S 904899788:904899788(0) win 4096
04:49:24.845696 nmap.mil.48006 >
victim.mil.143: SFP 904899788:904899788(0) win 4096 urg 0
04:49:24.845696 nmap.mil.48008 >
victim.mil.34691: S 904899788:904899788(0) win 4096
04:49:24.845696 nmap.mil.48010 >
victim.mil.34691: FP 904899788:904899788(0) win 4096 urg 0
04:49:24.845696 nmap.mil.47997 >
victim.mil.34691: udp 300
04:49:25.095696 nmap.mil.47998 >
victim.mil.143: S 904899789:904899789(0) win 4096
04:49:25.115696 nmap.mil.47999 >
victim.mil.143: S 904899790:904899790(0) win 4096
04:49:25.135696 nmap.mil.48000 >
victim.mil.143: S 904899791:904899791(0) win 4096
04:49:25.155696 nmap.mil.48001 >
victim.mil.143: S 904899792:904899792(0) win 4096
04:49:25.175696 nmap.mil.48002 >
victim.mil.143: S 904899793:904899793(0) win 4096
04:49:25.195696 nmap.mil.48003 >
victim.mil.143: S 904899794:904899794(0) win 4096
In this case, the final output of the nmap script shows the
following:
Starting nmap V. 2.02 by Fyodor (fyodor@dhp.com, www.insecure.org/nmap/)
Initiating SYN half-open stealth scan against victim.mil (xxx.xxx.xxx.xxx)
Adding TCP port 143 (state Open).
The SYN scan took 0 seconds to scan 1 ports.
For OSScan assuming that port 143 is open and
port 32159 is closed and neither are firewalled
Interesting ports victim.mil (xxx.xxx.xxx.xxx):
Port State Protocol Service
143 open tcp imap
TCP Sequence Prediction: Class=truly random
Difficulty=9999999 (Good luck!)
Sequence numbers: 8EE8EDC6 6A9E9A8B DA6DB46D 5D9366 CFE64AAB 4822733B
Remote operating system guess: Linux 2.0.35-36
Nmap run completed -- 1 IP address (1 host up) scanned in 0 seconds
Conclusions
Nmap is a powerful tool that is capable of generating
a multitude of signatures depending on how it is used. However, if we understand
the operation of the tool in general, it is easier to recognize its overall
signature in network traffic. Dissecting the signature into sub-patterns
one can differentiate between fingerprinting attempts that were successful
and those that were not. It is important to understand that we have examined
only one of the scan types that nmap can perform, the SYN half-open stealth
scan. Several other scans are supported by Nmap: Tcp connect, FIN, Xmas,
NULL, udp, ping, and even ftp-bounce. Expect to see these in the near future!
The intelligence that can be garnered by using nmap is
extensive. It provides all the information that is needed for a well-informed,
full-fledged, precisely targeted assault on a network. Such an attack would
have a high probability of success, and would likely go unnoticed by organizations
that lack intrusion detection capabilities.
Advisory
Now that we understand what is causing the recently detected
traffic patterns, we should avoid becoming complacent. I’ve often heard
"That’s just a reset scan" or "It’s only a icmp mapping attempt, what’s
the harm?". Psychological operations, subterfuge, and decoy mechanisms
are both prevalent and effective modern warfare methods. Information warfare
is no different. The network analyst should always assume that there is
more to an incident than meets the eye.
SHADOW has some evidence that this might indeed be the
case in this latest round of scans. There are known overt organized efforts
underway to create a detailed database of all Internet hosts. Why shouldn’t
there be underground ones? Nmap provides many of the tools to make this
possible and fairly easy.
In the past the cost of storing such a map was prohibitive,
this is no longer an issue. Even moderately funded groups could undertake
such a venture, given the arrival of 40-gigabyte disk drives that cost
less than $2000.
In figure 4, I showed just a minute fraction of the scan
reported by the NSWC SHADOW team. The structure of the actual scan indicates
concurrent, cooperating processes. "Process 1" used the ping scan mode
of nmap to create a map of hosts that responded to the query from our class
B network. About half way through the ping mapping, another process started
scanning only the hosts that replied to the icmp query. This
implies that process 1 (the mapping process) was writing a file that process
2 (the scanning process) was reading, simultaneously. This falls under
the category of "slick time saving" techniques. So, in a matter of less
than ten minutes every machine that would respond to an icmp echo request
or tcp ping had been mapped and its operating system fingerprinted.
Many of the responding systems were infrastructure computers.
Since this class of computer is fairly static on any given network, hackers
are willing to sacrifice an ISP account in order to construct maps that
will likely be valid for a long time. These scans should be taken seriously,
and should be considered a strong indication and warning of future attacks.
There may still be skeptics who think that cost or storage
required to create such a map is insurmountable. Please take a moment to
consider the worst case scenario and "work through the numbers".
Let’s begin by determining how much disk space might be
required to store such a map using a non-optimal, brute force method. Ignoring
the fact that IANA has set aside "reserved address blocks", there are 2554
or
4,228,250,625 possible addresses. Each address is a 32-bit representation
that can be stored as an integer. So, storing every possible Internet address
would require 4 bytes (the integer representation) times the 4,228,250,625
possible addresses. This multiplication yields 16,913,002,500 bytes.
Assume that each of these hosts has an average of 10 tcp
and 10 udp services running and can be mapped. If we store these 20 services
as short integers (2 bytes each), then the amount of space required would
be 16,913,002,500 bytes times 20 services times 2 bytes or 676,520,100,000
bytes or 645.18 gigabytes. At 40 gigabytes per disk, it would take 645.18
gigabytes divided by 40 gigabytes per disk, or 17 disk drives. Seventeen
disk drives times $2000 dollars yields a final cost of $34,000. Presupposing
we had a $40,000 budget, this leaves $6000 dollars to buy 4 PCs to house
the hard disks.
John Green - Shadow Team Leader NSWC Dahlgren |