full-disclosure - New Security News Website

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: pauls at utdallas.edu (Paul Schmehl)
Subject: New Security News Website

--On Monday, February 16, 2004 1:49 PM -0800 "Gregory A. Gilliss" 
<ggilliss@...publishing.com> wrote:

> You're kidding, right? Me thinks you *need* some hacker intel!

So you think a simple nmap scan is sufficient to determine if a host is 
insecure?  Interesting.

If you scanned my Windows XP boxes, you'd find a bunch of juicy ports open. 
What you wouldn't find is a hackable daemon.  All the open ports feed a 
program that captures the packets for analysis later.  The boxes are 
running no Internet-addressable services.  Yet, from an nmap scan you might 
(wrongly) assume that those boxes were grossly insecure.

This is the Internet.  Things are not always what they seem.  And open 
ports don't always mean negligence.

For example:

bash-2.05b# telnet www.hackerintel.com 113
Trying 216.92.170.7...
Connected to hackerintel.com.
Escape character is '^]'.
Connection closed by foreign host.
bash-2.05b# telnet www.hackerintel.com 543
Trying 216.92.170.7...
Connected to hackerintel.com.
Escape character is '^]'.
Connection closed by foreign host.
bash-2.05b# telnet www.hackerintel.com 544
Trying 216.92.170.7...
Connected to hackerintel.com.
Escape character is '^]'.
Connection closed by foreign host.

Looks suspiciously like tcpwrappers to me.

And just because you *can* get a login prompt or banner on a particular 
port, *even if* it appears to be a "normal" service for that port,  does 
not necessarily mean you are addressing that actual service.  (The program 
I refer to would make you *think* you were talking to a compromised machine 
running NetBus, for example - as well as MyDoom, Slammer and a few other 
nasties, if all you did was telnet to that port.)

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu