News Group Posts

security exploits hacker hacked

These security scans can be good, but they have to be tempered with common sense and knowledge of the systems involved.

I had a customer who used one of these security analysis firms and got an urgent warning one morning about a "critical" vulnerability. I forget the details now, but let's say it involved PHP. My customer called me demanding that something be done to "fix" this immediately.

Sure. One small problem though: they weren't using any PHP anywhere. There was nothing to fix.

The security firm was just warning her about anything and everything, whether it involved her systems or not. You can get that kind of information on-line for free!

From: Jeff Liebermann <jeffl@comix.santa-cruz.ca.us>
Newsgroups: comp.unix.sco.misc
Subject: Re: Sequential Port allocation Problem
Date: Sat, 17 Jun 2000 10:03:09 -0700
Message-ID: <tg7nks8mdfi6joalbppcc3u20ic20h49ot@4ax.com> 

On Fri, 16 Jun 2000 18:40:24 -0400, Darrell Tschakert
<dtschake@erols.com> wrote:

>The company doing the security check (Not Audit) is Booz Allen
>Hamilton.  They used a program called CyberCop to create a list
>of security risks found on our WAN/LAN.

CyberCop Scanner 5.50 is a security tool by Network Associates Inc,
the people that also sell McAffee virus scanners.
  http://www.pgp.com/asp_set/products/tns/cybercop_intrusion.asp
  http://www.pgp.com/asp_set/products/tns/ccscanner_features.asp
$102 per user.

>This check is designed to test if a host will spawn it's listening
>ports in sequential order.  If this is the case attackers can
>implement host spooling techniques to services which poll other
>hosts for authentication.
>  Examples of such services, would be for instance, any service which
>  requires authentication from DNS servers."

The above is a quote from:
  http://www.nai.com/media/doc/anti_virus/covert/RPC_Services.doc

Not very clear but a good clue as to what they were alluding to.
Somewhat more specific is:

http://www.nai.com/media/doc/anti_virus/covert/FTP_Vulnerabilities.doc
FTP - ports opened in sequential order
The FTP server on the target host was found to open bound ports,
utilized by the PASV feature, in sequential order. By opening ports in
sequential order, it is easy for an attacker to predict the next port
that the FTP service will use, and then connect to this port,
retrieving another user's file.

The detailed explanation of this exploit is at:
  http://www.nai.com/nai_labs/asp_set/advisory/ftp-paper.asp

>So how does that sound?  Does it make things any more clear?

Sounds like a real problem.  Exploitation is largely dependent upon
the effectiveness and configuration of your firewall.  If you're
running anonymous ftp, there's gonna be a problem.  Please note that
to be effective, the attacker must have a valid username and password
to open the anticipated connection.  Therefore, the exploit is
restricted to authorized users.

There's nothing I can do without source code.  Actually, I'm a lousy
programmer, so even source code won't do me any good.  I suggest you
send email to the SCO security people:
        http://stage.sco.com/support/security/
and imply that you'll defenestrate their product unless they drop
everything and fix this problem immediately.

Hmmm.  I just noticed, among the unreadable italic type, that SSE37b
for 3.2v5.0.5 was recently re-released.
        ftp://stage.sco.com/SSE/sse037b.ltr
        ftp://stage.sco.com/SSE/sse037.tar.Z

>I have
>an idea that most of what we got from BAH is boiler plate
>material from a program named CyberCop.

Well, there's only so much NAI can throw into the security scanner.
If it belched prolific prose and technobabble, methinks you might
complain that it was confusing.

>One of the things that
>CyberCop claimed was that we had IP Forwarding turned on in
>all of our machines.  The file that determines whether or not we
>have IP Forwarding definitely said that it was not on.  None of our
>machines are gateways and would have no place to pass the IP's.
>CyberCop said "Turn Off IP-Forwarding".  Still, the above quote
>seems to be written with a certain amount confidence.  Any Ideas?

Nope.  It takes to ports to do IP forwarding (a NIC and a modem with
PPP will work).  Basically, IP forwarding forms the basic function of
a bridge or possibly a router.  If you have no internal gateways,
Cybercop probably parked itself on two network segments and looked for
duplaced bridged packets, the smoking gun of IP forwarding.  However,
duplicated packets can also be generated by a misconfigured
multi-homed NIC interface (an ethernet interface card with two IP
addresses).  An overlapping netmask between the two IP's will do the
trick.  Every packet that comes from one IP will also spew from the
other if improperly configured.  In extreme cases, every packet on the
entire network will appear twice, once with each of the two IP
addresses as the source.  Without knowing what criteria CyberCop is
using for detecting forwarding, the aformentioned is pure guesswork.

Drivel:  If you're going to send me "courtesy copies" of your
postings, please indicate somewhere that the message was also posted.


-- 
Jeff Liebermann   jeffl@comix.santa-cruz.ca.us
150 Felker St #D  Santa Cruz CA  95060
831-421-6491 pager   831-429-1240 fax
http://www.cruzio.com/~jeffl/sco/   SCO stuff

Comments?

More Articles by Tony Lawrence

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.