[13404] in bugtraq
Re: usual iploggers miss some variable stealth scans
daemon@ATHENA.MIT.EDU (Simple Nomad)
Tue Jan 18 12:16:54 2000
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-Id: <Pine.LNX.4.10.10001172310060.1084-100000@blackhole.nmrc.org>
Date: Mon, 17 Jan 2000 23:22:27 -0600
Reply-To: Simple Nomad <thegnome@NMRC.ORG>
From: Simple Nomad <thegnome@NMRC.ORG>
X-To: bugtraq@securityfocus.com
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <Pine.LNX.4.10.10001172001170.498-100000@0zZurT.whitehouse.gov>
On Mon, 17 Jan 2000, vecna wrote:
> in November`99 more or less... i've discovered 5 type of new stealth scan,
> with the modification of flags used normally on XMAS stealth scan.
>
> the five type of packets that can be used for stealth scanning, and isn't
> logged from the normal tcplogd/scanlogger have this flag:
> URG
> PUSH
> URG+FIN
> PUSH+FIN
> URG+PUSH
>
> this flag on packet, such FIN, XMAS (fin+urg+psh), and NULL scan (no one
> flag set) cause the reply RST+ACK if port is closed, and no reply if
> port is open. this is efective only against *nix system
This and all other TCP stealth scans can be eliminated by modification to
most open source kernels. By adding code to the parts of the kernel that
handle TCP input, you can look to see if a packet is a part of an existing
conversation. If not, drop it (and perhaps log it). Allow the regular SYN
packets to be handled by other methods, such as TCP wrappers, firewall
code (ipfwadm, ipchains), etc.
This is basically taking advantage of a kernel's state table. Any open
source kernel that supports firewalling software should be capable of
handling this mod. The only real negative side effect I've noticed is
"push" technology gets blocked, so you get fewer web ads ;-)
- Simple Nomad - -
- thegnome@nmrc.org - No rest for the Wicca'd -
- www.nmrc.org - -
