Re: analysis of auditable port scanning techniques

[Dan Harkless <dan-bugtraq () DILVISH SPEED NET>]

Guido Bakker <guidob () sentia nl> writes:
> 1.2.1 - reverse ident scanning
>
> This technique involves issuing a response to the ident/auth daemon,
> usually port 113 to query the service for the owner of the running
> process.  The main reason behind this is to find daemons running as root,
> obviously this result would entice an intruder to find a vulnerable
> overflow and instigate other suspicious activities involving this
> port. Alternatively, a daemon running as user nobody (httpd) may not be as
> attractive to a user because of limited access privileges. Unknowing to
> most users is that identd could release miscellaneous private information
> such as:
>
>  * user info
>  * entities
>  * objects
>  * processes
>
> Although the identification protocol would appear as an authentication
> mechanism, it was not designed or intended for this purpose. As the RFC
> states, "At best, it provides some additional auditing information with
> respect to TCP connections".  Needless to say, it should not be used as an
> access control service nor relied upon added host/username authenticity.
>
> The formal syntax taken from RFC 1413 reveals the following EBNF:
>
> FORMAL SYNTAX
>
>    <request> ::= <port-pair> <EOL>
>
>    <port-pair> ::= <integer> "," <integer>
>
>    <EOL> ::= "015 012"  ; CR-LF End of Line Indicator, octal \r\n
>                         ; equivalents
>
>    <integer> ::= 1*5<digit> ; 1-5 digits.
>
>
> Using this grammar applied to the data we send to an arbitrary host piped
> to the ident/auth port will reveal the process owner running on a given
> port, even though we initiated the connection.

Uh, no.  With properly-written ident daemons, such as pidentd, the dameon
will only respond for connections initiated on the machine on which it's
running, and with a destination of the machine querying the daemon.  Do you
have examples of ident daemons that don't enforce this?

> Notoriously, the SYN method was first used to avoid a well used IDS, named
> SATAN.

Eh?  SATAN was a security scanner, not an intrusion detection system...

----------------------------------------------------------------------
Dan Harkless                   | To prevent SPAM contamination, please
dan-bugtraq () dilvish speed net  | do not mention this private email
SpeedGate Communications, Inc. | address in Usenet posts.  Thank you.