[ Home ] [ Contact ] [ Staff Biographies ] [ Downloads ] [ Links ]

NOTE: This report is based on the format used by GIAC, the Global Incident Analysis Center.

1.    Source of Network Trace:

These network traces come from one of our client networks with their permission.

2.    Detect was Generated by:

Cisco routers produced this network trace as a result of a catchall rule that logs denied traffic:

access-list 100 deny ip any any log

3.    Probability the source address was spoofed:

Is the source address spoofed?  It is unlikely but we cannot prove it.  This type of reconnaissance requires a successful return of information, however, it is possible that the individuals performing this scan have control of an intermediary system and are looking for the responses as they pass back to a spoofed host.  If an intermediary system has been compromised, to be effective, it is probably on a network very close to 210.178.9.1.  

4.    Description of Attack:

What follows is a reconnaissance scan of the DMZ of two entry points in the company’s network done in such a way that the potential hacker is willing to wait for weeks for the complete results.

Log Format:

Date | Router Hostname | Log Entry # | Protocol | Source IP | (Source Port) | -> | Destination IP | (Destination Port) | # of packets  

Log Information:

Data from the Dallas Cisco log:

Here they are hitting Houston also:

In this example someone has probed the Dallas and Houston DMZ for systems that are running the portmapper service.  These probes are spaced over 8 hours per packet.  At this rate, a complete mapping of one class C network will take about 7 weeks.

Portmapper has many known exploits that will give a malicious attacker root access to the system.  One document describing such attacks is available from CERT at http://www.cert.org/advisories/CA-2000-17.html.

While portmapper is the intended destination port, these packets are sent from the source port of 53.  The probable intent is to get past the outside routers that may filter traffic but allow DNS queries from other DNS servers, which typically occurs on a source port of 53.  This probe failed on the designated DNS servers because router access rules allow traffic to the DNS servers only from a source and destination ports of 53.

The producers of these packets are hitting multiple network blocks at the same time from the same host IP address.  For instance, on Nov 5 9:10 Houston is probed from 210.178.9.1 to a destination IP address ending in .7.  The Dallas DMZ receives a probe within the same minute to the same ending IP address.

While this method appears slow, what they lack in reconnaissance speed on one network is compensated by the fact that they are hitting more than one network at a time. 

5.    Attack Mechanism:

This scan, had it not been blocked by the router, would have produced a return packet from all hosts.  Those that were running the portmapper service would have returned a SYN-ACK to try to complete the 3-way handshake.  Those that were not running portmapper would return a “connection refused” message.

6.    Correlations:

Sorting the logs by source IP address led to the discovery this network trace.  No other occurrences of this IP address, or nearby IP addresses, appear in any of the other logs of the firewalls and routers.

So who are they?  Using the “whois” service of ARIN.NET point to a very large Asian network block.  Information from APNIC.NET points to a network in the Republic of Korea.  The Korean “whois” server names an elementary school.  I have sent some email to the administrator at this site to try and get this system looked at.

I tried contacting the administrators of the netblocks on either sides of our network in an attempt to verify that we were chosen solely by our IP address space.  Unfortunately, as of this writing I have had no response from them.  It would be nice to confirm that this scan of our address space is a random choice.

Traceroute Output:

This traceroute show the routers involved after leaving our ISP’s network. Lake Cowichan is in British Colombia, Canada.

This information comes from http://www.apnic.net

Checking the service at http://www.whois.nic.or.kr provides the following:

Orgnization ID : ORG42378

Name           : Tandae Elementary School

State          : KYONGGI

Address        : 77 Tandae-dong Sujung-gu Sungnam-si

Zip Code       : 461-140

7.    Evidence of Active Targeting:

This appears to be a scan of these networks directly and not the result of other traffic and so can be considered evidence of active targeting.  This reconnaissance scan probably would have been followed by attacks to individual hosts if portmapper had been found to be running.

8.    Severity: (5 + 1) – (5 + 5) = -4

Criticality = 5

The systems being scanned are the main routers and firewalls.  Compromise to these systems can provide access to many more.

Lethality = 1

As a reconnaissance probe, this network trace is only a precursor to later lethal traffic.

System Countermeasures = 5

The entire scan is blocked at the router.

Network Countermeasures = 5

None of the systems inside the routers are running portmapper.

9.    Defensive Recommendation:

So what are our options?  TCP port 111 is already blocked at the router and this reconnaissance failed to produce the intended results.  Systems inside the routers should be checked for the portmapper service and should be removed as a second line defense.  This is a small example of "defense in depth" and good common sense.

10.    Sample test questions based on this network trace:

This is an example of what kind of scan:

a)    Search for DNS servers

b)    Search for portmapper service

c)    Search for POP3 servers

d)    None of the above

Or

What is the significance of the source port 53 on this scan?

a)    No significance

b)    These packets are from DNS servers

c)    These packets are sent to DNS servers

d)    Probe is trying to evade router access rules