April 03, 2001, 5:53 PM —
Two weeks ago I wrote about stealth scans and promised to follow up with a column on NMAP, Fyodor's wonderful open source port scanner. But between that time and the appearance of this column, two big stories got in the way. First came word that LinuxWorld.com was moving to ITworld.com's site. Then came a rare opportunity to bring together Bob Young and a player from the Dark Side in an exclusive one-on-one, which was presented last week in place of the stealth scan follow-up (see Resources for links). My apologies for being late, but here it is. And just as someone out there is certain to be snickering about my network security skills, better late than never. (See Resources for links to previous columns.)
Call it baud karma. Call it carelessness. Call it inevitable. I was 0wn3d and didn't know it. After downloading and installing BETA 21 of version 2.54 of NMAP (and its graphical frontend), I su'd to root, fired it up, and aimed a FIN stealth scan at ports 1-32000 on my server. I was running portsentry on the server, but my desktop machine -- the one I was running NMAP on -- was on the portsentry ignore list so that it wouldn't simply reroute my inquisitive packets to /dev/null after I hit the first protected port.
The image above shows the way I had NMAP configured for the scan. It took less than a minute to ruin my entire week. The results are below. The same scan produces markedly different results today.
Starting nmap V. 2.54BETA22 ( www.insecure.org/nmap/ ) Interesting ports on pooh.pjprimer.com (216.140.158.195): (The 31957 ports scanned but not shown below are in state: closed) Port State Service 1/tcp open tcpmux 7/tcp open echo 9/tcp open discard 11/tcp open systat 15/tcp open netstat 21/tcp open ftp 23/tcp open telnet 25/tcp open smtp 70/tcp open gopher 79/tcp open finger 80/tcp open http 98/tcp open linuxconf 109/tcp open pop-2 110/tcp open pop-3 111/tcp open sunrpc 113/tcp open auth 119/tcp open nntp 138/tcp open netbios-dgm 139/tcp open netbios-ssn 143/tcp open imap2 512/tcp open exec 513/tcp open login 514/tcp open shell 515/tcp open printer 540/tcp open uucp 635/tcp open unknown 1080/tcp open socks 1524/tcp open ingreslock 2000/tcp open callbook 2001/tcp open dc 4000/tcp open unknown 4001/tcp open unknown 5742/tcp open unknown 6000/tcp open X11 6001/tcp open X11:1 6667/tcp open irc 8892/tcp open seosload 10000/tcp open unknown 12345/tcp open NetBus 12346/tcp open NetBus 20034/tcp open unknown 30303/tcp open unknown 31337/tcp open Elite Remote operating system guess: Linux 2.1.122 - 2.2.16 Uptime 130.704 days (since Wed Nov 1 16:21:30 2000) Nmap run completed -- 1 IP address (1 host up) scanned in 42 seconds
The feeling you get in the pit of your stomach when you first suspect that your site has been cracked is similar to the feeling you get when you first discover your house has been broken into. It is a sickening sense of muted outrage. Muted because you are still hoping against hope that it hasn't really happened. But your eyes are telling you that it has, that in spite of your denial you've been violated, that you're 0wn3d.
