Last week, I spent most of my time installing Linux and a few white hat
applications from hacker Web sites: Firewalk, Nmap, Sniffit, Swatch and
Tripwire. This week, I've had a bit of a chance to play around with
them.

This "white hat" nomenclature confused me when I first heard it. White
hat is a fairly common term for people who hack legitimately - security
staff, researchers and so on. By contrast, black hat hackers hack
maliciously. Basically, white hats are the good guys; black hats are
the bad guys. Gray hats are somewhere between the two, and nobody knows
where Red Hat Linux fits in with all this.

I'm told the terms come from the early Western movies. Because the
movies were filmed in black and white, the chase scenes tended to get a
bit confusing, until someone decided to give the good guys white hats
and the bad guys black hats. Anyway, back to Linux. Frills and Thrills

Nmap impressed me. It's simple, it's powerful, and it does exactly what
it says it does: It maps your network. The author, who goes only by the
name Fyodor, even includes a short but well-written HTML manual in a
choice of five languages. The program is freeware, so you've got to
admire the amount of work that he's put into it.

Nmap runs ping sweeps to find out what machines are connected to your
local network, a port scan to find out what services each machine is
running and TCP/IP fingerprinting to find out what operating system
each is running. The result is a log file giving you a reasonably
complete list of what's on your network and what it's doing. That's
useful information both for a security manager and any hacker.

We also run Internet Scanner from Atlanta-based Internet Security
Systems Inc. (ISS). Internet Scanner can do exactly what Nmap can do
and much more. The big difference between the tools - apart from the
fact that Nmap is free and Internet Scanner most certainly isn't - is
the slant each puts on this function.

The ISS tool gives a much more user-friendly graphical user interface
(GUI), advertises its presence to anyone being scanned and so on. It's
clearly designed to fit into a corporate environment.

Nmap, on the other hand, is designed for technical staffers who want to
dispense with the frills: It's much faster, and it's designed to be run
in "stealth mode" so as to avoid detection by intrusion detection
software. It certainly snuck in beneath the radar of our intrusion
detection software, RealSecure from ISS. That's something we'll have to
sort out.

Sniffing for Hack Attacks
Next up was Sniffit, a network packet sniffer. Packet sniffers are
rather intriguingly named pieces of software that monitor network
traffic.

Under many networking protocols, data that you transmit gets split into
small segments, or packets, and the Internet Protocol address of the
destination computer is written into the header of each packet. These
packets then get passed around by routers and eventually make their way
to the network segment

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine