Instructor: Scans and sweeps. 2 2
In the last lesson on rogue devices, 3 3
we talked about the importance of scanning your network 4 4
and enumerating your network to figure out 5 5
what is exactly on there. 6 6
Now, rogue devices often are going to begin 7 7
their attacks by scanning and sweeping 8 8
to find additional hosts and vulnerabilities. 9 9
Just like you as a cybersecurity analyst 10 10
want to scan your network to figure out what's out there, 11 11
also, these devices want to do the same thing. 12 12
So if I just hooked up a rogue device, 13 13
like a malicious client to your network, 14 14
the first thing I want to start doing 15 15
is scanning and sweeping around the network 16 16
to see what hosts are there, 17 17
what servers are there, 18 18
what routers and switches are there. 19 19
As I get that information, I can start building up 20 20
a presence and start figuring out 21 21
exactly what's there so I can then figure out 22 22
how I want to attack it. 23 23
Now, when we talk about this, 24 24
there's a couple of key terms we have to think about. 25 25
First is port scan. 26 26
What is a port scan? 27 27
Well, a port scan is going to enumerate 28 28
the status of TCP and UDP ports 29 29
on a given target using software tools. 30 30
The most common of these is Nmap, 31 31
which we're going to spend a lot 32 32
of time on later in this course. 33 33
Now, when we talk about enumeration 34 34
of a single target, this is called fingerprinting. 35 35
Fingerprinting is identifying the type and version 36 36
of an operating system or a server application 37 37
by analyzing its responses to network scans. 38 38
So for instance, if I'm using Nmap 39 39
and I'm doing a port scan of your server 40 40
and it reports back to me 41 41
that you're on port 80 and that's open, 42 42
it will then tell me also in addition 43 43
knowing that it's port 80 44 44
that you're running Apache or IIS Azure Web Server. 45 45
Now, in addition to that, 46 46
it'll also figure out if you're running Windows or Linux 47 47
based on what the responses are that it's getting 48 48
through this fingerprinting process. 49 49
Now, that's what happens when we do a scan. 50 50
That's one single target. 51 51
But what if I want to start looking at a wider range? 52 52
Well, that's called a sweep. 53 53
Now, a sweep is a scan that's directed 54 54
at multiple IP addresses to discover 55 55
whether a host responds to a connection request 56 56
for a particular port. 57 57
So for example, if I wanted to sweep 58 58
my entire network and see who has port 80 open, 59 59
who's running a web server, I can do that. 60 60
That might be useful if I found 61 61
that there is a vulnerability out there 62 62
that only attacks port 80. 63 63
I want to figure out who's open on port 80. 64 64
And once I do that, 65 65
that might gimme a list of five or 10 servers. 66 66
I can then go deeper into just those five or 10 servers 67 67
and ignore the other thousands of servers on my network. 68 68
Now, when we're dealing with a sweep 69 69
or we're dealing with multiple assets, 70 70
this is also known as footprinting. 71 71
So with footprinting, this is the phase of an attack 72 72
or penetration test in which the attacker or tester 73 73
gathers information about the target before attacking it. 74 74
Now in this case, when we talk about the target, 75 75
we're talking about the target organization. 76 76
We are trying to figure out 77 77
across the board what's there. 78 78
So when you hear fingerprinting, it's one machine. 79 79
When you hear footprinting, 80 80
that tends to be multiple machines. 81 81
Now, one of the questions students often ask me is, 82 82
who should be doing these scans? 83 83
Well, only the people who are authorized. 84 84
Authorized network scans should be performed 85 85
from a restricted range of hosts as well. 86 86
So if you're a cybersecurity analyst, 87 87
you probably have a small network 88 88
of administrative workstations, 89 89
and these are the ones that you and your team 90 90
are going to use to do all of your scanning from. 91 91
Now, why do we want to do that? 92 92
Well, because a lot of our systems 93 93
have intrusion detection systems 94 94
that are looking for things 95 95
like port scans or sweeps, 96 96
and if we know that it's coming 97 97
from a particular range, 98 98
we can authorize that range 99 99
and ignore those requests. 100 100
So if I see a port scan coming 101 101
from the host at 192.168.1.10, 102 102
which is my workstation, 103 103
that can be written as a rule to ignore it. 104 104
But if it comes from any other IP address, 105 105
we're going to flag it. 106 106
That's the way these things work. 107 107
So you want to keep that in mind 108 108
and keep a restricted range of hosts 109 109
when you do your scans. 110 110
Now, intrusion detection systems, 111 111
like I just mentioned, 112 112
can identify scanning by detecting 113 113
the different numbers of SYN packets, 114 114
SYN/ACK packets, or FIN packets. 115 115
And if we don't see a statistical balance there, 116 116
that means we're probably being scanned. 117 117
As we're going to talk about later with Nmap, 118 118
when people do scans, often they will send out 119 119
SYN packets and never respond with the SYN/ACK. 120 120
So if I had 100 SYN packets go out, 121 121
but only three SYN/ACK packets, 122 122
that probably means I'm doing a lot of scanning here, 123 123
because I'm sending out a lot 124 124
of SYNs to see what the responses are 125 125
and never replying to them. 126 126
That would be something that an IDS could flag for us. 127 127
Now, let me give you a quick warning here 128 128
and a word of advice. 129 129
I've worked for some companies that have freaked out 130 130
when they started seeing port scanning 131 131
against their resources. 132 132
If you're running web servers 133 133
or any internet facing resources, 134 134
just realize that scan sweeps 135 135
of your organization's footprint 136 136
is going to be a common occurrence 137 137
and it should not be something 138 138
that sends you into a panic. 139 139
Yes, if somebody is doing a scan, 140 140
they may want to attack you 141 141
at some point in the future. 142 142
Yes, if people are doing a scan, 143 143
they may not want to attack you 144 144
at some point in the future. 145 145
Both of those are true statements. 146 146
Because attackers use this, 147 147
but so do other organizations too. 148 148
So if you have something that's forward facing, 149 149
you are going to see a lot of scanning. 150 150
It's just something that happens all the time. 151 151
My own personal network in my office, 152 152
I see scans happening against us all the time, 153 153
but it's not necessarily an indication 154 154
that there's going to be an attack. 155 155
Now after the fact, 156 156
if you were the victim of an attack, 157 157
you might go back and look 158 158
at that historical data to see 159 159
if an intrusion could be correlated 160 160
to some scanning activity. 161 161
But the scanning activity by itself 162 162
is not a big enough indicator 163 163
for us to get worked up about 164 164
and try to start deploying resources against it, 165 165
because it is just such a common occurrence.