1 1 00:00:00,060 --> 00:00:02,340 Scans and sweeps. 2 2 00:00:02,340 --> 00:00:04,140 In the last lesson on rogue devices, 3 3 00:00:04,140 --> 00:00:06,510 we talked about the importance of scanning your network 4 4 00:00:06,510 --> 00:00:08,340 and enumerating your network to figure out 5 5 00:00:08,340 --> 00:00:10,140 what is exactly on there. 6 6 00:00:10,140 --> 00:00:12,510 Now, rogue devices often are going to begin 7 7 00:00:12,510 --> 00:00:14,460 their attacks by scanning and sweeping 8 8 00:00:14,460 --> 00:00:17,250 to find additional hosts and vulnerabilities. 9 9 00:00:17,250 --> 00:00:19,110 Just like you as a cybersecurity analyst 10 10 00:00:19,110 --> 00:00:21,750 want to scan your network to figure out what's out there, 11 11 00:00:21,750 --> 00:00:24,780 also, these devices want to do the same thing. 12 12 00:00:24,780 --> 00:00:26,670 So if I just hooked up a rogue device, 13 13 00:00:26,670 --> 00:00:28,170 like a malicious client to your network, 14 14 00:00:28,170 --> 00:00:29,670 the first thing I want to start doing 15 15 00:00:29,670 --> 00:00:31,440 is scanning and sweeping around the network 16 16 00:00:31,440 --> 00:00:32,760 to see what hosts are there, 17 17 00:00:32,760 --> 00:00:33,780 what servers are there, 18 18 00:00:33,780 --> 00:00:35,580 what routers and switches are there. 19 19 00:00:35,580 --> 00:00:37,650 As I get that information, I can start building up 20 20 00:00:37,650 --> 00:00:39,060 a presence and start figuring out 21 21 00:00:39,060 --> 00:00:41,100 exactly what's there so I can then figure out 22 22 00:00:41,100 --> 00:00:42,660 how I want to attack it. 23 23 00:00:42,660 --> 00:00:43,890 Now, when we talk about this, 24 24 00:00:43,890 --> 00:00:46,140 there's a couple of key terms we have to think about. 25 25 00:00:46,140 --> 00:00:47,700 First is port scan. 26 26 00:00:47,700 --> 00:00:49,230 What is a port scan? 27 27 00:00:49,230 --> 00:00:50,880 Well, a port scan is going to enumerate 28 28 00:00:50,880 --> 00:00:53,520 the status of TCP and UDP ports 29 29 00:00:53,520 --> 00:00:56,220 on a given target using software tools. 30 30 00:00:56,220 --> 00:00:57,960 The most common of these is Nmap, 31 31 00:00:57,960 --> 00:00:59,070 which we're going to spend a lot 32 32 00:00:59,070 --> 00:01:01,110 of time on later in this course. 33 33 00:01:01,110 --> 00:01:02,850 Now, when we talk about enumeration 34 34 00:01:02,850 --> 00:01:06,300 of a single target, this is called fingerprinting. 35 35 00:01:06,300 --> 00:01:08,850 Fingerprinting is identifying the type and version 36 36 00:01:08,850 --> 00:01:11,340 of an operating system or a server application 37 37 00:01:11,340 --> 00:01:14,250 by analyzing its responses to network scans. 38 38 00:01:14,250 --> 00:01:16,200 So for instance, if I'm using Nmap 39 39 00:01:16,200 --> 00:01:18,570 and I'm doing a port scan of your server 40 40 00:01:18,570 --> 00:01:19,560 and it reports back to me 41 41 00:01:19,560 --> 00:01:21,990 that you're on port 80 and that's open, 42 42 00:01:21,990 --> 00:01:23,550 it will then tell me also in addition 43 43 00:01:23,550 --> 00:01:24,720 knowing that it's port 80 44 44 00:01:24,720 --> 00:01:28,230 that you're running Apache or IIS Azure Web Server. 45 45 00:01:28,230 --> 00:01:29,100 Now, in addition to that, 46 46 00:01:29,100 --> 00:01:31,350 it'll also figure out if you're running Windows or Linux 47 47 00:01:31,350 --> 00:01:34,170 based on what the responses are that it's getting 48 48 00:01:34,170 --> 00:01:36,390 through this fingerprinting process. 49 49 00:01:36,390 --> 00:01:38,040 Now, that's what happens when we do a scan. 50 50 00:01:38,040 --> 00:01:39,690 That's one single target. 51 51 00:01:39,690 --> 00:01:42,360 But what if I want to start looking at a wider range? 52 52 00:01:42,360 --> 00:01:44,430 Well, that's called a sweep. 53 53 00:01:44,430 --> 00:01:46,230 Now, a sweep is a scan that's directed 54 54 00:01:46,230 --> 00:01:48,300 at multiple IP addresses to discover 55 55 00:01:48,300 --> 00:01:50,640 whether a host responds to a connection request 56 56 00:01:50,640 --> 00:01:52,350 for a particular port. 57 57 00:01:52,350 --> 00:01:53,820 So for example, if I wanted to sweep 58 58 00:01:53,820 --> 00:01:57,000 my entire network and see who has port 80 open, 59 59 00:01:57,000 --> 00:01:59,610 who's running a web server, I can do that. 60 60 00:01:59,610 --> 00:02:00,930 That might be useful if I found 61 61 00:02:00,930 --> 00:02:02,190 that there is a vulnerability out there 62 62 00:02:02,190 --> 00:02:03,840 that only attacks port 80. 63 63 00:02:03,840 --> 00:02:05,790 I want to figure out who's open on port 80. 64 64 00:02:05,790 --> 00:02:06,870 And once I do that, 65 65 00:02:06,870 --> 00:02:08,790 that might gimme a list of five or 10 servers. 66 66 00:02:08,790 --> 00:02:11,730 I can then go deeper into just those five or 10 servers 67 67 00:02:11,730 --> 00:02:14,880 and ignore the other thousands of servers on my network. 68 68 00:02:14,880 --> 00:02:16,080 Now, when we're dealing with a sweep 69 69 00:02:16,080 --> 00:02:18,060 or we're dealing with multiple assets, 70 70 00:02:18,060 --> 00:02:20,370 this is also known as footprinting. 71 71 00:02:20,370 --> 00:02:22,590 So with footprinting, this is the phase of an attack 72 72 00:02:22,590 --> 00:02:25,140 or penetration test in which the attacker or tester 73 73 00:02:25,140 --> 00:02:28,740 gathers information about the target before attacking it. 74 74 00:02:28,740 --> 00:02:30,330 Now in this case, when we talk about the target, 75 75 00:02:30,330 --> 00:02:32,430 we're talking about the target organization. 76 76 00:02:32,430 --> 00:02:33,330 We are trying to figure out 77 77 00:02:33,330 --> 00:02:35,310 across the board what's there. 78 78 00:02:35,310 --> 00:02:37,860 So when you hear fingerprinting, it's one machine. 79 79 00:02:37,860 --> 00:02:39,090 When you hear footprinting, 80 80 00:02:39,090 --> 00:02:41,400 that tends to be multiple machines. 81 81 00:02:41,400 --> 00:02:44,040 Now, one of the questions students often ask me is, 82 82 00:02:44,040 --> 00:02:45,720 who should be doing these scans? 83 83 00:02:45,720 --> 00:02:48,330 Well, only the people who are authorized. 84 84 00:02:48,330 --> 00:02:50,460 Authorized network scans should be performed 85 85 00:02:50,460 --> 00:02:52,620 from a restricted range of hosts as well. 86 86 00:02:52,620 --> 00:02:54,240 So if you're a cybersecurity analyst, 87 87 00:02:54,240 --> 00:02:56,280 you probably have a small network 88 88 00:02:56,280 --> 00:02:58,020 of administrative workstations, 89 89 00:02:58,020 --> 00:03:00,030 and these are the ones that you and your team 90 90 00:03:00,030 --> 00:03:02,430 are going to use to do all of your scanning from. 91 91 00:03:02,430 --> 00:03:04,260 Now, why do we want to do that? 92 92 00:03:04,260 --> 00:03:05,790 Well, because a lot of our systems 93 93 00:03:05,790 --> 00:03:07,380 have intrusion detection systems 94 94 00:03:07,380 --> 00:03:08,400 that are looking for things 95 95 00:03:08,400 --> 00:03:10,680 like port scans or sweeps, 96 96 00:03:10,680 --> 00:03:12,360 and if we know that it's coming 97 97 00:03:12,360 --> 00:03:13,560 from a particular range, 98 98 00:03:13,560 --> 00:03:15,030 we can authorize that range 99 99 00:03:15,030 --> 00:03:16,710 and ignore those requests. 100 100 00:03:16,710 --> 00:03:18,360 So if I see a port scan coming 101 101 00:03:18,360 --> 00:03:22,080 from the host at 192.168.1.10, 102 102 00:03:22,080 --> 00:03:23,520 which is my workstation, 103 103 00:03:23,520 --> 00:03:25,650 that can be written as a rule to ignore it. 104 104 00:03:25,650 --> 00:03:27,270 But if it comes from any other IP address, 105 105 00:03:27,270 --> 00:03:28,560 we're going to flag it. 106 106 00:03:28,560 --> 00:03:29,700 That's the way these things work. 107 107 00:03:29,700 --> 00:03:31,080 So you want to keep that in mind 108 108 00:03:31,080 --> 00:03:32,850 and keep a restricted range of hosts 109 109 00:03:32,850 --> 00:03:34,530 when you do your scans. 110 110 00:03:34,530 --> 00:03:36,090 Now, intrusion detection systems, 111 111 00:03:36,090 --> 00:03:36,930 like I just mentioned, 112 112 00:03:36,930 --> 00:03:39,180 can identify scanning by detecting 113 113 00:03:39,180 --> 00:03:41,040 the different numbers of SYN packets, 114 114 00:03:41,040 --> 00:03:43,380 SYN/ACK packets, or FIN packets. 115 115 00:03:43,380 --> 00:03:45,870 And if we don't see a statistical balance there, 116 116 00:03:45,870 --> 00:03:48,150 that means we're probably being scanned. 117 117 00:03:48,150 --> 00:03:50,010 As we're going to talk about later with Nmap, 118 118 00:03:50,010 --> 00:03:52,350 when people do scans, often they will send out 119 119 00:03:52,350 --> 00:03:55,500 SYN packets and never respond with the SYN/ACK. 120 120 00:03:55,500 --> 00:03:57,630 So if I had 100 SYN packets go out, 121 121 00:03:57,630 --> 00:03:59,550 but only three SYN/ACK packets, 122 122 00:03:59,550 --> 00:04:01,590 that probably means I'm doing a lot of scanning here, 123 123 00:04:01,590 --> 00:04:02,520 because I'm sending out a lot 124 124 00:04:02,520 --> 00:04:04,350 of SYNs to see what the responses are 125 125 00:04:04,350 --> 00:04:05,910 and never replying to them. 126 126 00:04:05,910 --> 00:04:08,850 That would be something that an IDS could flag for us. 127 127 00:04:08,850 --> 00:04:10,920 Now, let me give you a quick warning here 128 128 00:04:10,920 --> 00:04:12,000 and a word of advice. 129 129 00:04:12,000 --> 00:04:14,820 I've worked for some companies that have freaked out 130 130 00:04:14,820 --> 00:04:15,990 when they started seeing port scanning 131 131 00:04:15,990 --> 00:04:17,460 against their resources. 132 132 00:04:17,460 --> 00:04:18,660 If you're running web servers 133 133 00:04:18,660 --> 00:04:20,850 or any internet facing resources, 134 134 00:04:20,850 --> 00:04:22,620 just realize that scan sweeps 135 135 00:04:22,620 --> 00:04:24,240 of your organization's footprint 136 136 00:04:24,240 --> 00:04:26,100 is going to be a common occurrence 137 137 00:04:26,100 --> 00:04:27,240 and it should not be something 138 138 00:04:27,240 --> 00:04:29,010 that sends you into a panic. 139 139 00:04:29,010 --> 00:04:31,770 Yes, if somebody is doing a scan, 140 140 00:04:31,770 --> 00:04:33,090 they may want to attack you 141 141 00:04:33,090 --> 00:04:34,770 at some point in the future. 142 142 00:04:34,770 --> 00:04:36,780 Yes, if people are doing a scan, 143 143 00:04:36,780 --> 00:04:38,070 they may not want to attack you 144 144 00:04:38,070 --> 00:04:39,300 at some point in the future. 145 145 00:04:39,300 --> 00:04:41,010 Both of those are true statements. 146 146 00:04:41,010 --> 00:04:42,840 Because attackers use this, 147 147 00:04:42,840 --> 00:04:45,000 but so do other organizations too. 148 148 00:04:45,000 --> 00:04:46,830 So if you have something that's forward facing, 149 149 00:04:46,830 --> 00:04:48,210 you are going to see a lot of scanning. 150 150 00:04:48,210 --> 00:04:50,190 It's just something that happens all the time. 151 151 00:04:50,190 --> 00:04:52,170 My own personal network in my office, 152 152 00:04:52,170 --> 00:04:55,230 I see scans happening against us all the time, 153 153 00:04:55,230 --> 00:04:56,730 but it's not necessarily an indication 154 154 00:04:56,730 --> 00:04:58,740 that there's going to be an attack. 155 155 00:04:58,740 --> 00:04:59,880 Now after the fact, 156 156 00:04:59,880 --> 00:05:01,650 if you were the victim of an attack, 157 157 00:05:01,650 --> 00:05:02,760 you might go back and look 158 158 00:05:02,760 --> 00:05:04,500 at that historical data to see 159 159 00:05:04,500 --> 00:05:06,150 if an intrusion could be correlated 160 160 00:05:06,150 --> 00:05:07,650 to some scanning activity. 161 161 00:05:07,650 --> 00:05:09,570 But the scanning activity by itself 162 162 00:05:09,570 --> 00:05:11,190 is not a big enough indicator 163 163 00:05:11,190 --> 00:05:12,540 for us to get worked up about 164 164 00:05:12,540 --> 00:05:14,760 and try to start deploying resources against it, 165 165 00:05:14,760 --> 00:05:16,960 because it is just such a common occurrence.