Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Scaricare il pdf (Pagina 59)

If all else fails, and you can't find a process owner for an open port, suspect that it may be an RPC (Remote

Procedure Call) service of some kind. These use randomly assigned ports without any seeming logic or

consistency, and are typically controlled by the portmap daemon. In some cases, these may not reveal the

process owner to netstat or lsof. Try stopping portmap, and then see if the mystery service goes away. Or

you can use rpcinfo −p localhost to see what RPC services may be running (portmap must be running for

this to work).

If you suspect you have been broken into, do not

trust netstat or ps output. There is a good chance that

they, and other system components, has been tampered

with in such a way that the output is not reliable.

8.4. Attacks and Threats

In this section, we will take a quick look at some of the common threats and techniques that are out there, and

attempt to put them into some perspective.

The corporate world, government agencies and high profile Internet sites have to be concerned with a much

more diverse and challenging set of threats than the typical home desktop user. There are many reasons

someone may want to break in to someone else's computer. It may be just for kicks, or any number of

malicious reasons. They may just want a base from which to attack someone else. This is a very common

motivation.

The most common "attack" for most of us is from already compromised systems. The Internet is littered with

computers that have been broken into, and are now doing their master's bidding blindly, in zombie−like

fashion. They are programmed to scan massively large address ranges, probing each individual IP address as

they go. Looking for one or more open ports, and then probing for known weaknesses if they get the chance.

Very impersonal. Very methodical. And very effective. We are all in the path of such robotic scans. All

because those responsible for these systems fail to do what you are doing now − taking steps to protect their

system(s), and avoid being r00ted.

These scans do not look at login banners that may be presented on connection. It will do little good to change

your /etc/issue.net to pretend that you are running some obscure operating system. If they find

something listening, they will try all of the exploits appropriate to that port, without regard to any indications

your system may give. If it works, they are in −− if not, they will move on.

8.4.1. Port Scans and Probes

First, let's define "scan" and "probe" since these terms come up quite a bit. A "probe" implies testing if a

given port is open or closed, and possibly what might be listening on that port. A "scan" implies either

"probing" multiple ports on one or more systems. Or individual ports on multiple systems. So you might

"scan" all ports on your own system for instance. Or a cracker might "scan" the 216.78.*.* address range to

see who has port 111 open.

Black hats can use scan and probe information to know what services are running on a given system, and then

they might know what exploits to try. They may even be able to tell what Operating System is running, and

Security Quick−Start HOWTO for Red Hat Linux

8.4. Attacks and Threats 56

1 2 ... 54 55 56 57 58 59 60 61 62 63 64 ... 81 82

Nessun commento

Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Pagina 59