Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Scaricare il pdf (Pagina 61)

really try very hard. Just scan, look, try, move on if unsuccessful. There is always more IPs to be scanned. If

your firewall is effectively bouncing this kind of thing, it is no threat to you at all. Take comfort in that, and

don't over re−act.

It is worth noting, that these worms cannot "force" their way in. They need an open and accessible port, and a

known vulnerability. If you remember the "Iptables Weekly Log Summary" in the opening section above,

many of those may have all been the result of this type of scan. If you've followed the steps in this HOWTO,

you should be reasonably safe here. This one is easy enough to deflect.

8.4.4. Script Kiddies

A "script kiddie" is a "cracker" wanna be who doesn't know enough to come up with his/her own exploits, but

instead relies on "scripts" and exploits that have been developed by others. Like "worms", they are looking

for easy victims, and may similarly scan large address ranges looking for specific ports with known

vulnerabilities. Often, the actual scanning is done from already comprised systems so that it is difficult to

trace it back to them.

The script kiddie has a bag of ready made tricks at his disposal, including an arsenal of "rootkits" for various

Operating Systems. Finding susceptible victims is not so hard, given enough time and address space to probe.

The motives are a mixed bag as well. Simple mischief, defacement of web sites, stolen credit card numbers,

and the latest craze, "Denial of Service" attacks (see below). They collect zombies like trophies and use them

to carry out whatever their objective is.

Again, the key here is that they are following a "script", and looking for easy prey. Like the worm threat

above, a functional firewall and a few very basic precautions, should be sufficient to deflect any threat here.

By now, you should be relatively safe from this nuisance.

8.4.5. Spoofed IPs

How easy is it to spoof an IP address? With the right tools, very easy. How much of a threat is this? Not

much, for most of us, and is over−hyped as a threat.

Because of the way TCP/IP works, each packet must carry both the source and destination IP addresses. Any

return traffic is based on this information. So a spoofed IP can never return any useful information to an

attacker who is sending out spoofed packets. The traffic would go back to wherever that spoofed IP address

was pointed. The attacker gets nothing back at all.

This does have potential for "DoS" attacks (see below) where learning something about the targeted system is

not important. And may be used for some general mischief making as well.

8.4.6. Targeted Attacks

The worm and wide ranging address type scans, are impersonal. They are just looking for any vulnerable

system. It makes no difference whether it is a top secret government facility, or your mother's Window's box.

But there are "black hats" that will spend a great deal of effort to get into a system or network. We'll call

these "targeted" attacks since there has been a deliberate decision made to break in to a specific system or

Security Quick−Start HOWTO for Red Hat Linux

8.4.4. Script Kiddies 58

1 2 ... 56 57 58 59 60 61 62 63 64 65 66 ... 81 82

Nessun commento

Red Hat NETSCAPE MANAGEMENT SYSTEM 6.2 - COMMAND-LINE Guida di Installazione Pagina 61