TECH TIPS
Hacker techniques and exploits: Prevent system fingerprinting, probing
Vernon Habersetzer, Contributing Writer
01.17.2005
Rating: -3.75- (out of 5)
|
Serious hackers don't shoot in the dark when attempting to penetrate a system. Instead, they will use hacker techniques such as operating system fingerprinting and probing to systematically identify what systems and services your company is running to determine your weakest link. Are you connected to a partner network that has a firewall equivalent to Swiss cheese? Does your remote access system require only mediocre authentication? Do you have in-house staff develop webpages that haven't been checked for security holes? These are the weaknesses hackers are looking for.
In every hacker's tool bag are a variety of free system probing and fingerprinting tools, the purpose of which is to identify specifics about your hardware and software configurations. Some of these tools will undoubtedly check for open ports on routers and firewalls and identify what system services are available for exploitation. To get an idea of what a hacker would see, download and run some of these tools against your own network. Be sure to let your staff know when these tools are being run, in case there are performance issues when certain scans are launched, and always test them against a few non-critical machines first.
The first step in defending against hacker techniques and exploits designed to access your systems is to block unnecessary, incoming firewall ports. The ports that remain open should be protected by patching the services that use those ports, such as Web services, email and FTP. Your software vendors should be able to provide their most up...
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
-to-date patches. CERT lists vulnerability information about services you may be running. Additionally, Cassandra is an excellent online vulnerability database, freely available to assist you in identifying which vulnerable services you are running, and includes many applications not listed elsewhere.
To determine if someone is using such tools to probe and fingerprint your operating systems, you'll need to implement at least one type of logging tool that will record port scans, fingerprinting, failed login attempts, etc. Ideally, any open ports should be monitored with an intrusion prevention system (IPS), which will detect and prevent most attacks before they reach your systems. A common free and open source intrusion detection system (IDS), which only detects attacks and does not prevent them, and IPS is Snort. A quick Google search will yield plenty of free support and add-ons for Snort.
Whatever system you implement to detect operating system fingerprinting and probing, you'll want to keep an eye on the log files to identify which machines seem to be probing your systems. Many firewalls and intrusion detection/prevention systems can alert you via email or launch a program when an attack is detected, but none of these systems is capable of reaching through the hacker's monitor and slapping their hands. Someday…
About the author
Vernon Haberstetzer, president of security seminar and consulting company i.e.security, has many years of in-the-trenches security experience in healthcare and retail environments.
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchSecurity.com.
Register now
to start rating these tips. Log in if you are already a member.
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
