Problem solve Get help with specific problems with your technologies, process and projects.

Hacker techniques and exploits: Prevent system fingerprinting, probing

As part of our series on hacker tactics and techniques, in this tip you will learn how to identify and avoid certain hacker strategies, such as probing and fingerprinting.

Serious hackers don't shoot in the dark when attempting to penetrate a system. Instead, they will use hacker techniques such as operating system fingerprinting and probing to systematically identify what systems and services your company is running to determine your weakest link. Are you connected to a partner network that has a firewall equivalent to Swiss cheese? Does your remote access system require only mediocre authentication? Do you have in-house staff develop webpages that haven't been checked for security holes? These are the weaknesses hackers are looking for.

In every hacker's tool bag are a variety of free system probing and fingerprinting tools, the purpose of which is to identify specifics about your hardware and software configurations. Some of these tools will undoubtedly check for open ports on routers and firewalls and identify what system services are available for exploitation. To get an idea of what a hacker would see, download and run some of these tools against your own network. Be sure to let your staff know when these tools are being run, in case there are performance issues when certain scans are launched, and always test them against a few non-critical machines first.

The first step in defending against hacker techniques and exploits designed to access your systems is to block unnecessary, incoming firewall ports. The ports that remain open should be protected by patching the services that use those ports, such as Web services, email and FTP. Your software vendors should be able to provide their most up-to-date patches. CERT lists vulnerability information about services you may be running. Additionally, Cassandra is an excellent online vulnerability database, freely available to assist you in identifying which vulnerable services you are running, and includes many applications not listed elsewhere.

To determine if someone is using such tools to probe and fingerprint your operating systems, you'll need to implement at least one type of logging tool that will record port scans, fingerprinting, failed login attempts, etc. Ideally, any open ports should be monitored with an intrusion prevention system (IPS), which will detect and prevent most attacks before they reach your systems. A common free and open source intrusion detection system (IDS), which only detects attacks and does not prevent them, and IPS is Snort. A quick Google search will yield plenty of free support and add-ons for Snort.

Whatever system you implement to detect operating system fingerprinting and probing, you'll want to keep an eye on the log files to identify which machines seem to be probing your systems. Many firewalls and intrusion detection/prevention systems can alert you via email or launch a program when an attack is detected, but none of these systems is capable of reaching through the hacker's monitor and slapping their hands. Someday…

About the author
Vernon Haberstetzer, president of security seminar and consulting company, has many years of in-the-trenches security experience in healthcare and retail environments.


  Introduction: Hacker attack tactics
 How to stop hacker theft
  Hacker system fingerprinting, probing
  Using network intrusion detection tools
  Avoid physical security threats
  Authentication system security weaknesses
  Improve your access request process
  Social engineering hacker attack tactics
  Secure remote access points
 Securing your Web sever
  Wireless security basics
  How to tell if you've been hacked

This was last published in January 2005

Dig Deeper on Hacker tools and techniques: Underground hacking sites