C844 Task 1 NMAP SUMMARY, VULNERABILITIES, WIRESHARK ANOMALIES, IMPLICATIONS OF ANOMALIES, & SOULTIO

downloaded from

Scholarfriends

https://scholarfriends.com

Downloaded by: browsegrades@gmail.com | https://scholarfriends.com/singlePaper/206493/c844-task-1docpdf Distribution of this document is illegal.

A: NMAP SUMMARY I used Zenmap to scan the network on the 192.168.27.0/24 domain. The results of the scan indicated that the network had a star topology and consisted of 9 devices connected to a central point with an IP address of 192.168.29.2. Five of the connected devices were running a version of the Windows operating system, three were running a version of Linux, and one appeared to be a VPN gateway (see Figure 1.)

(Figure 1)

B: NMAP VULNERABILITIES By using Zenmap I was able to view potential vulnerabilities on the network. In this report, I will focus on two specific vulnerabilities.

The first issue is with the system that is assigned the IP address of 192.168.27.12. On this system, port 21 is open (see Figure 2.) Port 21 is used for FTP traffic. FTP traffic uses cleartext passwords for authentication purposes and therefore is susceptible to man-in-the-middle attacks.

FTP traffic can also be used to inject malware into software applications that have been downloaded via FTP. (SSH Communications Security, Inc., 2017) Malicious users can also use password sniffing attacks to capture the cleartect usernames and passwords and then attempt to use those credentials to access other systems on the network.

(Figure 2) The second issue is with the system that is assigned the IP address of 192.168.27.15. On this system, port 23 is open (see Figure 3.) Port 23 is used for Telnet. The telnet service is unencrypted and, like FTP, sends data in cleartext. As a result, everyone on the local network can sniff the data that passes between the client and the server and capture the cleartect usernames and passwords. A malicious remote user could also send packets to port 23 and cause a denialof-service (DoS) attack which could prevent authorized users from accessing Telnet, SSH and even HTTP remote management services. (Mullins, 2005)

(Figure 3)

C: WIRESHARK ANOMALIES By using Wireshark, I was able to identify several anomalies and issues within the network. In this report, I will focus on three specific issues.

The first issue is with a system with an IP address of 172.16.80.243. This system appears to be running an Nmap scan on the internal network in a possible attempt to gain as much information as possible on the network. In the example below, I used Wireshark to follow a stream to show the Nmap scan of the host with the IP address of 192.168.27.12 (see Figure 4.)

(Figure 4)

The second issue is with the systems assigned the IP addresses of 192.168.27.18 and 192.168.27.12. These two systems are engaged in a file transfers using the FTP protocol, which is unencrypted and in cleartext. As a result, any system listening in on network traffic would be able to see this cleartext communication and would be able to identify the username and password used to access the system via FTP (see Figure 5 and Figure 6.)

(Figure 5)

(Figure 6)

The third issue involves the system assigned the IP address of 192.168.27.15. In Wireshark between frames 29101 and 29325 I found that the computer assigned the IP address of 172.16.80.243 attempted to login to the system via Telnet. The malicious user first attempted to use the username “Administrator” with the password “Passw0rd.” They then attempted to login to the system using the username “User” and the password “Passw0rd” (see Figure 7 and Figure 8.) It should be noted that this is the same password that was found to be used between the systems assigned the IP addresses of 192.168.27.18 and 192.168.27.12 during their previous FTP session which used cleartext and was susceptible to sniffing attacks.

(Figure 7)

(Figure 8)

D: IMPLICATIONS OF ANOMALIES

The first issue identified via Nmap was with the system that is assigned the IP address of 192.168.27.12. On this system, port 21 is open. Port 21 is used for FTP traffic. FTP traffic uses cleartext passwords for authentication purposes and therefore is susceptible to man-in-the-middle

attacks. FTP traffic can also be used to inject malware into software applications that have been downloaded via FTP. (SSH Communications Security, Inc., 2017) Malicious users can also use password sniffing attacks to capture the cleartect usernames and passwords and then attempt to use those credentials to access other systems on the network.

The second issue identified via Nmap was with the system that is assigned the IP address of 192.168.27.15. On this system, port 23 is open. Port 23 is used for Telnet. The telnet service is unencrypted and, like FTP, sends data in cleartext. As a result, everyone on the local network can sniff the data that passes between the client and the server and capture the cleartect usernames and passwords. A malicious remote user could also send packets to port 23 and cause a denialof-service (DoS) attack which could prevent authorized users from accessing Telnet, SSH and even HTTP remote management services. (Mullins, 2005) The first issue identified via Wireshark was with a system with the IP address of 172.16.80.243 using Nmap to scan the network. Failure to properly harden the systems and limit the amount of information disclosed could result in unauthorized information disclosure.

The second issue identified via Wireshark involved two systems that were engaged in a file transfers using the FTP protocol. As stated above, FTP is insecure by nature, and cleartext is used between the client and the server. As a result, any system listening in on network traffic would be able to see this cleartext communication and would be able to identify the username and password used to access the system via FTP. This would result in unauthorized information disclosure.

The third issue identified via Wireshark involved the system assigned the IP address of 192.168.27.15. In Wireshark between frames 29101 and 29325 I found that the computer assigned the IP address of 172.16.80.243 attempted to login to the system via Telnet. The malicious user first attempted to use the username “Administrator” with the password “Passw0rd.” They then attempted to login to the system using the username “User” and the password “Passw0rd” (see Figure 7 and Figure 8.) It should be noted that this is the same password that was found to be used between the systems assigned the IP addresses of 192.168.27.18 and 192.168.27.12 during their previous FTP session which used cleartext and was susceptible to sniffing attacks.

The overall underlying problems with the systems are the use of the FTP protocol and the use of Telnet protocol. Both protocols are unsecured and should not be used. The use of these protocols could result in unauthorized information disclosure. It can also lead to other issues such as vectors for DoS attacks.

E: SOULTIONS If a system on the network is going to be publicly addressable (such as a webserver) it is going to be vulnerable to a port scanner. However, there are some things that can be done to limit the amount of information that is disclosed via a port scan, such as closing unnecessary services that are not being used by the system. For example, if the system is only going to be used as a webserver, then things like Telnet (port 23) and FTP (port 21) should be closed. (Roger, 2001) Therefore, I recommend hardening each of these systems by removing any unnecessary services to reduce the risk of an attack as much as possible.

FTP is insecure by nature and should not be used. In industries that are regulated, it is nearly impossible to be in compliance with regulations if FTP is being used. (SSH Communications Security, Inc., 2017) Therefore, I recommend replacing FTP with SFTP and SSH. Both SFTP and SSH are supported on all modern operating systems and use encryption to protect the confidentiality of the communications.

Like FTP, Telnet is also an unencrypted protocol which is an easy target for sniffing attacks. I recommend replacing Telnet with SSH. If for some reason Telnet is deemed absolutely necessary to manage specific network devices, then I recommend using an access control list (ACL) on the router to restrict access. (Mullins, 2005) As a final recommendation, I propose implementing an Intrusion Prevention System (IPS) to help thrwart outside attacks. Network-based Intrusion Prevention Systems can detect and then automatically block potential attacks such as the one that occurred in this scenario.

(Scarfone, 2007)

F: SOURCES Mullins, M. (2005, JAN 27). Protect your network from this Telnet vulnerability. Retrieved from Tech Republic: https://www.techrepublic.com/article/protect-your-network-from-thistelnet-vulnerability/ Roger, C. (2001, OCT 5). Port Scanning Techniques and the Defense Against. Retrieved from SANS Institute: https://www.sans.org/reading-room/whitepapers/auditing/port-scanningtechniques-defense-70 Scarfone, K. (2007). Intrusion Detection and Prevention Systems. Retrieved from National Institute of Standards and Technology (NIST) : https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=901146 SSH Communications Security, Inc. (2017, MAR 3). Use SFTP for Security and Robustness.

Retrieved from SSH: https://www.ssh.com/ssh/ftp/server