C844 Task 1Revised.docx.pdf

downloaded from

Scholarfriends

https://scholarfriends.com

Downloaded by: browsegrades@gmail.com | https://scholarfriends.com/singlePaper/206500/c844-task-1reviseddocxpdf Distribution of this document is illegal.

Nathan Byrd xxxxxxxxx C844 Emerging Technologies in Cybersecurity Task 1

A. Describe the network topology you found when running Nmap. Include screenshots as evidence of running Nmap.

In order to see the network topology, I used the Zenmap version of nmap to run the scan on the network. As seen in the image below, the network is set up in a star topology. The central device in the star network is host 192.168.29.2, with 9 devices connecting to it. All the devices are under the 192.168.27.x subnet, so for simplicity I will refer to the device by the ID of the last octet of the IP address for the remainder of the report. The scan also shows the probable operating system of each device within the network. Hosts 10, 11, 12, 15, and 17 are most likely running Windows, hosts 14, 17, 20 are likely running a Linux OS, and host 13 is most likely a VPN gateway.

B. Summarize the vulnerabilities on the network and their potential implications based on your Nmap results.

Some of the hosts scanned showed potential vulnerabilities based on open ports and operating systems. I will highlight them below, including images of the Zenmap scan results Host 192.168.27.12 - The scan for host 12 shows ports 21, 80, 135, 139, and 445 open. Port 21 is potentially vulnerable as the FTP service that runs on it uses cleartext transmissions.

This means that usernames and passwords used for authentication are not encrypted and can be seen by anyone. Any data or files transmitted using this protocol are also vulnerable. This protocol is very susceptible to password sniffing and man-in-the-middle attacks. Ports 135, 139, and 445 are all ports used by the WannaCry Ransomware to infect Windows systems.

The WannaCry Ransomware can infect every version of Windows from XP to 10.

Ransomware is particularly nasty as it encrypts all the files on your computer, and demands payment, usually in Bitcoin, to receive the key to decrypt the files. Sometimes, the key isn’t even delivered. The only way to recover from a ransomware attack is to restore the system from the most recent backup, which can lead to loss of data going back hours or even days (Shaw, 2018).

Host 192.168.27.14 - The scan shows host 14 has ports 22 and 9090 open. Port 9090 is used for remote server administration for Linux servers running Red Hat Enterprise Linux and its siblings. It has a vulnerability that could allow an attacker to cause a denial of service on the server, making it inaccessible(SpeedGuide, "Port 9090 (tcp/udp)"). Port 22 uses the SSH protocol, which is commonly used to remote manage a system. If this is not configured properly or is set up with default passwords, an attacker can easily compromise the port and gain complete control over a system. This is even more likely if the version of SSH is not at the current version, which can introduce more vulnerabilities and potential attacks for port 22.

Host 192.168.27.15 - The scan of Host 15 shows several ports open. The most concerning is port 23, which runs the telnet protocol. The telnet protocol allows a user to gain a terminal session on the machine. While it requires authentication with a username and a password, often these values are left blank, a default value, or easily guessed credentials. This makes telnet an attractive target for hackers, as it is easily bypassed and gives them full control over the system (Gibson 2008). Ports 135, 139, and 445 are also of concern. Ports 135, 139, and 445 are all ports used by the WannaCry Ransomware to infect Windows systems. The WannaCry Ransomware can infect every version of Windows from XP to 10. Ransomware is particularly nasty as it encrypts all the files on your computer, and demands payment, usually in Bitcoin, to receive the key to decrypt the files. Sometimes, the key isn’t even delivered.

The only way to recover from a ransomware attack is to restore the system from the most recent backup, which can lead to loss of data going back hours or even days (Shaw, 2018).

Host 192.168.27.17 - The scan of Host 17 shows port 5555 open. This port is used by the game FreeCiv. If this is indeed a business server, it should be questioned why it’s being used to run any game. Also, FreeCiv has had vulnerabilities associated with it throughout the years. If this is a vulnerable version of the game, an attacker could use them to perform a DoS attack, or even gain control of the server (CVE Details, "Freeciv : Security Vulnerabilities").

Host 192.168.27.19 - The scan for host 12 shows ports 21, 80, 135, 139, 445, 5800, and 5900 open. Port 21 is potentially vulnerable as the FTP service that runs on it uses cleartext transmissions. This means that usernames and passwords used for authentication are not encrypted and can be seen by anyone. Any data or files transmitted using this protocol are also vulnerable. This protocol is very susceptible to password sniffing and man-in-the-middle attacks. Ports 5800 and 5900 are used by VNC service, which allows remote control of systems. If this is not set up properly, an attacker could use either port to gain control of the server. Ports 135, 139, and 445 are also of concern. Ports 135, 139, and 445 are all ports used by the WannaCry Ransomware to infect Windows systems. The WannaCry Ransomware can infect every version of Windows from XP to 10. Ransomware is particularly nasty as it encrypts all the files on your computer, and demands payment, usually in Bitcoin, to receive the key to decrypt the files. Sometimes, the key isn’t even delivered. The only way to recover from a ransomware attack is to restore the system from the most recent backup, which can lead to loss of data going back hours or even days (Shaw, 2018).

C. Describe the anomalies you found when running Wireshark, on the network capture file, and include evidence of the range of packets associated with each anomaly.

- Starting at packet 1334, there appears to be an NMAP scan of the hosts from host 172.16.80.243. It lasts until packet 3345. This appears to be a simple port scan from NMAP. - There appears to be a DNS attack from packet 33081 to 33086, hitting hosts 11 and 15, where the attacker appears to perform a DSUnbind request.

- From packets 35440-35550,there is someone utilizing FTP between hosts 12 and 18, using the anonymous user and a generic, commonly used password. This is likely an attacker as a legitimate user should have a unique account. The anonymous user successfully transfers 3 files with generic names.

- From packet 6442 to 6731, 9524 to 9865, and 24460 to 28357, there appears to be a web application attack. It originates from host 172.16.80.273 and shows the attacker hitting host 12, 14, and 17. It shows access attempts for multiple URI addresses, as well as non standard HTTP methods, including OPTIONS and PROPFIND. D. Summarize the potential implications of not addressing each of the anomalies found when running Wireshark.

- When you have public facing websites, it is impossible for them to not be scanned by attackers. Casual attackers are always scanning the internet. However, having unnecessary ports open to the internet is always a bad idea. It can lead to attackers being able to gain access to your systems, discover vulnerabilities that can compromise your systems, or allow for easy Denial of Service attacks.

- If an attacker can successfully perform a DNS transfer, they can effectively gain control of all the requests sent to your domains. This would allow them to redirect user traffic to sites they control, allowing them to harvest credentials, harvest sessions and cookies, and potentially take over user systems.

- Allowing the anonymous user account on FTP not only allows makes it difficult to audit who used the service, it can allow non authorized users to log in. This means that files can be transferred without any record of who transferred them, which means sensitive, confidential information could be stolen or sold.

- Web application attacks are very common and hard to eliminate entirely. However, allowing HTTP methods that aren’t necessary for the end user leads to potential weaknesses. The OPTIONS method allows an attacker to see all methods available on the web application.

The PROPFIND method allows an attacker to see the properties of backend XML files. If these files have any sensitive information, then they would be exposed to the attacker. This might include hidden directories, website structure, addresses and hostnames of connected servers and services, and possibly even user credentials.

E. Recommend solutions for eliminating or minimizing all identified vulnerabilities or anomalies from Wireshark and Nmap. Use current industry-respected reliable research and sources to support your recommendations.

Nmap Allowing ports to be open is a necessary part of a business. However, the only ports that should be open to the world should be the bare minimum for required functionality. Even when ports do not have vulnerabilities associated with them, the information and profiling that can be gleaned from a network scan could be used by an attacker. The vulnerable ports and services called out form the Nmap Scan should immediately researched to confirm that they are needed for business reasons. Those that are required for business operations should be upgraded to remove the vulnerability, or have some additional security put in place. FTP could be set up as either SFTP or FTPS to remove that vulnerability. Port 22 should have access disabled to outside the network, and the version of SSH should be checked to make sure it is not a vulnerable version. Default logins should be disabled, as well as strong credentials used for all authorized users (SecurityTrails Team, "SecurityTrails: Mitigating SSH based attacks – Top 15 Best SSH Security Practices", 2018). For ports 135, 139, and 445, the only real way to prevent a ransomware attack is to close down the ports associated with it. These ports should be closed down immediately. For ransomware attacks in general, the company should make sure they have a backup policy in place to make sure that they don’t lose too much data if a ransomware attack hits them(Shaw, 2018). All other ports,

vulnerable or not, should be closed to the internet. The telnet service should be shut down on all servers, and the FreeCiv game should be shut down (Gelnaw, 2019).

Wireshark As stated above, allowing unnecessary ports open to the internet is a bad idea. They should all be closed, to prevent a port scan from gleaning too much information about the servers.

An improperly configured DNS can facilitate a DNS Zone transfer. This allows future attacks from the attacker to be much more successful. This can be mitigated by hiding the BIND version of the server, restricting Zone Transfers, and using Two-Factor Authentication to prevent a credential leak from leading to further compromise(SecurityTrails Team, "SecurityTrails: 8 tips to prevent DNS attacks", 2018). For the FTP issue, all anonymous logins should be denied. This is a security risk for attackers, recovering from an attack, auditing for internal and external compliance, and being aware of who is adding, moving, and removing files from your systems (“FTP anonymous logins”). For the HTTP methods, it’s recommended to disable all HTTP methods that aren’t necessary. This includes OPTIONS, PROPFIND, TRACE, and DEBUG (Mosmans, 2017).

Reference

CVE Details. (n.d.). Freeciv : Security Vulnerabilities. Retrieved from https://www.cvedetails.com/vulnerability-list/vendor_id-4141/Freeciv.html FTP anonymous logins. (n.d.). Retrieved from https://www.acunetix.com/vulnerabilities/web/ftp-anonymous-logins/ Gelnaw, A. (2019, May 21). Open Port Vulnerabilities: What's the Big Deal? Retrieved from https://www.bitsight.com/blog/open-port-vulnerabilities-whats-the-big-deal Gibson, S. (2008). GRC : Port Authority, for Internet Port 23 . Retrieved from https://www.grc.com/port_23.htm Mosmans, P. (2017, April 7). unsafe HTTP methods. Retrieved from https://www.onwebsecurity.com/security/unsafe-http-methods.html SecurityTrails Team. (2018, July 4). SecurityTrails: 8 tips to prevent DNS attacks. Retrieved from https://securitytrails.com/blog/8-tips-to-prevent-dns-attacks SecurityTrails Team. (2018, August 29). SecurityTrails: Mitigating SSH based attacks – Top 15 Best SSH Security Practices. Retrieved from https://securitytrails.com/blog/mitigating-sshbased-attacks-top-15-best-security-practices Shaw, B. (2018, September 10). Disable TCP Port 135 and Avoid WannaCry Ransomware on Windows 10, 8.1, 8, 7, Vista, XP. Retrieved from https://www.drivethelife.com/windowsdrivers/disable-tcp-port-135-avoid-wannacry-ransomware-windows-10-8-7-vista-xp.html SpeedGuide. (n.d.). Port 9090 (tcp/udp). Retrieved from https://www.speedguide.net/port.php? port=9090