The complete security Part - I Anti-Scanning

------------------------------------------------------.Part1.---------------------------------------------------------
Good Morning/AfterNoon/Evening to all of you out there.

Yes this is just another guide to protect your server that is fresh from the company you bought it from, already configured and just needed to be pluged in. You are not even aware that the box is insecure at all. The next day you wake up to see it scrambled without a clue on what happened. This is why we are here. To save YOU from being destroyed. Read each and every single word of this tute if you want to stay alive in this mad world. But remember through this tute you will have to use common knowledge of the real world around you.

First of all the first step of knowing about a computer is by scanning. This process gives you a detailed information of the target system. By the means of scanning, one can find out the weaknesses and loopholes in a system. But the dis-advantage of scanning is that a programme running on the remomote system can easily detect the client that is trying to access the system and we have to take advantage of this weakness. In other words the client(attacker) is like a jackal trying to steal the lions food while its still eating it. All we have to do is get some programmes to sniff the sniffers(scanners). These programs differ depending on the platform. But more such prgs/walls can be used to protect the system.

Detection:
These programs can be easily detected through understanding when and by whom the attack is made. By knowing who you're dealing with you may be able to take counter measures. For ex. if you manage to capture the ip address of a person it may be possible to track him down or block him unless he has an dynamic ip. This is can done using software like:

Unix:
1) Snort (http://www.snort.org)
2) Scanlogd (http://www.openwall.com/scanlogd/)
3) Courtney - 1.3 (http://packetstorm.securify.com/unix...tney-1.3.tar.Z)
4) Ippl - 1.4 (http://www.pltplp.net/ippl/)
5) Protolog 1.0.8 (http://packetstorm.securify.com/unix...g-1.0.8.tar.gz)

Windows:
1) Genius (http://www.indiesoft.com)
2) BlackIce (http://www.networkice.com)
3)Zone-alarm(http://www.zonelabs.com)
Also Read this article on anti port scanning http://www.impsec.org/linux/security...tarpit-4.html.

Canary, Portkepper are monitoring tools too and Microsoft Base line is a prg that scans your comp for known vulnerabilities.

Now that we learnt on how to detect scans, we should also prevent these - "Prevention is better that cure" i.e. unless you have a back up of all the up-to-date data (for non-important data). It is very difficult to prevent someone from port scanning your system but the most you can do is take the most possible measures. For ex. you can't shut down all the TCP/UDP Ports. But you can deny access. In Linux, first of all you hae to close all un-necessary services through /etc/inetd.conf and remember doing this is not enough, You HAVE TO DISABLE THEM IN THE STARTUP SERVICES. Or else it will be like using a Hand Kerchief instead of a blanket to sleep in the North Pole. Softwares like Genius, Zone-alarm etc... Just record them. But programmes from http://www.tinysoftware.com provide a packet filtering and fireewall to save your ports. And how could I forget Sygate - http://www.sygate.com. But remember these are all just firewalls. You have to configure the properly. You should be careful while doing so. If you mess up, not a soul can access even your web site.

More will be on its way.
--------------------------------------------------.End of part ONE.------------------------------------------------

1) Genius (http://www.idiesoft.com)
wont open

Sorry, the mistake has been corrected.
You were right its http://www.indiesoft.com not idiesoft

not a good tutorial.

first you need to explain what portscanning is, how it works, and some programs that do the scan.
then you will need to explain that you must do scans against your self to know what are you defending.
Then close the ports that you do not need, i do not know why you need a sniffer since all portscanning packets are the same, and you could find examples of them online, they also contain no data that is important.

Yeah I know I thought of includein utils like nmap, icmp etc...
But I Couldn't give a brief explanation for all of it. My terms are around the corner so I dont have time for it. But I will Include it in part - II I promise. I thought I'd show them how to protect themselves then laterwhen possible give the long discription.

first of all if people use this tutorial just for protecting them selves, then ow my they are doomed.

any ways, thanks and keep up the good work

nice try mate u could have done better :) any way good first tut ,know haw hard it is to doa original work. u should have done a bit of research though

Also do you have any experience with those firewall programs? I have used Zone alarm and some of the others and find them a pain in the ass to configure and get working. Also hardware firewalls detect just as well and a twice as good. Maybe disscusing portscanners in general and one that you like would also help your tutorial...

A good idea for you and I have done this myself is to have a look at all these ideas and rewrite your tutorial. A revised version if you know what I mean.

That way you get to learn yourself whilst helping others.

The article has some good info, but it almost feels like a sales pitch - no offense.

These firewalls are good (and that's it...just good). Problem is, most hacker's exploits (not the older ones like SubSeven and BO 1.20 or Script Kiddie stuff) will get around these lightweight firewalls. Trust me on this...I've seen it. I'm sure I sound like a broken record, because I've said in in all my posts thus far (a whopping 3 to date), but anyone that relies on a just a firewall (especially ZoneAlarm, BlackICE, or Sygate or other software only firewall) as their ONLY line of defense, especially on Win32, is just about as bad as having a naked PC.

A firewall alone (even these convienent Firewall/IDS/Everything Else but the kitchen sink types, cannot protect you 100%. Nothing can. (Except maybe an internet connection slower than 9600 baud!!! Who'd waste their time?

My point is that a layered defense is much better, using multiple scanners, port blockers, IDS techniques, etc. Hopefully, you intend to address this in a future installment.

Also, I have a great collection of tools and informational resources. I'll post it in a .htm file complete with links to other sources. Its very open disclosure, so I don't want to here about any of you guys abusing your powers ;)

Quote:

---

Problem is, most hacker's exploits (not the older ones like SubSeven and BO 1.20 or Script Kiddie stuff) will get around these lightweight firewalls

---

You clearly don't have a clue what you're talking about here.
Sub7 or BO are not exploits they are simply "malicious remote administration tools" mostly trojans.
A decent configured firewall should stop almost everything, like the Blaster worm for example, if you have a properly configured firewall you wouldn't have gotten infected.

An exploit well, does what it says, it exploits a bug.
Trojans and **** don't exploit bugs.

Of course like you said a layered defense is much better, and of course necessary for a company. Solution: a router

hi,

I'm working on the part IIseeing the probs here. I'll try to include .conf (or something like that)files into the article. Butthis can be very dangerous in some situations. And as far as trusting firewalls go, I dont trust even security given bygreatest amount of firewalls. Its just a code begging to be cracked. And also abt the tools,I am not sure if to be posted here?? Tell me if I can put tools and their uses just so that I can exoplain how to counter them. Its your decision and I need a quick answer for it if I need to finish the tute in Jan 2k4. :confused:

About the trojans I agree with what you have to say. But my question is that if they are broken down, a few basic (not so good type) firewalls may not be able to detect and differenciate between 'em especially if decoy is used. Although commercial and good firewalls may be able to stop them, this is a quite common encounter.

Here is a suggestion for you. Go into the tutorials forum and review what tutorials have already been written. This way, you wont duplicate your efforts and you will also keep the tutorials forum clear of duplicate tutorials.

While I'm handing out suggestions, you might want to read the sticky at the top of the tutorials forum. It will provide you with guidelines for writing a good tutorial. As others have pointed out with varying degrees of directness, your post really isn't a tutorial, rather, a few paragraphs of questionable general information.

Hope this helps you out.

--TH13

:)