Firewall Discloses Information.

Hi,

I am running the Sygate firewall on my system, which is running Windows 2000 Professional. I have blocked nearly all the applications or put an 'Ask' option before any applicatoin starts, except for the generic ones.

I am on a LAN connection. However, recently, over an IP scan (don't know which scanner was used), all the IPs of my dorm were detected (most of us use Sygate et al). The person who did the scan was also able to tell us about whether we were using Linux or Windows. I thought that a firewall does not disclose the OS information to an outside scanner.

Also none of us, who are running Windows, got any attack logs in our firewall log files. Can you tell me how this is possible, what kind of scanner was the person using and what are the steps needed to block such information disclosure in future.

Thanks and Regards,
Bluzky.

your firewall logs didn't mention any "Port Scan Activity"?

Nmap comes to mind. Why don`t you just ask the person what scanner they were using?
I use sygate and it picks up portscans. At least the ones i know about.

Hi,

Thanks for replying.

No portscan logs et al were found in the log files. This is what amazes me.

I also think that Nmap could have been used. I tried to run Nmap on my IP. It did not detect much but for the BFTP server that I am running. Could this be the reason for the Windows OS detection?

And how can this FTP server detection be taken care of, since I myself saw NMAP detecting the FTP server running on my comp. Though Sygate does not ask for trusted IPs, however I tried NMap on Keiro also, but again the FTP server is being detected.

We have no idea who this person is, who ran the scans on our IPs. We just got an email from a yahoo address with the IP and OS information in it. I think its someone on the campus only who is trying to be a little mischievous. But still, the whole thing makes the adequacy and efficiency of a firewall questionable.

Thanks.
Bluzky.

Get nmap and try it out on yourself.
http://www.insecure.org/nmap/

[edit] sorry, i just read your post again and saw that you already did this[/edit]

Quote:

---

We have no idea who this person is, who ran the scans on our IPs. We just got an email from a yahoo address with the IP and OS information in it.

---

That`s strange...

Are your addresses public or private..... If you don't know the difference just post the first two octets such as 214.144.xxx.xxx

If they are private it's someone in college with you. And that's how they know your email address. if it's public then some naughty person went further than just scanning.

Our IPs are private IPs accessible only on the LAN. Access to our systems is not granted from outside the LAN so there is no chance of anyone trying this from outside the LAN network.

It has to be some guy on campus, but that is not the issue here. I wanted to know if such information can be avoided from disclosure. Till now, we only know that someone got to know our IPs (which he can do with any scanner) and also our OS (open port scans et al), but inspite of most of us having firewalls running on our systems. We don't know what else he has been able to gather from his scans, and thus the need to worry.

NMAP does show the presence of BFTP server, nearly with every firewall running. Is there any way of taking care of such anomalies. And also, does anyone have any idea what kind of scans this person might be running, which is bypassing the firewall itself, as no logs were found.

Hrmm... I wonder if he's picking up the information through other methods. How do you know that he even did scans and what suggests to you that he did do any scanning? You said that he sent an email to "everyone" with their IP and OS, right? I can pick out what OSes are running using Ettercap (there is an option to do OS detection with this sniffer). That would mean that I have access to the local LAN and can detect the OS without you knowing it.

The firewall becomes a non-entity because I use existing connections. In addition, anything sent in cleartext (ie., user names and passwords) can be easily collected.

The fact that he sent you an email suggests he knows you.

[edit]

Thought just occurred to me to add this because some may not realize it. There is a technique of detection referred to as "passive scanning". NMAP, Retina, Saint, SARA, etc. are all "active scanners". That is, they go and ask the target information.

Passive scanning or OS detection listens for packets and based on construction and TTLs determines the source OS (this has a far less reliable detection but can allow for detection of OS without being caught scanning).

The following might also help:

SecuriTeam Passive OS Detection Tool

Passive OS Detection Techniques and Details

Ofir Arkin's papers and work into OS Fingerprinting should also be reviewed. Visit Here

once you allow access for a service (ftp) to the internet its no longer protected by the firewall unless your doing filtering by ip. does sygate give you the option to allow ftp access and log connections anyway? are the others that were all detected runnnig an ftp server?

have you tried using nmap to run a stealth scan to see if sygate picks it up? and no ones running any filesharing software?

you could probably change the banner info in bullet proof. run strings.exe against all its files until you find the one that contains the banner info. open that file in a hex editor and change what needs to be changed (ascii chars) making sure you leave the number of characters in the string the same.

Another way someone could gain this information, is if they were to place something like 'Site Meter' on a web site everyone visits.
You can get information, such as this (from every visitor to the site):

Quote:

---

Domain Name Level3.net ? (Network)
IP Address XX.XX.XX.XX (ARIN)
Language Setting English
Operating System Microsoft WinXP
Browser Internet Explorer 6.0
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; YComp 5.0.2.6; FunWebProducts)
Time of Visit Mar 30 2004 5:08:24 pm
Last Page View Mar 30 2004 5:08:24 pm
Visit Length 0 seconds
Page Views 1
Referring URL
Visit Entry Page http://yoursite.com
Visit Exit Page http://yoursite.com
Time Zone UTC-5:00
EST - Eastern Standard
EDT - Eastern Daylight Saving Time
Visitor's Time Mar 30 2004 8:08:24 pm

---

And it will even graph the different types of OS's and or browsers that visit the site. The attachment is a grafh of the different browsers used to visit a site I have.

The only way I know of to defeat this is by using Proxomitron and not allowing counters to even detect your presents.

Knowing when a firewall is installed is pretty easy. Firewalls tend to just drop the packets they receive. A regular non-firewalled host will return RST packets in response to SYN packets send to closed ports. If any of the ports are open (like your ftp port) they would return a SYN-ACK. Both the SYN-ACK and the RST packets will have a TTL. You can tell the difference between *nix and windows just by looking at the TTL value.

Quote:

---

If any of the ports are open (like your ftp port) they would return a SYN-ACK. Both the SYN-ACK and the RST packets will have a TTL. You can tell the difference between *nix and windows just by looking at the TTL value.

---

But can't the TTLs be changed using the Firewall? (IIRC you can do this in iptables)

Quote:

---

Originally posted here by MsMittens
But can't the TTLs be changed using the Firewall? (IIRC you can do this in iptables)

---

Yes that's possible. You can even change the TTL without the help of a firewall (it's a configuration option of the TCP/IP stack). But most people using personal firewalls aren't even aware there is such a thing as a TTL and AFAIK personal firewalls don't change it either. So chances are pretty slim that the TTL was modified.

Simple fact is that if you provide any service whatsoever then the firewall lets the OS answer rather than dropping the packets. Once you let the OS answer then the differing implementations of the TCP/IP stack can and will give away your OS to anyone that wants it unless you have done something to modify the stack..... Which I'm guessing you haven't.

Then, you are on the same network segment. Well..... It's all too easy there really isn't it. I can use anything to sniff packets, and there are ways of doing it on a switched network. A quick look through the captures will tell me your OS if I know what I'm doing. Then, also, getting your email address etc. is fairly trivial..... maybe even your passwords especially if you use POP to the local mail server.

He has physical access to your network, period. So unless you firewall, provide no services and only use an encrypted tunnel for everything you do then he will be able to glean an awful lot of info about you quite easily.

I have to agree with Tiger. He's gotta be another student on the network. I just did about 5 variations of Nmap scans. Sygate picked them all up. So the fact that your's didn't makes me think this is a passive OS fingerprint and that perhaps you have more serious issues to worry about (like passwords in the clear).