Fail2ban Postfix Filter Remote Denial of Service Vulnerability
libarchive 'archive_write_zip_data()' Function Local Denial of Service Vulnerability

Before we get into this here is the standard disclaimer.  Do not scan any devices that you do not have explicit permission to scan.  If you do not own the devices I strongly recommend you get that permission in writing.  Also, port scanning may cause instability or failure of some devices and/or applications.  Just ask anyone who lost ILOs to heartbleed.  So be careful!

As we have seen in past diaries about reflective DDOS attacks they are certainly the flavor of the day.  US-CERT claims  there are several UDP based protocols that are potential attack vectors.  In my experience the most prevalent ones are DNS, NTP, SNMP, and CharGEN.  Assuming you have permission; Is there an easy way to do good data gathering for these ports on your network? Yes, as a matter of a fact it can be done in one simple nmap command.

nmap –sU –A –PN –n –pU:19,53,123,161 –script=ntp-monlist,dns-recursion,snmp-sysdescr <target>

Let’s break this down:

-sU –perform a UDP scan.  Since all the services above are UDP I only need to scan for the UDP ports.

-A -perform operating system and application version detection.  This will attempt to give you more information about what applications are running on the open ports.  The -A option also includes operating system detection, but it is unlikely that operating system detection will work when scanning this few ports.

-PN –scan even if you can’t contact the IP.  By default nmap will not scan any device it can’t contact. Unfortunately if a device is hidden behind a firewall nmap will not usually be able to detect the device and will omit it from the detailed scan.  A downside of using –PN is that nmap will complete the detailed scan against the IP even if it doesn’t exist or no ports are open.  If you are scanning a large number of IPs the scan will take a long time.

-n –don’t do a DNS resolution.  By default nmap performs a DNS resolution.  Not doing that resolution will speed up the scan somewhat.

-pU:19,53,123,161 –scan UDP ports specified.  In nmap ‘–p’ is used to indicate which ports to scan. The ‘U’ tells nmap that the ports that follow are UDP ports. Since this scan is only scanning UDP ports (–sU) the ‘U’ is redundant.  However over the years I have gotten into the habit of explicitly specifying which type of ports I want to scan unless I want to add some TCP ports (-pT:) to the scan at a later time.

The ports specified in this scan are:

  • 19 – CharGEN
  •  53 – DNS
  • 123 – NTP
  • 161 - SNMP

–script=ntp-monlist,dns-recursion,snmp-sysdescr – the –script= option enables the nmap scripting engine (NSE) and runs scripts when they make sense to run.  In other words, the ntp-monlist script will only be run when the NTP port is found to be open.  nmap has many scripts available which can be used to extend nmaps basic functionality.

The scripts specified on this scan are:

  • ntp-monlist – while any open NTP service can be used in a reflective DDOS attack the maximum amplification is achieved with NTP services that permit the monlist command to be executed. This script will do a check to see if monlist can be executed against an open NTP port.
    • Normally an open NTP service will look similar to:

123/udp   open   ntp   NTP v4

If the monlist command is enabled on the ntp server, the ntp-monlist script will give you more information:

123/udp open  ntp     NTP v4

| ntp-monlist:

|   Target is synchronised with

|   Alternative Target Interfaces:

|       XXX.16.1.71    

|   Public Servers (4)

|       XXX.87.64.125    XXX.75.12.11    XXX.108.0.131

|   Other Associations (596)


  • dns-recursion – Normally public DNS servers will only answer DNS queries for which they are authoritative.  A DNS server that permits and processes queries for names it is not authoritative are called recursive DNS servers and recursive DNS servers in most cases are misconfigured.   The output for an open DNS port with recursion enabled will be similar to :

53/udp  open          domain  Microsoft DNS 6.1.7600 (1DB04228)

| dns-nsid:

|_  bind.version: Microsoft DNS 6.1.7600 (1DB04228)

|_dns-recursion: Recursion appears to be enabled

  • snmp-sysdescr – attempts to extract more information from the SNMP service.  An open SNMP service will look similar to:

161/udp open     snmp    SNMPv1 server (public)

  • With the snmp-sysdescr script it will usually display more information which may tell you more about the device you are scanning:

161/udp open|filtered snmp

|_snmp-hh3c-logins: TIMEOUT

|_snmp-win32-shares: TIMEOUT


161/udp open     snmp    SNMPv1 server (public)

| snmp-sysdescr: Apple AirPort - Apple Inc., 2006-2012.  All rights Reserved.

|_  System uptime: 9 days, 20:15:36.56 (85053656 timeticks)

Want to take a guess at what these devices are?

As you can see nmap provides a simple and effective way of scanning for the common ports used in reflective DDOS attacks.  This diary has barely scratched the surface of nmap’s capabilities. 

I would be interested to know if any of you have ways to enhance or improve this scan.


-- Rick Wanner - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected)

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Nice Systems of Israel said it patched remaining critical flaws in its call recording software used by law enforcement, but the consultancy that discovered the risky flaws hasn't verified the fixes.
Customers have been telling Hewlett-Packard that they want laptops that run Android, so the company is rolling out the SlateBook PC to meet that demand.
Tablets are mostly packed with flash storage, but Hewlett-Packard has made an exception and plugged a high-capacity hard drive into its latest Split X2 budget tablet.

Many ISPs manage user's modems, be it DSL or Cable. Even if the ISP doesn't own the modem, they typically push configuration or firmware updates to the modem to keep it up to date and connected to their network. Overall, this isn't a bad idea. Keeping the firmware and configuration up to date would be rather difficult to end users. However, as some users have experienced with Comcast, these changes are not always in the customer's best interest.

For example, if you do use a Comcast provided modem with Comcast's "Business Class" access, your modem will be assigned a set of static IP addresses, but in addition, you will also receive a DHCP assigned address. This address isn't really used for any of your traffic. But, the address is reachable, and the modem's configuration screen is accessible via http (port 80/tcp) if someone connects to the address. The default (and widely known) password doesn't appear to work to log in in this case, but any bugs present in the configuration may be exposed. It wouldn't be the first time that a web based admin interface includes an authentication bypass vulnerability.

Luckily, the "dynamic" IP address that exposes the admin screen does not appear to be derived from the static address assigned to you by Comcast. So an attacker would have to scan all of Comcast's address space and would have no simple way to figure out who owns which dynamic address.

If you want to be a bit more secure, you can try and change the password from the default. However, be aware: As soon as the firmware is updated again, your new password will no longer work, neither will the default password. You will need to call Comcast support to have them reset the password.

Secondly, Comcast apparently started to enable public WiFi hotspots on cable modems that support the feature. In addition to charging users a rental fee for the modem, Comcast went ahead and turned the modems into public hotspots that can be used by other Comcast customers who happen to be in the area.

To turn off the public WiFi feature, you will need to connect to the Comcast customer portal (http://customer.comcast.com) and need to remove the option. After logging in, find the "Users & Preferences" option at the top of the screen

Then, find the "Manage Wifi" link (very small font, just below your address)

It is also a good idea to not use the default LAN IP range (e.g. or Instead, pick your own "random" range within RFC1918 space.

Johannes B. Ullrich, Ph.D.

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Nutanix Virtual Computing Platform brings resilient, cloud-like server and storage infrastructure to traditional virtualization deployments
A new but delayed chip from Intel that promises better performance and lower power consumption for tablets and laptops will take a small but important step forward this week with a planned demonstration at the Computex trade show.
Google Chrome 35.0.1916.114 Multiple Security Vulnerabilities
Internet Storm Center Infocon Status