Subject: Attacks and Role of FWTK

From: Naresh Narang <[email-masked]>
Date: Tue, 07 Mar 2000 10:20:11 +0530

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello,

        I got following messages in my /var/log/messages:

portmap[447]: connect from 212.171.166.222 to dump(): request from
unauthorized host
Mar  6 00:00:46 portmap[448]: connect from 212.171.166.222 to
getport(mountd): request from unauthorized host

Lame server on '38.220.67.206.in-addr.arpa' (in
'220.67.206.in-addr.arpa'?): [198.6.1.83].53 'AUTH03.NS.UU.NET'
Mar  6 14:12:26  named[311]: bad referral (. !< timesindia.COM)

ns_forw: query(6.241.123.131.in-addr.arpa) A RR negative cache entry
(KSUVXA.KENT.EDU:)
Mar  6 14:33:21  identd[887]: from: 131.123.241.6 (
mars.internet2.kent.edu ) for: 8986, 80
Mar  6 14:33:21  identd[887]: Returned: 8986 , 80 : NO-USER
Mar  6 14:33:29  named[311]: Lame server on 'dune.mcs.kent.edu' (in
'MCS.KENT.EDU'?): [131.123.1.1].53 'ns.net.kent.edu'
Mar  6 14:33:59  identd[889]: from: 131.123.241.2 (
dune.internet2.kent.edu ) for: 9063, 80
Mar  6 14:33:59  identd[889]: Returned: 9063 , 80 : NO-USER
Mar  6 14:33:59  identd[888]: from: 131.123.241.2 (
dune.internet2.kent.edu ) for: 9140, 80
Mar  6 14:34:00  identd[888]: Returned: 9140 , 80 : NO-USER

Please tell me:   What type of attacks are these. Is any proxy required
for portmapper. What is the intension of the attacker and how to prevent
it.

Thank You,
Naresh Narang

---

From: Dave Diemer <[email-masked]>
Date: Mon, 6 Mar 2000 21:12:05 -0800

How do you have your DNS setup? These are mostly
DNS errors. It appears you have a setup for only
known hosts but I could be wrong...

Remember:

portmap is a server that converts RPC program numbers into TCP or UDP
protocol port numbers.  It must be running in order to make RPC calls.

I belive "DNS calls" fall under this procedure.

Dave-

On Tue, 7 Mar 2000, Naresh Narang wrote:

|Date: Tue, 07 Mar 2000 10:20:11 +0530
|From: Naresh Narang <[email-masked]>
|To: "[email-masked]" <[email-masked]>
|Subject: Attacks and Role of FWTK
|
|[To be removed from this list send the message "unsubscribe fwtk-users" in the
|BODY of a mail message to [email-masked].]
|
|Hello,
|
|        I got following messages in my /var/log/messages:
|
|
|portmap[447]: connect from 212.171.166.222 to dump(): request from
|unauthorized host
|Mar  6 00:00:46 portmap[448]: connect from 212.171.166.222 to
|getport(mountd): request from unauthorized host
|
|
|Lame server on '38.220.67.206.in-addr.arpa' (in
|'220.67.206.in-addr.arpa'?): [198.6.1.83].53 'AUTH03.NS.UU.NET'
|Mar  6 14:12:26  named[311]: bad referral (. !< timesindia.COM)
|
|
|ns_forw: query(6.241.123.131.in-addr.arpa) A RR negative cache entry
|(KSUVXA.KENT.EDU:)
|Mar  6 14:33:21  identd[887]: from: 131.123.241.6 (
|mars.internet2.kent.edu ) for: 8986, 80
|Mar  6 14:33:21  identd[887]: Returned: 8986 , 80 : NO-USER
|Mar  6 14:33:29  named[311]: Lame server on 'dune.mcs.kent.edu' (in
|'MCS.KENT.EDU'?): [131.123.1.1].53 'ns.net.kent.edu'
|Mar  6 14:33:59  identd[889]: from: 131.123.241.2 (
|dune.internet2.kent.edu ) for: 9063, 80
|Mar  6 14:33:59  identd[889]: Returned: 9063 , 80 : NO-USER
|Mar  6 14:33:59  identd[888]: from: 131.123.241.2 (
|dune.internet2.kent.edu ) for: 9140, 80
|Mar  6 14:34:00  identd[888]: Returned: 9140 , 80 : NO-USER
|
|
|Please tell me:   What type of attacks are these. Is any proxy required
|for portmapper. What is the intension of the attacker and how to prevent
|it.
|
|Thank You,
|Naresh Narang
|

---

From: Naresh Narang <[email-masked]>
Date: Tue, 07 Mar 2000 11:10:47 +0530

The DNS is having entry for the only known host and that is firewall host. There
are no Internal ip addresses on this host. Internal DNS is forwarder to the
firewall host. Someone from "Outside" is trying for a "dump" and for
"getport(mountd)". What it could be?

Thank You
Naresh Narang

---

From: Rick Murphy <[email-masked]>
Date: Tue, 07 Mar 2000 07:00:48 -0500

>I belive "DNS calls" fall under this procedure.
I think you meant "NFS calls" (network file system). DNS doesn't use RPC.
         -Rick

---

From: Rick Murphy <[email-masked]>
Date: Tue, 07 Mar 2000 07:00:14 -0500

>portmap[447]: connect from 212.171.166.222 to dump(): request from

Portmap is used to locate RPC endpoints. The 'dump' request to the 
portmapper asks it to provide a list of all the RPC services running on 
your machine. You obviously have portmap wrapped so it rejected the request.

An attempt on your portmapper is often the first step of a Script Kiddie 
attack.

>getport(mountd): request from unauthorized host

Yup, it's an attack. Next, they try to connect to your NFS (network file 
system) mount daemon. There's a nasty set of buffer overflows here as well 
that the kids use.

>Mar  6 14:12:26  named[311]: bad referral (. !< timesindia.COM)

Someone doesn't have their DNS set up right. This isn't an indication of an 
attack.

>ns_forw: query(6.241.123.131.in-addr.arpa) A RR negative cache entry

Similar to the above (I think - I've never seen that one..)

>Mar  6 14:33:21  identd[887]: Returned: 8986 , 80 : NO-USER

If someone just browsed the kent.edu web site, this could be legit.

>Mar  6 14:34:00  identd[888]: Returned: 9140 , 80 : NO-USER

Ditto.

>for portmapper. What is the intension of the attacker and how to prevent

You shouldn't be running portmapper on your firewall. However, you appear 
to be running it wrapped to deny external access (that's the default on 
current versions of RedHat.) Your system was probed in the first case, but 
it turned the attack away. Nothing to get worried about; if it's a single 
instance, it's not worth reporting IMHO - repeated attempts are another case.
         -Rick

---

From: Ted Keller <[email-masked]>
Date: Tue, 7 Mar 2000 08:36:47 -0500 (EST)

Naresh,

Why do you have port map running on a firewall.  RPC calls are always a
source of vulnerabilities.  If at all possible, remove all portmapper and
all rpc services...

ted keller

---

From: Blair Lowe <[email-masked]>
Date: Tue, 7 Mar 2000 19:14:28 -0700

Hi Naresh,

I am assuming that you are running UNIX:

You should look at your inetd.conf file, and comment out any services 
that you don't need, or are insecure.

portmap and NFS are definitely a no no on a firewall, but that is a 
stand alone daemon (ie. not part of inetd services). NIS and SMB 
(SAMBA or Microsoft type  file services) also a risk on a firewall. 
If you need these services, then you should create an encrypted link 
(eg. IPsec, or CIPE) between your firewall, and the firewall of the 
LAN that you would like to connect to.

There is nothing wrong with running networking programs out of the 
inetd realm, but they must be ones that are known to be secure.

Hope this helps,
Blair.

>>  for portmapper. What is the intension of the attacker and how to prevent

Computer Engineering Inc.
http://www.compeng.net
Phone: 780 499 5687 (9 - 5 MST)
Fax:   780 435 0693 (24 Hours)