Is my home computer at risk knowing that nmap says...

Jay C. James · *nix forums beginner Joined: 06 Dec 2005 Posts: 12

"Moe Trin" <ibuprofin@painkiller.example.tld> wrote in message
news:slrne7pr32.mnf.ibuprofin@compton.phx.az.us...

Moe Trin · *nix forums Guru Joined: 20 Feb 2005 Posts: 972

On Tue, 30 May 2006, in the Usenet newsgroup comp.os.linux.security, in article
<e5i7de$7nn$1@home.itg.ti.com>, Jay C. James wrote:

Jay C. James · *nix forums beginner Joined: 06 Dec 2005 Posts: 12

"GM" <gaetan_martineau@yahoo.ca> wrote in message
news:1148971350.814822.316660@y43g2000cwc.googlegroups.com...

Moe Trin · *nix forums Guru Joined: 20 Feb 2005 Posts: 972

On 29 May 2006, in the Usenet newsgroup comp.os.linux.security, in article
<1148971350.814822.316660@y43g2000cwc.googlegroups.com>, GM wrote:

GM · *nix forums beginner Joined: 11 Mar 2006 Posts: 6

Molsons; I don't have at hand right now. But Singha, yes I do. And I am
glad to send!

And yes, firewall rules are set to "DROP".

By the way, I could also receive another nmap output, this one executed
right in my home town and the result is what I was more expecting to
see (below)

Great thanks again for this insight
Gaetan

nmap -sS -O -p 1-1024 xxx.xxx.xxx

Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2006-05-29
21:28
EDT
Warning: OS detection will be MUCH less reliable because we did not
find
at least 1 open and 1 closed TCP port
Interesting ports on xxx.xxx.xxx.xxx (xxx.xxx.xxx.xxx):
(The 1022 ports scanned but not shown below are in state: filtered)
PORT STATE SERVICE
21/tcp open ftp
80/tcp open http
Device type: general purpose
Running: Linux 2.4.X|2.5.X
OS details: Linux 2.4.0 - 2.5.20, Linux 2.4.10 - 2.4.18, Linux 2.4.19
(x86)
Uptime 24.828 days (since Fri May 5 01:37:31 2006)

Moe Trin · *nix forums Guru Joined: 20 Feb 2005 Posts: 972

On Mon, 29 May 2006, in the Usenet newsgroup comp.os.linux.security, in article
<slrne7nbb2.76i.ibuprofin@compton.phx.az.us>, I wrote:

Moe Trin · *nix forums Guru Joined: 20 Feb 2005 Posts: 972

On 29 May 2006, in the Usenet newsgroup comp.os.linux.security, in article
<1148946079.863066.283120@u72g2000cwu.googlegroups.com>, GM wrote:

GM · *nix forums beginner Joined: 11 Mar 2006 Posts: 6

Very interesting. Hop 2-3 a dialing link. Well I think so, yes (see
below)

Moe Trin · *nix forums Guru Joined: 20 Feb 2005 Posts: 972

On 29 May 2006, in the Usenet newsgroup comp.os.linux.security, in article
<1148889897.890006.213270@j73g2000cwa.googlegroups.com>, GM wrote:

Andrew Schulman · *nix forums Guru Wannabe Joined: 20 Feb 2005 Posts: 168

GM · *nix forums beginner Joined: 11 Mar 2006 Posts: 6

Thanks very much for your kind answers...

1) I can not see (so far..) anything here obviously showing that my
computer has been compromised.

2) In the meantime, since yesterday, I could make a phone call to my
home to ask for an on-site hand verification. This did show that the
firewall is still up.

3) Looking at the nmap output yesterday, I certainly overreacted and
maybe "panic" was the right word for qualifying this reaction. A scan
of ip's around mine is certainly not what I would normally do...

4) "ping" does not echo anything... Nor does "hping2", which I did
download and install (thanks for that info)

5) If I "traceroute" to my computer, I see, (well I do publish here the
hosts in between):
/usr/sbin/traceroute xxx.xxx.xxx.xxx | awk '/^ *[0-9]/{printf ( "%2d
%4d %4d %4d\n", $1, $(NF-5), $(NF-3), $(NF-1))}'
1 0 0 0
2 2 2 2
3 835 829 828
4 827 825 977
5 974 967 966
6 964 962 1963
7 1961 1959 1957
8 1956 1954 1952
9 1638 1637 1636
10 1633 1631 1630
11 1623 2720 2717
12 2716 2714 2712
13 2711 3069 2803
14 3066 3064 3061
15 1290 1288 1287
16 1283 1282 1796
17 1585 1583 1581
18 1578 1577 2092
19 2090 2089 2086
20 2083 2082 2081
21 1450 1449 1447
22 1445 1598 1596
23 1521 1518 1517
24 1587 1585 1582
25 1580 1579 1577
26 1575 1574 1572

.... but well, that does not mean much to me. However, of course, in the
complete output, I do recognize names until I get near my home city,
toward the last lines.

4) The services I want to run on this computer are: ssh, lpd, nfs and
samba for the inside network only and ftp and http for the outside and
inside. I want ssh for administration, lpd because there is a shared
printer, samba because there is in the internal network this other
computer that uses this other OS. ftp and http are allowed both in and
out also because I have information here I want to make available to
other peoples (news to friends etc). No other services are needed at
this point. Maybe I will allow ssh in the future, but certainly not
before I know better ... I think my netstat output (previous post) does
reflect these expectations of mine. If not, your kind comments are most
welcome.

5) I will try to find a friend (a linux friend, that is) in my home
country that can run a nmap scan for me and report the results to see
if that is different from the one I can run here. I may report that
here some time from now.

6) I will physically be at my home in two weeks from now to audit my
system. Maybe I will also report some more information then.

7) As for conclusion so far, I do not quite understand then the output
from nmap. And then, I am not quite sure of a "proxy" making, - if I
understand well -, nmap reporting here bad results.

Thanks,
Gaetan

Moe Trin · *nix forums Guru Joined: 20 Feb 2005 Posts: 972

On 28 May 2006, in the Usenet newsgroup comp.os.linux.security, in article
<1148807608.057988.272630@j55g2000cwa.googlegroups.com>, GM wrote:

Christian Hütter · *nix forums beginner Joined: 28 May 2006 Posts: 1

Hello,

GM · *nix forums beginner Joined: 11 Mar 2006 Posts: 6

Before I continue, let me tell that my home computer is some 10,000 km
away from me at the moment. My thinking goes: is it at risk knowing
that I here see, to my great surprise, on my linux laptop,
xxx.xxx.xxx.xxx being my IP at home:

nmap xxx.xxx.xxx.xxx | grep open | wc -l
1659

What ? 1659 open ports ? Sure looks to me as if the firewall went down.
This is *not-at-all* what I did expect... Ok then. I have Tripwire
running on a daily basis and mailing me the results. Everything here
seems fine (no change for the last two months). Also, as for services,
this computer is mailing me the running services, which did not change
either as I can read

netstat --inet -a | grep LISTEN | awk '{printf ("%s %d %d %s %s
%s\n",$1,$2,$3,$4,$5,$6)}'
tcp 0 0 *:1024 *:* LISTEN
tcp 0 0 *:printer *:* LISTEN
tcp 0 0 *:netbios-ssn *:* LISTEN
tcp 0 0 *:1006 *:* LISTEN
tcp 0 0 *:sunrpc *:* LISTEN
tcp 0 0 *:http *:* LISTEN
tcp 0 0 *:ftp *:* LISTEN
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 *:https *:* LISTEN

Yes, I know this is to be taken with a BIG grain of salt if the system
has ever been compromised. And well, if the firewall is down, well then
I can maybe ssh to my system as nmap report to me:
22/tcp open ssh

But I can't:
ssh xxx.xxx.xxx.xxx
ssh_exchange_identification: read: Connection reset by peer

Well, perhaps my ssh is configured for access only from my internal
network. Now two tests I do; (Yeah, the first is a bit not so much
netiquette maybe. But I am a bit paranoïd and want to be sure about my
home computer)
I run:
#!/bin/bash
i=yyy
while [ $i -lt zzz ] ; do
echo $i
nmap xxx..xxx.xxx.$i > nmapxxx.xxx.xxx.$i
i=$[i+1];
done

where (zzz==yyy+20) then scanning around my Ip for other results from
nmap. It turns out that all these show nearly the same output (to my
surprise):
wc -l nmapxxx.xxx.xxx.y[10]*
1665 nmapxxx.xxx.xxx.y00
1665 nmapxxx.xxx.xxx.y01
1592 nmapxxx.xxx.xxx.y02
1665 nmapxxx.xxx.xxx.y03
1665 nmapxxx.xxx.xxx.y04
1665 nmapxxx.xxx.xxx.y05
1665 nmapxxx.xxx.xxx.y06
1665 nmapxxx.xxx.xxx.y07
1665 nmapxxx.xxx.xxx.y08
1634 nmapxxx.xxx.xxx.y09
1665 nmapxxx.xxx.xxx.y10
1665 nmapxxx.xxx.xxx.y11
1665 nmapxxx.xxx.xxx.y12
1665 nmapxxx.xxx.xxx.y13
1635 nmapxxx.xxx.xxx.y14
1665 nmapxxx.xxx.xxx.y15
1665 nmapxxx.xxx.xxx.y16
1665 nmapxxx.xxx.xxx.y17
1665 nmapxxx.xxx.xxx.y18

I have a hard time believing all these computers around mine ALSO have
virtually no firewall... I can recognize my IAP name through reverse
DNS on each of the above IP. So what ? Could it be that my IAP
provider can "intercept" a scan and "report" spoofed results ? I doubt.

My IP here is aaa.bbb.ccc.ddd. Running.
nmap aaa.bbb.ccc.ddd

also gives tons of output (like 1600 lines showing "open" ) But, then,
I log to http://www.grc.com and ask for a scan of my ports on
aaa.bbb.ccc.ddd here. It says all ports except #2(closed) are stealth.
So what ? There is something from nmap that I don't understand.

Is my home computer at risk knowing that "nmap" on it reports 1659 open
ports ???

Any answer or comments on the above are most welcome. Thanks.

Gaetan

Google