Slashdot Mirror
Nmap Gets Version Detection
Anonymous Coward writes "Up until now, everyone's favorite port scanner, nmap has had decent OS detection (through TCP fingerprinting) and service identification based on the open port, but the latest version, 3.45 released today, has version detection for each service! This means not only can nmap tell you that httpd is running on port 80, but that it is `apache httpd version 2.0.39`! While this is a little bit worrisome because of what malicious purposes people might use nmap's version detection for, this should make the jobs of admins everywhere easier and keep us all more on our toes when it comes to security. Fyodor has also published a paper on how the version detection works."
If you plan your network security through obscurity...thats asking for trouble.
If you hope nobody can hack you or cause any problems with your servers because you assume they dont know what you are running...that is a problem.
How about being accountable, upgrading and securing your system, instead of being alarmed that "suddenly" (like they couldnt before) people can see specifically what you are running.
Hats off to nmap...first matrix reloaded, now a drastic improvement! Who knows, matrix revolutions may be sporting a new nmap!
[I can picture a world without war, without hate. I can picture us attacking that world, because they'd never expect it]
Security through obscurity never worked that much, will work much worse now. However, I do not see worms using such tools to propagate better. Worms just try to infect everyone and do not care about being glued in honeypots.
While this is a little bit worrisome because of what malicious purposes people might use nmap's version detection for [...]
By the same logic, one might consider it "worrisome" that there even exists software packages like "Nessus" and "Saint".
Adding features such as version detection to a tool that can be used for both good and bad purposed shouldn't be considered "worrisome". It is just something that makes the tool better, for good and for bad. And unless we are talking about software which by design always causes destructive damage when used, I will always consider it a good thing that there are such excellent security auditing tools available to the public. With all respect, sorry to hear that someone finds this "worrisome".
When you have to keep track of many different servers of different OSes, sometimes you forget things, or stuff that you thought you turned off you find out you didn't. It happens to the best of us.
It's the first thing I always do when I put a new server on the network. It never hurts to do a double-check to make sure that your servers are behaving the way that you think they are. Just like it doesn't hurt to reboot a linux box perodically to make sure that all your startup scrips work as expected in case of a power outage or whatever.
-Through the server, over the router, off the firewall... Nothing but 'Net!
Duh, it's for finding the OS other machines are running. If you're troubleshooting something, and have a network with 500 computers to check, then being able to automatically see what OS is running where can be very useful.
To put a simple example, you might scan a network for Linux hosts running Samba to then verify that they aren't running a vulnerable version.
Sheesh, no need to get all self-righteous on me.
I know that nmap is useful for more than
black hat purposes, I use it myself, blah blah.
If you look through my post, you'll find nowhere
that I'm suggesting banning it, making it illegal,
or anything like that. Instead, what my post,
intending to be humorous, was about, was simply
stating that it IS used for blackhat things too,
and version detection doesn't change things that
much with regards to that.
It's great that you're a crusader against people
who would take useful things away from us through
laws, but, as in any such thing, be careful where
you're aiming -- friendly fire isn't a good thing,
and you'll just make yourself and others in the
cause look like jerks who can't stop posturing
on who's the bigger crusader. Not useful.
For every problem, there is at least one solution that is simple, neat, and wrong.
It's the duality inherent in most things. nmap can be used for good/bad. Any tool which is remotely useful is like this. The tools of a locksmith can be used to make your house more secure, or to break into it. A gun may be used by cop or crook. You get the idea...
They say the first thing to go is your penis. Well, it's either that or your brain. I forget which...
Unfortunately I can then come along and run hmap to detect what it really is using finger printing techniques. Concealing server names and versions gives only a very small increase in security and can make management of multiple servers harder (as it's more difficult to check you patched everything). Rich.
When you support 10,000 servers and 30,000 desktops
There's no way to support this many machines alone. It's simply an impossible workload. As for making the lives of SKs easier, yep, it'll help em target machines, no doubt about it. There's a positive though, at least this tool is public and we're all aware of it now. It's the tools I don't know about that worry me.
Good people do not need laws to tell them to act responsibly, while bad people will find a way around the laws-Plato
"hrm, i wonder what version of apache i'm running at the moment... should i look in apache..? no.. i know, i'll scan myself"
you're obviously not an admin, and obviously don't do any serious work with computers at all.
--Drunk as in Beer
the kids just run scripts. no one cares about what OS you are running much less what versions.
/scripts/root.exe?/c+dir HTTP/1.0" 404 284 /MSADC/root.exe?/c+dir HTTP/1.0" 404 282 /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 292 /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 306 /_vti_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir /_mem_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 323 /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c 1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 339 /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 ??
how many lines in your apache logs look like this ?
"GET
"GET
"GET
"GET
"GET
"GET
HTTP/1.0" 404 323
24.91.103.152 "GET
24.91.103.152 "GET
24.91.103.152 "GET
Sanity is the trademark of a weak mind. -- Mark Harrold