Null Session

But wait, there's more. Null sessioning has been described as analogous to finger. In essence, it is logging on to a system as a nobody user. Although you cannot modify anything, you can

learn about the system. A sample command string is as follows: net use \\172.20.244.164\IPC$ "" /USER:""

This generates literally pages of information, a section of which is shown here:

2/18/98 1:39 AM - Jsmith - \\192.168.4.22 UserName

Administrator Groups,Administrators (Local,

Members can fully administer the computer/domain) AccountType,User

HomeDrive

HomeDir PswdCanBeChanged,Yes PswdLastSetTime,Never PswdRequired,Yes PswdExpires,No AcctDisabled,No AcctLockedOut,No AcctExpiresTime,Never

LastLogonTime,11/20/98 3:24 PM

LastLogonServer,192.168.4.22 Sid,S-1-5-21-706837240-361788889-398547282-500

Null sessioning can be prevented on Windows 2000 and if you will give me a second, I will test it on Windows XP Professional. Yup, it works—Control Panel, Administrative Tools, Local Security Policy.

Stealth Attacks

The first time I heard the term stealth was in a paper by Chris Klaus titled "Stealth Scanning—Bypassing Firewalls/SATAN Detectors." He was describing what people now usually refer to as "half open"—that is, intentionally violating the TCP three-way handshake. There are a number of variations of half scans, and we are going to examine all the common ones. These are not all that hard to detect in and of themselves, but as you will learn in the discussion on coordinated attacks, they are getting some help. Nowadays, some folks use stealth to mean null flags (no flags or code bits set). The only approaches I find actually stealthy are those based on either low and slow, or highly distributed, packet delivery. As time goes on, static packet filters continue to be less and less common; half-open scans are less and less an issue. They certainly should not be called stealth because they stand out like a sore thumb. The Snort web page, www.snort.org, lists a number of effective rules to detect these probes.

This is a season of advanced scans; attackers with the skill to type, make, and actually compile software are using tools that give them the look and feel of "eleetness." Three years ago it was jackal; at the turn of the century, hping and nmap; and today, distributed scanners.