Intro to Network Port Scanning and Advanced Techniques: How Snort's Stealth TCP Port Scanning Works

SecurityWeek Network reported "The simple truth is that the only way to be sure that we actually analyze all network malware-related traffic is to perform a full inspection of all traffic on all ports." One of the primary tools used by malicious attackers to assess your network weaknesses is the port scan. By running a port scan an attacker can find out what "doors" into your network are open. Once they know that information they can begin to research what sorts of vulnerabilities or exploits that might open up to a network. It is vital that organizations restrict and control the traffic that is allowed into the network. One of the important attacks that Snort NIDS detects is port scanning.

An Introduction to Port Scanning

According to Tony Bradley, a network security expert at About.com who wrote "Port Knocking: The Secret Knock Can Open Your System," port scanning is similar to a thief going through your neighborhood and checking every door and window on each house to see which are open and which are locked. TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are two of the protocols that make up the TCP/IP protocol suite which is used universally to communicate on the Internet. Each of these has ports 0 through 65535 available, so essentially there are more than 65,000 doors to lock.

The first 1024 TCP ports are called the Well-Known Ports and are associated with standard services such as FTP, HTTP, SMTP, or DNS. Some of the addresses over 1023 also have commonly associated services, but the majority of these ports are not associated with any service and are available for a program or application to use to communicate.

TCP scanning is the most common type of scanning which uses the operating system's network functions. The attacker sends a SYN packet to the victim and in case the port is open then an ACK packet is sent back to the attacker by the victim thus notifying that the port is open. This process is termed as 3-way handshaking.

UDP Scanning is a connectionless protocol. This means that there is no notification sent back to the attacker whether the packet has been received or dropped by the victim's network. If a UDP packet is sent to a port that is not open, the system will respond with an ICMP port unreachable message. Most UDP port scanners use this scanning method and use the absence of a response to infer that a port is open.

What is Stealth TCP Port Scanning?

If the port scan is being done with malicious intent, the intruder would generally prefer to go undetected. Network security applications such as Network Intrusion Detection Systems (NIDS) can be configured to alert administrators if they detect connection requests across a broad range of ports from a single host. To get around this the intruder can do the port scan in strobe or stealth mode. Strobing limits the ports to a smaller target set rather than blanket scanning all 65536 ports. Stealth scanning uses techniques such as slowing the scan. By scanning the ports over a much longer period of time you reduce the chance that the target will trigger an alert."

Network intrusion detection systems (NIDS) monitors packets on the network wire and attempts to discover an intruder by matching the attack pattern to a database of known attack patterns. A typical example is looking for a large number of TCP connection requests (SYN) to many different ports on a target machine, thus discovering if someone is attempting a TCP port scan. A network intrusion detection system sniffs network traffic by promiscuously watching all network traffic."

Snort is an open source network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks. It can perform protocol analysis, content searching/matching, and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts, and much more.

Tactical FLEX, Inc. is a privately owned software development firm based in Seattle, specializing in information security research, engineering, technology design, and production. With the technological development of Aanval® SIEM and IDS Solutions, Tactical FLEX, Inc. has become a global provider of information security vulnerability and risk management software solutions that protect businesses and organizations. The firm also provides IT consulting and professional services. Currently there are over 6,000 organizations worldwide in more than 100 countries that rely upon Aanval as part of their security infrastructure. These organizations include government security, defense organizations, weapons manufacturers, technology corporations, global financial organizations, space explorations, educational institutions, healthcare providers, and many others. For more information on Tactical FLEX, Inc. and Aanval, please visit http://www.aanval.com/.

Media Relations Contact:
Jennifer L. Manguino
Tactical FLEX, Inc
Telephone: 800-921-2584 Ext. 2151
Email: jmanguino@tacticalflex.com  

View the original article here

Embracing Mobile 3D Laser Scanning

"Technology is advancing so quickly that it's slowly replacing the surveyor." These concerns have been voiced over and over as LiDAR scanning becomes more accessible. The most recent advance in scanning is terrestrial mobile LiDAR scanning (TMLS). This technology collects survey-grade data at highway speeds and at traditional survey costs, and in the transportation discipline it is a safer means of data collection while reducing risk for the entire project. But it has surveyors questioning the longevity of their profession. What is seen as a threat because of efficiency must be embraced in order for surveying to survive. Land surveyors are increasingly missing out on surveying work because they are not advancing in current measurement technologies. Understanding and appropriately responding to non-traditional ways will significantly contribute to the success of the surveying profession and to the clients you serve.

Changing a Mindset
Historically, improvements in the surveying profession include the use of real-time kinematics (RTK) and global positioning systems (GPS) replacing field crew members. The robotic total station was another scientific invention to aid survey professionals that resulted in slimming down crews. So did the calculator for field trig values and computers for CAD drawings, but eventually they too were accepted and are widely used today. The profession adjusted.

Now mobile 3D laser scanning is creating a new apprehension from an over-restricted view of the profession, although TMLS does not have to be viewed as another replacement. The future of the surveying profession is still viable if the technology is used as "another tool in the toolbox." Hans Hess, former CEO of Leica Geosystems, one of the major producers and suppliers of both survey field equipment and static laser scanners, says that he encounters this attitude. "Sometimes I hear our customers say, 'Well, the surveying profession is dying and there is no future for us.' The need for geo-information is tremendous, and growing; geo-information has to be more up to date, more 3D, more accessible over the internet, and so on. There are not many industries that offer so many exciting prospects."

Understanding the Technology
Technology is constantly changing, and so must the surveyor's tools. The end product is only as good as the original field data gathered. TMLS systems measure hundreds of thousands of points a second while traveling at highway speeds. The data gathered are complete 3D images of the space being measured. What used to take months now takes only a few hours in the field. The surveyor or CAD technician can extract the needed features of this data in the office at the desktop. Because the surveyor is trained in spatial recognition, virtually walking the site becomes a benefit to the data extraction process. This technique allows the surveyor to extract data in more areas than he would have performing traditional shots every 25 feet.

Accompanying video documentation and digital images allows for a better QA/QC process through a recorded visual reference. This allows the surveyor to return to the site at the desktop instead of revisiting the field to make additional observations. Combined, this creates a collection of better original survey data for surveyors with added benefits.

Benefits of TMLS Surveyors must approach this proven technology as a way to solve problems in the field. Many organizations have developed key standards for safety, efficiency, and accuracy, and mobile 3D laser scanning addresses those standards in the following ways.

Safety: Survey-grade road surface documentation at highway speeds improves safety and efficiency for both the traveling public and the surveyor in the following ways. It:
• eliminates road/lane closures,
• reduces traffic disruption,
• finishes the project more quickly than traditional methods,
• is a safer method of data collection, and
• keeps the surveyor out of the red zone.

Efficiency: Because in-house surveyors supply control and check shots through traditional methods, efficiency is increased,and those benefits can be passed through to the client through:
• acceleration of the design project schedule through faster field data collection,
• deliverables created through in-house technicians,
• data available for extraction, when needed, how needed, where needed, and
• control of the data remaining in-house.

Accuracy: TMLS is a proven technology. Evaluations performed at a Caltrans test area specifically designed to evaluate mobile laser scanning systems resulted in an RMS error of 0.022'. The route chosen was to allow companies advanced in mobile laser scanning technology an independent evaluation against CalTrans total station collected points.

Implementing TMLS
Many surveyors have mastered only one way of performing surveying operations, and they need to expand their horizons by learning multiple software packages for field-to-finish and office computations. There are a variety of new services a traditional surveyor can add to the profession to expand business through TMLS. Surveyors who acquired scanners originally to complete traditional surveys and inspections are carving their own niche in the industry through accident reconstruction surveys. Companies that have been doing forensic work for years have found that laser scanning enables them to complete investigations faster and more thoroughly, and mere access to scanner data is keeping them ahead of the competition when bidding for new jobs.

In the past, the airborne industry has documented the majority of overhead line surveys. With mobile 3D laser scanning, wires down to 3mm in diameter can be accurately located and their heights measured. The data allows for calculations of sway and sag of overhead power lines. The cost to the client between airborne and mobile surveying is a drastic reduction. What the "fly-by" replaced in speed from traditional methods, the "drive-by" added benefits in cost. TMLS technology, like the StreetMapper system out of the United Kingdom, can easily be adapted within less than an hour to vessels providing high-resolution coastal land surveys of upland features, including dunes, beach cusps, scarps, and vegetation. The 3D laser scanning resolution far exceeds that which can be obtained through traditional surveying methods. This allows for surveys of unprecedented detail.

Rapid data acquisition through TMLS enables the generation of 3D city models to be used for homeland security issues and evacuation planning. Colorization of models are added benefits to planning boards and marketing city attractions and expansion. City modeling is rapidly becoming a significant catalyst for data acquisition through technologies such as Google Earth and MapQuest.

Rail construction tasks require reliable survey data. Due to highly increasing traffic load, combined with the age structure of the rail network, responsible administrations are forced to put the main emphasis of maintenance activities into projects to ensure quality, safety, and sufficient traffic capacity. The negative influences of maintenance tasks have to be kept as small as possible. This is even more important for the necessary substantial engineering/survey work that is needed in advance to capture basic data for construction planning and preparation. TMLS mounted on a hyrailer minimizes the survey effort to capture the required data along existing railways.

Only a comparatively short driving time is needed for data collection, while the traffic flow is not significantly affected. This approach reduces both costs and safety risks.Three-dimensional airport surveys captured by TMLS empower engineers and land surveying crews with scan data of runway surfaces, building footprints, measure distance, sign identification, and locations as well as survey terminals, taxiways,and aprons, all without disruption to air traffic.

Automated permitting for truck routing for bridge heights and clearances by traditional survey methods is costly, time consuming, and presents difficult in managing the changing data due to continued highway construction resurfacing projects. Obtaining survey-grade accuracy for bridge heights and clearances at traffic speeds is the most efficient way to measure various structures and roadway features. Accuracies of better than 1/2" have been obtained for vertical clearances of roadway structures. It is critically important in oversize route planning. Horizontal clearance measurements must also be maintained. Collecting this data in a traditional manner can be dangerous or can cause congestion with work crews subject to serious traffic hazards. Work must be performed during available traffic breaks, which can introduce errors. From a system-wide perspective, clearance information in many cases is incomplete, inaccurate, and difficult to maintain and to access.

Highway surveys with mobile 3D laser scanning are used for maintenance and asset management of road surface and street configurations by identifying concrete spalling and pitting. Construction monitoring can also be obtained for forensic identification of rebar placement before a pour. This data allows for complete surface contour capabilities of road crowning and rutting measurements.

Mark Coon, LS, a geospatial manager at Erdman Anthony, says, "We currently use Terrestrial LiDAR on highway and bridge surveys for the NYSDOT, and it's obvious that mobile lidar will be the technology of choice sooner or later."

These are just some of the ways the surveying profession can enhance their services using TMLS as another tool in their toolbox. Surveyors who understand and accurately position themselves to respond to these technology advancements will stay ahead of the concerns of an otherwise seemingly dying breed.

View the original article here