In-Depth

How Secure is Your Network?

Seven network scanners test your security before the crackers do.

• By Greg Saoutine
• 09/01/2001

Network scanning is one of the most misinterpreted terms in computer security. As technology continues to evolve, its definition changes. Network scanning is sometimes confused with system scanning, application scanning or even modem scanning (sometimes called war dialing). Sometimes, network scans are referred to as penetration testing or even hacking. Strictly speaking, a network scan is a systematic test of an operating system's network stack. A stack is a set of system applications or services that allow one system to communicate with other systems connected to the same wired or wireless medium. For example, the TCP/IP protocol is implemented as a network stack. This type of a scan is often called a port scan.

In the current IT environment, we expect network scanners to perform a lot more than just a port scan. Additional functionality may include network discovery (finding all devices on a network), OS identification (also called fingerprinting), and vulnerability checking (searching for common security flaws such as configuration errors and Trojan horses). For this article, I'll look at tools that perform network discovery, OS identification, port scanning and vulnerability checking of common network services such as FTP and DNS. Such a tool should perform all these actions without being physically installed on the computer being scanned, and even without logging onto the computer. Here's what we look at this month:

• Atelierweb's Atelierweb 4.04
• Cerebus Information Security/@Stake's CIS
• ClicktoSecure's Hailstorm 1.02
• eEye's Retina 3.0
• Internet Security Systems' Network Scanner 6.1
• LANGuard Network Security's LANGuard 1.25
• Nessus' Nessus 1.0.8

Some scanners are more sophisticated than others about checking systems to which they connect. Scanners with application-level checks (such as CGI scanners) are designed to understand higher-level protocols (for example, HTTP), and the input/output application parameters are most often available via an HTML page. Using a Web site as an example, a network scanner could find an HTTP server on a certain port and check for vulnerabilities (for example, unpatched security holes), while an application scanner would be able to browse Web pages and try to test the strength of exposed scripts. Some of the scanners discussed in this article provide application scanning.

To test the scanners, we scanned a default installation of Windows 2000 Advanced Server that included these components:

• IIS 5.0 running a Web site on port 80 and another Web site on port 8086. Traffic was split between the two sites based on host headers. No virtual IP addresses were assigned.
• An FTP site allowing Read and Write permissions to the root directory to anonymous users.
• Telnet server.
• Simple Network Management Protocol (SNMP) with public string as Read-Only and private string as Read and Write.
• DNS server.
• DHCP server.
• Terminal Services.
• Service Pack 2.

After the first round of testing, we installed Back Orifice 2000 remote management software (a multi-functional Trojan) from Cult of the Dead Cow and retested the scanners for their ability to detect this potentially malicious application on the host computer.

10 Steps for a Successful Scan Pre-Execution Determine the overall scan objective and pick the right tools. During this stage, determine what you’re going to scan. Is it a firewall scan, intrusion-detection test, bastion host assessment, or “cracker” emulation attack? Make sure you always try to scan the most important link in your security—firewall, Web server, Web application, scripts—as well as the most vulnerable links. Based on this determination, choose the right tool. Train all personnel who will perform scans on how to use the software. Always test the scanner in a lab environment prior to using it, but after you update it with the latest vulnerability probes (if any). Contact the parties involved in a scan and obtain their agreement for a scan. Note that the use of scanners may result in denial of service (DOS). Without permission, your “attack” may be reported to a security authority such as CERT, or there might be other legal consequences. Analyze the architecture of the target network. Ideally you should know about intrusion detection systems (IDS) and other alarms on the network that you scan (some IDSs can disable your scanner). Load balancers, proxy servers, firewalls and other network equipment can potentially interfere with the scan. Execution Monitor the scan and be available to turn it off (should the circumstances demand). If possible, run a sniffer on a target subnet to make sure the scanner “hits” your target as expected (this may also be useful in analyzing scanning traffic and identifying “false positives,” something most scanners can produce). Let all parties involved know the scan’s over. Post-Execution Verify the scanner’s accuracy based on OS recognition and overall responses. Analyze the results and filter false positives. Explore any serious vulnerabilities in depth. System settings may have to be examined to confirm the findings. Some scanners, such as Hailstorm or Nessus, allow you to create custom packets to do further testing. Compare the results with previous scans. This is called trending. Keep a copy of the results for the future. Only a few tools allow you to do this, but you can construct a simple database to store your results quickly. Forward a completed copy to those who got scanned as a good-faith move and make yourself available to answer questions. —Greg Saoutine

Choosing the Right Scanner
Good network scanning tools can enable network administrators to perform quick and fairly efficient assessments of their networks on a periodic basis. They can also help in keeping track of the latest vulnerabilities. More sophisticated tools such as ISS, Nessus and Retina can “probe” vulnerabilities by sending actual attacks (or more often, by sending probes simulating an attack) to targets. The most sophisticated scanners also provide engines that allow more experienced users to create custom attacks.

You should realize, though, that network scanners aren’t infallible. None of the scanners we reviewed was able to detect the Back Orifice Trojan that was installed on a non-standard port. It’s quite a challenge to detect such Trojans because the scanner would need to check every listening port for every known Trojan. Note, though, that the scanners we reviewed reported an unknown service on the port where we installed Back Orifice. If you’re auditing your own server, finding such unknown services should be treated as a warning bell.

When choosing a network scanner, you need to understand your environment and capabilities of various products. If a quick inventory scan with information-gathering elements and basic password checks are required, one of the free, basic products (such as LANguard) can be used. For a more comprehensive, targeted assessment, more sophisticated products should be used: ISS, Retina, and even Nessus provide IT professionals with an easy, “point-and-click” solution, regular vulnerability database updates and excellent reporting. When choosing a vendor, don’t forget to ask about the frequency of updates to the scanner’s database.

For a more sophisticated user who wants to have full control over the test or needs to customize testing for complex network components (such as intrusion detection systems), tools with scripting capabilities (such as Nessus or Hailstorm) are ideal.

Finally, while it’s a good idea to have a relationship with a commercial vendor, several free products are available on the Internet. Some of the free products have advanced features that may not even be available in your vendor’s product.