Quantitatively Assessing and Visualising Industrial System Attack Surfaces

CHAPTER 2. METHODOLOGY 23
A banner is the metadata associated with a TCP connection to a specific port. Tradition-
ally this was used by network engineers to tag ports with information (such as applications
redirected to another port), but recently these banners often reflect the default setup of
a system. They contain a great deal of information such as time zones, character sets,
dates of connection, server information, protocol, and sometimes OS information.
2.4.1 Banners
An example banner:
HTTP/1.0 200 OK
Date: Sat, 23 Apr 2011 21:1:34 GMT
Content-Type: text/html
EnergyICT RTU 130-D93392-0840
Expires: Sat, 23 Apr 2011 21:1:34 GMT
An average banner returned by Shodan provides a server information field such as:
Apache/1.3.31 (Unix)
PHP/4.3.9 mod_ssl/2.8.20 OpenSSL/0.9.7e
So the device under investigation is running an Apache Server version 1.3.31 on Unix with
with dynamic webpages and using SSL.
2.5 Adding exploit information and geolocation
Having found a number of different systems that are or at least were at a certain time
connected to the global internet, we turn towards other sources of information. Specifi-
cally, Google’s geocoding service, and two sources of vulnerability information: Metasploit
and ExploitDB. This allows us to get an idea of where these systems are, and if known
vulnerabilities exist for the technology stack those devices or systems advertise through
their banners.
2.5.1 Exploit searches
Decomposing the banner information in a hierarchical manner, it is possible to search for
known exploits in exploit databases. We can:
1. Search exploit databases with the same query given to Shodan (which rarely returns
anything) and cache the result for the rest of the session.