Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

(HTTP) traffic (port 80), port scans searching for reachable active devices are increasingly
targeting Port 80 as a mechanism for defeating intermediate firewalls.
Several types of port scanning approaches exist to exploit weaknesses within the Internet’s
historic Transport Layer Protocols (i.e., TCP and UDP) to learn information about remote
systems from transport layer responses, and these types include:
• The transmission control protocol (TCP) connect scan (i.e., connects to the target port by
completing the three-way TCP handshake: SYN, SYN/ACK, and ACK).
• The TCP SYN scan (i.e., only partially connects to the port—enough so that it knows that
the port is there and is active).
• TCP FIN scan (sends FIN packets to the target port, i.e., see RFC 793).
• TCP Xmas tree scan (Sends FIN, URG, and PUSH packets to the target port).
• The TCP Null scan (the technique turns off all flags. Based upon RFC 793, the target
system should respond by sending back a RST for all closed ports).
• User Datagram Protocol (UDP) scan (that is looking for an ICMP port unreachable
message—if no such reply, then the port is open).
Once it is determined that an active device is reachable, the attacker may want to scan the target
device to discover what services it provides. The strobe, sc, netcat, portpro, portscan, nmap, and
udp_scan tools are very useful for doing this. (Note: the latter was an element within
“SATAN,” which has subsequently been updated to become “SARA” and “SAINT.”) Nmap is
perhaps the most powerful of these tools since it performs many other functions and also
provides decoy capabilities within its scans.
Target Unix systems may support port 113, making them vulnerable to ident scanning (see RFC
1413). In such systems, queries to port 113 will reveal all of the active ports within that system,
the protocol (TCP and UDP) being used by that port, the service using that port (i.e., the identity
of the application layer daemon), and the owner (e.g., root) of the daemon that is listening on
that port. All of this information is very useful to an attacker.
Many other scanning attacks and exploits exist, including the file transfer protocol (FTP) bounce
attack, which leverages the inherent security vulnerabilities of FTP to post virtually untraceable
volumes of documents (e.g., mail and news) onto a third site, potentially filling up the disks of
that third site, thereby creating a denial of service (DoS) attack. All other IP Advance Research
Projects Agency (ARPA) services (as well as the Unix r- services) were similarly designed for
trusted environments and are therefore similarly characterized by having ineffective security.
The ARPA services include FTP (RFC 2228), trivial file transfer protocol (TFTP) (RFC 1782),
Telnet (RFC 854), and SMTP (RFC 1652). For example, SMTP (port 25, i.e., Internet
Electronic Mail) is so completely barefoot that one can readily spoof any aspect of the SMTP
electronic mail header from one’s own machine’s port 25. However, the FTP is unique in that it
A-4