Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

permits one to instruct an FTP service on another machine to send files to an FTP service on a
third machine, thereby cloaking the command origin—a very useful tool for attackers to hide the
origin of attacks.
A.1.4 OPERATING SYSTEM DETECTION.
A second objective of port scanning is to determine the OS of that machine. Knowing the target
machine’s OS is invaluable in the vulnerability-mapping phase that immediately precedes
launching exploits to attempt to actually take over the remote machine (see discussion about the
cracking devices in section A.2). The OS identity can be learned from mechanisms such as
banner grabbing; 10 however, the most useful approaches use stack fingerprinting.
Tools such as nmap, cheops, tkined, and queso are commonly used to do stack fingerprinting to
quickly ascertain what the target machine’s OS is, including the actual version of the OS
implementation, with a high degree of probability. These tools leverage techniques such as the
FIN probe (see RFC 793), the Bogus Flag probe, initial sequence number sampling, don’tfragment-bit
monitoring, TCP initial window size, ACK value, ICMP error message quenching
(see RFC 1812), ICMP message quoting, ICMP error message echoing integrity, type of service
for “ICMP port unreachable” messages, fragmentation handling, and other TCP options (see
RFC 1323) to make their calculations. Specifically, the RFCs that define TCP specify how a
system should respond during connection initiation. However, they do not define how the
system should respond to the various illegal combinations of TCP code bits. Rather, each
implementation responds somewhat differently to the same set of illegal flags or finite state
machine protocol violations. These differences provide a basis for these hacker tools to
determine, with a high degree of probability, exactly what OS they are remotely accessing.
A.1.5 ENUMERATION.
Once the attacker has identified the OS of the target machine to crack, the attacker will want to
learn the valid accounts or exported resource names of that system. This process is known as
enumeration. The tools and approaches for accomplishing enumeration are largely a function of
the target OS to be cracked. The default configuration of Microsoft Windows machines is
particularly vulnerable for enumeration, though other machines are also vulnerable.
For example, within Unix devices, the Sun ONC services (e.g., Sun remote procedure call
(RPC), network information system, and network file system (NFS)) are particularly vulnerable
to enumeration. The finger utility is perhaps the oldest way to do enumeration on Unix systems.
Similarly, r- commands such as rusers and rwho also provide enumeration services.
Enumeration can also occur via SMTP. The SMTP VRFY command confirms the names of
valid users and the EXPN command reveals the actual delivery addresses of aliases and mailing
lists.
10 Services such as FTP, Telnet, SMTP, HTTP, POP3, IMAP4, and others frequently identify the operating system
of their hosting machine. This identification is then leveraged by the attacker to focus the attack upon known
weaknesses of that OS, often by using automated attack mechanisms.
A-5