Security Experts, lend me your ears...

[Agent_Embryo]

Found an unauthorized server on our network. Here's an NMAP log:

- - -

# nmap (V. 3.00) scan initiated Fri Jun 27 14:11:47 2003 as: nmap -sS -PT -PI -I -R -O -T 3 -oN C:\Documents and Settings\dawi99\Skrivbord\10_1_1_253.log 10.1.1.253
Interesting ports on (10.1.1.253):
(The 1592 ports scanned but not shown below are in state: closed)
Port State Service
22/tcp open ssh
25/tcp open smtp
113/tcp open auth
199/tcp open smux
443/tcp open https
3389/tcp open ms-term-serv
13722/tcp open VeritasNetbackup
13782/tcp open VeritasNetbackup
13783/tcp open VeritasNetbackup
No exact OS matches for host (If you know what OS is running on it, see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
TCP/IP fingerprint:
SInfo(V=3.00%P=i686-pc-windows-windows%D=6/27%Time=3EFC34DB%O=22%C=1)
TSeq(Class=RI%gcd=1%SI=2B7DB1%IPID=I%TS=100HZ)
TSeq(Class=RI%gcd=1%SI=2BB11D%IPID=I%TS=100HZ)
TSeq(Class=RI%gcd=1%SI=42B4FA%IPID=I%TS=100HZ)
T1(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW )
T2(Resp=Y%DF=N%W=7D78%ACK=S%Flags=AR%Ops=)
T3(Resp=Y%DF=Y%W=3F25%ACK=S++%Flags=AS%Ops=MENNTNW )
T4(Resp=Y%DF=N%W=7D78%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=N%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=N%W=7D78%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=N%W=7D78%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=C0%IPLEN=164%RIPTL=148%RIPCK=E% UCK=E%ULEN=134%DAT=E)

Uptime 217.478 days (since Fri Nov 22 01:44:22 2002)

# Nmap run completed at Fri Jun 27 14:13:15 2003 -- 1 IP address (1 host up) scanned in 88 seconds

- - -

I want to know more about this server, in other words who has set it up. It has a private network IP that nothing else has in our net, and our routers shouldn't be routing to that network anyway, unless he got into the router and changed stuff.

Anyone have any ideas? How can I nail this guy? It's probably someone sitting on our cable-net.

[Siliconjunkie]

If it is past your router and not on your netblock then why is it concerning you? How did you determine that it is there? Do you have an ACL in place to prevent routing to other private nets? It sure feels to me like you are portscanning someone else that you happen to be able to see. I know that I see my first hop as a 10. something IP with my cable.

Also, the way to "nail" this guy is to call the ISP. If he isnt physically on the network you own it is all their problem.

[Agent_Embryo]

We found this when a consultant said there were some strange IPs on our public network. An IPScan revealed this live host.
This server is on a network that is supposed to have public IPs. We are the providers (or rather sub-providers) of this network.

Our next router-hop is an 81.x.x.x adress.

[Siliconjunkie]

Hrm, can you physically track down the box or is the network too big for that? From the MAC address you should be able to track it to a switch and either filter out the MAC or shut down the port.

[Agent_Embryo]

No, it's too big of a network, and it's probably sitting on a cable-modem somewhere. Our private clients are on cable modems, with their own 81.x.x.x adresses.

It could just be someone who made a mistake, but it's a Windows 2000 server with Terminal Services, so I doubt it.

Way outa my league!

AE, PM DVNT1, as this is probably right up his alley. And if you verify you are authorised to do this, I'm sure he will help you with some very useful info.

Cheers
Mick

[Siliconjunkie]

I dont know what kind of equipment you are working with but you should be able to track it down to the segment using the MAC address then determine from there where it is from that. Actually it appears that you are already on the same segment if you can portscan it, since your routers shouldnt know how to get there. Unfortunately without shutting down modems it will be nearly impossible to find out what customer has it unless you can track it back to a specific modems MAC address.

Or do you suspect that someone has put an unauthorized cable modem on a line somewhere?

I will say that until you determine exactly what is going on attempting to hack/take down the box would seem like a bad idea. If it is a legitimate customer who made a mistake then you could have a real fight on your hands. I know I would be upset if my ISP took out one of my boxes simply because it was there and misconfigured I would be HOT. Even if it was a security risk, they can blackhole the MAC or kill it at the router. There are much more graceful and professional ways to deal with it via ACLs rather than attacking it.

[Agent_Embryo]

Yeah, doing anything with that box is a bad idea, because I'm an idiot. It IS on our leased line supplier's net, and not on ours. Better contact them then...oh well...sorry for this whole ordeal...

DOH!

[Siliconjunkie]

No harm, good to think thru these things sometimes. I quite enjoy idle problem solving.

At least you now know the next step to take, AE: contact your line supplier.

Think of it as thinking aloud.

Cheers
Mick