Repository navigation
IPscan Special Tests
IPscan includes the following tests to identify known weak protocols or poorly configured services, which may be exploited. It is important to note that the same exploits may well apply to IPv4 hosts running the same protocols.
The NTP protocol daemon, in versions prior to 4.2.7, supported a feature (NTP Monitor List Query) which reported a list of up to 600 clients which had used the queried NTP server as their time reference. If an attacker uses a spoofed source address then a victim can be flooded with considerable NTP traffic. The size of the response is typically considerably larger than the request and consequently the attacker is able to amplify the volume of traffic directed at the victim. Additionally, because the responses are legitimate data coming from valid servers, it is especially difficult to block these types of attacks. The solution is to disable “monlist” within the NTP server or to upgrade to a version of NTP >= 4.2.7, which disables the “monlist” functionality.
To prevent your NTP daemon being used in DDoS attacks it is necessary to disable “monlist” functionality. On a public-facing NTP server that cannot be updated to version 4.2.7 or later, add the “noquery” directive to the “restrict default” line in the system’s ntpd.conf, as shown below:
restrict default kod nomodify notrap nopeer noquery
restrict -6 default kod nomodify notrap nopeer noquery
See CVE-2013-5211 for further details.
IPscan performs three SNMP queries. SNMP supports a variety of versions and authentication methods and since IPscan cannot know the credentials to use to test your system it defaults to using commonly-used, and therefore insecure, community strings.
| Port/Special Case | SNMP version | Test performed, credentials used |
|---|---|---|
| UDP/161 | v1 | GET with 'public' community string |
| UDP/161[1] | v2c | GET with 'private' community string |
| UDP/161[2] | v3 | EngineID Discovery, credentials not required |
IPscan performs two Memcache query types.
| Port/Special Case | Memcache version |
|---|---|
| UDP/11211 | Memcache ASCII version |
| UDP/11211[1] | Memcache Binary version |