 |
 |
> > Has anybody out there been seeing scans of port 445 from machines on campus? > > > > Oct 17 13:52:37 myhostname [2370]: attackalert: TCP SYN/Normal scan from > host: haydn.cse.msu.edu/35.9.26.157 to TCP port: 445 > > From what I understand this is an attempt to test for then exploit > avulnerability. > > 1. Anybody know the specifics on this? > > 2. Isn't scanning other departments machines without their consent against > Acceptable Use Policy? There are literally thousands of computer systems either on the MSU campus or associated with MSU users which are compromised, and are scanning port 445 and others. We have been tracking these systems for several months, now. We have been working on notifying the system owners of these systems, but it is a time-consuming process, and we can only handle a small percentage of the worst offenders at any given time. The bulk of the compromised computer systems are either in the residence halls, or connect to our network through the local dialup lines. We do see some departmental computer systems among the list, and we make an effort to notify those sysadmins in a timely fashion. The specific CSE system you list above does show on our list of compromised, scanning systems, but even after discounting many dialup, residence hall, and DHCP-registered computers, still ranks only 18th in the list of top scanners over the past few days. I would imagine that we will be notifying the CSE department shortly, if we haven't already, about that system. The MSU Statement of Acceptable Use (new terminology for what has been called the "Acceptable Use Policy") prohibits intentionally seeking data belonging to other users, attempting to infiltrate, or attempting to damage other computers. To the best of my knowledge, none of the port scanning activity we see is an intentional act on the part of any MSU individual, and therefore would not be an Acceptable Use issue. It's not clear whether port scanning, in and of itself, constitutes an infiltration or intrusion. A port scan can only tell you if a given system may be running a specific service or protocol - it doesn't return data from the target system. Now, most attack tools will follow up on a positive return from a port scan with an attempt to access the system or service in question, generally with the goal of compromising the computer system, and occasionally with the goal of obtaining data from that system. I will say that while the Statement of Acceptable Use may or may not directly prohibit port scanning, our policy is to obtain permission before running any intentional port scans. We either get the permission from the system owner (with the explicit or implied consent from all system users), or from our director and/or from VP Dave Gift, before any system scans are run. The best advice I can give, as always, is to keep your systems patched, turn off unneeded services, and ensure that your firewalls allow access to only those systems which need access. Doug Doug Nelson, Network Manager | [log in to unmask] Academic Computing and Network Services | Ph: (517) 353-2980 Michigan State University | http://www.msu.edu/~nelson/