A person who is interested in breaking in to an organization's computers wants to know as much about these computers as possible. She is interested in the operating system, which services that are running on the computer, which ports that are open, and so on. Much such information is available from any computer connected to the Internet.

Traditionally such a person may have used tools for example to scan ports on one or a set of computers in an organization. Last year there were several reports about hackers in different countries who cooperated in obtaining such information from an organization. The idea behind this was that since several computeres were involved in obtaining information, the entries in the log files would not be so obvious, and the probability was higher that the information-gathering attempts would be unnoticed by the attacked organization.

Late last year we saw a new development in this area. A tool which made attempts to gather information that seemed to come from different computers, even though they originated from one computer only (spoofing). Most likely such a tool was used in the attempt to break into the Pentagon a short time ago; an event which received great press coverage.

One such program  - Nmap - uses a technique called "fingerprinting". It scans the TCP/IP stack on a computer and based on the response compares this with a database of known specialities of a lot of operating systems and versions. It can scan one computer or any range of computers, and supports a lot of different scanning techniques.

Armed with this information a hacker might use known security holes in that particular version of the operating system and/or services to break into the computer(s).

Such programs are of course potentially dangerous if they are used to break in to computers. They may however also be used as security tools. The personell responsible for security in an organization may use them to find weaknesses in the organizations computers and network thus being able to get rid of those.

Per Olav Førland