A technique used by many hackers in the first few decades of widespread personal computer use is wardialing. Wardialing is a technique that was popular in the 1980s and 1990s as a footprinting tool, which explains why the process involves the use of modems. Wardialing is very simple: It uses a modem to dial phone numbers to locate modems. An attacker who picked a town at random and dialed up a range of phone numbers in that town would likely turn up several computers with modems attached. Wardialing using modems is a legacy technique with extremely limited utility value today, but it does give rise to many similar techniques that essentially search for open communication ports.

Wardriving is another technique for uncovering access points into a network. Wardriving is the process of locating wireless access points and gaining information about the configuration of each. This “sniffing” was initially performed with a laptop computer, a car, and software designed to record the access points detected. Additionally, a Global Positioning System (GPS) was optionally included to go to the next step of mapping the physical location of the access points. It wasn’t long before mobile devices became smaller, more functional, and better suited to finding wireless access points. The ease of carrying around a small device with a wireless adapter, GPS receiver, and software to collect information gave rise to warwalking, warjogging, warbiking, and even warflying. If an attacker is able to locate even a single unsecured access point, the dangers can be enormous because it can give that same attacker quick and easy access to the internal network of a company. An attacker connecting to an unsecured access point is more than likely bypassing protective measures, such as the corporate firewall.

Although there are a multitude of tools used to perform wardriving, other tools, including the following, are useful in defending against these attacks:

• AirSnort—Wireless cracking tool

• AirSnare—An intrusion detection system to help you monitor your wireless networks. It can notify you as soon as an unapproved machine connects to your wireless network.

• Kismet—Wireless network detector, sniffer, and intrusion detection system commonly found on Linux

• NetStumbler—Wireless network detector; also available for Mac and handheld devices

So why is wardriving successful? One of the most common reasons is that in spite of increasingly aggressive security measures, personnel sometimes install their own access points on the company network without company permission (known as a rogue access point). An individual who installs an access point in such a way will more than likely have no knowledge of, or possibly not care about, good security practices and may well leave the access point completely unsecured. Another reason is that sometimes when an access point has been installed, those performing the installation have actively decided not to configure any security features. Wardriving generally preys upon situations in which security is not considered or is poorly planned. Make sure you stay out of situations like that.

A technique that is useful at determining whether a system is present and active is a ping sweep of an IP address range. By default, a computer will respond to a ping request with a ping reply or echo. A ping is a network utility that sends an Internet Control Message Protocol (ICMP) message. With the use of a ping, it is possible to identify active machines and measure the speed at which packets are moved from one host to another as well as obtain details, such as the time to live (TTL).

A key advantage of ICMP scanning is that it can be performed rapidly because it runs scanning and analysis processes in parallel. In other words, it means multiple systems can be scanned simultaneously. In fact, it is possible to scan an entire network rapidly. The ping utility is available as a command-line utility in all common operating systems and is often available as a feature in larger network management software packages.

Of course, for every pro there is a con, and pinging in this manner is not without issue. First, it is not uncommon for network administrators to specifically block ping ICMP messages at the firewall or even turn off ping messages completely on host devices. Second, it is a safe bet that any intrusion detection system (IDS) or intrusion prevention system (IPS) that is in place will detect and alert network managers in the event a ping sweep occurs. Finally, ping sweeps have no capability to detect systems that are attached to the network but powered down.

The next step to take after discovering active systems is to find out what services are available on the systems. The most straightforward technique is to scan ports for active services. Port scanning is designed to probe each port on a system in an effort to determine which ports are open. It is effective for gaining information about a host because the probes sent to a system have the capability to reveal more information than a ping sweep can. A successful port scan will return results that will give a clear picture of what services are running on a system. This is because ports are bound to services.

Before discussing how to scan ports, it is important to cover some of the fundamentals of ports. In all, there are 65,535 TCP and 65,535 UDP ports on any given system. Each of these port numbers identifies a specific process that is either sending or receiving information at any time. At first glance, it might seem that you would need to memorize all 65,000-plus ports to be adequately prepared, but this is not the case. In reality, only a few ports should ever be committed to memory, and if a port scan returns any ports that are not immediately recognizable, those port numbers should be further scrutinized. Some common port numbers are shown in TABLE 6-1.

Look closely at the last column of Table 6-1. In this column, the protocol in use is listed as either TCP or UDP. In practice, applications that access the network can do so using either TCP or UDP, based on how the service is designed. An effective port scan will be designed to consider both TCP and UDP as part of the scanning process. These two transport layer protocols work in different ways. TCP acknowledges each connection attempt. UDP does not, so it tends to produce less reliable results.