Tech Notes

The Distributed Computing Environment / Remote Procedure Calls (DCE/RPC) protocol was established as a method to allow distributed software to be run as if it was all working on the same system. One of the functions of DCE/RPC is service enumeration, or the ability of a client system to get information about all the services running on a server. As with most useful network tools, this ability to enumerate services on a server can provide tons of information about a server and its services to an attacker if proper restrictions are not put in place. The biggest risk of allowing DCE/RPC is information leakage. An attacker querying systems using DCE/RPC can gain vital information about the services running on the servers. This can provide the attacker with knowledge of potentially vulnerable services that can be exploited in a variety of ways. This trove of information greatly increases the attack surface…

Cleartext protocols, like Hyper Text Transfer Protocol (HTTP), Telnet, and File Transfer Protocol (FTP) do not use any sort of encryption to protect the data being sent over them. For the most part, this is ok, as not every web page or file that is shared needs to be protected in that manner. If you are looking at a page on Wikipedia, then it is understandable that there is no encryption on that page, as the information is readily available for everyone to look at. But logging into the admin console of your website is definitely not something you want to share with everyone else. Cleartext protocols allow threat actors to sniff network traffic and see everything in plain writing. If that network packet happens to be you logging into your web admin portal, then that means your username and password are more visible to the threat actor then they…

Understanding SNMP and GetBulk SNMP (Simple Network Management Protocol) is a widely used protocol for network management and monitoring. It allows administrators to access and manage network devices, such as routers, switches, and servers. SNMP GetBulk requests allow the retrieval of a large amount of data from multiple network devices in a single request, resulting in increased efficiency and reduced network traffic. This is a boon for network administrators, making their jobs easier. But it is a boon for threat actors, as well. SNMP GetBulk Reflected DDoS Attack Threat actors can take advantage of the SNMP GetBulk command's ability to retrieve a large volume of data from multiple devices simultaneously. They exploit this capability by reflecting and amplifying the attack traffic off SNMP enabled devices, creating significantly larger traffic volumes than the attacker's resources alone could generate. This is commonly known as a Reflected Distributed Denial of Service (Reflected DDoS)…