Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I received an email from a client with IDS logs. I was wondering if the following log has any real indications of the server being compromised. If there are certain things I can do to diagnose the situation I am open for any suggestions.

###Log Start##
02/28/2011 08:58:42.352 - Alert - Intrusion Prevention - Possible port scan
detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 8897, OPT - TCP scanned
port list, 8869, 8867, 8863, 8898, 8899
02/28/2011 09:08:01.144 - Alert - Intrusion Prevention - Possible port scan
detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 12470, OPT - TCP scanned
port list, 12403, 12454, 12462, 12466, 12472
02/28/2011 09:09:20.080 - Alert - Intrusion Prevention - Probable TCP FIN
scan detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 14037, OPT - TCP
scanned port list, 13972, 13970, 14023, 13979, 13983
02/28/2011 09:10:58.496 - Alert - Intrusion Prevention - Probable TCP FIN
scan detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 15749, OPT - TCP
scanned port list, 15755, 15715, 15697, 15717, 15751
02/28/2011 09:14:24.112 - Alert - Intrusion Prevention - Probable TCP FIN
scan detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 19277, OPT - TCP
scanned port list, 19239, 19266, 19269, 19273, 19275
02/28/2011 09:15:50.592 - Alert - Intrusion Prevention - Probable TCP FIN
scan detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 21033, OPT - TCP
scanned port list, 21071, 20965, 21111, 20955, 21090
02/28/2011 09:26:15.016 - Alert - Intrusion Prevention - Probable TCP FIN
scan detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 37244, OPT - TCP
scanned port list, 37260, 37278, 37235, 37238, 37247
02/28/2011 09:28:53.592 - Alert - Intrusion Prevention - Probable TCP FIN
scan detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 40411, OPT - TCP
scanned port list, 40468, 40453, 40454, 40455, 40465
02/28/2011 09:29:19.128 - Alert - Intrusion Prevention - Possible port scan
detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 41163, OPT - TCP scanned
port list, 41217, 41216, 41178, 41137, 41138
02/28/2011 09:40:38.240 - Alert - Intrusion Prevention - Probable TCP FIN
scan detected - x.x.x.x.x, 443, OPT - x.x.x.x.x, 55567, OPT - TCP
scanned port list, 55555, 55553, 55582, 55589, 55561
###Log End##
share|improve this question

migrated from serverfault.com Feb 28 '11 at 19:25

This question came from our site for system and network administrators.

    
Can you give us any info about if there were common IPs from which the scans originated from? The x.x.x.x (why are there 5 x's in your example?) would be more helpful if we knew at least about some of the associations of the IPs.. – mrnap Mar 3 '11 at 5:32
    
Cannot tell for sure without knowing the IP addresses and what IP address you believe may be compromised. For all we know, the port scan could be originating from your "compromised" host and scanning the internet. – user2320464 Jun 26 at 3:51

There are no indications of a compromise in the logs. They only show at worst port scanning. This is the act of looking for open ports, the next stage if open ports were found would be to check the version of software running and then to try to exploit potential vulnerabilities to gain access. This would show up in the logs as well (as long as the IDS has not been incorrectly tuned).

However, it would be worth looking at the web server logs to see if the source address of this activity corresponds to a valid IP using the web server. Sometimes when clients try to connect to a service they make a connection on the remote port (in this case 443) and the server attempts to open up a high port for the return traffic. If this is blocked the connection may try to establish a different high port and so on. This can have the effect of looking like a port scan.

share|improve this answer

Answer

No, this is not an indication for a compromise.

Details about Portscans

As the messages indicate, there are two different kinds of portscans happening:

  • TCP Scan: Either a full (SYN, SYN/ACK, ACK) or half-open (SYN, SYN/ACK) scan
  • FIN Scan: A more advanced scan technique

It depends which threshold is required by the FW/IDS module to generate these messages. Different products come with different default values. The 2nd scan technique is quite unpopular and less common to be seen as a harmless fluke. This might indicate someone taking time to enumerate the target site. The detection lets us assume that either the person is less skilled or in a hurry.

DoS Attempt unlikely

Furthermore, the timing of the messages does not indicate a possible DDoS flooding approach. It is way too slow.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.