Let's say Alice, Bob, and Mallory all live together in a house.
Mallory decides to go on vacation, but before leaving, she decides to play a game with Bob and Alice. She makes two claims:
- She has installed hidden cameras inside the house.
- She has remote access to the cameras.
Mallory challenges Bob and Alice to find the cameras and then leaves for vacation.
Bob and Alice conduct a casual visual search throughout the house, but do not find any cameras.
Based off the search, Bob assumes that Mallory is lying about the cameras. Alice is not convinced that Malory is lying, so Bob wants to prove it.
He decides to attempt debunking Mallory's second claim.
To the best of his knowledge, there is only one wireless router installed inside the house. Bob gets on his laptop and gets a command line running.
# iw dev wlan1 scan | grep -B 4 SSID
He runs this
iw command several times and notices that only one SSID is found consistently. This is the SSID he knows his router uses.
He then tries to find the gateway address of the router.
$ netstat -rn Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 192.168.1.254 0.0.0.0 UG 0 0 0 wlan1 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 wlan1 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan1
Bob's networking knowledge is limited and his knowledge on cameras is even more limited, but he assumes that in order to remotely access the cameras, Mallory would have to have opened ports for those cameras.
# nmap -v -A 192.168.1.254 | grep "open port" Discovered open port 443/tcp on 192.168.1.254 Discovered open port 80/tcp on 192.168.1.254 Discovered open port 49152/tcp on 192.168.1.254
A quick google search shows that port 80 is for HTTP and port 443 is for HTTPS, but Bob is unsure what port 49152 is for. It seems
nmap is also unsure what the port is used for:
49152/tcp open unknown 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi : SF-Port49152-TCP:V=5.21%I=7%D=3/28%Time=53362E24%P=x86_64-unknown-linux-gnu%r(FourOhFourRequest,5,"\*\xced\0\x03")%r(GetRequest,5,"\*\xced\0\x03")%r( SF:HTTPOptions,5,"\*\xced\0\x03")%r(RTSPRequest,5,"\*\xced\0\x03")%r(RPCCh SF:eck,5,"\*\xced\0\x03")%r(DNSVersionBindReq,5,"\*\xced\0\x03")%r(DNSStat SF:usRequest,5,"\*\xced\0\x03")%r(SSLSessionReq,5,"\*\xced\0\x03")%r(SMBPr SF:ogNeg,5,"\*\xced\0\x03")%r(X11Probe,5,"\*\xced\0\x03")%r(LDAPBindReq,5, SF:"\*\xced\0\x03")%r(SIPOptions,5,"\*\xced\0\x03")%r(LANDesk-RC,5,"\*\xce SF:d\0\x03")%r(TerminalServer,5,"\*\xced\0\x03")%r(NCP,5,"\*\xced\0\x03")% SF:r(NotesRPC,5,"\*\xced\0\x03")%r(WMSRequest,5,"\*\xced\0\x03")%r(oracle- SF:tns,5,"\*\xced\0\x03");
What can Bob do to verify whether or not this is the port Mallory is using to remotely access the cameras?
Bob is also worried that has not considered any wired internet connections. He is wondering if it's possible that Mallory hired a security company to install the cameras and that Mallory accesses the cameras remotely via the security company's website.
What else can Bob do to convince Alice that Mallory is lying about her second claim?