WGU C844 Emerging Technologies in Cybersecurity Task 1 GRP1

WGU C844 Emerging Technologies in Cybersecurity Task 1 GRP1. . The Network Topology After opening the root emulator and typing Zenmap, I ran a network scan of the domain 10.168.27.0/24. I selected the Quick scan plus option, then clicked scan. The network scan showed a star topology with six devices connected to a local host. Results:  IP 10.168.27.20 – 1 Open Port – OS Linux 2.6.32  IP 10.168.27.14 – 1 Open Port – OS Linux 2.6.32  IP 10.168.27.132 – 1 Open Port – OS Linux 2.6.32  IP 10.168.27.10 – 8 Open Ports – OS MS Windows Server 2012 R2  IP 10.168.27.15 – 10 Open Ports – OS MS Windows Server 2008 R2 or Windows 8.1  IP 10.168.27.1 – 0 Open Ports – OS Unknown 2 WGU C844 Emerging Technologies in Cybersecurity Task 1 GRP1 about:blank 3/12 TASK 1: NMAP AND WIRESHARK B. Summary of nmap/Zenmap Results After completing the scan with Zenmap, I identified several problems. The vulnerabilities and their implications based on the scan are as follows: 1. 10.168.27.14 (Linux 2.6.32) ssh service OpenSSH 5.5p1 Debian, (protocol 2.0). Vulnerability: This version of OpenSSH grants a remote attacke r access to itemize all accounts on the system while processing authentication requests. Implication: Attackers can send specifically constructed series of packets and observe behavior of a server to detect the presence of a valid username. If this system isn’ t configured appropriately or a user account is set with a default password, a hacker can weaken the port and control the entire system. 3 WGU C844 Emerging Technologies in Cybersecurity Task 1 GRP1 about:blank 4/12 TASK 1: NMAP AND WIRESHARK 2. 10.168.27.15 - Microsoft Windows Server 2008 R2 or W indows 8.1 Vulnerability: The scan revealed this host has ten open ports. Port 135 msrpc i s concerning. MS Remote Procedure Call (RPC) is a service that allows other systems to spot services are publicized on a server and what port to find them on. Implication: Tools used by hackers such as "epdump" (Endpoint Dump) can quickly identify eve ry DCOMrelated server/service running on a host computer and match them up with known exploits.