|
The idle scan is a TCP port scan method that consists of sending spoofed packets to a computer to find out what services are available. This is accomplished by impersonating another computer called a "''zombie''" (that is not transmitting or receiving information) and observing the behavior of the ''zombie'' system. ==Information== This action can be done through common software network utilities such as nmap and hping. The attack involves sending forged packets to a specific machine ''target'' in an effort to find distinct characteristics of another ''zombie'' machine. The attack is sophisticated because there is no interaction between the attacker computer and the target: the attacker interacts only with the "''zombie''" computer. This exploit functions with two purposes, as a port scanner and a mapper of trusted IP relationships between machines. The target system interacts with the "''zombie''" computer and difference in behaviour can be observed using different "zombies" with evidence of different privileges granted by the target to different computers. Discovered by Salvatore Sanfilippo (also known by his handle "Antirez") in 1998, the idle scan has been used by many black hat "hackers" to covertly identify open ports on a target computer in preparation for attacking it. Although it was originally named ''dumb scan'', the term ''idle scan'' was coined in 1999, after the publication of a proof of concept 16-bit identification field (IPID) scanner named ''idlescan'', by Filipe Almeida (aka LiquidK). This type of scan can also be referenced as ''zombie scan''; all the nomenclatures are due to the nature of one of the computers involved in the attack. 抄文引用元・出典: フリー百科事典『 ウィキペディア（Wikipedia）』 ■ウィキペディアで「Idle scan」の詳細全文を読む スポンサード リンク
|