Null session

A null session is an anonymous connection to an inter-process communication network service on Windows-based computers.[1] The service is designed to allow named pipe connections[2] but may be used by attackers to remotely gather information about the system.[3]

Exposure

From a NULL session, hackers can call APIs and use Remote Procedure calls to enumerate information. These techniques can, and will provide information on passwords, groups, services, users and even active processors. NULL session access can also even be used for escalating privileges and perform DoS attacks.

— Ixis Research LTD[4]

References

  1. ↑ "Null Session Attacks and How to Avoid Them". Retrieved 2016-01-05.
  2. ↑ "IPC$ share and null session behavior in Windows". Microsoft. Retrieved 2016-01-05.
  3. ↑ "The Anatomy of a Attack". Retrieved 2016-01-05.
  4. ↑ "How is information enumerated through NULL session access, Remote Procedure Calls and IPC$?". Ixis Research LTD. Retrieved 24 February 2013.


This article is issued from Wikipedia - version of the Wednesday, January 06, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.