
01 55784X FM.qxd 3/29/04 4:16 PM Page i
Hacking
FOR
DUMmIES‰
by Kevin Beaver
Foreword by Stuart McClure
01 55784X FM.qxd 3/29/04 4:16 PM Page v
01 55784X FM.qxd 3/29/04 4:16 PM Page i
Hacking
FOR
DUMmIES‰
by Kevin Beaver
Foreword by Stuart McClure
01 55784X FM.qxd 3/29/04 4:16 PM Page ii
Hacking For Dummies®
Published by
Wiley Publishing, Inc.
111 River Street
Hoboken, NJ 07030-5774
Copyright © 2004 by Wiley Publishing, Inc., Indianapolis, Indiana Published by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Legal Department, Wiley Publishing, Inc., 10475
Crosspoint Blvd., Indianapolis, IN 46256, (317) 572-3447, fax (317) 572-4447, e-mail: permcoordinator@
wiley.com.
Trademarks: Wiley, the Wiley Publishing logo, For Dummies, the Dummies Man logo, A Reference for the Rest of Us!, The Dummies Way, Dummies Daily, The Fun and Easy Way, Dummies.com, and related trade dress are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates in the United States and other countries, and may not be used without written permission. All other trademarks are the property of their respective owners. Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book.
GENERAL DISCLAIMER: THE PUBLISHER AND THE AUTHOR MAKE NO REPRESENTATIONS OR WARRANTIES WITH RESPECT TO THE ACCURACY OR COMPLETENESS OF THE CONTENTS OF THIS WORK
AND SPECIFICALLY DISCLAIM ALL WARRANTIES, INCLUDING WITHOUT LIMITATION WARRANTIES
OF FITNESS FOR A PARTICULAR PURPOSE. NO WARRANTY MAY BE CREATED OR EXTENDED BY
SALES OR PROMOTIONAL MATERIALS. THE ADVICE AND STRATEGIES CONTAINED HEREIN MAY NOT
BE SUITABLE FOR EVERY SITUATION. THIS WORK IS SOLD WITH THE UNDERSTANDING THAT THE
PUBLISHER IS NOT ENGAGED IN RENDERING LEGAL, ACCOUNTING, OR OTHER PROFESSIONAL SERVICES. IF PROFESSIONAL ASSISTANCE IS REQUIRED, THE SERVICES OF A COMPETENT PROFESSIONAL
PERSON SHOULD BE SOUGHT. NEITHER THE PUBLISHER NOR THE AUTHOR SHALL BE LIABLE FOR
DAMAGES ARISING HEREFROM. THE FACT THAT AN ORGANIZATION OR WEBSITE IS REFERRED TO
IN THIS WORK AS A CITATION AND/OR A POTENTIAL SOURCE OF FURTHER INFORMATION DOES NOT
MEAN THAT THE AUTHOR OR THE PUBLISHER ENDORSES THE INFORMATION THE ORGANIZATION
OR WEBSITE MAY PROVIDE OR RECOMMENDATIONS IT MAY MAKE. FURTHER, READERS SHOULD
BE AWARE THAT INTERNET WEBSITES LISTED IN THIS WORK MAY HAVE CHANGED OR DISAPPEARED
BETWEEN WHEN THIS WORK WAS WRITTEN AND WHEN IT IS READ.
For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at 800-762-2974, outside the U.S. at 317-572-3993, or fax 317-572-4002.
Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.
Library of Congress Control Number: 2004101971
ISBN: 0-7645-5784-X
Manufactured in the United States of America
10 9 8 7 6 5 4 3 2 1
1B/RV/QU/QU/IN
01 55784X FM.qxd 3/29/04 4:16 PM Page iii
About the Author
As founder and principal consultant of Principle Logic, LLC, Kevin Beaver has over 16 years of experience in IT and specializes in information security.
Before starting his own information security services business, Kevin served in various information technology and security roles for several Fortune 500 corporations and a variety of consulting, e-commerce, and educational institutions. In addition to ethical hacking, his areas of information security expertise include network and wireless network security, e-mail and instant messaging security, and incident response Kevin is also author of the book The Definitive Guide to Email Management and Security by Realtimepublishers.com and co-author of the book The Practical Guide to HIPAA Privacy and Security Compliance by Auerbach Publications. In addition, he is technical editor of the book Network Security For Dummies by Wiley Publishing, and a contributing author and editor of the book Healthcare Information Systems, 2nd ed. by Auerbach Publications.
Kevin is a regular columnist and information security expert advisor for SearchSecurity.com and SearchMobileComputing.com and is a Security Clinic Expert for ITsecurity.com. In addition, his information security work has been published in Information Security Magazine, HIMSS Journal of Healthcare Information Management, Advance for Health Information Executives as well as on SecurityFocus.com . Kevin is an information security instructor for the Southeast Cybercrime Institute and also frequently speaks on information security at various workshops and conferences around the U.S. including TechTarget's Decisions conferences, CSI, and the Southeast Cybercrime Summit.
Kevin is the founder and president of the Technology Association of Georgia's Information Security Society and serves as an IT advisory board member for several universities and companies around the southeast. Kevin earned his bachelor's degree in Computer Engineering Technology from Southern Poly-technic State University and his master's degree in Management of Technology from Georgia Tech. He also holds CISSP, MCSE, Master CNE, and IT Project+
certifications. Kevin can be reached at kbeaver@principlelogic.com.
01 55784X FM.qxd 3/29/04 4:16 PM Page iv
Dedication
For Amy, Garrett, Master, and Murphy --- through thick and thicker, we did it!
I couldn't have written this book without the tremendous inspiration each of you have given me. You all make the world a better place --- thanks for being here for me.
Author's Acknowledgments
First, I'd like to thank Melody Layne, my acquisitions editor at Wiley, for contacting me with this book idea, providing me this great opportunity, and for being so patient with me during the acquisitions, writing, and editing processes. Also, thanks to all the other members of the acquisitions team at Wiley who helped me shape my outline and initial chapter.
I'd like to thank my project editor, Pat O'Brien, as well as Kim Darosett and the rest of the tireless editorial staff at Wiley for all of your hard work, patience, and great edits! Also, thanks to Terri Varveris for making the initial Dummies contact several years back in the Hungry Minds days and for introducing me to the team --- you truly helped get this ball rolling.
Major kudos go out to the security legend, Peter T. Davis, my technical editor.
Your For Dummies experience and seemingly never-ending technical knowledge are a great asset to this book. I really appreciate your time and effort you've put forth, and I'm truly honored that you helped me on this project.
I'd also like to thank Stuart McClure --- the highly-talented security expert and phenomenal author --- for writing the foreword. It's funny how this book turned out and how you still ended up being involved! Just look at what you created instead --- you should be proud.
To Ira Winkler, Dr. Philippe Oechslin, David Rhoades, Laura Chappell, Matt Caldwell, Thomas Akin, Ed Skoudis, and Caleb Sima --- thank you all for doing such a great job with the case studies in this book! They're a perfect fit and each of you were true professionals and great to work with. I really appreciate your time and effort.
01 55784X FM.qxd 3/29/04 4:16 PM Page v
I'd like to extend deep gratitude to Robert Dreyer --- my favorite professor at Southern Poly --- who piqued my technical interest in computer hardware and software and who taught me way more about computer bits and bytes than I thought I'd ever know. Also, thanks to my friend William Long --- one of the smartest people I've ever known --- for being the best computer and network mentor I could ever have. In addition, I'd like to thank John Cirami for showing me how to run that first DOS executable file off of that 5 1/4" floppy way back when and for helping me to get the ball rolling in my computer career.
A well-deserved thanks also goes out to all my friends and colleagues --- you know who you are --- who helped provide feedback and advice about the title change.
Finally, I'd like to thank Rik Emmett, Geoff Tate, Neil Peart, and all of their supporting band members for the awesome lyrics and melodies that inspired me to keep pushing forward with this book during the challenging times.
01 55784X FM.qxd 3/29/04 4:16 PM Page vi
Publisher's Acknowledgments
We're proud of this book; please send us your comments through our online registration form located at www.dummies.com/register/.
Some of the people who helped bring this book to market include the following:
Acquisitions, Editorial, and
Production
Media Development
Project Coordinator: Maridee Ennis
Project Editor: Pat O'Brien
Layout and Graphics: Andrea Dahl,
Acquisitions Editor: Melody Layne
Denny Hager, Lynsey Osborn,
Heather Ryan, Jacque Schneider
Senior Copy Editor: Kim Darosett
Proofreaders: Carl W. Pierce, Brian H. Walls,
Technical Editor: Peter T. Davis
TECHBOOKS Production Services
Editorial Manager: Kevin Kirschner
Indexer: TECHBOOKS Production Services
Media Development Manager: Laura VanWinkle
Media Development Supervisor:
Richard Graves
Editorial Assistant: Amanda Foxworth
Cartoons: Rich Tennant, www.the5thwave.com
Publishing and Editorial for Technology Dummies
Richard Swadley, Vice President and Executive Group Publisher Andy Cummings, Vice President and Publisher
Mary C. Corder, Editorial Director
Publishing for Consumer Dummies
Diane Graves Steele, Vice President and Publisher Joyce Pepple, Acquisitions Director
Composition Services
Gerry Fahey, Vice President of Production Services Debbie Stailey, Director of Composition Services 01 55784X FM.qxd 3/29/04 4:16 PM Page vii Contents at a Glance
Foreword...................................................................xvii Introduction .................................................................1
Part I: Building the Foundation for Ethical Hacking .......7
Chapter 1: Introduction to Ethical Hacking ...................................................................9
Chapter 2: Cracking the Hacker Mindset ......................................................................21
Chapter 3: Developing Your Ethical Hacking Plan .......................................................29
Chapter 4: Hacking Methodology ..................................................................................39
Part II: Putting Ethical Hacking in Motion ..................53
Chapter 5: Social Engineering ........................................................................................55
Chapter 6: Physical Security ..........................................................................................69
Chapter 7: Passwords .....................................................................................................79
Part III: Network Hacking ........................................103
Chapter 8: War Dialing ..................................................................................................105
Chapter 9: Network Infrastructure ..............................................................................117
Chapter 10: Wireless LANs ...........................................................................................147
Part IV: Operating System Hacking ..........................165
Chapter 11: Windows ....................................................................................................167
Chapter 12: Linux ..........................................................................................................193
Chapter 13: Novell NetWare .........................................................................................215
Part V: Application Hacking .....................................235
Chapter 14: Malware .....................................................................................................237
Chapter 15: Messaging Systems ..................................................................................257
Chapter 16: Web Applications .....................................................................................279
Part VI: Ethical Hacking Aftermath ..........................297
Chapter 17: Reporting Your Results ............................................................................299
Chapter 18: Plugging Security Holes ...........................................................................305
Chapter 19: Managing Security Changes ....................................................................311
01 55784X FM.qxd 3/29/04 4:16 PM Page viii
Part VII: The Part of Tens .........................................317
Chapter 20: Ten Tips for Getting Upper Management Buy-In ..................................319
Chapter 21: Ten Deadly Mistakes ................................................................................323
Part VIII: Appendixes ...............................................327
Appendix A: Tools and Resources................................................................................329
Appendix B: About the Book Web Site.........................................................................337
Index .......................................................................339
01 55784X FM.qxd 3/29/04 4:16 PM Page ix
Table of Contents
Foreword ...................................................................xvii Introduction..................................................................1
Who Should Read This Book? ........................................................................1
About This Book ..............................................................................................2
How to Use This Book ....................................................................................2
What You Don't Need to Read .......................................................................3
Foolish Assumptions ......................................................................................3
How This Book Is Organized ..........................................................................3
Part I: Building the Foundation for Ethical Hacking ..........................4
Part II: Putting Ethical Hacking in Motion ..........................................4
Part III: Network Hacking ......................................................................4
Part IV: Operating System Hacking .....................................................4
Part V: Application Hacking .................................................................5
Part VI: Ethical Hacking Aftermath .....................................................5
Part VII: The Part of Tens .....................................................................5
Part VIII: Appendixes ............................................................................5
Icons Used in This Book .................................................................................6
Where to Go from Here ...................................................................................6
Part I: Building the Foundation for Ethical Hacking ........7
Chapter 1: Introduction to Ethical Hacking . . . . . . . . . . . . . . . . . . . . . . .9
How Hackers Beget Ethical Hackers .............................................................9
Defining hacker ......................................................................................9
Ethical Hacking 101 .............................................................................10
Understanding the Need to Hack Your Own Systems ..............................11
Understanding the Dangers Your Systems Face .......................................12
Nontechnical attacks ..........................................................................12
Network-infrastructure attacks .........................................................13
Operating-system attacks ...................................................................13
Application and other specialized attacks .......................................13
Obeying the Ethical hacking Commandments ..........................................14
Working ethically .................................................................................14
Respecting privacy ..............................................................................14
Not crashing your systems ................................................................15
The Ethical hacking Process ........................................................................15
Formulating your plan ........................................................................15
Selecting tools ......................................................................................17
Executing the plan ...............................................................................19
Evaluating results ................................................................................20
Moving on .............................................................................................20
01 55784X FM.qxd 3/29/04 4:16 PM Page x
Hacking For Dummies
x
Chapter 2: Cracking the Hacker Mindset . . . . . . . . . . . . . . . . . . . . . . . .21
What You're Up Against ................................................................................21
Who Hacks .....................................................................................................22
Why Hackers Hack ........................................................................................24
Planning and Performing Attacks ................................................................26
Maintaining Anonymity ................................................................................27
Chapter 3: Developing Your Ethical Hacking Plan . . . . . . . . . . . . . . . .29
Getting Your Plan Approved ........................................................................29
Establishing Your Goals ................................................................................30
Determining What Systems to Hack ...........................................................32
Creating Testing Standards ..........................................................................33
Timing ...................................................................................................34
Specific tests ........................................................................................34
Blind versus knowledge assessments ..............................................35
Location ................................................................................................36
Reacting to major exploits that you find ..........................................36
Silly assumptions .................................................................................36
Selecting Tools ...............................................................................................37
Chapter 4: Hacking Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .39
Setting the Stage ............................................................................................39
Seeing What Others See ...............................................................................41
Gathering public information ............................................................41
Mapping the network ..........................................................................43
Scanning Systems ..........................................................................................45
Hosts .....................................................................................................46
Modems and open ports ....................................................................46
Determining What's Running on Open Ports .............................................47
Assessing Vulnerabilities .............................................................................49
Penetrating the System ................................................................................51
Part II: Putting Ethical Hacking in Motion ...................53
Chapter 5: Social Engineering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55
Social Engineering 101 ..................................................................................55
Before You Start .............................................................................................56
Why Hackers Use Social Engineering .........................................................58
Understanding the Implications ..................................................................58
Performing Social-Engineering Attacks ......................................................59
Fishing for information .......................................................................60
Building trust .......................................................................................62
Exploiting the relationship .................................................................63
Social-Engineering Countermeasures .........................................................65
Policies ..................................................................................................66
User awareness ....................................................................................66
01 55784X FM.qxd 3/29/04 4:16 PM Page xi
Table of Contents
xi
Chapter 6: Physical Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .69
Physical-Security Vulnerabilities ................................................................69
What to Look For ...........................................................................................70
Building infrastructure .......................................................................72
Utilities ..................................................................................................73
Office layout and usage ......................................................................74
Network components and computers ..............................................75
Chapter 7: Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .79
Password Vulnerabilities ..............................................................................79
Organizational password vulnerabilities ..........................................80
Technical password vulnerabilities ..................................................82
Cracking Passwords ......................................................................................82
Cracking passwords the old-fashioned way ....................................83
High-tech password cracking .............................................................85
General password-hacking countermeasures ..................................91
Password-protected files ....................................................................95
Other ways to crack passwords ........................................................97
Securing Operating Systems ......................................................................101
Windows .............................................................................................101
Linux and UNIX ..................................................................................102
Part III: Network Hacking ........................................103
Chapter 8: War Dialing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .105
War Dialing ...................................................................................................105
Modem safety .....................................................................................105
General telephone-system vulnerabilities ......................................106
Attacking .............................................................................................106
Countermeasures ..............................................................................114
Chapter 9: Network Infrastructure . . . . . . . . . . . . . . . . . . . . . . . . . . . .117
Network Infrastructure Vulnerabilities ....................................................119
Choosing Tools ............................................................................................120
Scanners .............................................................................................120
Vulnerability assessment .................................................................121
Scanning, Poking, and Prodding ................................................................121
Port scanners .....................................................................................121
SNMP scanning ..................................................................................129
Banner grabbing ................................................................................130
Firewall rules ......................................................................................131
Looking through a network analyzer ..............................................134
The MAC-daddy attack .....................................................................140
Denial of service ................................................................................144
General network defenses ................................................................146
01 55784X FM.qxd 3/29/04 4:16 PM Page xii
Hacking For Dummies
xii
Chapter 10: Wireless LANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .147
Understanding the Implications of Wireless Network Vulnerabilities ....147
Choosing Your Tools ...................................................................................148
Wireless LAN Discovery .............................................................................151
Checking for worldwide recognition ...............................................151
Scanning your local airwaves ..........................................................152
Wireless Network Attacks ..........................................................................154
Encrypted traffic ...............................................................................155
Countermeasures ..............................................................................156
Rogue networks .................................................................................158
Countermeasures ..............................................................................159
Physical-security problems ..............................................................160
Countermeasures ..............................................................................160
Vulnerable wireless workstations ...................................................161
Countermeasures ..............................................................................161
Default configuration settings .........................................................162
Countermeasures ..............................................................................163
Part IV: Operating System Hacking ..........................165
Chapter 11: Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .167
Windows Vulnerabilities ............................................................................168
Choosing Tools ............................................................................................168
Essential tools ....................................................................................169
Free Microsoft tools ..........................................................................169
All-in-one assessment tools ..............................................................170
Task-specific tools .............................................................................170
Information Gathering ................................................................................171
System scanning ................................................................................171
NetBIOS ..............................................................................................174
RPC ................................................................................................................177
Enumeration .......................................................................................178
Countermeasures ..............................................................................178
Null Sessions ...............................................................................................179
Hacks ...................................................................................................179
Countermeasures ..............................................................................184
Share Permissions .......................................................................................186
Windows defaults ..............................................................................186
Testing ................................................................................................187
General Security Tests ................................................................................189
Windows Update ................................................................................189
Microsoft Baseline Security Analyzer (MBSA) ...............................190
LANguard ............................................................................................191
Chapter 12: Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .193
Linux Vulnerabilities ...................................................................................194
Choosing Tools ............................................................................................194
01 55784X FM.qxd 3/29/04 4:16 PM Page xiii
Table of Contents
xiii
Information Gathering ................................................................................195
System scanning ................................................................................195
Countermeasures ..............................................................................199
Unneeded Services .....................................................................................200
Searches ..............................................................................................200
Countermeasures ..............................................................................202
.rhosts and hosts.equiv Files .....................................................................204
Hacks ...................................................................................................204
Countermeasures ..............................................................................205
NFS ................................................................................................................206
Hacks ...................................................................................................206
Countermeasures ..............................................................................207
File Permission ............................................................................................207
Hacks ...................................................................................................207
Countermeasures ..............................................................................207
Buffer Overflows .........................................................................................208
Attacks ................................................................................................209
Countermeasures ..............................................................................209
Physical Security .........................................................................................209
Hacks ...................................................................................................210
Countermeasures ..............................................................................210
General Security Tests ................................................................................211
Patching Linux .............................................................................................212
Distribution updates .........................................................................213
Multiplatform update managers ......................................................213
Chapter 13: Novell NetWare . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .215
NetWare Vulnerabilities ..............................................................................215
Choosing Tools ............................................................................................216
Getting Started ............................................................................................216
Server access methods .....................................................................217
Port scanning .....................................................................................217
NCPQuery ...........................................................................................219
Countermeasures ..............................................................................220
Authentication .............................................................................................220
Rconsole .............................................................................................221
Server-console access ......................................................................224
Intruder detection .............................................................................224
Rogue NLMs .......................................................................................225
Cleartext packets ..............................................................................229
General Best Practices for Minimizing NetWare Security Risks ............230
Rename admin ...................................................................................231
Disable eDirectory browsing ...........................................................231
Removing bindery contexts .............................................................233
System auditing .................................................................................233
TCP/IP parameters ............................................................................234
Patching ..............................................................................................234
01 55784X FM.qxd 3/29/04 4:16 PM Page xiv
Hacking For Dummies
xiv
Part V: Application Hacking .....................................235
Chapter 14: Malware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .237
Implications of Malware Attacks ...............................................................237
Types of Malware ........................................................................................239
Trojan horses .....................................................................................239
Viruses ................................................................................................240
Worms .................................................................................................240
Rootkits ...............................................................................................240
Spyware ..............................................................................................241
Built-in programming interfaces ......................................................241
Logic bombs .......................................................................................242
Security tools .....................................................................................242
How Malware Propagates ...........................................................................243
Automation .........................................................................................243
E-mail ...................................................................................................243
Hacker backdoors .............................................................................244
Testing ..........................................................................................................244
Vulnerable malware ports ................................................................244
Manual assessment ...........................................................................245
Antivirus software testing ................................................................249
Network scanning ..............................................................................250
Behavioral-analysis tools .................................................................253
Malware Countermeasures ........................................................................253
General system administration .......................................................253
E-mails .................................................................................................255
Files .....................................................................................................255
Chapter 15: Messaging Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .257
Messaging-System Vulnerabilities .............................................................257
E-Mail Attacks ..............................................................................................258
E-mail bombs .....................................................................................258
Banners ...............................................................................................263
SMTP attacks .....................................................................................265
General best practices for minimizing e-mail security risks ........271
Instant Messaging .......................................................................................272
Vulnerabilities ....................................................................................272
Countermeasures ..............................................................................275
Chapter 16: Web Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .279
Web-Application Vulnerabilities ................................................................279
Choosing Your Tools ...................................................................................280
Insecure Login Mechanisms ......................................................................280
Testing ................................................................................................280
Countermeasures ..............................................................................283
Directory Traversal .....................................................................................283
Testing ................................................................................................283
Countermeasures ..............................................................................285
01 55784X FM.qxd 3/29/04 4:16 PM Page xv
Table of Contents
xv
Input Filtering ..............................................................................................285
Input attacks ......................................................................................286
Countermeasures ..............................................................................289
Default Scripts .............................................................................................289
Attacks ................................................................................................289
Countermeasures ..............................................................................290
URL Filter Bypassing ...................................................................................290
Bypassing filters ................................................................................290
Countermeasures ..............................................................................292
Automated Scans ........................................................................................292
Nikto ....................................................................................................292
WebInspect .........................................................................................292
General Best Practices for Minimizing
Web-Application Security Risks .............................................................294
Obscurity ............................................................................................294
Firewalls ..............................................................................................295
Part VI: Ethical Hacking Aftermath ...........................297
Chapter 17: Reporting Your Results . . . . . . . . . . . . . . . . . . . . . . . . . . . .299
Pulling the Results Together ......................................................................299
Prioritizing Vulnerabilities .........................................................................301
Reporting Methods .....................................................................................302
Chapter 18: Plugging Security Holes . . . . . . . . . . . . . . . . . . . . . . . . . .305
Turning Your Reports into Action .............................................................305
Patching for Perfection ...............................................................................306
Patch management ............................................................................306
Patch automation ..............................................................................307
Hardening Your Systems ............................................................................308
Assessing Your Security Infrastructure ....................................................309
Chapter 19: Managing Security Changes . . . . . . . . . . . . . . . . . . . . . . .311
Automating the Ethical Hacking Process .................................................311
Monitoring Malicious Use ..........................................................................312
Outsourcing Ethical Hacking .....................................................................313
Instilling a SecurityAware Mindset ..........................................................315
Keeping Up with Other Security Issues ....................................................316
Part VII: The Part of Tens ..........................................317
Chapter 20: Ten Tips for Getting Upper Management Buy-In . . . . . .319
Cultivate an Ally and Sponsor ...................................................................319
Don't Be a FUDdy Duddy ............................................................................319
Demonstrate How the Organization Can't Afford to Be Hacked ...........320
Outline the General Benefits of Ethical Hacking .....................................320
01 55784X FM.qxd 3/29/04 4:16 PM Page xvi
Hacking For Dummies
xvi
Show How Ethical Hacking Specifically Helps the Organization ...........321
Get Involved in the Business .....................................................................321
Establish Your Credibility ..........................................................................321
Speak on Their Level ..................................................................................322
Show Value in Your Efforts .........................................................................322
Be Flexible and Adaptable .........................................................................322
Chapter 21: Ten Deadly Mistakes . . . . . . . . . . . . . . . . . . . . . . . . . . . . .323
Not Getting Approval in Writing ................................................................323
Assuming That You Can Find All Vulnerabilities During Your Tests ....324
Assuming That You Can Eliminate All Security Vulnerabilities .............324
Performing Tests Only Once ......................................................................324
Pretending to Know It All ...........................................................................325
Running Your Tests without Looking at Things
from a Hacker's Viewpoint .....................................................................325
Ignoring Common Attacks ..........................................................................325
Not Using the Right Tools ..........................................................................325
Pounding Production Systems at the Wrong Time .................................326
Outsourcing Testing and Not Staying Involved .......................................326
Part VIII: Appendixes ...............................................327
Appendix A: Tools and Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . .329
Awareness and Training .............................................................................329
Dictionary Files and Word Lists ................................................................329
General Research Tools ..............................................................................330
Hacker Stuff ..................................................................................................330
Linux .............................................................................................................331
Log Analysis .................................................................................................331
Malware ........................................................................................................331
Messaging .....................................................................................................332
NetWare ........................................................................................................332
Networks ......................................................................................................332
Password Cracking ......................................................................................333
War Dialing ...................................................................................................334
Web Applications ........................................................................................334
Windows .......................................................................................................334
Wireless Networks ......................................................................................335
Appendix B: About the Book Web Site . . . . . . . . . . . . . . . . . . . . . . . . .337
Index........................................................................339
01 55784X FM.qxd 3/29/04 4:16 PM Page xvii
Foreword
Little more than 10 years ago, security was barely a newborn in diapers.
With only a handful of security professionals in 1994, few practiced security and even fewer truly understood it. Security technologies amounted to little more than antivirus software and packet filtering routers at that time.
And the concept of a "hacker" came primarily from the Hollywood movie "War Games"; or more often it referred to someone with a low golf score. As a result, just like Rodney Dangerfield it got "no respect" and no one took it seriously.
IT professionals saw it largely as a nuisance, to be ignored --- that is until they were impacted by it.
Today, the number of Certified Information Systems Security Professionals (CISSP) have topped 23,000 (www.isc2.org) worldwide, and there are more security companies dotting the landscape than anyone could possibly remember. Today security technologies encompass everything from authentication and authorization, to firewalls and VPNs. There are so many ways to address the security problem that it can cause more than a slight migraine simply considering the alternatives. And the term "hacker" has become a permanent part of our everyday vernacular --- as defined in nearly daily headlines. The world (and its criminals) has changed dramatically.
So what does all this mean for you, the home/end user or IT/security professional that is thrust into this dangerous online world every time you hit the power button on your computer? The answer is "everything". The digital landscape is peppered with land mines that can go off with the slightest touch or, better yet, without any provocation whatsoever. Consider some simple scenarios: ߜ Simply plugging into the Internet without a properly configured firewall can get you hacked before the pizza is delivered, within 30 minutes or less.
ߜ Opening an email attachment from a family member, friend, or work colleague can install a backdoor on your system allowing a hacker free access to your computer.
ߜ Downloading and executing a file via your Internet Messaging (IM) program can turn your pristine desktop into a Centers for Disease Control (CDC) hotzone, complete with the latest alphabet soup virus.
ߜ Browsing to an innocent (and trusted) website can completely compromise your computer, allowing a hacker to read your sensitive files or worse delete them.
01 55784X FM.qxd 3/29/04 4:16 PM Page xviii
Hacking For Dummies
xviii
Trust me when we say the likelihood of becoming an Internet drive-by statistic on the information superhighway is painfully real.
I am often asked, "Is the fear, uncertainty, and doubt (FUD) centered on cyberterrorism justified? Can cyberterrorists really affect our computer systems and our public infrastructure as some have prognosticated like new age Nostradamus soothsayers? The answer I always give is "Unequivocally, yes".
The possibility of a digital Pearl Harbor is closer than many think. Organized terrorist cells like Al Qaeda are raided almost weekly, and when computers are discovered, their drives are filled with cyber hacking plans, U.S. infrastructure blueprints, and instructions on attacking U.S. computer and infrastructure targets.
Do you believe the energy commissions report about the biggest power outage in U.S history? The one that on August 14, 2003 left 1/5th of the U.S. population without power (about 50 million people) for over 12 hours? Do you believe that it has to do with untrimmed trees and faulty control processes? If you believe in Occam's Razor, then yes, the simplest explanation is usually the correct one but remember this: the power outage hit just three days after the Microsoft Blaster worm, one of the most vicious computer worms ever unleashed on the Internet, first hit. Coincidence? Perhaps.
Some of you may be skeptical, saying "Well, if the threat is so real, why hasn't something bad happened yet?" I respond simply, "If I had come to you on Sept. 10, 2001, and said that in the near future people would use commercial airplanes as bombs to kill over 3,000 people in the matter of 5 hours, would you believe me?" I understand your skepticism. And you should be skeptical.
But we are asking for your trust, and your faith, before something bad happens.
Trust that we know the truth, we know what is possible, and we know the mind of the enemy. I think we can all agree on at least one thing, we cannot allow them to succeed.
Every minute of every day there are governments, organized crime, and hacker groups turning the doors on your house looking for an unlocked entry. They are rattling the windows and circling your domicile, looking for a weakness, a vulnerability, or a way into your house. Are you going to let them in? Are you going to sit idly by and watch as they ransack your belongings, make use of your facilities, and desecrate your sanctuary? Or are you going to empower yourself, educate yourself, and prevent them from winning? The actions you take today will ultimately answer that question.
Do not despair, all hope is not lost. Increasing security is more of a mindset than anything else. Security is akin to working out. If you don't do it regularly, it won't become a part of your lifestyle. And if it doesn't become a part of your lifestyle, it will quickly become something you can forego and avoid. In other words, you won't be fit. Same thing applies for security. If you don't realize that it is a process, not a goal, then you will never make it part of your everyday wellness routine, as a result it quickly becomes something you forego and avoid. And if you avoid it, you will eventually be bit by it.
01 55784X FM.qxd 3/29/04 4:16 PM Page xix
Foreword
xix
The greatest gift you can give yourself is that of education. What you don't know may not kill you but it may seriously impact you or someone you care about. Knowing what you don't know is the real trick. And filling in the gaps of knowledge is paramount to preventing a significant attack. Hacking For Dummies can fill in those gaps. Kevin has done a remarkable job in presenting material that is valuable and unique in that it covers hacking methodologies for Windows, Novell, and Linux, as well as such little covered topics as physical security, social engineering, and malware. The varied coverage of security topics in this book is what helps you more completely understand the mind of the hacker and how they work; and it will ultimately be the singular reason you may avoid an attack in the future. Read it carefully. Learn from it. And practice what it says in every area you can.
Make no mistake; the digital battlefield is very real. It has no beginning, it has no ending, it has no boundaries, and it has no rules. Read this book, learn from it and defend yourself or we may lose this digital war.
Stuart McClure is a world-renowned information security expert, founder and co-author of the highly-popular Hacking Exposed series of books, and founder and President and Chief Technology Officer of Foundstone, Inc., experts in strategic security. He can be reached at stu@foundstone.com.
01 55784X FM.qxd 3/29/04 4:16 PM Page xx
Hacking For Dummies
xx
02 55784x intro.qxd 3/29/04 4:16 PM Page 1
Introduction
Welcome to Hacking For Dummies. This book outlines computer hacker tricks and techniques --- in plain English --- to assess the security of your own information systems, find security vulnerabilities, and fix the vulnerabilities before malicious and criminal hackers have an opportunity to take advantage of them. This hacking is the professional, aboveboard, and legal type of security testing --- which I call ethical hacking throughout the book . Computer and network security is a complex subject and an ever-moving target. You must stay on top of it to ensure your information is protected from the bad guys.
You can implement all the security technologies and other best practices possible, and your information systems may be secure --- as far as you know.
However, until you understand how hackers think and apply that knowledge to assess your systems from a hacker's-eye view, you can't get a true sense of how secure your information really is.
Ethical hacking --- sometimes referred to as penetration testing or white-hat hacking --- is a necessary requirement to ensure that information systems are truly secure on an ongoing basis. This book provides you with the knowledge required to successfully implement an ethical hacking program, along with countermeasures that you can implement to keep malicious hackers out of your business.
Who Should Read This Book?
If you want to hack other people's computer systems maliciously, this book is not for you.
Disclaimer: If you choose to use the information in this book to hack or break into computer systems maliciously in an unauthorized fashion, you're on your own. Neither I, as the author, nor anyone else associated with this book shall be liable or responsible for any unethical or criminal choices that you may make and execute using the methodologies and tools that I describe. This book is intended solely for the IT professional to test information security in an authorized fashion.
02 55784x intro.qxd 3/29/04 4:16 PM Page 2
2
Hacking For Dummies
Okay, now that that's out of the way, time for the good stuff! This book is for you if you're a network administrator, information-security manager, security consultant, or someone interested in finding out more about legally and ethically hacking your own or a customer's information systems to make them more secure.
As the ethical hacker performing well-intended information-security assessments, you can detect and point out security holes that may otherwise be overlooked. If you're performing these tests on your own systems, the information you uncover in your tests can help you win over management and prove that information security should be taken seriously. Likewise, if you're performing these tests for your customers, you can help find security holes that can be plugged before malicious hackers have a chance to exploit them.
The information in this book helps you stay on top of the security game and enjoy the fame and glory that comes with helping your organization and customers prevent bad things from happening to their information.
About This Book
Hacking For Dummies is a reference guide on hacking computers and network systems. The ethical hacking techniques are based on the unwritten rules of computer system penetration testing and information-security best practices.
This book covers everything from establishing your hacking plan to testing your systems to managing an ongoing ethical hacking program. Realistically, for many networks, operating systems, and applications, thousands of possible hacks exist. I cover the major ones that you should be concerned about.
Whether you need to assess security vulnerabilities on a small home-office network, a medium-size corporate network, or across large enterprise systems, Hacking For Dummies provides the information you need.
How to Use This Book
This book includes the following features:
ߜ Various technical and nontechnical hack attacks and their detailed methodologies
ߜ Hack-attack case studies from well-known and anonymous hackers and other security experts
ߜ Specific countermeasures to protect against hack attacks Each chapter is an individual reference on a specific ethical hacking subject.
You can refer to individual chapters that pertain to the type of systems you're assessing, or you can read the book straight through.
02 55784x intro.qxd 3/29/04 4:16 PM Page 3
Before you start hacking your systems, familiarize yourself with the information in Part I so you're prepared for the tasks at hand. The adage "if you fail to plan, you plan to fail" rings true for the ethical hacking process. You must get written permission and have a solid game plan.
This material is not intended to be used for unethical or illegal hacking purposes to propel you from script kiddie to mega hacker. Rather, it is designed to provide you with the knowledge you need to hack your own or your customers' systems --- in an ethical and legal manner --- to enhance the security of the information involved.
What You Don't Need to Read
Depending on your computer and network configurations, you may be able to skip chapters. For example, if you aren't running Linux or wireless networks, you can skip those chapters.
Foolish Assumptions
I make a few assumptions about you, aspiring information-security person: ߜ You're familiar with basic computer-, network-, and information-security-related concepts and terms.
ߜ You have a basic understanding of what hackers do.
ߜ You have access to a computer and a network on which to test these techniques.
ߜ You have access to the Internet in order to obtain the various tools used in the ethical hacking process.
ߜ You have permission to perform the hacking techniques in this book.
How This Book Is Organized
This book is organized into eight parts --- six regular chapter parts, a Part of Tens, and a part with appendixes. These parts are modular, so you can jump around from one part to another as needed. Each chapter provides practical methodologies and best practices you can utilize as part of your ethical hacking efforts, including checklists and references to specific tools you can use, as well as resources on the Internet.
02 55784x intro.qxd 3/29/04 4:16 PM Page 4
4
Hacking For Dummies
This part covers the fundamental aspects of ethical hacking. It starts with an overview of the value of ethical hacking and what you should and shouldn't do during the process. You get inside the hacker's mindset and discover how to plan your ethical hacking efforts. This part covers the steps involved in the ethical hacking process, including how to choose the proper tools.
Part II: Putting Ethical Hacking in Motion
This part gets you rolling with the ethical hacking process. It covers several well-known hack attacks, including social engineering and cracking passwords, to get your feet wet. The techniques presented are some of the most widely used hack attacks. This part covers the human and physical elements of security, which tend to be the weakest links in any information-security program. After you plunge into these topics, you'll know the tips and tricks required to perform common general hack attacks against your systems, as well as specific countermeasures to keep your information systems secure.
Part III: Network Hacking
Starting with the larger network in mind, this part covers methods to test your systems for various well-known network infrastructure vulnerabilities.
From weaknesses in the TCP/IP protocol suite to wireless network insecurities, you find out how networks are compromised using specific methods of flawed network communications, along with various countermeasures that you can implement to keep from becoming a victim. This part also includes case studies on some of the network hack attacks that are presented.
Part IV: Operating System Hacking
Practically all operating systems have well-known vulnerabilities that hackers often use. This part jumps into hacking three widely used operating systems: Windows, Linux, and NetWare. The hacking methods include scanning your operating systems for vulnerabilities and enumerating the specific hosts to gain detailed information. This part also includes information on exploiting well-known vulnerabilities in these operating systems, taking over operating systems remotely, and specific countermeasures that you can implement to make your operating systems more secure. This part also includes case studies on operating-system hack attacks.
02 55784x intro.qxd 3/29/04 4:16 PM Page 5
Part V: Application Hacking
Application security is gaining more visibility in the information-security arena these days. An increasing number of attacks are aimed directly at various applications, which are often able to bypass firewalls, intrusion-detection systems, and antivirus software. This part discusses hacking specific applications, including coverage on malicious software and messaging systems, along with practical countermeasures that you can put in place to make your applications more secure.
One of the most common network attacks is on Web applications. Practically every firewall lets Web traffic into and out of the network, so most attacks are against the millions of Web applications available to almost anyone. This part covers Web application hack attacks, countermeasures, and some application hacking case studies for real-world security testing scenarios.
Part VI: Ethical Hacking Aftermath
After you've performed your ethical hack attacks, what do you do with the information you've gathered? Shelve it? Show it off? How do you move forward? This part answers all these questions and more. From developing reports for upper management to remediating the security flaws that you discover to establishing procedures for your ongoing ethical hacking efforts, this part brings the ethical hacking process full circle. This information not only ensures that your effort and time are well spent, but also is evidence that information security is as an essential element for success in any business that depends on computers and information technology.
Part VII: The Part of Tens
This part contains tips to help ensure the success of your ethical hacking program. You find out how to get upper management to buy into your ethical hacking program so you can get going and start protecting your systems. This part also includes the top ten ethical hacking mistakes to avoid and my top ten tips for ethical hacking success.
Part VIII: Appendixes
This part includes two appendixes that cover ethical hacking reference materials. This includes a one-stop reference listing of ethical hacking tools and resources, as well as information on the Hacking For Dummies Web site.
02 55784x intro.qxd 3/29/04 4:16 PM Page 6
6
Hacking For Dummies
Icons Used in This Book
This icon points out technical information that is interesting but not vital to your understanding of the topic being discussed.
This icon points out information that is worth committing to memory.
This icon points out information that could have a negative impact on your ethical hacking efforts --- so please read it!
This icon refers to advice that can help highlight or clarify an important point.
Where to Go from Here
The more you know about how hackers work and how your systems should be tested, the better you're able to secure your computer systems. This book provides the foundation that you need to develop and maintain a successful ethical-hacking program for your organization and customers. Keep in mind that the high-level concepts of ethical hacking won't change as often as the specific information-security vulnerabilities you're protecting against. The art and science of ethical hacking will always remain an art and a science --- and a field that's ever-changing. You must keep up with the latest hardware and software technologies, along with the various vulnerabilities that come about year after year. No one best way to hack your systems ethically exists, so tweak this information to your heart's content. Happy (ethical) hacking!
03 55784X PP01.qxd 3/29/04 4:16 PM Page 7
Foundation for
Ethical Hacking
03 55784X PP01.qxd 3/29/04 4:16 PM Page 8
In this part . . .
Your mission --- should you choose to accept it --- is to
find the holes in your network before the bad guys do.
This mission will be fun, educational, and most likely enter-taining. It will certainly be an eye-opening experience. The cool part is that you can emerge as the hero, knowing that your company will be better protected against hacker attacks and less likely to have its name smeared across the headlines at any time.
If you're new to ethical hacking, this is the place to begin.
The chapters in this part will get you started with information on what to do and how to do it when you're hacking your own systems. Oh, and also, you find out what not to do as well. This information will guide you through building the foundation for your ethical hacking program to make sure you're going down the right path so you don't veer off and end up going down a one-way dead-end street.
04 55784x Ch01.qxd 3/29/04 4:16 PM Page 9
Chapter 1
ᮣ Understanding hacker objectives
ᮣ Outlining the differences between ethical hackers and malicious hackers
ᮣ Examining how the ethical hacking process has come about
ᮣ Understanding the dangers that your computer systems face
ᮣ Starting the ethical hacking process
This book is about hacking ethically --- the science of testing your computers and network for security vulnerabilities and plugging the holes you find before the bad guys get a chance to exploit them.
Although ethical is an often overused and misunderstood word, the Merriam-Webster dictionary defines ethical perfectly for the context of this book and the professional security testing techniques that I cover --- that is, conforming to accepted professional standards of conduct. IT practitioners are obligated to perform all the tests covered in this book aboveboard and only after permission has been obtained by the owner(s) of the systems --- hence the disclaimer in the introduction.
How Hackers Beget Ethical Hackers
We've all heard of hackers. Many of us have even suffered the consequences of hacker actions. So who are these hackers? Why is it important to know about them? The next few sections give you the lowdown on hackers.
Defining hacker
Hacker is a word that has two meanings:
ߜ Traditionally, a hacker is someone who likes to tinker with software or electronic systems. Hackers enjoy exploring and learning how computer systems operate. They love discovering new ways to work electronically.
04 55784x Ch01.qxd 3/29/04 4:16 PM Page 10
10 Part I: Building the Foundation for Ethical Hacking ߜ Recently, hacker has taken on a new meaning --- someone who maliciously breaks into systems for personal gain. Technically, these criminals are crackers (criminal hackers). Crackers break into (crack) systems with malicious intent. They are out for personal gain: fame, profit, and even revenge. They modify, delete, and steal critical information, often making other people miserable.
The good-guy (white-hat) hackers don't like being in the same category as the bad-guy (black-hat) hackers. (These terms come from Western movies where the good guys wore white cowboy hats and the bad guys wore black cowboy hats.) Whatever the case, most people give hacker a negative connotation.
Many malicious hackers claim that they don't cause damage but instead are altruistically helping others. Yeah, right. Many malicious hackers are electronic thieves.
In this book, I use the following terminology:
ߜ Hackers (or bad guys) try to compromise computers .
ߜ Ethical hackers (or good guys) protect computers against illicit entry .
Hackers go for almost any system they think they can compromise. Some prefer prestigious, well-protected systems, but hacking into anyone's system increases their status in hacker circles.
Ethical Hacking 101
You need protection from hacker shenanigans. An ethical hacker possesses the skills, mindset, and tools of a hacker but is also trustworthy. Ethical hackers perform the hacks as security tests for their systems.
If you perform ethical hacking tests for customers or simply want to add another certification to your credentials, you may want to consider the ethical hacker certification Certified Ethical Hacker, which is sponsored by ECCouncil. See www.eccouncil.org/CEH.htm for more information.
Ethical hacking --- also known as penetration testing or white-hat hacking ---
involves the same tools, tricks, and techniques that hackers use, but with one major difference: Ethical hacking is legal. Ethical hacking is performed with the target's permission. The intent of ethical hacking is to discover vulnerabilities from a hacker's viewpoint so systems can be better secured. It's part of an overall information risk management program that allows for ongoing security improvements. Ethical hacking can also ensure that vendors' claims about the security of their products are legitimate.
04 55784x Ch01.qxd 3/29/04 4:16 PM Page 11
To hack your own systems like the bad guys, you must think like they think.
It's absolutely critical to know your enemy; see Chapter 2 for details.
Understanding the Need to
Hack Your Own Systems
To catch a thief, think like a thief. That's the basis for ethical hacking.
The law of averages works against security. With the increased numbers and expanding knowledge of hackers combined with the growing number of system vulnerabilities and other unknowns, the time will come when all computer systems are hacked or compromised in some way. Protecting your systems from the bad guys --- and not just the generic vulnerabilities that everyone knows about --- is absolutely critical. When you know hacker tricks, you can see how vulnerable your systems are.
Hacking preys on weak security practices and undisclosed vulnerabilities.
Firewalls, encryption, and virtual private networks (VPNs) can create a false feeling of safety. These security systems often focus on high-level vulnerabilities, such as viruses and traffic through a firewall, without affecting how hackers work. Attacking your own systems to discover vulnerabilities is a step to making them more secure. This is the only proven method of greatly hardening your systems from attack. If you don't identify weaknesses, it's a matter of time before the vulnerabilities are exploited.
As hackers expand their knowledge, so should you. You must think like them to protect your systems from them. You, as the ethical hacker, must know activities hackers carry out and how to stop their efforts. You should know what to look for and how to use that information to thwart hackers' efforts.
You don't have to protect your systems from everything. You can't. The only protection against everything is to unplug your computer systems and lock them away so no one can touch them --- not even you. That's not the best approach to information security. What's important is to protect your systems from known vulnerabilities and common hacker attacks.
It's impossible to buttress all possible vulnerabilities on all your systems. You can't plan for all possible attacks --- especially the ones that are currently unknown. However, the more combinations you try --- the more you test whole systems instead of individual units --- the better your chances of discovering vulnerabilities that affect everything as a whole.
Don't take ethical hacking too far, though. It makes little sense to harden your systems from unlikely attacks. For instance, if you don't have a lot of foot traffic 04 55784x Ch01.qxd 3/29/04 4:16 PM Page 12
12 Part I: Building the Foundation for Ethical Hacking in your office and no internal Web server running, you may not have as much to worry about as an Internet hosting provider would have. However, don't forget about insider threats from malicious employees!
Your overall goals as an ethical hacker should be as follows: ߜ Hack your systems in a nondestructive fashion.
ߜ Enumerate vulnerabilities and, if necessary, prove to upper management that vulnerabilities exist.
ߜ Apply results to remove vulnerabilities and better secure your systems.
Understanding the Dangers
Your Systems Face
It's one thing to know that your systems generally are under fire from hackers around the world. It's another to understand specific attacks against your systems that are possible. This section offers some well-known attacks but is by no means a comprehensive listing. That requires its own book: Hack Attacks Encyclopedia, by John Chirillo (Wiley Publishing, Inc.) .
Many information-security vulnerabilities aren't critical by themselves.
However, exploiting several vulnerabilities at the same time can take its toll.
For example, a default Windows OS configuration, a weak SQL Server administrator password, and a server hosted on a wireless network may not be major security concerns separately. But exploiting all three of these vulnerabilities at the same time can be a serious issue.
Nontechnical attacks
Exploits that involve manipulating people --- end users and even yourself ---
are the greatest vulnerability within any computer or network infrastructure.
Humans are trusting by nature, which can lead to social-engineering exploits.
Social engineering is defined as the exploitation of the trusting nature of human beings to gain information for malicious purposes. I cover social engineering in depth in Chapter 5.
Other common and effective attacks against information systems are physical.
Hackers break into buildings, computer rooms, or other areas containing critical information or property. Physical attacks can include dumpster diving (rummaging through trash cans and dumpsters for intellectual property, passwords, network diagrams, and other information).
04 55784x Ch01.qxd 3/29/04 4:16 PM Page 13
Network-infrastructure attacks
Hacker attacks against network infrastructures can be easy, because many networks can be reached from anywhere in the world via the Internet. Here are some examples of network-infrastructure attacks: ߜ Connecting into a network through a rogue modem attached to a computer behind a firewall
ߜ Exploiting weaknesses in network transport mechanisms, such as TCP/IP
and NetBIOS
ߜ Flooding a network with too many requests, creating a denial of service (DoS) for legitimate requests
ߜ Installing a network analyzer on a network and capturing every packet that travels across it, revealing confidential information in clear text ߜ Piggybacking onto a network through an insecure 802.11b wireless configuration Operating-system attacks
Hacking operating systems (OSs) is a preferred method of the bad guys. OSs comprise a large portion of hacker attacks simply because every computer has one and so many well-known exploits can be used against them.
Occasionally, some operating systems that are more secure out of the box ---
such as Novell NetWare and the flavors of BSD UNIX --- are attacked, and vulnerabilities turn up. But hackers prefer attacking operating systems like Windows and Linux because they are widely used and better known for their vulnerabilities.
Here are some examples of attacks on operating systems: ߜ Exploiting specific protocol implementations
ߜ Attacking built-in authentication systems
ߜ Breaking file-system security
ߜ Cracking passwords and encryption mechanisms
Application and other specialized attacks
Applications take a lot of hits by hackers. Programs such as e-mail server software and Web applications often are beaten down:
04 55784x Ch01.qxd 3/29/04 4:16 PM Page 14
14 Part I: Building the Foundation for Ethical Hacking ߜ Hypertext Transfer Protocol (HTTP) and Simple Mail Transfer Protocol (SMTP) applications are frequently attacked because most firewalls and other security mechanisms are configured to allow full access to these programs from the Internet.
ߜ Malicious software (malware) includes viruses, worms, Trojan horses, and spyware. Malware clogs networks and takes down systems.
ߜ Spam (junk e-mail) is wreaking havoc on system availability and storage space. And it can carry malware.
Ethical hacking helps reveal such attacks against your computer systems.
Parts II through V of this book cover these attacks in detail, along with specific countermeasures you can implement against attacks on your systems.
Obeying the Ethical Hacking
Commandments
Every ethical hacker must abide by a few basic commandments. If not, bad things can happen. I've seen these commandments ignored or forgotten when planning or executing ethical hacking tests. The results weren't positive.
Working ethically
The word ethical in this context can be defined as working with high professional morals and principles. Whether you're performing ethical hacking tests against your own systems or for someone who has hired you, everything you do as an ethical hacker must be aboveboard and must support the company's goals. No hidden agendas are allowed!
Trustworthiness is the ultimate tenet. The misuse of information is absolutely forbidden. That's what the bad guys do.
Respecting privacy
Treat the information you gather with the utmost respect. All information you obtain during your testing --- from Web-application log files to cleartext passwords --- must be kept private. Don't use this information to snoop into confidential corporate information or private lives. If you sense that someone should know there's a problem, consider sharing that information with the appropriate manager.
04 55784x Ch01.qxd 3/29/04 4:16 PM Page 15
Involve others in your process. This is a "watch the watcher" system that can build trust and support your ethical hacking projects.
Not crashing your systems
One of the biggest mistakes I've seen when people try to hack their own systems is inadvertently crashing their systems. The main reason for this is poor planning. These testers have not read the documentation or misunderstand the usage and power of the security tools and techniques.
You can easily create DoS conditions on your systems when testing. Running too many tests too quickly on a system causes many system lockups. I know because I've done this! Don't rush things and assume that a network or specific host can handle the beating that network scanners and vulnerability-assessment tools can dish out.
Many security-assessment tools can control how many tests are performed on a system at the same time. These tools are especially handy if you need to run the tests on production systems during regular business hours.
You can even create an account or system lockout condition by social engineering someone into changing a password, not realizing that doing so might create a system lockout condition.
The Ethical Hacking Process
Like practically any IT or security project, ethical hacking needs to be planned in advance. Strategic and tactical issues in the ethical hacking process should be determined and agreed upon. Planning is important for any amount of testing --- from a simple password-cracking test to an all-out penetration test on a Web application.
Formulating your plan
Approval for ethical hacking is essential. Make what you're doing known and visible --- at least to the decision makers. Obtaining sponsorship of the project is the first step. This could be your manager, an executive, a customer, or even yourself if you're the boss. You need someone to back you up and sign off on your plan. Otherwise, your testing may be called off unexpectedly if someone claims they never authorized you to perform the tests.
04 55784x Ch01.qxd 3/29/04 4:16 PM Page 16
16 Part I: Building the Foundation for Ethical Hacking The authorization can be as simple as an internal memo from your boss if you're performing these tests on your own systems. If you're testing for a customer, have a signed contract in place, stating the customer's support and authorization. Get written approval on this sponsorship as soon as possible to ensure that none of your time or effort is wasted. This documentation is your Get Out of Jail Free card if anyone questions what you're doing.
You need a detailed plan, but that doesn't mean you have to have volumes of testing procedures. One slip can crash your systems --- not necessarily what anyone wants. A well-defined scope includes the following information: ߜ Specific systems to be tested ߜ Risks that are involved
ߜ When the tests are performed and your overall timeline ߜ How the tests are performed
ߜ How much knowledge of the systems you have before you start testing ߜ What is done when a major vulnerability is discovered ߜ The specific deliverables --- this includes security-assessment reports and a higher-level report outlining the general vulnerabilities to be addressed, along with countermeasures that should be implemented When selecting systems to test, start with the most critical or vulnerable systems. For instance, you can test computer passwords or attempt social-engineering attacks before drilling down into more detailed systems.
It pays to have a contingency plan for your ethical hacking process in case something goes awry. What if you're assessing your firewall or Web application, and you take it down? This can cause system unavailability, which can reduce system performance or employee productivity. Even worse, it could cause loss of data integrity, loss of data, and bad publicity.
Handle social-engineering and denial-of-service attacks carefully. Determine how they can affect the systems you're testing and your entire organization.
Determining when the tests are performed is something that you must think long and hard about. Do you test during normal business hours? How about late at night or early in the morning so that production systems aren't affected?
Involve others to make sure they approve of your timing.
The best approach is an unlimited attack, wherein any type of test is possible. The bad guys aren't hacking your systems within a limited scope, so why should you? Some exceptions to this approach are performing DoS, social-engineering, and physical-security tests.
Don't stop with one security hole. This can lead to a false sense of security.
Keep going to see what else you can discover. I'm not saying to keep hacking 04 55784x Ch01.qxd 3/29/04 4:16 PM Page 17
until the end of time or until you crash all your systems. Simply pursue the path you're going down until you can't hack it any longer (pun intended).
One of your goals may be to perform the tests without being detected. For example, you may be performing your tests on remote systems or on a remote office, and you don't want the users to be aware of what you're doing. Otherwise, the users may be on to you and be on their best behavior.
You don't need extensive knowledge of the systems you're testing --- just a basic understanding. This will help you protect the tested systems.
Understanding the systems you're testing shouldn't be difficult if you're hacking your own in-house systems. If you're hacking a customer's systems, you may have to dig deeper. In fact, I've never had a customer ask for a fully blind assessment. Most people are scared of these assessments. Base the type of test you will perform on your organization's or customer's needs.
Chapter 19 covers hiring "reformed" hackers.
Selecting tools
As with any project, if you don't have the right tools for ethical hacking, accomplishing the task effectively is difficult. Having said that, just because you use the right tools doesn't mean that you will discover all vulnerabilities.
Know the personal and technical limitations. Many security-assessment tools generate false positives and negatives (incorrectly identifying vulnerabilities).
Others may miss vulnerabilities. If you're performing tests such as social-engineering or physical-security assessments, you may miss weaknesses.
Many tools focus on specific tests, but no one tool can test for everything.
For the same reason that you wouldn't drive in a nail with a screwdriver, you shouldn't use a word processor to scan your network for open ports. This is why you need a set of specific tools that you can call on for the task at hand.
The more tools you have, the easier your ethical hacking efforts are.
Make sure you that you're using the right tool for the task: ߜ To crack passwords, you need a cracking tool such as LC4, John the Ripper, or pwdump.
A general port scanner, such as SuperScan, may not crack passwords.
ߜ For an in-depth analysis of a Web application, a Web-application assessment tool (such as Whisker or WebInspect) is more appropriate than a network analyzer (such as Ethereal).
04 55784x Ch01.qxd 3/29/04 4:16 PM Page 18
18 Part I: Building the Foundation for Ethical Hacking When selecting the right security tool for the task, ask around. Get advice from your colleagues and from other people online. A simple Groups search on Google (www.google.com) or perusal of security portals, such as SecurityFocus.com, SearchSecurity.com, and ITsecurity.com, often produces great feedback from other security experts.
Hundreds, if not thousands, of tools can be used for ethical hacking --- from your own words and actions to software-based vulnerability-assessment programs to hardware-based network analyzers. The following list runs down some of my favorite commercial, freeware, and open-source security tools: ߜ Nmap ߜ EtherPeek
ߜ SuperScan
ߜ QualysGuard
ߜ WebInspect
ߜ LC4 (formerly called L0phtcrack)
ߜ LANguard Network Security Scanner
ߜ Network Stumbler
ߜ ToneLoc
Here are some other popular tools:
ߜ Internet Scanner
ߜ Ethereal
ߜ Nessus
ߜ Nikto
ߜ Kismet
ߜ THC-Scan
I discuss these tools and many others in Parts II through V when I go into the specific hack attacks. Appendix A contains a more comprehensive listing of these tools for your reference.
The capabilities of many security and hacking tools are often misunderstood.
This misunderstanding has shed negative light on some excellent tools, such as SATAN (Security Administrator Tool for Analyzing Networks) and Nmap (Network Mapper).
Some of these tools are complex. Whichever tools you use, familiarize yourself with them before you start using them. Here are ways to do that: 04 55784x Ch01.qxd 3/29/04 4:16 PM Page 19
ߜ Read the readme and/or online help files for your tools.
ߜ Study the user's guide for your commercial tools.
ߜ Consider formal classroom training from the security-tool vendor or another third-party training provider, if available.
Look for these characteristics in tools for ethical hacking: ߜ Adequate documentation.
ߜ Detailed reports on the discovered vulnerabilities, including how they may be exploited and fixed.
ߜ Updates and support when needed.
ߜ High-level reports that can be presented to managers or nontechie types.
These features can save you time and effort when you're writing the report.
Executing the plan
Ethical hacking can take persistence. Time and patience are important. Be careful when you're performing your ethical hacking tests. A hacker in your network or a seemingly benign employee looking over your shoulder may watch what's going on. This person could use this information against you.
It's not practical to make sure that no hackers are on your systems before you start. Just make sure you keep everything as quiet and private as possible. This is especially critical when transmitting and storing your test results.
If possible, encrypt these e-mails and files using Pretty Good Privacy (PGP) or something similar. At a minimum, password-protect them.
You're now on a reconnaissance mission. Harness as much information as possible about your organization and systems, which is what malicious hackers do. Start with a broad view and narrow your focus: 1. Search the Internet for your organization's name, your computer and network system names, and your IP addresses.
Google is a great place to start for this.
2. Narrow your scope, targeting the specific systems you're testing.
Whether physical-security structures or Web applications, a casual assessment can turn up much information about your systems.
3. Further narrow your focus with a more critical eye. Perform actual scans and other detailed tests on your systems.
4. Perform the attacks, if that's what you choose to do.
04 55784x Ch01.qxd 3/29/04 4:16 PM Page 20
20 Part I: Building the Foundation for Ethical Hacking Evaluating results
Assess your results to see what you uncovered, assuming that the vulnerabilities haven't been made obvious before now. This is where knowledge counts.
Evaluating the results and correlating the specific vulnerabilities discovered is a skill that gets better with experience. You'll end up knowing your systems as well as anyone else. This makes the evaluation process much simpler moving forward.
Submit a formal report to upper management or to your customer, outlining your results. Keep these other parties in the loop to show that your efforts and their money are well spent. Chapter 17 describes this process.
Moving on
When you've finished your ethical hacking tests, you still need to implement your analysis and recommendations to make sure your systems are secure.
New security vulnerabilities continually appear. Information systems constantly change and become more complex. New hacker exploits and security vulnerabilities are regularly uncovered. You may discover new ones! Security tests are a snapshot of the security posture of your systems. At any time, everything can change, especially after software upgrades, adding computer systems, or applying patches. Plan to test regularly (for example, once a week or once a month). Chapter 19 covers managing security changes.
05 55784x Ch02.qxd 3/29/04 4:16 PM Page 21
In This Chapter
ᮣ Understanding the enemy
ᮣ Profiling hackers
ᮣ Understanding why hackers do what they do
ᮣ Examining how hackers go about their business
Before you start assessing the security of your own systems, it helps to know something about the enemies you're up against. Many information-security product vendors and other professionals claim that you should protect your systems from the bad guys --- both internal and external. But what does this mean? How do you know how these bad guys think and work?
Knowing what hackers want helps you understand how they work. Understanding how they work helps you look at your information systems in a whole new way. In this chapter, I describe what you're up against, who's actually doing the hacking, and what their motivations and methods are so you're better prepared for your ethical hacking tests.
What You're Up Against
Thanks to sensationalism, the definition of hacker has transformed from harmless tinkerer to malicious criminal. Hackers often state that the general public misunderstands them, which is mostly true. It's easy to prejudge what you don't understand. Hackers can be classified by both their abilities and underlying motivations. Some are skilled, and their motivations are benign; they're merely seeking more knowledge. At the other end of the spectrum, hackers with malicious intent seek some form of personal gain. Unfortunately, the negative aspects of hacking usually overshadow the positive aspects, resulting in the stereotyping.
Historically, hackers have hacked for the pursuit of knowledge and the thrill of the challenge. Script kiddies aside, hackers are adventurous and innovative thinkers, and are always thinking about exploiting computer vulnerabilities.
05 55784x Ch02.qxd 3/29/04 4:16 PM Page 22
22 Part I: Building the Foundation for Ethical Hacking (For more on script kiddies, see "Who Hacks," later in this chapter.) They see what others often overlook. They wonder what would happen if a cable were unplugged, a switch were flipped, or lines of code were changed in a program.
These old-school hackers are like Tim the Toolman Taylor --- Tim Allen's character on the late, great sitcom Home Improvement --- thinking mechanical and electronic devices can be improved if they're "rewired." More recent evidence shows that many hackers are hacking for political, competitive, and even financial purposes, so times are changing.
When they were growing up, hackers' rivals were monsters and villains on video game screens. Now hackers see their electronic foes as only that ---
electronic. Hackers who perform malicious acts don't really think about the fact that human beings are behind the firewalls and Web applications they're attacking. They ignore that their actions often affect those human beings in negative ways, such as jeopardizing their job security.
Hackers and the act of hacking drive the advancement of security technology.
After all, hackers don't create security holes; they expose and exploit existing holes in applications. Unfortunately, security technology advances don't ward off all hacker attacks, because hackers constantly search for new holes and weaknesses. The only sure-fire way to keep the bad guys at bay is to use behavior modification to change them into productive, well-adjusted members of society. Good luck with that.
However you view the stereotypical hacker, one thing is certain: Some people always will try to take down your computer systems through manual hacking or by creating and launching automated worms and other malware. You must take the appropriate steps to protect your systems against them.
Who Hacks
Computer hackers have been around for decades. Since the Internet became widely used in the late 1990s, we've started to hear more and more about hacking. Only a few hackers, such as John Draper (also known as Captain Crunch) and Kevin Mitnick, are well known. Gobs more unknown hackers are looking to make a name for themselves. They're the ones to look out for.
In a world of black and white, it's easy to describe the typical hacker. A general stereotype of a typical hacker is an antisocial, pimple-faced teenage boy.
But the world has many shades of gray and, therefore, many types of hackers.
Hackers are human like the rest of us and are, therefore, unique individuals, so an exact profile is hard to outline. The best broad description of hackers is that all hackers aren't equal. Each hacker has motives, methods, and skills.
But some general characteristics can help you understand them.
Not all hackers are antisocial, pimple-faced teenagers. Regardless, hackers possess curiosity, bravado, and often very sharp minds.
05 55784x Ch02.qxd 3/29/04 4:16 PM Page 23
Is the government hacking?
While in a conflict with another country, some
of waging war is becoming more common as
governments will wage war via the Internet and
technology progresses. Many folks are skepti---
other computer systems. For example, the U.S.
cal about this as well, and the U.S. govern---
government reportedly has launched cyber---
ment denies most of its involvement. However,
attacks against its adversaries --- such as
because the world increasingly relies on com---
Yugoslavia during the Milosevic crisis in the late
puter and network technology, PCs, and the
1990s and in the recent war in Iraq.
Internet, those avenues may become the launching pads or battlegrounds for future conflicts.
Are we headed toward a digital Pearl Harbor?
I'm not convinced that we are, but this method
Just like anyone can become a thief, an arsonist, or a robber, anyone can become a hacker, regardless of age, gender, or race. Given this diverse profile, skills vary widely from one malicious hacker to the next. Some hackers barely know how to surf the Internet, whereas others write software that other hackers and ethical hackers alike depend on.
ߜ Script kiddies: These are computer novices who take advantage of the hacker tools and documentation available for free on the Internet but don't have any knowledge of what's going on behind the scenes. They know just enough to cause you headaches but typically are very sloppy in their actions, leaving all sorts of digital fingerprints behind. Even though these guys are the stereotypical hackers that you hear about in the news media, they often need minimal skills to carry out their attacks.
ߜ Intermediate hackers: These halfway hackers usually know just enough to cause serious problems. They know about computers and networks, and often use well-known exploits. Some want to be experts; given enough time and effort, they can be.
ߜ Elite hackers: These are skilled hacking experts. These are the people who write many of the hacker tools, including the scripts and other programs that the script kiddies use. These folks write such malware as viruses and worms. They can break into systems and cover their tracks.
They can even make it look like someone else hacked the systems.
Elite hackers are often very secretive and share information with their
"subordinates" only when they are deemed worthy. Typically, for lower-ranked hackers to be considered worthy, they must possess some unique information or prove themselves through a high-profile hack. These hackers are your worst enemies in information security. Okay, maybe they're not as bad as untrained end users, but that's another issue. Fortunately, elite hackers are not as plentiful as script kiddies.
Other hacktivists try to disseminate political or social messages through their work. A hacktivist wants to raise public awareness of an issue. Examples of 05 55784x Ch02.qxd 3/29/04 4:16 PM Page 24
24 Part I: Building the Foundation for Ethical Hacking hacktivism are the Web sites that were defaced with the Free Kevin messages in the name of freeing Kevin Mitnick from prison for his famous hacking escapades. Other cases of hacktivism include messages about legalizing marijuana, protests against the U.S. Navy spy plane that collided with the Chinese fighter jet in 2001, the common hacker attacks between India and Pakistan, and attacks against the U.S. White House Web site over the years.
Cyberterrorists attack government computers or public utility infrastructures, such as power grids and air-traffic-control towers. They crash critical systems or steal classified government information. Countries take these threats so seriously that many mandate information-security controls in such industries as the power industry to protect essential systems against these attacks.
Hackers for hire are part of organized crime on the Internet. In late 2003, the Korean National Police Agency busted the Internet's largest organized hacking ring, which had over 4,400 members. Prior to that, police in the Philippines busted a multimillion-dollar organized hacking ring that was selling cheap phone calls made through phone lines the ring had hacked into. Many of these hackers hire themselves out for money --- and lots of it!
Why Hackers Hack
The main reason hackers hack is because they can! Okay, it goes a little deeper than that. Hacking is a casual hobby for some hackers --- they just hack to see what they can and can't break into, usually testing only their own systems.
These aren't the folks I'm writing about here. I'm focusing on those hackers who are obsessive and often have criminal intent.
Many hackers get a kick out of outsmarting corporate and government IT and security administrators. They thrive on making headlines and being notorious cyberoutlaws. Defeating an entity or possessing knowledge makes them feel better about themselves. Many of these hackers feed off instant gratification.
They become obsessed with this feeling. Hackers can't resist the adrenaline rush they get when breaking into someone else's systems. Often, the more difficult the job is, the greater the thrill.
The knowledge that malicious hackers gain and the elevated ego that comes with that knowledge are like an addiction and a way of life. Some hackers want to make your life miserable, and others simply want to be seen or heard. Some common hacker motives are revenge, basic bragging rights, curiosity, boredom, challenge, vandalism, theft for financial gain, sabotage, blackmail, extortion, and corporate espionage.
Hackers often promote individualism --- or at least the decentralization of information --- because many believe that all information should be free.
They think cyberattacks are different from attacks in the real world. They easily ignore or misunderstand their victims and the consequences of hacking.
05 55784x Ch02.qxd 3/29/04 4:16 PM Page 25
Many hackers say they don't intend to harm or profit through their bad deeds, which helps them justify their work. They often don't look for tangible payoffs.
Just proving a point is often a good enough reward for them.
Many business owners and managers --- even some network and security administrators --- believe that they don't have anything that a hacker wants or that hackers can't do much damage if they break in. This couldn't be further from the truth. This kind of thinking helps support hackers and their objectives. Hackers can compromise a seemingly unimportant system to access the network and use it as a launching pad for attacks on other systems.
It's worth repeating that hackers often hack because they can. Some hackers go for high-profile systems, but hacking into anyone's system helps them fit into hacker circles. Hackers use the false sense of security that many people have and go for almost any system they think they can compromise. They know that electronic information can be in more than one place at the same time. It's tough to prove that hackers took the information and possess it.
Similarly, hackers know that a simple defaced Web page --- however easily attacked --- is not good for business. The following Web sites show examples of Web pages that have been defaced in the past few years: ߜ www.2600.com/hacked\_pages ߜ www.onething.com/archive
Hacked sites like these can persuade management and other nonbelievers that information threats and vulnerabilities should be addressed.
Hacking continues to get easier for several reasons:
ߜ Increasing use of networks and Internet connectivity ߜ Anonymity provided by computer systems working over the Internet ߜ Increasing number and availability of hacking tools
ߜ Computer-savvy children
ߜ Unlikelihood that hackers are investigated or prosecuted if caught Although most hacker attacks go unnoticed or unreported, hackers who are discovered are often not pursued or prosecuted. When they're caught, hackers often rationalize their services as being altruistic and a benefit to society: They're merely pointing out vulnerabilities before someone else does.
Regardless, if justice is ever served, it helps eliminate the "fame and glory"
reward system that hackers thrive on.
These criminal hackers are in the minority, so don't think that you're up against millions of these villains. Many other hackers just love to tinker and only seek knowledge of how computer systems work.
05 55784x Ch02.qxd 3/29/04 4:16 PM Page 26
26 Part I: Building the Foundation for Ethical Hacking Hacking in the name of liberty
Many hackers exhibit behaviors that contradict
go to great lengths to get their own rights back
what they're fighting for --- that is, they fight for
from anyone who tries to take them away.
civil liberties and want to be left alone, and at the
The case against copyrighted materials and
same time, they love prying into other people's
the Recording Industry Association of America
business. Many hackers claim to be civil liber-
(RIAA) is a classic example. Hackers have gone
tarians supporting the principles of personal pri---
to great lengths to prove a point, from defacing
vacy and freedom. However, they act in an
the Web sites of organizations that support copy---
entirely different way by intruding on the privacy
rights to illegally sharing music by using other---
and property of others. They often steal the
wise legal mediums such as Kazaa, Gnutella,
property and rights of others, yet are willing to
and Morpheus.
Planning and Performing Attacks
Hacking styles vary widely:
ߜ Some hackers prepare far in advance of a large attack. They gather small bits of information and methodically carry out their hacks, as I outline in Chapter 4. These hackers are more difficult to track.
ߜ Other hackers --- usually, the inexperienced script kiddies --- act before they think things through. For example, such hackers may try to telnet directly into an organization's router without hiding their identities. Other hackers may try to launch a DoS attack against a Microsoft Exchange e-mail server without first determining what version of Exchange is running or what patches are installed.
These are the guys who usually get caught.
Although the hacker underground is a community, many of the hackers ---
especially the elite hackers --- don't share information with the crowd. Most hackers do much of their work independently from other hackers. Hackers who network with one another use private bulletin board systems (BBSs), anonymous e-mail addresses, hacker Web sites, and Internet Relay Chat (IRC).
You can log on to many of these sites to see what hackers are doing.
Whatever approach they take, most malicious hackers prey on ignorance.
They know the following aspects of real-world security: ߜ The majority of systems that hackers want to attack aren't managed properly. The computer systems aren't properly patched, hardened, and monitored as they should be. Hackers often can attack by flying below the average radar of the firewalls, IDSs, and authentication systems.
05 55784x Ch02.qxd 3/29/04 4:16 PM Page 27
ߜ Most network and security administrators simply can't keep up with the deluge of new vulnerabilities.
ߜ Information systems grow more complex every year. This is yet another reason why overburdened administrators find it difficult to know what's happening across the wire and on the hard drives of their systems.
Time is a hacker's friend --- and it always seems to be on the hacker's side. By attacking through computers rather than in person, hackers have more control over when they can carry out their attacks.
ߜ Hack attacks can be carried out slowly, making them hard to detect.
ߜ They're frequently carried out after typical business hours --- often, in the middle of the night. Defenses are often weaker at night --- with less physical security and less intrusion monitoring --- when the typical network administrator (or security guard) is sleeping.
If you want detailed information on how some hackers work or want to keep up with the latest hacker methods, several magazines are worth checking out: ߜ 2600 --- The Hacker Quarterly magazine (www.2600.com). I've found gobs of great information in 2600.
ߜ PHRACK (www.phrack.org).
ߜ Computer Underground Digest (www.soci.niu.edu/~cudigest).
Also, check out Lance Spitzner's Web site www.tracking-hackers.com for some great information on using honeypots to track hacker behavior.
Hackers learn from their hacking mistakes. Every mistake moves them one step closer to breaking into someone's system. They use this wisdom when carrying out future attacks.
Maintaining Anonymity
Smart hackers want to be as low-key as possible. Covering their tracks is a priority. In fact, success often depends on it. They don't want to raise suspicion so they can come back and access the systems in the future. Hackers often remain anonymous by using one of the following techniques: ߜ Borrowed or stolen dial-up accounts from friends or previous employers ߜ Public computers at libraries, schools, or kiosks at the local mall ߜ Internet proxy servers or anonymizer services ߜ Anonymous or disposable e-mail accounts from free e-mail services 05 55784x Ch02.qxd 3/29/04 4:16 PM Page 28
28 Part I: Building the Foundation for Ethical Hacking ߜ Open e-mail relays
ߜ Unsecured computers --- also called zombies --- at other organizations ߜ Workstations or servers on the victim's own network
If hackers use enough steppingstones for their attacks, they are hard to trace.
06 55784x Ch03.qxd 3/29/04 4:16 PM Page 29
Hacking Plan
In This Chapter
ᮣ Setting ethical hacking goals
ᮣ Selecting which systems to test
ᮣ Developing your ethical hacking testing standards
ᮣ Examining hacking tools
As an ethical hacker, you must plan your ethical hacking efforts before you start. A detailed plan doesn't mean that your testing must be elaborate.
It just means that you're very clear and concise on what's done. Given the seriousness of ethical hacking, make this as structured a process as possible.
Even if you're just testing a single Web application or workgroup of computers, it's critical to establish your goals, define and document the scope of what you'll be testing, determine your testing standards, and gather and familiarize yourself with the proper tools for the task. This chapter covers these steps to help you create a positive ethical hacking environment so you can set yourself up for success.
Getting Your Plan Approved
Getting approval for ethical hacking is critical. First, obtain project sponsorship. This approval can come from your manager, an executive, a customer, or yourself (if you're the boss). Otherwise, your testing may be canceled suddenly, or someone can deny authorizing the tests. There can even be legal consequences for unauthorized hacking. Always make sure that what you're doing is known and visible --- at least to the decision-makers. Chapter 20
outlines ten tips for getting upper management's buy-in on your security initiatives.
06 55784x Ch03.qxd 3/29/04 4:16 PM Page 30
30 Part I: Building the Foundation for Ethical Hacking If you're an independent consultant or have a business with a team of ethical hackers, consider getting professional liability (also known as errors and omissions) insurance from an agent who specializes in business insurance coverage. This kind of insurance can be expensive, but it can be well worth it.
The authorization can be as simple as an internal memo from upper management if you're performing these tests on your own systems. If you're performing testing for a customer, you must have a signed contract in place, stating the customer's support and authorization. Get written approval as soon as possible to ensure that your time and efforts are not wasted. This documentation is your security if anyone questions what you're doing.
Establishing Your Goals
Your ethical hacking plan needs goals. The main goal of ethical hacking is to find vulnerabilities in your systems so you can make them more secure. You can then take this a step further:
ߜ Define more specific goals. Align these goals with your business objectives.
ߜ Create a specific schedule with start and end dates. These dates are critical components of your overall plan.
Before you begin any ethical hacking, you absolutely, positively need everything in writing and signed-off on.
Document everything, and involve upper management in this process. Your best ally in your ethical hacking efforts is a manager who supports what you're doing.
The following questions can start the ball rolling:
ߜ Does ethical hacking support the mission of the business and its IT and security departments?
ߜ What business goals are met by performing ethical hacking?
These goals may include the following:
• Prepping for the internationally accepted security framework of ISO 17799 or a security seal such as SysTrust or WebTrust
• Meeting federal regulations
• Improving the company's image
ߜ How will ethical hacking improve security, IT, and the general business?
ߜ What information are you protecting?
06 55784x Ch03.qxd 3/29/04 4:16 PM Page 31
Chapter 3: Developing Your Ethical Hacking Plan
31
This could be intellectual property, confidential customer information, or private employee information.
ߜ How much money, time, and effort are you and your organization willing to spend on ethical hacking?
ߜ What specific deliverables will there be?
Deliverables can include anything from high-level executive reports to detailed technical reports and write-ups on what you tested along with the outcomes of your tests. You can deliver specific information that is gleaned during your testing, such as passwords and other confidential information.
ߜ What specific outcomes do you want?
Desired outcomes include the justification for hiring or outsourcing security personnel, increasing your security budget, or enhancing security systems.
People within your organization may attempt to keep you from performing your ethical hacking plans. The best antidote is education. Show how ethical hacking helps support the business in everyone's favor.
After you know your goals, document the steps to get there. For example, if one goal is to develop a competitive advantage to keep existing customers and attract new ones, determine the answers to these questions: ߜ When will you start your ethical hacking?
ߜ Will your ethical hacking be blind, in which you know nothing about the systems you're testing, or a knowledge-based attack, in which you're given specific information about the systems you're testing such as IP
addresses, hostnames, and even usernames and passwords?
ߜ Will this testing be technical in nature or involve physical security assessments or even social engineering?
ߜ Will you be part of a larger ethical hacking team, often called a tiger team or red team?
ߜ Will you notify your customers of what you're doing? If so, how?
Customer notification is a critical issue. Many customers appreciate that you're taking steps to protect their information. Approach the testing in a positive way. Don't say, "We're breaking into our systems to see what information of yours is vulnerable to hackers." Instead, you can say that you're assessing the overall security of your systems so the information is as secure as possible from the bad guys.
ߜ How will you notify customers that the organization is taking steps to enhance the security of their information?
ߜ What measurements can ensure that these efforts are paying off?
06 55784x Ch03.qxd 3/29/04 4:16 PM Page 32
32 Part I: Building the Foundation for Ethical Hacking Establishing your goals takes time, but you won't regret it. These goals are your road map. If you have any concerns, refer to these goals to make sure that you stay on track.
Determining What Systems to Hack
You probably don't want --- or need --- to assess the security of all your systems at the same time. This could be quite an undertaking and could lead to problems. I'm not saying you shouldn't eventually assess every computer and application you have. I'm just suggesting that whenever possible, you should break your ethical hacking projects into smaller chunks to make them more manageable. You may decide which systems to test based on a high-level risk analysis, answering questions such as: ߜ What are your most critical systems? Which systems, if hacked, would cause the most trouble or the greatest losses?
ߜ Which systems appear to be most vulnerable to attack?
ߜ Which systems are not documented, are rarely administered, or are the ones you know the least about?
After you've established your overall goals, decide which systems to test.
This step helps you carefully define a scope for your ethical hacking so that you not only establish everyone's expectations up front, but also better estimate the time and resources for the job.
The following list includes systems and applications that you may consider performing your hacking tests on:
ߜ Routers
ߜ Firewalls
ߜ Network infrastructure as a whole
ߜ Wireless access points and bridges
ߜ Web, application, and database servers
ߜ E-mail and file/print servers
ߜ Workstations, laptops, and tablet PCs
ߜ Mobile devices (such as PDAs and cell phones) that store confidential information
ߜ Client and server operating systems
ߜ Client and server applications, such as e-mail or other in-house systems 06 55784x Ch03.qxd 3/29/04 4:16 PM Page 33
Chapter 3: Developing Your Ethical Hacking Plan
33
What specific systems you should test depends on several factors. If you have a small network, you can test everything from the get-go. You may consider testing just public-facing hosts such as e-mail and Web servers and their associated applications. The ethical hacking process is flexible. Base these decisions on what makes the most business sense.
Start with the most vulnerable systems, and consider the following factors: ߜ Where the computer or application resides on the network ߜ Which operating system and application(s) it runs
ߜ The amount or type of critical information stored on it If you're hacking your own systems or a customer's systems, a previous security-risk assessment or vulnerability test may already have generated this information. If so, that documentation may help identify systems for more testing.
Ethical hacking goes a few steps beyond the higher-level information risk assessments and vulnerability testing. As an ethical hacker, you first glean information on all systems --- including the organization as a whole --- and then further assess the systems that appear most vulnerable. I discuss the ethical hacking methodology in more detail in Chapter 4.
Another factor to help you decide where to start is to assess the systems that have the greatest visibility. For example, focusing on a database or file server that stores customer or other critical information may make more sense --- at least initially --- than concentrating on a firewall or Web server that hosts marketing information about the company.
Creating Testing Standards
One miscommunication or slip-up can send your systems crashing during your ethical hacking tests. No one wants that to happen. To prevent mishaps, develop and document testing standards. These standards should include ߜ When the tests are performed, along with the overall timeline ߜ What tests are performed ߜ How the tests are performed, and from where
ߜ How much knowledge of the systems you acquire in advance ߜ What you do when a major vulnerability is discovered This is a list of general best practices. You can apply more standards for your situation.
06 55784x Ch03.qxd 3/29/04 4:16 PM Page 34
34 Part I: Building the Foundation for Ethical Hacking Timing
You know they say that it's "all in the timing." This is especially true when performing ethical hacking tests. Make sure that the tests you're performing minimize disruption to business processes, information systems, and people.
You want to avoid situations like miscommunicating the timing of tests and causing a DoS attack against a high-traffic e-commerce site in the middle of the day, or forcing yourself or others to perform password-cracking tests in the middle of the night. It's amazing what a 12-hour time difference can make!
Everyone in the project should agree on a detailed timeline before you begin.
This puts everyone on the same page and sets correct expectations.
Notify any Internet Service Providers (ISP) or Application Service Providers (ASPs) involved before performing any tests across the Internet. This way, ISPs and ASPs will be aware of the testing going on, which will minimize the chance that they will block your traffic if they suspect malicious behavior that shows up on their firewalls or Intrusion Detection Systems (IDSs).
The timeline should include specific short-term dates and times of each test, the start and end dates, and any specific milestones in between. You can develop and enter your timeline into a simple spreadsheet or Gantt chart, or you can include the timeline as part of your initial customer proposal and contract. For example, you could use a timeline similar to the following: Test Performed
Tester
Start Time
Projected End Time
War dial
Tommy Tinker
July 1, 6:00 a.m.
July 1, 10:00 a.m.
Password cracking
Amy Trusty
July 2, 12:00 p.m.
July 2, 5:00 p.m.
This timeline will keep things simple and provide a reference during testing.
Specific tests
You may have been charged with performing a general penetration test, or you may want to perform specific tests, such as cracking passwords or war-dialing into a network. Or you might be performing a social-engineering test or assessing the Windows operating systems on the network. However you're testing, you may want to conceal the specifics of the testing to keep what you're doing covert or to protect your methodologies. In fact, your manager or customer may not want the details. Either way, document and make known at a high level what you're doing. This can help eliminate any potential miscommunication and keep you out of hot water.
A good way to provide evidence of what was tested, when it was tested, and more is to enable logging on the systems you're testing.
06 55784x Ch03.qxd 3/29/04 4:16 PM Page 35
Chapter 3: Developing Your Ethical Hacking Plan
35
Sometimes, you may know the general tests that you're performing, but if you're using automated tools, it may be next to impossible to understand completely every test you're performing. This is especially true if the software you're using receives real-time vulnerability-testing updates from the vendor every time you run it. The potential for frequent updates underscores the importance of reading the documentation and readme files that come with the tools you're using.
I have experienced surprising vulnerability updates in the past. I was performing an automated assessment on a customer's Web site --- the same test I had just performed the previous week. The customer and I had scheduled the test date and time in advance. What I didn't know is that the software vendor made some changes to its Web form submission tests, and I flooded the customer's Web application, creating a DoS condition.
Luckily, this DoS condition occurred after business hours and didn't affect the customer's operations. However, the customer's Web application was coded to generate an alert e-mail for every form submission. The application developer and company's president received 4,000 e-mails in their inboxes within about 10 minutes --- ouch! I was lucky that the president was tech-savvy and understood the situation. It's important to have a contingency plan in case a situation like this occurs.
Blind versus knowledge assessments
It may be good to have some knowledge of the systems you're testing, but it's not required. However, a basic understanding of the systems you're hacking can protect you and others. Obtaining this knowledge shouldn't be difficult if you're hacking your own in-house systems. If you're hacking a customer's systems, you may have to dig a little deeper into how the systems work so you know what's what. That's how I've always done it. In fact, I've never had a customer ask for a fully blind assessment. Most people are scared of these assessments. This doesn't mean that blind assessments aren't valuable. The type of assessment you carry out depends on your specific needs.
The best approach is to plan on unlimited attacks, wherein any test is possible.
The bad guys aren't hacking your systems within a limited scope, so why should you?
Consider whether the tests should be undetected. This isn't required but should be considered, especially for social-engineering and physical security tests. I outline specific tests for those subjects in Chapter 5 and Chapter 6.
A false sense of vigilance can be created if too many insiders know about your testing which can end up negating the hard work you're putting into this.
This doesn't mean you shouldn't tell anyone. Always have a main point of contact within the organization --- preferably someone with decision-making authority --- that both you and all employees can contact if and when something goes wrong.
06 55784x Ch03.qxd 3/29/04 4:16 PM Page 36
36 Part I: Building the Foundation for Ethical Hacking Location
The tests you're performing dictate where you must run them from. Your goal is to hack your systems from locations where malicious hackers can access the systems. You can't predict whether you'll be attacked by a hacker from outside or inside your network, so cover all your bases. Combine external (public Internet) tests and internal (private network) tests.
You can perform some tests, such as password cracking and network-infrastructure assessments, from the comfort of your office --- inside the network.
But it may be better to have a true outsider perform other tests on routers, firewalls, and public Web applications.
For your external hacks that require network connectivity, you may have to go off-site (a good excuse to work from home) or use an external proxy server.
Better yet, if you can assign an available public IP address to your computer, plug into the network on the outside of the firewall for a hacker's-eye view of your systems. Internal tests are easy because you need only physical access to the building and the network.
Reacting to major exploits that you find
Determine ahead of time whether you'll stop or keep going when you find a critical security hole. Your manager or your customer may not ask you to, but I think it's best to keep going to see what else you can discover. I'm not saying to keep hacking until the end of time or until you crash all your systems. Simply pursue the path you're going down until you can't hack it any longer (pun intended).
Silly assumptions
You've heard what you make of yourself when you assume things. Even so, you must make assumptions when you hack your systems. Here are some examples of those assumptions:
ߜ Computers, networks, and people are available when you're testing.
ߜ You have all the proper hacking tools.
ߜ The hacking tools you're using won't crash your systems.
ߜ Your hacking tools actually work.
ߜ You know all the risks of your tests.
You should document all assumptions and have management or your customer sign off on them as part of your overall approval process.
06 55784x Ch03.qxd 3/29/04 4:16 PM Page 37
Chapter 3: Developing Your Ethical Hacking Plan
37
Selecting Tools
The required security-assessment tools (hacking tools) depend on the tests you're running. You can perform some ethical hacking tests with a pair of sneakers, a telephone, and a basic workstation on the network. However, comprehensive testing is easier with hacking tools.
Not only do you need an arsenal of tools, but you should also use the right tool for the task:
ߜ If you're cracking passwords, a general port scanner such as SuperScan or Nmap may not do the trick. For this task, you need a tool such as LC4, John the Ripper, or pwdump.
ߜ If you're attempting an in-depth analysis of a Web application, a Web-application assessment tool (such as Nikto or WebInspect) is more appropriate than a network analyzer such as Ethereal.
If you're not sure what tools to use, fear not. Throughout this book, I introduce a wide variety of tools --- both free and commercial --- that you can use to accomplish your tasks.
You can choose among hundreds, if not thousands, of tools for ethical hacking --- everything from your own words and actions to software-based vulnerability-assessment programs to hardware-based network analyzers.
Here's a rundown of some of my favorite commercial, freeware, and open-source security tools:
ߜ @stake L0phtcrack (now called LC4)
ߜ Ethereal
ߜ Foundstone SuperScan
ߜ Qualys QualysGuard
ߜ GFI LANguard Network Security Scanner
ߜ John the Ripper
ߜ Network Stumbler
ߜ Nessus
ߜ Nikto
ߜ Nmap
ߜ Pwdump2
ߜ SPI Dynamics WebInspect
ߜ THC-RUT
ߜ ToneLoc
06 55784x Ch03.qxd 3/29/04 4:16 PM Page 38
38 Part I: Building the Foundation for Ethical Hacking ߜ Wellenreiter
ߜ WildPackets EtherPeek and AiroPeek
I discuss these tools, including details on how to use many of them, in Parts II through V when I cover specific hack attacks. Appendix A contains a more comprehensive listing of these tools for your reference.
The capabilities of many security and hacking tools are often misunderstood.
This misunderstanding has shed negative light on some excellent tools, such as SATAN (Security Administrator Tool for Analyzing Networks) and Nmap (Network Mapper). It's important to know what each tool can and can't do and how to use each one. I suggest reading the manual and other help files.
Unfortunately, some tools have limited documentation, which can be pretty frustrating when you're trying to use those tools. You can search newsgroups and message boards and post a message if you're having trouble with a tool.
Hacking tools can be hazardous to your network's health. Be careful when using them. Always make sure that you understand what every option does before you use it. Try your tools on test systems if you're not sure how to use them. These precautions help prevent DoS conditions and loss of data integrity and availability on your production systems.
Look for these characteristics in the tools you select for ethical hacking: ߜ Adequate documentation.
ߜ Detailed reports on the vulnerabilities, including how they may be exploited and fixed.
ߜ Updates and support when needed.
ߜ High-level reports that can be presented to managers or other nontechie types. These reports can save you time and effort when you're writing the report. I cover the reporting process in Chapter 17.
Know the limitations of your tools and of yourself. Many security-assessment tools generate false positives --- alerting to a vulnerability when it doesn't really exist. Some even generate false negatives, which means they miss the vulnerabilities altogether. Likewise, if you're performing social-engineering tests or physical-security assessments, it's only human to miss specific vulnerabilities.
You may despise some "popular" freeware and open-source hacking tools. If these tools end up causing you more headaches than they're worth or don't do what you need them to do, consider purchasing commercial alternatives.
They're often easier to use and typically generate better reports faster ---
especially high-level executive reports. Some commercial tools are quite expensive, but their ease of use and functionality may justify the cost.
07 55784x Ch04.qxd 3/29/04 4:15 PM Page 39
In This Chapter
ᮣ Examining steps for successful ethical hacking
ᮣ Gleaning information about your organization from the Internet
ᮣ Scanning your network
ᮣ Looking for vulnerabilities
Before you start testing your systems, plan a basic methodology. Ethical hacking involves more than just penetrating and patching. Proven techniques can help guide you along the hacking highway and ensure that you end up at the right destination. Planning a methodology that supports your ethical hacking goals is what separates the professionals from the amateurs.
Setting the Stage
In the past, ethical hacking was mostly a manual process. Now, tools can automate various tasks. These tools allow you to focus on performing the tests instead of on your testing methods. However, it's important to follow a general methodology and understand what's going on behind the scenes.
Ethical hacking is similar to beta testing software. Think logically --- like a programmer --- dissecting and interacting with all the network components to see how they work. You gather information --- often small pieces --- and assemble the pieces of the puzzle. You start at point A with several goals in mind, hack (repeating many steps along the way), and move closer until you discover security vulnerabilities at point B.
The process that ethical hacking is built around is basically the same as what a malicious hacker would use. The goals and how you achieve them are different. In addition, as an ethical hacker, you will eventually attempt to assess all information-security vulnerabilities and properly address them, rather than run a single exploit. Today's attacks can come from any angle against any system, not just from the perimeter of your network and the Internet.
Test every possible entry point, including partner, vendor, and customer networks, as well as home users, wireless LANs, and modems.
07 55784x Ch04.qxd 3/29/04 4:15 PM Page 40
40 Part I: Building the Foundation for Ethical Hacking When you start rolling with your ethical hacking, keep detailed logs of every test you perform, every system you test, and your results. This information can help you do the following: ߜ Track what worked in previous tests and why.
ߜ Help prove that you didn't maliciously hack the systems.
ߜ Correlate your testing with intrusion-detection systems and other log files if questions arise.
In addition to taking general notes, it's also helpful to take screen captures of your results whenever possible. These will come in handy later if you need to show proof of what occurred, as well as when you're generating your final report. Chapter 1 lists the general steps of ethical hacking.
These steps don't include specific information on the low-tech hacking methods that you will use for social engineering and assessing physical security, but the techniques are basically the same. I cover these methods in more detail in Chapters 5 and 6.
Your main task is to simulate information-gathering and system compromises carried out by a hacker. This can be either a partial attack on one computer or a comprehensive attack against the entire organization. Generally, you're looking for what both inside and outside hackers see. You want to assess internal systems (processes and procedures that involve computers, networks, people, and physical infrastructures). Look for vulnerabilities; check how all your systems interconnect and how private systems and information are protected from untrusted elements.
If you're performing ethical hacking for a customer, you may go the blind-assessment route and start with just the company name and no other information that gives you a leg up, such as:
ߜ IP addresses
ߜ Host names
ߜ Software versions
ߜ Firewall rules
ߜ Phone numbers
ߜ Employee names
This blind-assessment approach allows you to start from ground zero and gives you a better sense of what information hackers can access publicly.
As an ethical hacker, you may not have to worry about covering your tracks or evading intrusion-detection systems, because everything you're doing is legitimate. But then again, one of your goals may be to test systems in a stealthy 07 55784x Ch04.qxd 3/29/04 4:15 PM Page 41
fashion. I discuss techniques that hackers use to conceal their actions in later chapters and outline some countermeasures for them as well. I don't discuss covering your tracks in the overall ethical hacking methodology.
Seeing What Others See
Your reconnaissance mission can turn up a ton of information about your organization and systems that the whole world can see. This process is often called footprinting. Here's how to gather the information: ߜ Start by using a Web browser to search the Web for information about your organization.
With the resources available on the Internet, you can gather information until the end of time. Unless you're really bored or trying to take advantage of AOL's introductory offer to stay online for free for 23 hours a day, I don't recommend it!
ߜ Discover more-specific information about your systems from a hacker's viewpoint. You can determine this information by running network scans, probing ports, and assessing vulnerability.
Whether you're searching generally or probing more technically, you ultimately should limit the amount of information you gather based on what's reasonable for you. You may spend an hour, a day, or a week gathering this information --- it all just depends on how large your organization is and the complexity of your information systems.
Gathering public information
The amount of information you can passively gather usually is staggering.
This information is all over the Internet. It's your job to find out what everyone knows about you. This information positions hackers to target specific areas, including departments and individuals.
Web search
Performing a Web search or simply browsing your Web site can turn up the following information:
ߜ Employee names and contact info
ߜ Important company dates
ߜ Incorporation filings for private companies
07 55784x Ch04.qxd 3/29/04 4:15 PM Page 42
42 Part I: Building the Foundation for Ethical Hacking ߜ SEC filings for public companies
ߜ Press releases on moves, organizational changes, and new products ߜ Mergers and acquisitions
ߜ Patents and trademarks
ߜ Presentations, articles, and Webcasts
My favorite tool --- the favorite of many hackers --- is Google (www.google.
com). It ferrets out information --- from word-processing documents to graphics files --- on any publicly accessible computer. It's free, too! There are entire books on using Google. Appendix A lists my favorite resources. With Google, you can search the Internet several ways: ߜ By typing keywords: This often reveals dozens and sometimes hundreds of pages of information --- such as files, phone numbers, and addresses --- that you never guessed were available.
ߜ By performing more advanced Web searches: Google's advanced search options can find sites that link back to your company's Web site. This type of search often reveals a lot of information about partners, vendors, clients, and other affiliations.
ߜ By using switches to dig deeper into a Web site: For example, if you want to find a certain word or file on your Web site, simply enter a line like one of the following into Google: site: www.your\_domain.com keyword
site: www.your\_domain.com filename
Web crawling
Web-crawling utilities such as BlackWidow can mirror your Web site by downloading every publicly accessible file from it. You can then inspect ߜ The Web site layout and configuration offline.
ߜ The HTML source code of Web pages.
ߜ Comment fields. These fields contain such information as names and e-mail addresses of the developers and internal IT personnel, server names, software versions, and internal addressing schemes.
Web sites
These Web sites may provide specific information about your organization: ߜ Government and business Web sites:
• www.hoovers.com and finance.yahoo.com for detailed information about public companies
07 55784x Ch04.qxd 3/29/04 4:15 PM Page 43
• www.sec.gov/edgar.shtml for SEC filings on public companies
• www.uspto.gov for patent and trademark registrations
• The Web site for your state's Secretary of State or similar organization for incorporation and corporate officer information ߜ Background checks through companies such as ChoicePoint (www.choicepoint.com) and USSearch (www.ussearch.com) Mapping the network
When you're mapping out your network, you can search public databases and resources to see what the hackers know about you.
Whois
The best starting point is to perform a Whois lookup by using any one of the Whois tools available on the Internet. Whois is the tool you've most likely used to check whether a particular Internet domain name is available.
For ethical hacking, Whois provides information that can give a hacker a leg up to start a social-engineering attack or to scan your network: ߜ Internet domain-name information, such as contact names and addresses ߜ DNS servers responsible for your domain You can look up Whois information at one of the following places: ߜ A domain registrar's site, such as www.networksolutions.com or www.registerfly.com.
ߜ An ISP's tech-support page.
My favorite Whois tool is Sam Spade (www.samspade.org). You can use its Web site or download its Windows-based tool, shown in Figure 4-1.
You can run DNS queries directly from the site or download the site's Windows-based tool and run it from your PC. Sam Spade can
ߜ Display general domain-registration information
ߜ Show which host handles e-mail (the Mail Exchanger or MX record) for a domain
ߜ Determine whether the host is listed on some spam blacklists
07 55784x Ch04.qxd 3/29/04 4:16 PM Page 44
44 Part I: Building the Foundation for Ethical Hacking Figure 4-1:
The Sam
Spade
graphical
interface.
The following list runs down various lookup sites for other categories: ߜ Government: whois.nic.gov
ߜ Military: whois.nic.mil
ߜ AfriNIC: www.afrinic.org (emerging Regional Internet Registry for Africa)
ߜ APNIC: www.apnic.net/search/index.html (Regional Internet Registry for the Asia Pacific Region)
ߜ ARIN: www.arin.net/whois/index.html (Regional Internet Registry for North America, a portion of the Caribbean, and subequatorial Africa) ߜ LACNIC: Latin American and Caribbean Internet Addresses Registry www.lacnic.net ߜ RIPE Network Coordination Centre: www.ripe.net/db/whois/
whois.html (Europe, Central Asia, African countries north of the equator, and the Middle East)
Alldomains.com offers a reverse Whois service called D-Tective. This paid service finds specific Internet domains for a domain name, a phone number, or an address.
07 55784x Ch04.qxd 3/29/04 4:16 PM Page 45
Google groups
The Google Groups at groups.google.com can reveal surprising public network information. Search for such information as your hostnames, IP
addresses, and usernames. You can search hundreds of millions of Usenet posts back to 1981 for public and often very private information.
You might find some information such as the following that you didn't realize was being made public:
ߜ A tech-support or similar message that divulges too much information about your systems. Many people who post messages to Usenet don't realize that their messages are shared with the world.
ߜ Disgruntled employees or customers who have posted confidential information about your company.
A few years ago, I was helping some folks at an Internet startup company select a telephone service vendor. I searched Google Groups for a vendor they were interested in and turned up some interesting information about the telephone service's network. Apparently, its network administrator had posted some messages to a tech-support site that revealed his full name and e-mail address, specific server names, IP addresses, and network configuration information of its internal systems. My customer used another vendor.
If you discover that confidential information is posted about your company, you may be able to get it removed. Check out the Google Groups help page at groups.google.com/googlegroups/help.html for details.
Privacy policies
Check your Web site's privacy policy. A good practice is to disclose basic information about how user information is protected.
Make sure that the people writing privacy policies don't divulge details about your information-security infrastructure. An Internet startup businessman once contacted me about business opportunities. During the conversation, he was bragging about his company's security systems to ensure the privacy of client information. I went to his Web site to check out his privacy policy.
He had posted the brand and model of firewall he was using. Not a good idea!
Scanning Systems
Active information gathering produces more details about your network and helps you see your systems from a hacker's perspective. For instance, you can 07 55784x Ch04.qxd 3/29/04 4:16 PM Page 46
46 Part I: Building the Foundation for Ethical Hacking ߜ Use the information provided by your Whois lookups and start testing other closely related IP addresses and host names. When you map out --- enumerate --- your network, you see how your systems are laid out.
This includes determining IP addresses, host names (both external and internal), running protocols, open ports, and running services and applications.
ߜ Scan your internal hosts --- if they are within the scope of your testing.
These hosts may not be visible to outsiders, but you should test them.
The hacker may be on the inside!
If you're not completely comfortable scanning your systems, consider first using a lab with test systems or a system running virtual-machine software such as VMware Workstation or Microsoft's Virtual PC. Some hacking tools may not work as designed when you run them on virtual-machine software. If you have trouble getting the software to load or hosts to respond, you may have to run your tests against physically separate computers.
Hosts
Scan and document specific hosts that are reachable from the Internet. Start by pinging either specific host names or IP addresses with one of these: ߜ The basic ping utility that's built into your operating system ߜ A third-party utility that allows you to ping multiple addresses at the same time, such as SuperScan (www.foundstone.com) and NetScanTools Pro (www.netscantools.com) for Windows and fping for UNIX (which allows you to ping more than one address) The site www.whatismyip.com shows how your gateway IP address appears on the Internet. Just browse to that site. Your outermost public IP address (your firewall or router --- preferably not your local computer) appears.
Modems and open ports
Scan for modems and open ports by using network-scanning tools: ߜ Check for unsecured modems with war-dialing software, such as ToneLoc, PhoneSweep, and THC-Scan. I cover war dialing in Chapter 8.
ߜ Scan network ports with SuperScan or Nmap (www.insecure.org/
nmap). You can use a happy-clicky-GUI version made for Windows called NMapWin, shown in Figure 4-2. See Chapter 9 for details.
ߜ Listen to network traffic with a network analyzer such as Ethereal. I cover this topic in various chapters throughout the book.
07 55784x Ch04.qxd 3/29/04 4:16 PM Page 47
Figure 4-2:
The
NMapWin
graphical
interface.
Scanning internally is easy. Simply connect your PC to the network, load up the software, and fire away. Scanning from outside your network takes a few more steps, but it can be done: ߜ For war dialing, scanning shouldn't be an issue. You can just use one of your internal analog lines to dial out from.
ߜ Pinging and scanning is more complicated. The easiest way to connect and get an "outside-in" perspective is to assign yourself a public IP
address and plug your workstation into a switch or hub on the public side of your firewall or router. Physically, you're not on the Internet looking in, but this type of connection works just the same.
Determining What's Running
on Open Ports
As an ethical hacker, you should glean as much information as possible after scanning your systems. You can often identify the following information: ߜ Protocols in use, such as IP, IPX, and NetBEUI ߜ Services running on the hosts, such as e-mail and database applications 07 55784x Ch04.qxd 3/29/04 4:16 PM Page 48
48 Part I: Building the Foundation for Ethical Hacking ߜ Available remote-access services, such as Windows Terminal Services and Secure Shell (SSH)
ߜ VPN services, such as PPTP, SSL, and IPSec
ߜ Required authentication for network shares
You can look for the following open ports (your network scanning program reports these as open):
ߜ Ping (ICMP echo) replies; ICMP traffic is allowed to and from the host ߜ TCP port 20 and/or 21, showing that FTP is running
ߜ TCP port 23, showing that telnet is running
ߜ TCP ports 25 or 465 (SMTP), 110 or 995 (POP3), or 143 or 993 (IMAP), showing that an e-mail server is running
ߜ TCP/UDP port 53, showing that a DNS server is running ߜ TCP ports 80 and 443, showing that a Web server is running ߜ TCP/UDP ports 137, 138, and 139, showing that an unprotected Windows host is running Thousands of ports can be open --- 65,535, to be exact. I cover many popular port numbers when describing hacks throughout this book. A listing of all well-known port numbers (ports 1--1023) and registered port numbers (ports 1024--49151), with their associated protocols and services, is located at www.iana.org/assignments/port-numbers. You can also perform a port-number lookup at www.cotse.com/cgi-bin/port.cgi.
If you detect a Web server running on the system you're testing, you can check the software version by using one of the following methods: ߜ Type the site's name, followed by a page that you know doesn't exist, such as www.your\_domain.com/1234.html. Many Web servers return an error page showing detailed version information.
ߜ Use Netcraft's Web server-search utility (www.netcraft.com), which connects to your server from the Internet and displays the Web-server version and operating system, as shown in Figure 4-3.
You can dig deeper for more specific information on your hosts. This reveals what software version is running on the systems and more: ߜ NMapWin can determine the system OS version; refer to Figure 4-2.
ߜ An enumeration utility (such as DumpSec) can extract users, groups, and file and share permissions directly from Windows.
ߜ Many systems return useful banner information when you connect to a service or application running on a port. For example, if you telnet to an
07 55784x Ch04.qxd 3/29/04 4:16 PM Page 49
e-mail server on port 25 by entering telnet mail.your\_domain.com 25 at a command prompt, you may see something like this: 220 mail.your\_domain.com ESMTP all\_the\_version\_info\_
you'll\_ever\_need Ready
Most e-mail servers return detailed information, such as the version and the current service pack installed. After you have this information, you (and hackers) can determine what vulnerabilities are present on the system from some of the Web sites listed in the next section.
ߜ An e-mail to an invalid address may return with detailed e-mail header information. A bounced message often discloses lots of information that can be used against you, including internal IP addresses and software versions. On certain Windows systems, you can map drives and establish other types of network connections. I cover these issues in Chapter 11.
Figure 4-3:
Netcraft's
Web-server
version
utility.
Assessing Vulnerabilities
After finding potential security holes, test whether they are vulnerabilities.
Before you test, perform some manual searching. You can research hacker message boards, Web sites, and vulnerability databases, such as these: ߜ Common Vulnerabilities and Exposures (cve.mitre.org/cve) ߜ CERT/CC Vulnerability Notes Database (www.kb.cert.org/vuls) ߜ NIST ICAT Metabase (icat.nist.gov/icat.cfm) These sites list practically every known vulnerability. If you can't find a vulnerability documented on one of these sites, search the vendor's site. You can find 07 55784x Ch04.qxd 3/29/04 4:16 PM Page 50
50 Part I: Building the Foundation for Ethical Hacking a list of commonly exploited vulnerabilities at www.sans.org/top20. This is the SANS Top 20 Internet Security Vulnerabilities consensus list, which is compiled and updated by information-security authorities.
If you're not keen on researching your potential vulnerabilities and can jump right into testing, you have a couple of options:
ߜ Manual assessment: You can assess the potential vulnerabilities by connecting to the ports that are exposing the service or application and poking around. You should manually assess certain vulnerabilities (such as in Web applications). The vulnerability reports in the preceding databases often disclose how to do this --- at least generally. If you have a lot of free time, performing these tests manually may be for you.
ߜ Automated assessment: If you're like me, you'll assess vulnerabilities automatically when you can. Manual assessments are a great way to learn, but people usually don't have the time for most manual steps.
I love many of the available vulnerability-assessment tools. Some test for vulnerabilities on specific platforms (such as Windows and UNIX) and types of networks (either wired or wireless). They test for specific system vulnerabilities --- some even focus on the SANS Top 20 list. Versions of these tools can map the business logic within an application; others can help software developers test for code flaws. The drawback to these tools is that they find only individual vulnerabilities, not correlating vulnerabilities. However, this is changing with the advent of event-correlation applications.
Many people love the Nessus tool (www.nessus.org). However, it's not best for beginners or without a Linux or UNIX server.
One of my favorite ethical hacking weapons is a vulnerability-assessment tool called QualysGuard by Qualys (www.qualys.com). It's both a port scanner and vulnerability-assessment tool. You don't even need a computer to run it.
QualysGuard --- which has its roots in Nessus --- is an application service provider-based commercial tool. Just browse to the Qualys Web site, log in, and enter the IP address of the systems you want to test. You schedule the assessment; it runs, then generates excellent reports, such as these: ߜ An executive report containing information like the partial screen capture of a QualysGuard report shown in Figure 4-4.
ߜ A technical report of detailed explanations of the vulnerabilities and specific countermeasures.
Like most good security tools, you pay for QualysGuard --- it's not the least expensive tool --- but you get what you pay for. Some newer products offer similar technical capabilities while adding convenience.
07 55784x Ch04.qxd 3/29/04 4:16 PM Page 51
Figure 4-4:
A sample
QualysGuard
vulnerability-assessment
report.
Assessing vulnerabilities with a tool such as QualysGuard requires follow-up expertise. Study the reports to base your recommendations on the tested systems.
Penetrating the System
You can use identified critical security holes to do the following: ߜ Gain further information about the host and its data.
ߜ Start or stop certain services or applications.
ߜ Access other systems.
ߜ Disable logging or other security controls.
ߜ Capture screen shots.
ߜ Install such hacker tools as rootkits (hacker programs that masquerade as legitimate OS programs) and network analyzers for later backdoor entry.
ߜ Capture keystrokes.
ߜ Send an e-mail as the administrator.
ߜ Perform a buffer-overflow attack.
ߜ Launch another type of DoS attack.
ߜ Upload a file proving your victory.
07 55784x Ch04.qxd 3/29/04 4:16 PM Page 52
52 Part I: Building the Foundation for Ethical Hacking You can exploit the vulnerabilities on your systems and go for complete system penetration. Ideally, you've already made your decision on this. You may want to leave well enough alone. There are also tasks you can't do --- such as installing rootkits or planting a file --- unless you try.
Leave the more-intrusive penetration to those with more time on their hands.
Focus on correcting problems. Part VI of this book covers reporting, patching, and managing.
Don't take the steps I outline in this chapter too literally. General ethical hacking methodologies can be either too simplistic or too rigid. Ultimately, you are in control and can decide what to do and when to do it.
08 55784X PP02.qxd 3/29/04 4:15 PM Page 53
Hacking in Motion
08 55784X PP02.qxd 3/29/04 4:15 PM Page 54
In this part . . .
Let the games begin! You've waited long enough ---
now's the time to start testing your systems. But
where do you start? How about with your two P s --- your people and your physical systems? These are, after all, two of the most easily and commonly attacked targets in your organization.
This part starts out with a discussion of hacking people.
It then goes on to take a look at physical security vulnerabilities. Of course, I'd be remiss in a part about people if I skipped passwords, so I cover testing those as well. This is a great way to get the ball rolling to warm you up for the more specific hacks that come later in the book.
09 55784x Ch05.qxd 3/29/04 4:15 PM Page 55
In This Chapter
ᮣ Introducing social engineering
ᮣ Examining the ramifications of social engineering
ᮣ Understanding social-engineering techniques
ᮣ Protecting your organization against social engineering S ocial engineering takes advantage of the weakest link in any organization's information-security defenses: the employees. Social engineering is "people hacking" and involves maliciously exploiting the trusting nature of human beings for information that can be used for personal gain.
Social Engineering 101
Typically, hackers pose as someone else to gain information they otherwise can't access. Hackers then take the information obtained from their victims and wreak havoc on network resources, steal or delete files, and even commit industrial espionage or some other form of fraud against the organization they're attacking. Social engineering is different from physical-security issues, such as shoulder surfing and dumpster diving, but they are related.
Here are some examples of social engineering:
ߜ False support personnel claim that they need to install a patch or new version of software on a user's computer, talk the user into downloading the software, and obtain remote control of the system.
ߜ False vendors claim to need to make updates to the organization's accounting package or phone system, ask for the administrator password, and obtain full access.
ߜ False contest Web sites run by hackers gather user IDs and passwords of unsuspecting contestants. The hackers then try those passwords on other Web sites, such as Yahoo! and Amazon.com, and steal personal or corporate information.
09 55784x Ch05.qxd 3/29/04 4:15 PM Page 56
56 Part II: Putting Ethical Hacking in Motion
ߜ False employees notify the security desk that they have lost their keys to the computer room, are given a set of keys, and obtain unauthorized access to physical and electronic information.
Sometimes, social engineers act as forceful and knowledgeable employees, such as managers or executives. Other times, they may play the roles of extremely uninformed or naïve employees. They often switch from one mode to the other, depending on whom they are speaking to.
Effective information security --- especially for fighting social engineering ---
begins and ends with your users. Other chapters in this book provide great technical advice, but never forget that basic human communication and interaction also affect the level of security. The candy-security adage is "Hard crunchy outside, soft chewy inside." The hard crunchy outside is the layer of mechanisms --- such as firewalls, intrusion-detection systems, and encryption --- that organizations rely on to secure their information. The soft chewy inside is the people and the systems inside the organization. If hackers can get past the thick outer layer, they can compromise the (mostly) defenseless inner layer.
Social engineering is one of the toughest hacks, because it takes great skill to come across as trustworthy to a stranger. It's also by far the toughest hack to protect against because people are involved. In this chapter, I explore the ramifications of social engineering, techniques for your own ethical hacking efforts, and specific countermeasures to take against social engineering.
Before You Start
I approach the ethical hacking methodologies in this chapter differently than in subsequent hacking chapters. Social engineering is an art and a science. It takes great skill to perform social engineering as an ethical hacker and is dependent upon your personality and overall knowledge of the organization you're testing. If social engineering isn't natural for you, consider using the information in this chapter for educational purposes --- at first --- until you have more time to study the subject.
You can use the information in this chapter to perform specific tests or improve information-security awareness in your organization. Social engineering can harm people's jobs and reputations, and confidential information could be leaked. Proceed with caution and think before you act.
You can perform social-engineering attacks millions of ways. For this reason, and because it's next to impossible to train specific behaviors in one chapter, I don't provide how-to instructions on carrying out social-engineering attacks.
Instead, I describe specific social-engineering scenarios that have worked for other hackers --- both ethical and unethical. You can tailor these same tricks and techniques to specific situations.
09 55784x Ch05.qxd 3/29/04 4:15 PM Page 57
A case study in social engineering
with Ira Winkler
In this case study, Ira Winkler, a world-renowned
load the user administration tool, add a new
social engineer, was gracious in sharing with
user to the domain, and make the user a
me an interesting study in social engineering.
member of the administrators' group. Then they
quickly left.
The Situation
The two men had access to the entire corporate
Mr. Winkler's client wanted a general tempera---
network with administrative rights within two
ture of the organization's security awareness
hours! They also used the badges to perform
level. He and his accomplice went for the pot of
after-hours walkthroughs of the building. In
gold and tested the organization's susceptibility
doing this, they found the key to the CEO's office
to social engineering. Getting started, they
and planted a mock bug there.
scoped out the main entrance of the client's
building and found that the reception/security
The Outcome
desk was in the middle of a large lobby and was
Nobody outside the team knew what the two
staffed by a receptionist. The next day, the two
men did until they were told after the fact. After
men walked into the building during the morn---
the employees were informed, the guard super---
ing rush while pretending to talk on cell phones.
visor called Mr. Winkler and wanted to know
They stayed at least 15 feet from the attendant
who issued the badges. Mr. Winkler informed
and simply ignored her as they walked by.
him that the fact that his area didn't know who
After they were inside the facility, they found a
issued the badges was a problem in and of
conference room to set up shop. They sat down
itself, and that he does not disclose that infor---
to plan the rest of the day and decided a facility
mation.
badge would be a great start. Mr. Winkler called
How This Could Have Been Prevented
the main information number and asked for the
office that makes the badges. He was forwarded
According to Mr. Winkler, the security desk
to the reception/security desk. He then pre---
should have been located closer to the entrance,
tended to be the CIO and told the person on
and the company should have had a formal
the other end of the line that he wanted badges
process for issuing badges. In addition, access
for a couple of subcontractors. The person
to special areas like the computer room should
responded, "Send the subcontractors down to
require approval from a known entity. After
the main lobby."
access is granted, a confirmation should be
sent to the approver. Also, the server screen
When Mr. Winkler and his accomplice arrived,
should have been locked, the account should
a uniformed guard asked what they were work---
not have been logged on unattended, and any
ing on, and they mentioned computers. The
addition of an administrator-level account should
guard then asked them if they needed access to
be audited and appropriate parties should be
the computer room! Of course they said, "That
alerted.
would help." Within minutes, they both had
badges with access to all office areas and the
Ira Winkler, CISSP, CISM, is considered one of
computer operations center. They went to the
the world's best social engineers. You can find
basement and used their badges to open the
more of his case studies in his book Spies
main computer room door. They walked right in
Among Us (McGraw-Hill).
and were able to access a Windows server,
09 55784x Ch05.qxd 3/29/04 4:15 PM Page 58
58 Part II: Putting Ethical Hacking in Motion
These social-engineering techniques may be best performed by an outsider to the organization. If you're performing these tests against your own organization, you may have difficulties acting as an outsider if everyone knows you.
This may not be a problem in larger organizations, but if you have a small, close-knit company, people usually are on to your antics.
You can outsource social-engineering testing to a trusted consulting firm or even have a colleague perform the tests for you. The key word here is trusted.
If you're involving someone else, you must get references, perform background checks, and have the testing approved by management in writing beforehand.
I cover the topic of outsourcing ethical hacking in Chapter 19.
Why Hackers Use Social Engineering
Bad guys use social engineering to break into systems because they can. They want someone to open the door to the organization so that they don't have to break in and risk getting caught. Firewalls, access controls, and authentication devices can't stop a determined social engineer.
Most social engineers perform their attacks slowly, so they're not so obvious and don't raise suspicion. The bad guys gather bits of information over time and use the information to create a broader picture. Alternatively, some social-engineering attacks can be performed with a quick phone call or e-mail. The methods used depend on the hacker's style and abilities.
Social engineers know that many organizations don't have formal data classification, access-control systems, incident-response plans, and securityawareness programs.
Social engineers know a lot about a lot of things --- both inside and outside their target organizations --- because it helps them in their efforts. The more information social engineers gain about organizations, the easier it is for them to pose as employees or other trusted insiders. Social engineers' knowledge and determination give them the upper hand over average employees who are unaware of the value of the information social engineers are seeking.
Understanding the Implications
Most organizations have enemies that want to cause trouble through social engineering. These enemies could be current or former employees seeking revenge, competitors wanting a leg up, or basic hackers trying to prove their skills.
09 55784x Ch05.qxd 3/29/04 4:15 PM Page 59
Regardless of who is causing the trouble, every organization is at risk. Larger companies spread across several locations are often more vulnerable, but small companies also are attacked. Everyone from receptionists to security guards to IT personnel are potential victims of social engineering. Help-desk and call-center employees are especially vulnerable because they are trained to be helpful and forthcoming with information. Even the average untrained end user is susceptible to attack.
Social engineering has serious consequences. Because the objective of social engineering is to coerce someone for ill-gotten gains, anything is possible.
Effective social engineers can obtain the following information: ߜ User or administrator passwords
ߜ Security badges or keys to the building and even the computer room ߜ Intellectual property such as design specifications, formulae, or other research and development documentation
ߜ Confidential financial reports
ߜ Private and confidential employee information
ߜ Customer lists and sales prospects
If any of the preceding information is leaked out, it can cause financial losses, lower employee morale, jeopardize customer loyalty, and even create legal issues. The possibilities are endless.
One reason protecting against social-engineering attacks is difficult is that they aren't well documented. Because so many possible methods exist, recovery and protection are difficult after the attack. The hard crunchy outside created by firewalls and intrusion-detection systems often creates a false sense of security, making the problem even worse.
With social engineering, you never know the next method of attack. The best you can do is remain vigilant, understand the social engineer's methodology, and protect against the most common attacks. In the rest of this chapter, I discuss how you can do this.
Performing Social-Engineering Attacks
The process of social engineering is actually pretty basic. In general, social engineers find the details of organizational processes and information systems to perform their attacks. With this information, they know what to pursue.
Hackers typically perform social-engineering attacks in four simple steps: 09 55784x Ch05.qxd 3/29/04 4:15 PM Page 60
60 Part II: Putting Ethical Hacking in Motion
1. Perform research.
2. Build trust.
3. Exploit relationship for information through words, actions, or technology.
4. Use the information gathered for malicious purposes.
These steps can include myriad substeps and techniques, depending on the attack being performed.
Before social engineers perform their attacks, they need a goal in mind. This is the hacker's first step in this process, and this goal is most likely already implanted in the hacker's mind. What does the hacker want to accomplish?
What is the hacker trying to hack? Does he want intellectual property, server passwords, or security badges; or does he simply want to prove that the company's defenses can be penetrated? In your efforts as an ethical hacker performing social engineering, determine this goal before you move forward.
Fishing for information
Social engineers typically start by gathering public information about their victim. Many social engineers acquire information slowly over time so they don't raise suspicion. Obviousness is a tip-off when defending against social engineering. I cover other warning signs throughout the rest of this chapter.
Regardless of the initial research method, all a hacker needs to start penetrating an organization is an employee list, a few key internal phone numbers, or a company calendar.
Using the Internet
Today's basic research medium is the Internet. A few minutes on Google or other search engines, using simple key words such as the company name or specific employees' names, often produces a lot of information. You can find even more information in SEC filings at www.sec.gov and at sites such as www.hoovers.com and finance.yahoo.com. In fact, many organizations --- especially upper management --- would be dismayed by what's available. By using this search-engine information and browsing the company's Web site, the hacker often has enough information to start.
Hackers can pay $100 or less for a comprehensive background check on individuals. These searches can turn up practically any public --- and sometimes private --- information about a person in minutes.
09 55784x Ch05.qxd 3/29/04 4:15 PM Page 61
Dumpster diving
Dumpster diving is a more difficult method of obtaining information. This method is literally going through trash cans for information about a company.
Dumpster diving can turn up even the most confidential information, because many employees think that their information is safe after it goes into file 13.
Most people don't think about the potential value of paper they throw away.
These documents often contain a wealth of information that tips off the social engineer with information needed to penetrate the organization further. The astute social engineer looks for the following printed documents: ߜ Internal phone lists ߜ Organizational charts
ߜ Employee handbooks, which often contain security policies ߜ Network diagrams
ߜ Password lists
ߜ Meeting notes
ߜ Spreadsheets and reports
ߜ E-mails containing confidential information
Shredding is effective if the paper is cross-shredded into tiny pieces of con-fetti. Inexpensive shredders that shred documents only in long strips are basically worthless against a determined social engineer. With a little time and tape, a social engineer can easily piece a document back together.
Hackers often gather confidential personal and business information from others by listening in on conversations held in restaurants, coffee shops, and airports. People who speak loudly when talking on a cell phone are a great source. Poetic justice, perhaps? While writing in public places, it's amazing what I've heard others divulge --- and I wasn't trying to listen!
Hackers also look for floppy disks, CD-ROM and DVD discs, old computer cases (especially with hard drives) and backup tapes.
See Chapter 6 for more on trash and other physical-security issues, including countermeasures against these exploits.
Phone systems
Hackers can obtain information by using the dial-by-name feature built into most voice-mail systems. To access this feature, you usually just press 0
09 55784x Ch05.qxd 3/29/04 4:15 PM Page 62
62 Part II: Putting Ethical Hacking in Motion
when calling into the company's main number or even someone's desk. This trick works best after hours to make sure that no one answers.
Hackers can protect their identifies if they can hide where they're calling from. Here are some ways that they can do that:
ߜ Residential phones sometimes can hide their numbers from caller ID.
The code to hide a residential phone number from a caller ID is 67. Just dial 67 before the number; it blocks the source number.
This feature is usually disabled when you're calling toll-free (800, 888, 877) numbers.
ߜ Business phones are more difficult to spoof from an office by using a phone switch. However, all the hacker usually needs is the user guide and administrator password for the phone-switch software. In many switches, the hacker can enter the source number --- including a falsified number, such as the victim's home phone number.
Hackers find interesting bits of information, such as when their victims are out of town, just by listening to voice-mail messages. They even study victims'
voices by listening to their voice-mail messages or Internet presentations and Webcasts to impersonate those people.
Building trust
Trust --- so hard to gain, so easy to lose. Trust is the essence of social engineering. Most humans trust other humans until a situation occurs that forces them not to. We want to help one another, especially if trust can be built and the request for help is reasonable. Most people want to be team players in the workplace and don't know what can happen if they divulge too much information to a "trusted" source. This is why social engineers can accomplish their goals. Of course, building deep trust often takes time. Crafty social engineers gain it within minutes or hours. How do they build trust?
ߜ Likability: Who can't relate to a nice person? Everyone loves courtesy.
The friendlier the social engineer --- without going overboard --- the better his chances of getting what he wants. Social engineers often begin by establishing common interests. They often use information they gained in the research phase to determine what the victim likes and act as if they like those things as well. For instance, they can phone victims or meet them in person and, based on information they've learned about the person, start talking about local sports teams or how wonderful it is to be single again. A few low-key and well-articulated comments can be the start of a nice new relationship.
09 55784x Ch05.qxd 3/29/04 4:15 PM Page 63
ߜ Believability: Of course, believability is based in part on the knowledge that social engineers have and how likable they are. But social engineers also use impersonation --- perhaps posing as a new employee or fellow employee that the victim hasn't met. They may even pose as a vendor that does business with the organization. They often modestly claim authority to influence people. The most common social-engineering trick is to do something nice so that the victim feels obligated to be nice in return or to be a team player for the organization.
Exploiting the relationship
After social engineers obtain the trust of their unsuspecting victims, they coax them into divulging more information than they should. Whammo ---
they can go in for the kill. They do this through face-to-face or electronic communications that victims feel comfortable with, or they use technology to get victims to divulge information.
Deceit through words and actions
Wily social engineers can get inside information from their victims many ways.
They are often articulate and focus on keeping their conversations moving without giving their victims much time to think about what they're saying.
However, if they're careless or overly anxious during their social-engineering attacks, the following tip-offs may give them away:
ߜ Acting overly friendly or eager
ߜ Mentioning names of prominent people within the organization ߜ Bragging about authority within the organization
ߜ Threatening reprimands if requests aren't honored
ߜ Acting nervous when questioned (pursing the lips and fidgeting ---
especially the hands and feet, because more conscious effort is required to control body parts that are farther from the face)
ߜ Overemphasizing details
ߜ Physiological changes, such as dilated pupils or changes in voice pitch ߜ Appearing rushed
ߜ Refusing to give information
ߜ Volunteering information and answering unasked questions ߜ Knowing information that an outsider should not have ߜ A known outsider using insider speech or slang
09 55784x Ch05.qxd 3/29/04 4:15 PM Page 64
64 Part II: Putting Ethical Hacking in Motion
ߜ Asking strange questions
ߜ Misspelling words in written communications
A good social engineer isn't obvious with the preceding actions, but these are some of the signs that malicious behavior is in the works.
Hackers often do a favor for someone and then turn around and ask that person if he or she would mind helping them. This is a common social-engineering trick that works pretty well. Hackers also often use what's called reverse social engineering. This is where they offer help if a specific problem arises; some time passes, the problem occurs (often by their doing), and then they help fix the problem. They may come across as heroes, which can further their cause.
Hackers also simply may ask an unsuspecting employee for a favor. Yes ---
they just outright ask for a favor. Many people fall for it.
Impersonating an employee is easy. Social engineers can wear a similar looking uniform, make a fake ID badge, or simply dress like the real employees.
They often pose as employees. People think, "Hey --- he looks and acts like me, so he must be one of us." Social engineers also pretend to be employees calling in from an outside phone line. This is an especially popular way of exploiting help-desk and call-center personnel. Hackers know that it's easy for these people to fall into a rut due to such repetitive tasks as saying, "Hello, can I get your customer number, please?"
Here's my story about how I was social-engineered because I didn't think before I spoke. One day, I was having trouble with my high-speed Internet connection. I figured I could just use dial-up access, because it's better than nothing for e-mail and other basic tasks. I contacted my ISP and told the tech-support guy I couldn't remember my dial-up password. This sounds like the beginning of a social-engineering stunt that I could've pulled off, but I got taken. The slick tech-support guy paused for a minute, as if he was pulling up my account info, and then asked, "What password did you try?"
Stupid me, I proceeded to mouth off all the passwords it could've been! The phone got quiet for a moment. He reset my password and told me what it was. After I hung up the phone, I thought, "What just happened? I just got social-engineered!" Man, was I mad at myself. I changed all the passwords that I divulged in case he used that information against me. I still bet to this day that he was just experimenting with me. Lesson learned: Never, ever, under any circumstances divulge your password to someone else.
Deceit through technology
Technology can make things easier --- and more fun --- for the social engineer.
Often, the request comes from a computer or other electronic entity you think you can identify. But spoofing a computer name, an e-mail address, a fax number, or a network address is easy. Fortunately, you can take a few countermeasures against this, as described in the next section.
09 55784x Ch05.qxd 3/29/04 4:15 PM Page 65
One way hackers deceive through technology is by sending e-mail for critical information. Such e-mail usually provides a link that directs victims to a professional-and legitimate-looking Web site that "updates" such account information as user IDs, passwords, and Social Security numbers Many spam messages use this trick. Most users are inundated with so much spam and other unwanted e-mail that they often let their guard down and open e-mails and attachments that they shouldn't open. These e-mails usually look professional and believable. They often dupe people into disclosing information they should never give in exchange for a gift. These social-engineering tricks also occur when a hacker who has already broken into the network sends messages or creates fake Internet pop-up windows. The same tricks have occurred through instant messaging and cell-phone messaging.
In some well-publicized incidents, hackers emailed to their victims a patch purporting to come from Microsoft or another well-known vendor. Users think it looks like a duck and it quacks like a duck --- but it's not Bill this time! The message is from a hacker wanting the user to install the "patch" so a Trojan-horse keylogger can be installed or a backdoor can be created into computers and networks. Hackers use these backdoors to hack into the organization's systems or use the victims' computers (known as zombies) as launching pads to attack another system. Even viruses or worms use social engineering. For instance, the LoveBug worm told users they had a secret admirer. When the victims opened the e-mail, it was too late. Their computers were infected; perhaps worse, they didn't have a secret admirer.
The Nigerian 419 e-mail fraud scheme attempts to access unsuspecting people's bank accounts and money. These social engineers --- scamsters ---
offer to transfer millions of dollars to the victim to repatriate a deceased client's funds to the United States. All the victim must provide is personal bank-account information and a little money up front to cover the transfer expenses. Victims have ended up having their bank accounts emptied.
Many computerized social-engineering tactics can be performed anonymously through Internet proxy servers, anonymizers, and remailers. When people fall for requests for confidential personal or corporate information, the sources of these social-engineering attacks are often impossible to track.
Social-Engineering Countermeasures
You have only a few good lines of defense against social engineering. Even with strong security systems, a naïve or untrained user can let the social engineer into the network. Never underestimate the power of social engineers.
09 55784x Ch05.qxd 3/29/04 4:15 PM Page 66
66 Part II: Putting Ethical Hacking in Motion
Policies
Specific policies help ward off social engineering long-term in these areas: ߜ Classifying data
ߜ Hiring employees and contractors and setting up user IDs ߜ Terminating employees and contractors, and removing user IDs ߜ Setting and resetting passwords
ߜ Handling proprietary and confidential information
ߜ Escorting guests
These policies must be enforceable and enforced --- for everyone within the organization. Keep them up to date and tell your end users about them.
User awareness
The best line of defense against social engineering is an organization with employees who can identify and respond to social-engineering attacks. User awareness begins with initial training for everyone and follows with securityawareness initiatives to keep social-engineering defenses on everyone's mind.
Align training and awareness with specific security policies.
Consider outsourcing security training to a seasoned security trainer.
Employees often take training more seriously if it comes from an outsider.
Outsourcing security training is worth the investment.
As you approach ongoing user training and awareness in your organization, the following tips help you combat social-engineering long term: ߜ Treat security awareness and training as a business investment.
ߜ Train users on an ongoing basis to keep security fresh in their minds.
ߜ Tailor your training content to your audience whenever possible.
ߜ Create a social-engineering awareness program for your business functions and user roles.
ߜ Keep your messages as nontechnical as possible.
ߜ Develop incentive programs for preventing and reporting incidents.
ߜ Lead by example.
09 55784x Ch05.qxd 3/29/04 4:15 PM Page 67
Share these tips with your users to help prevent social-engineering attacks: ߜ Never divulge any information unless you can validate that the person requesting the information needs it and is who he says he is. If a request is made over the telephone, verify the caller's identity, and call back.
ߜ Never click an e-mail link that supposedly loads a page with information that needs updating. This is especially true for unsolicited e-mails.
ߜ Escort all guests within a building.
ߜ Never send or open files from strangers.
ߜ Never give out passwords.
A few other general suggestions can ward off social engineering: ߜ Never let a stranger connect to one of your network jacks --- even for a few seconds. A hacker can place a network analyzer, Trojan-horse program, or other malware directly onto your network.
ߜ Classify your information assets, both hard-copy and electronic. Train all employees to handle each asset type.
ߜ Develop and enforce computer media and document destruction policies that help ensure data is handled carefully and stays where it should.
ߜ Use cross-shredding paper shredders. Better, hire a document-shredding company that specializes in confidential document destruction.
ߜ Never allow anonymous File Transfer Protocol (FTP) access into your FTP servers if you don't have to.
These techniques can reinforce the content of formal training: ߜ New-employee orientation, lunch 'n' learns, e-mails, and newsletters ߜ Social-engineering survival brochure with tips and FAQs ߜ Trinkets, such as screen savers, mouse pads, sticky notes, pens, and office posters Appendix A lists my favorite user-awareness trinket vendors to improve user awareness in your organization.
09 55784x Ch05.qxd 3/29/04 4:15 PM Page 68
68 Part II: Putting Ethical Hacking in Motion
10 55784x Ch06.qxd 3/29/04 4:15 PM Page 69
In This Chapter
ᮣ Understanding the importance of physical security
ᮣ Q&A with a well-known physical-security expert
ᮣ Looking for physical-security vulnerabilities
ᮣ Implementing countermeasures for physical-security attacks I'm a strong believer that information security is more dependent on nontechnical policies, processes, and procedures than on the technical hardware and software solutions that many people swear by. Physical security --- protection of physical property --- encompasses both technical and nontechnical components.
Physical security is an often overlooked aspect of an information-security program. Physical security is a critical component of information security.
Your ability to secure your information depends on your ability to secure your site physically. In this chapter, I cover some common physical-security weaknesses, as they relate to computers and information security, to look for in your own systems. In addition, I outline free and low-cost countermeasures to minimize your vulnerabilities. I don't recommend breaking and entering, which is required for some physical-security tests. Instead, approach sensitive areas to see how far you can get. Take a fresh look --- from an outsider's perspective --- at the physical vulnerabilities I cover in this chapter. You may discover holes in your physical-security infrastructure.
Physical-Security Vulnerabilities
Whatever your computer and network-security technology, practically any hack is possible if a hacker is in your building or computer room. That's why it's important to look for physical-security vulnerabilities.
10 55784x Ch06.qxd 3/29/04 4:15 PM Page 70
70 Part II: Putting Ethical Hacking in Motion
In small companies, some physical-security issues may not be a problem.
Many physical security vulnerabilities depend on factors like the following: ߜ Size of the building
ߜ Number of buildings or sites
ߜ Number of employees
ߜ Location and number of building entrance/exit points ߜ Placement of the computer room(s) and other confidential information Literally thousands of possible physical-security vulnerabilities exist. The bad guys are always on the lookout for them --- so you should find these vulnerabilities first. Here are some common physical-security vulnerabilities I've found when assessing security: ߜ No receptionist in a building
ߜ No visitor sign-in or escort required for building access ߜ Employees trusting visitors just because they're wearing vendor uniforms or say they're there to work on the copier or computers ߜ No access controls on doors ߜ Doors propped open
ߜ Publicly accessible computer rooms
ߜ Backup media lying around
ߜ Unsecured computer hardware and software media
ߜ CDs and floppy disks with confidential information in trash cans When these physical-security vulnerabilities are exploited, bad things can happen. Perhaps the biggest problem is that unauthorized people can enter your building. After intruders are in your building, they can wander the halls; log onto computers; rummage through the trash; and steal hard-copy documents, floppy disks and CDs, and even computers out of offices.
What to Look For
You should look for specific security vulnerabilities. Many potential physical-security exploits seem unlikely, but they happen to organizations that don't take physical security seriously.
Hackers can exploit many physical-security vulnerabilities, including weaknesses in a building's infrastructure, office layout, computer-room access, and design. In addition to these factors, consider the facility's proximity to 10 55784x Ch06.qxd 3/29/04 4:15 PM Page 71
local emergency assistance (police, fire, and ambulance) and the area's crime statistics (burglary, breaking and entering, and so on) so you can better understand what you're up against.
A Q&A on physical security with Jack Wiles
In this Q&A session, Jack Wiles, an information---
go to for HR, we simply left and then looked for
security pioneer with over 30 years of experi---
other entrances to that same building. If we
ence, answered several questions on physical
found an outside smoking area at a different
security and how a lack of it often leads to infor---
door, we attempted tailgating and simply walked mation insecurity.
in behind other employees who were reentering the building after finishing their breaks.
How important do you think physical security
Tailgating also worked at most entrances that
is in relation to technical-security issues?
required card access. In my career as a redI've been asked that question many times in the
team leader, we were never stopped and ques---
past, and from decades of experience with both
tioned. We simply said, "Thank you" as we
physical and technical security, I have a stan---
walked in and compromised the entire building.
dard answer. Without question, many of the
What kinds of things would you bring out of a
most expensive technical-security counter-
building?
measures and tools become worthless when
physical security is weak. If I can get my team
It was always easy to get enough important
into your building(s) and walk up to someone's
documentation to prove that we were there. In
desk and log in as that person, I have bypassed
many cases, the documentation was sitting in a
all your technical-security systems. In past
box next to someone's desk (especially if that
security assessments, after my team and I
person was someone important) marked RECY---
entered a building, we always found that people
CLE. To us, that really said, "Steal me first"! We
simply thought that we belonged there --- that
found it interesting that many companies just let
we were employees. We were always friendly
their recycle boxes fill up before emptying them.
and helpful when we came in contact with real
We would also look for a room where strip-cut
employees. They would often return the kind---
shredders were used. The documents that were
ness by helping us with whatever we asked for.
shredded were usually stored in clear plastic
bags. We loaded these bags into our cars and
How were you able to get into most of the
had many of the shredded documents put back
buildings when you conducted "red team" pen-
together in a few hours. We found that if we
etration tests for companies?
pasted the strips from any page on cardboard
In many cases, we just boldly walked into the
with as much as an inch of space between the
building and went up the elevator in multistory
strips, the final document was still readable.
buildings. If we were challenged, we always
Jack Wiles is president of TheTrainingCo.
had a story ready. Our typical story was that we
and
promotes
the annual information---
thought that this was the HR department, and
security conference Techno Security (www.
we were there to apply for a job. If we were
thetrainingco.com).
stopped at the door and told which building to
10 55784x Ch06.qxd 3/29/04 4:15 PM Page 72
72 Part II: Putting Ethical Hacking in Motion
The following sections list vulnerabilities to look for when assessing your organization's physical security. This won't take a lot of technical savvy or expensive equipment. Depending on the size of your facilities, these tests shouldn't take much time. The bottom line is to determine whether the physical-security systems are adequate for the risks involved. Above all, be practical and use common sense.
Building infrastructure
Doors, windows, and walls are critical components of a building --- especially in a computer room or in an area where confidential information is stored.
Attack points
Hackers can exploit a handful of building-infrastructure vulnerabilities.
Consider the following attack points, which are commonly overlooked: ߜ Are doors propped open? If so, why?
ߜ Can gaps at the bottom of critical doors allow someone using a balloon or other device to trip a sensor on the inside of a "secure" room?
ߜ Would it be easy to force doors open? Would a simple kick near the doorknob suffice?
ߜ What is the building and/or computer room made of (steel, wood, con-crete), and how sturdy are the walls and entryways? How resilient would the material be to earthquakes, tornadoes, strong winds, heavy rains, and vehicles driving into the building?
ߜ Are any doors or windows made of glass? Is this glass clear? Is the glass shatterproof or bulletproof?
ߜ Are doors, windows, and other entry points wired to an alarm system?
ߜ Are there drop ceilings with tiles that can be pushed up? Are the walls slab-to-slab? If not, hackers can easily scale walls, bypassing any door or window access controls.
Countermeasures
Many physical-security countermeasures for building vulnerabilities may require other maintenance, construction, or operations experts. If building infrastructures is not your forte, you can hire outside experts during the design, assessment, and retrofitting stages to ensure that you have adequate controls. Here are some of the best ways to solidify building security: ߜ Strong doors and locks ߜ Windowless walls around computer rooms
10 55784x Ch06.qxd 3/29/04 4:15 PM Page 73
ߜ An alarm system that's connected to all access points and continuously monitored
ߜ Lighting (especially around entry/exit points)
ߜ Mantraps that allow only person at a time to pass through a door ߜ Fences (barbed wire and razor wire)
Utilities
You must consider building and computer-room utilities, such as power, water, and fire suppression, when accessing physical security. These utilities can help fight off such incidents as fire and keep other access controls running during a power loss. They can also be used against you if an intruder enters the building.
Attack points
Hackers often exploit utility-related vulnerabilities. Consider the following attack points, which are commonly overlooked:
ߜ Is power-protection equipment (surge protectors, UPSs, and generators) in place? How easily accessible are the on/off switches on these devices?
Can an intruder walk in and flip a switch?
ߜ When the power fails, what happens to physical-security mechanisms?
Do they fail open, allowing anyone through, or fail closed, keeping everyone in or out until the power is restored?
ߜ Where are fire-detection and -suppression devices --- including alarm sensors, extinguishers, and sprinkler systems --- located? Determine how a malicious intruder can abuse them. Are these devices placed where they can harm electronic equipment during a false alarm?
ߜ Where are water and gas shutoff valves located? Can you access them, or would you have to call maintenance personnel about an incident?
ߜ Are local telecom wires (both copper and fiber) that run outside of the building located aboveground, where someone can tap into them with telecom tools? Can digging in the area cut them easily? Are they located on telephone poles that are vulnerable to traffic accidents?
Countermeasures
You may need to involve other experts during the design, assessment, or retrofitting stages. The key is placement:
ߜ Where are the major utility controls placed?
ߜ Can a hacker or other miscreant walking through the building access the controls to turn them on and off?
10 55784x Ch06.qxd 3/29/04 4:15 PM Page 74
74 Part II: Putting Ethical Hacking in Motion
Covers for on/off switches and thermostat controls and locks for server power buttons and PCI expansion slots are effective defenses.
I once assessed the physical security of an Internet collocation facility for a very large computer company (whose name will remain anonymous). I made it past the front guard and tailgated through all the controlled doors to reach the data center. After I was inside, I walked by such equipment as servers, routers, firewalls, UPSs, and power cords that were owned by very large dot-com companies. All this equipment was completely exposed to anyone walking in that area. A quick flip of a switch or an accidental trip over a network cable dan-gling to the floor could bring an entire shelf --- and a global e-commerce site --- to the ground.
Office layout and usage
Office design and usage can either help or hinder physical security.
Hackers may exploit some office vulnerabilities. Consider these attack points: ߜ Does a receptionist or security guard monitor traffic in and out?
ߜ Do employees have confidential information on their desks? What about mail and other packages --- do they lie around outside someone's door or, even worse, outside the building, waiting for pickup?
ߜ Where are trash cans and dumpsters located? Are they easily accessible by anyone? Are recycling bins or shredders used? Open recycling bins and other careless handling of trash are open invitations for dumpster diving --- in which hackers search for confidential company information in phone lists and memos in the trash. Dumpster diving can lead to many security exposures.
ߜ How secure are mail and copy rooms? If hackers can access these rooms, they can steal mail or company letterhead to use against you.
ߜ Are closed-circuit television (CCTV) cameras used and monitored?
ߜ What access controls are on doors and windows? Are regular keys, card keys, combination locks, or biometrics used? Who can access these keys, and where are they stored? Keys and programmable keypad combinations are often shared among users, making accountability difficult to determine. Find out how many people share these combinations and keys.
Countermeasures
Simple measures can reduce your exposure to office vulnerabilities: 10 55784x Ch06.qxd 3/29/04 4:15 PM Page 75
ߜ A receptionist or a security guard who monitors people coming and going.
This is the most critical countermeasure. This person can ensure that every visitor signs in and that all new or untrusted visitors are always escorted.
Make it policy and procedure for all employees to question strangers and report strange behavior in the building.
Employees Only or Authorized Personnel Only signs show the bad guys where they should go instead of deterring them from entering.
ߜ CCTV cameras.
ߜ Single entry/exit points to a building or computer room.
ߜ Secure areas for dumpsters.
ߜ Cross-cut shredders or secure recycling bins for hard-copy documents.
ߜ Limited numbers of keys and pass-code combinations.
Make keys and pass codes unique for each person, whenever possible.
ߜ Biometrics identification systems can be very effective, but they can also be expensive and difficult to manage.
Network components and computers
After hackers obtain physical access to a building, they look for the computer room and other easily accessible computer and network devices.
Attack points
The keys to the kingdom are often as close as someone's desktop computer and not much farther than an unsecured computer room or wiring closet.
Malicious intruders can do the following:
ߜ Obtain network access and send malicious e-mails as a logged-in user.
ߜ Steal files from the computer by copying them onto a floppy disk or USB
drive, or by emailing them to an external address.
ߜ Enter unlocked computer rooms and mess around with servers, firewalls, and routers.
ߜ Walk out with network diagrams, contact lists, and business-continuity and incident-response plans.
ߜ Obtain phone numbers from analog lines and circuit IDs from T1, frame-relay, and other telecom equipment for future attacks.
10 55784x Ch06.qxd 3/29/04 4:15 PM Page 76
76 Part II: Putting Ethical Hacking in Motion
Practically every bit of unencrypted information that traverses the network can be recorded for future analysis through one of the following methods: ߜ Connecting a computer running network-analyzer software to a hub, monitor, or mirrored port on a switch on your network ߜ Installing network-analyzer software on an existing computer.
This is very hard to spot.
How would hackers access this information in the future?
ߜ The easiest attack method is to either install remote-administration software on the computer or dial into a modem by using VNC or pcAnywhere.
ߜ A crafty hacker with enough time can bind a public IP address to the computer if it's outside the firewall. Hackers with enough network knowledge can configure new firewall rules to do this.
Also consider these other vulnerabilities:
ߜ How easily can someone's computer be accessed during regular hours?
During lunchtime? After hours?
ߜ Are servers, firewalls, routers, and switches mounted in locked racks?
ߜ Are computers --- especially laptops --- secured to desks with locks?
ߜ Are passwords stored on sticky notes on computer screens, keyboards, or desks?
ߜ Are backup media lying around the computer room susceptible to theft?
ߜ Are media safes used to protect backup media? Who can access the safe?
ߜ How are laptops and handheld computers handled in-house and when employees are working from home or traveling? Are personal digital assistants (PDAs) and cell phones sitting around unsecured? These devices are often at great risk because of their size and value. Also, they are typically unprotected by the organization's regular security controls.
Are specific policies and technologies in place to help protect them? Is locking laptop bags and PDA cases required? What about power-on passwords? Also consider encryption in case these devices get into a hacker's hands.
ߜ How easily can someone access a wireless access point (AP) signal or the AP itself to join the network?
ߜ Are network firewalls, routers, switches, and hubs (basically, anything with an Ethernet connection) easily accessible, which would enable a hacker to plug into the network easily?
10 55784x Ch06.qxd 3/29/04 4:15 PM Page 77
ߜ Are all cables patched through on the patch panel in the wiring closet so all network drops are live?
This is very common but a bad idea.
ߜ Are cable traps/locks in place that prevent hackers from unplugging network cables from patch panels or computers to use those connections for their own computers?
Countermeasures
Network and computer security countermeasures are some of the simplest to implement, yet the most difficult to enforce because they involve everyday actions. Here is a rundown of these countermeasures: ߜ Require users to lock their screens --- which usually takes a few clicks or keystrokes in Windows or UNIX --- to keep intruders out of their systems.
ߜ Ensure that strong passwords are used (as covered in Chapter 7).
ߜ Require laptop users to lock their systems to their desks with a locking cable. This is especially important in larger companies or locations that receive a lot of foot traffic.
ߜ Keep computer rooms and wiring closets locked, and monitor those areas for malicious wrongdoings.
ߜ Keep a current inventory of hardware and software within the organization --- especially in computer rooms --- so it's easy to determine when extra equipment appears or other equipment is missing.
ߜ Properly secure computer media --- such as floppy disks, CD-ROMs, tapes, and hard drives --- when stored and during transport.
ߜ Use a bulk eraser on magnetic media before it's discarded.
10 55784x Ch06.qxd 3/29/04 4:15 PM Page 78
78 Part II: Putting Ethical Hacking in Motion
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 79
In This Chapter
ᮣ Identifying password vulnerabilities
ᮣ Examining password-hacking tools and techniques
ᮣ Hacking operating-system passwords
ᮣ Hacking password-protected files
ᮣ Protecting your systems from password hacking
Password hacking is one of the easiest and most common ways hackers obtain unauthorized computer or network access. Although strong passwords that are difficult to crack (or guess) are easy to create and maintain, users often neglect this. Therefore, passwords are one of the weakest links in the information-security chain. Passwords rely on secrecy. After a password is compromised, its original owner isn't the only person who can access the system with it. That's when bad things start happening.
Hackers have many ways to obtain passwords. They can glean passwords simply by asking for them or by looking over the shoulders of users as they type them in. Hackers can also obtain passwords from local computers by using password-cracking software. To obtain passwords from across a network, hackers can use remote cracking utilities or network analyzers.
This chapter demonstrates just how easily hackers can gather password information from your network. I outline common password vulnerabilities that exist in computer networks and describe countermeasures to help prevent these vulnerabilities from being exploited on your systems.
If you perform the tests and implement the countermeasures outlined in this chapter, you're well on your way to securing your systems' passwords.
Password Vulnerabilities
When you balance the cost of security and the value of the protected information, the combination of user ID and secret password is usually adequate.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 80
80 Part II: Putting Ethical Hacking in Motion
However, passwords give a false sense of security. The bad guys know this and attempt to crack passwords as a step toward breaking into computer systems.
One big problem with relying solely on passwords for information security is that more than one person can know them. Sometimes, this is intentional; often, it's not. You can't know who has a password other than the owner.
Knowing a password doesn't make someone an authorized user.
Here are the two general classifications of password vulnerabilities: ߜ Organizational or end-user vulnerabilities: This includes lack of password awareness on the part of end users and the lack of password policies that are enforced within the organization.
ߜ Technical vulnerabilities: This includes weak encryption methods and insecure storage of passwords on computer systems.
Before computer networks and the Internet, the user's physical environment was an additional layer of password security. Now that most computers have network connectivity, that protection is gone.
Organizational password vulnerabilities
It's human nature to want convenience. This makes passwords one of the easiest barriers for an attacker to overcome. Almost 3 trillion (yes, trillion with a t and 12 zeros) eight-character password combinations are possible by using the 26 letters of the alphabet and the numerals 0 through 9. However, most people prefer to create passwords that are easy to remember. Users like to use such passwords as "password," their login name, or a pet's name.
Unless users are educated and reminded about using strong passwords, their passwords usually are
ߜ Weak and easy to guess.
ߜ Seldom changed.
ߜ Reused for many security points. When bad guys crack a password, they try to access other systems with the same password and user name.
ߜ Written down in nonsecure places. The more complex a password is, the more difficult it is to crack. However, when users create more complex passwords, they're more likely to write them down. Hackers can find these passwords and use them against you.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 81
A case study in Windows password vulnerabilities
with Philippe Oechslin
In this case study, Dr. Philippe Oechslin, a
same password produces the same hash on
researcher and independent information secu---
any Windows machine. Although it is known
rity consultant, shared with me his recent
that Windows hashes have no random element,
research findings on Windows password
no one has used a technique like the one that
vulnerabilities.
Dr. Oechslin discovered to crack Windows
passwords.
The Situation
For a short time, Dr. Oechslin and his team had
In 2003, Dr. Oechslin discovered a new method
an interactive tool on their Web site
for cracking Windows passwords. While test-
(lasecwww.epfl.ch) that enabled visitors to
ing a brute-force password-cracking tool, he
submit hashes and have them cracked. Over a
thought it was a waste of time for everyone
six-day period, the tool cracked 1,845 pass---
using the same tool to have to generate the
words in an average of 7.7 seconds! They deac---
same hashes over and over again. He believed
tivated the demo after a week (and a million hits)
that generating a huge dictionary of all possible
and did not release the tool because they didn't
hashes would make it easier to crack Windows
want to help hackers. Dr. Oechslin did say that
passwords, but then he quickly realized that a
he has heard about other tools (such as
dictionary of the LAN Manager (LM) hashes of
RainbowCrack) that use the same method but
all possible alphanumerical passwords would
are being developed independently.
require over a terabyte of storage.
The Outcome
During his research, Dr. Oechslin discovered a
technique called time-memory trade-offs,
So what's the big deal, you say? This password---
where hashes are computed in advance but
cracking method can crack any alphanumerical
only a small fraction are stored (approximately
password in a few seconds, whereas current
one in a thousand). He discovered that how the
brute-force tools can take several hours. Dr.
LM hashes are organized allows you to find any
Oechslin and his research team have generated
password if you spend some time recalculating
a table with which they can crack any pass---
some of the hashes. This technique saves
word made of letters, numbers, and 16 other
memory but takes a lot of time. Studying this
characters in less than a minute, demonstrating
method, he found a way to make it more effi---
that passwords made up of letters and numbers
cient, making it possible to find any of the 80 bil---
aren't good enough. He also stated that this
lion unique hashes by using a table of 250 million
method is useful for ethical hackers who have
entries (1GB worth of data) and performing only
only limited time to perform their testing.
4 million hash calculations. This process is
Unfortunately, hackers have the same benefit
much faster than a brute-force attack, which
and can perform their attacks before anyone
must generate 50 percent of the hashes (40 bil---
detects them!
lion) on average.
Philippe Oechslin, PhD, CISSP, is a lecturer and
This research is based on the absence of a
senior research assistant at the Swiss Federal
random element when Windows passwords are
Institute of Technology in Lausanne and spends
hashed. This is true for both the LM hash and
his spare time as an independent information---
the NT hash built into Windows. As a result, the
security consultant.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 82
82 Part II: Putting Ethical Hacking in Motion
Technical password vulnerabilities
You can often find these serious technical vulnerabilities after exploiting organizational password vulnerabilities:
ߜ Weak password-encryption schemes. Hackers can break weak password storage mechanisms by using cracking methods that I outline in this chapter. Many vendors and developers believe that passwords are safe from hackers if they don't publish the source code for their encryption algorithms. Wrong! A persistent, patient hacker can usually crack this security by obscurity fairly quickly. After the code is cracked, it is soon distributed across the Internet and becomes public knowledge.
Password-cracking utilities take advantage of weak password encryption.
These utilities do the grunt work and can crack any password, given enough time and computing power.
ߜ Software that stores passwords in memory and easily accessed databases.
ߜ End-user applications that display passwords on the screen while typing.
The ICAT Metabase (an index of computer vulnerabilities) currently identifies over 460 technical password vulnerabilities, 230 of which are labeled as high-severity. You can search for some of these issues at icat.nist.gov/icat.
cfm to find out how vulnerable some of your systems are from a technical perspective.
Cracking Passwords
Password cracking is one of the most enjoyable hacks for the bad guys. It fuels their sense of exploration and desire to figure things out. You may not have a burning desire to explore everyone's passwords, but it helps to approach password cracking with this thinking. So where should you start hacking the passwords on your systems? Generally speaking, any user's password works.
After you obtain one password, you can obtain others --- including administrator or root passwords.
Administrator passwords are the pot of gold. With unauthorized administrative access, you can do virtually anything on the system. When looking for your organization's password vulnerabilities, I recommend first trying to obtain the highest level of access possible (such as administrator) through the most discreet method possible. That's what the hackers do.
You can use low-tech ways and high-tech ways to exploit the vulnerabilities and obtain passwords. For example, you can deceive users into divulging passwords over the telephone or simply observe what a user has written down on a piece of paper. Or you can capture passwords directly from a computer or over a network or the Internet with tools covered in the following sections.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 83
Cracking passwords the old-fashioned way
A hacker can use low-tech methods to crack passwords. These methods include using social-engineering techniques, shoulder surfing, and simply guessing passwords from information that you know about the user.
Social engineering
The most popular low-tech method is social engineering, which is covered in detail in Chapter 5. Social engineering takes advantage of the trusting nature of human beings to gain information that can later be used maliciously.
Techniques
To obtain a password through social engineering, you just ask for it. For example, you can simply call a user and tell him that he has some important-looking e-mails stuck in the mail queue and you need his password to log in and free them up. This is how hackers try to get the information!
If your colleague gives you his password, make sure that he changes it.
Countermeasures
User awareness is the best defense against social engineering. Train users to spot attacks (such as suspicious phone calls or deceitful e-mails) and respond effectively. Their best response is to not give out any information and to alert the appropriate information-security officer in the organization to see whether the inquiry is legitimate and whether a response is necessary.
For this defense to be successful, the organization must enforce a security policy and provide ongoing securityawareness training to users.
Shoulder surfing
Shoulder surfing is an effective, low-tech password hack.
Techniques
To mount this attack, you must be near the user and not look obvious. Simply watch either the user's keyboard or screen when logging in.
A hacker with a good eye may watch whether the user is glancing around his desk for either a reminder of the password or the password itself.
Many folks have experienced shoulder surfing at the grocery-store checkout line. You swipe your debit card to pay for your chips and dip; you enter your PIN to authorize the transaction; and before you know it, the guy in line behind you has your PIN! He simply watched you enter it into the keypad.
You can try shoulder surfing yourself --- though preferably not in the grocery-store checkout line. Just walk around the office and perform random spot checks. Go to users' desks, and ask them to log in to their computers, the 11 55784x Ch07.qxd 3/29/04 4:15 PM Page 84
84 Part II: Putting Ethical Hacking in Motion
network, or even their e-mail applications. Just don't tell them what you're doing beforehand, or they'll be on to you and attempt to hide what they're typing or where they're looking for their password --- two things that they should've been doing all along!
Countermeasures
Encourage users to be aware of their surroundings and not enter their passwords when they suspect that someone is looking over their shoulder.
Instruct users that if they suspect someone is looking over their shoulder while they're logging in, they should politely ask the person to look away.
Inference
Inference is simply guessing passwords from information you know about users --- such as their date of birth, favorite television show, and phone numbers. It sounds silly, but you can determine passwords by guessing!
The best defense against an inference hack attack is to educate users about creating secure passwords that do not include information that can be associated with them. You can't easily enforce this practice with technical controls, so you need a sound security policy and ongoing awareness training to remind users of the importance of secure password creation.
Weak authentication
Hackers can obtain --- or simply avoid having to use --- passwords by taking advantage of older operating systems, such as Windows 9 x and Me. These operating systems don't require passwords to log in.
Bypassing authentication
On a Windows 9 x or similar workstation that's prompting for a password, you can press Esc on the keyboard to get right in. After you're in, you can find other passwords stored in such places as dial-up networking connections and screen savers. These weak systems can serve as trusted machines --- meaning that it's assumed that they're secure --- and provide good launching pads for network-based password attacks as well.
Countermeasures
The only true defense against this hack is to not use operating systems that employ weak authentication. To eliminate this vulnerability, upgrade to Windows XP, or use Linux or the flavors of UNIX, including Mac OS X.
More modern authentication systems (such as Kerberos, which is used in newer versions of Windows), directory services (such as Novell's eDirectory), and network-based e-mail systems (such as Exchange) encrypt user passwords or don't communicate the passwords across the network. These measures create an extra layer of security, but these authentication systems still have some vulnerabilities, which I discuss shortly.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 85
High-tech password cracking
High-tech password cracking involves using a program that tries to guess a password by determining all possible password combinations. These high-tech methods are mostly automated after you access the computer and password database files.
Password cracking software
You can try to crack your organization's operating-system and Internet-application passwords with various password cracking tools: ߜ LC4 (previously called L0phtcrack) can sniff out password hashes from the wire. Go to www.atstake.com/research/lc ߜ NetBIOS Auditing Tool (NAT) specializes in network-based password attacks. Go to www.securityfocus.com/tools/543
ߜ Chknull (www.phreak.org/archives/exploits/novell) for Novell NetWare password testing
ߜ These tools require physical access on the tested computer:
• John the Ripper (www.openwall.com/john)
• pwdump2 (razor.bindview.com/tools/desc/pwdump2\_
readme.html)
• Crack (coast.cs.purdue.edu/pub/tools/unix/pwdutils/
crack)
• Brutus (www.hoobie.net/brutus)
• Pandora (www.nmrc.org/project/pandora)
• NTFSDOS Professional (www.winternals.com)
ߜ Various other handy password tools exist, such as
• GetPass for decrypting login passwords for Cisco routers (www.
boson.com/promo/utilities/getpass/getpass\_utility.htm)
• Win Sniffer for capturing FTP, e-mail, and other types of passwords off the network
• Cain and Abel for capturing, cracking, and even calculating various types of passwords on a plethora of systems (www.oxid.it/
cain.html)
You may be wondering what value a password-cracking tool offers if you need physical access to your systems to test them. Some would say that if a hacker can obtain physical access to your systems and password files, you have more than just basic information-security problems to worry about. But this kind of access is entirely possible! What about a summer intern, a disgruntled employee, or an outside consultant with malicious intent?
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 86
86 Part II: Putting Ethical Hacking in Motion
Password-cracking utilities take a set of known passwords and run them through a password-hashing algorithm. The resulting hashes --- or an encrypted form of a data set --- are then compared at lightning speed to the password hashes extracted from the original password database. When a match is found between the newly generated hash and the hash in the original database, the password has been cracked. It's that simple.
Other password-cracking programs simply attempt to logon using a predefined set of user IDs and passwords. In fact, NAT can do just that. NAT takes advantage of some known weaknesses in Microsoft's Server Message Block (SMB) protocol, which is used for file and print sharing.
Try running NAT in a real-world scenario. Simply download NAT from the preceding address, and extract it to a temporary directory on your hard drive.
NAT comes with some predefined usernames and passwords in the userlist.
txt and passlist.txt files, but you can modify them or add your own. For a quick test of a Windows NT or 2000 machine across the network, enter this basic NAT command at a command prompt:
nat -u userlist.txt -p passlist.txt IP\_address\_of\_the\_computer\_you're\_testing Figure 7-1 shows the output of my test server when I ran NAT against it. NAT
used the default password list to crack the administrator password in just a few seconds. If you don't have any luck, consider using one of the dictionary files listed in the next section. Just give the test some time. If you use one of the larger lists, the process may take quite a while.
Figure 7-1:
Output from
the NetBIOS
Auditing
Tool.
Passwords that are subjected to cracking tools eventually lose. You have access to the same tools as the bad guys. These tools can be used for both legitimate auditing and malicious attacks. You want to audit your passwords before the bad guys do, and in this section, I show you some of my favorite methods for auditing Windows and Linux/UNIX passwords.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 87
When trying to crack passwords, the associated user accounts may be locked out, which could interrupt your users. Be careful if you have intruder lockout enabled --- you may have to go back in and reenable locked accounts.
Passwords are typically stored on a computer in an encrypted fashion, using an encryption or one-way hash algorithm such as DES or MD5. Hashed passwords are then represented as fixed-length encrypted strings that always represent the same passwords with exactly the same strings. These hashes are irreversible for all practical purposes, so passwords can never be decrypted.
Password storage locations vary by operating system:
ߜ Windows usually stores passwords in these locations:
• Security Accounts Manager (SAM) database
(c:\winnt\system32\config)
• Active Directory database file that's stored locally or spread across domain controllers (ntds.dit)
Windows sometimes stores passwords in either a backup of the SAM file in the c:\winnt\repair directory or on an emergency repair disk.
Some Windows applications store passwords in the Registry or as plain-text files on the hard drive!
ߜ Linux and other UNIX variants typically store passwords in these files:
• etcpasswd (readable by everyone)
• etcshadow (accessible by root only)
• etcsecurity/passwd (accessible by root only)
• /.secureetcpasswd (accessible by root only)
Two high-tech password-cracking methods are dictionary attacks and brute-force attacks.
Dictionary attacks
Dictionary attacks against passwords quickly compare a set of words ---
including many common passwords --- against a password database. This database is a text file with thousands of words typically listed in alphabetical order. For instance, suppose that you have a dictionary file that you downloaded from one of the sites in the following list. The English dictionary file at the Purdue site contains one word per line starting with 10th, 1st . . . all the way to zucchini and zygote.
Many password-cracking utilities can use a separate dictionary that you create or download from the Internet. Here are some popular sites that house dictionary files and other miscellaneous word lists: 11 55784x Ch07.qxd 3/29/04 4:15 PM Page 88
88 Part II: Putting Ethical Hacking in Motion
ߜ ftp://ftp.cerias.purdue.edu/pub/dict
ߜ ftp://ftp.ox.ac.uk/pub/wordlists
ߜ packetstormsecurity.nl/Crackers/wordlists
ߜ www.outpost9.com/files/WordLists.html
Most dictionary attacks are good for weak (easily guessed) passwords.
However, some special dictionaries have common misspellings of words such as pa$$w0rd (password) and 5ecur1ty (security), non-English words, and the-matic words from religions, politics, or Star Trek.
Brute-force attacks
Brute-force attacks can crack any password, given sufficient time. Brute-force attacks try every combination of numbers, letters, and special characters until the password is discovered. Many password-cracking utilities let you specify such testing criteria as the characters and password length to try.
A brute-force test can take quite a while, depending on the number of accounts, their associated password complexities, and the speed of the computer that's running the cracking software.
Smart hackers attempt logins slowly or at random times so the failed login attempts aren't as predictable or obvious in the system log files. Some malicious users may even call the IT help desk to attempt a reset of the account they've just locked out. This social-engineering technique could be a major issue, especially if the organization has no or minimal mechanisms in place to verify that locked-out users are who they say they are.
Can an expiring password deter a hacker's attack and render password-cracking software useless? Yes. After the password is changed, the cracking must start again if the hacker wants to test all the possible combinations.
This is one reason why passwords must be changed periodically. Shortening the change interval can reduce the risk of a password's being cracked.
Exhaustive password-cracking attempts usually aren't necessary. Most passwords are fairly weak. Even minimum password requirements, such as a password length, can help you in your testing; you may be able to give your cracking programs more defined cracking parameters, which eliminates combinations for faster results.
Cracking passwords with pwdump2 and John the Ripper
The following steps use two of my favorite utilities to test the security of current passwords on Windows systems:
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 89
ߜ pwdump2 (to extract password hashes from the Windows SAM database) ߜ John the Ripper (to crack the hashes of Windows and UNIX passwords) This test requires administrative access to either your Windows NT/2000
stand-alone workstation or server:
1. Create a new directory called passwords from the root of your Windows C: drive.
2. Download and install a decompression tool, if you don't have one.
FreeZip (members.ozemail.com.au/~nulifetv/freezip) and IZArc (www.webattack.com/get/izarc.shtml) are free Windows decompression tools. Windows XP includes built-in decompression.
3. Download, extract, and install the following software, if you don't already have it on your system:
• pwdump2 --- download the file from razor.bindview.com/
tools/desc/pwdump2\_readme.html
• John the Ripper --- download the file from www.openwall.com/john 4. Enter the following command to run pwdump2 and redirect its output to a file called cracked.txt:
pwdump2 > cracked.txt
This file will be used to store the Windows SAM password hashes that will later be cracked with John the Ripper. Figure 7-2 shows the contents of the cracked.txt file that contains the local Windows SAM-database password hashes.
Figure 7-2:
Output from
pwdump2.
5. Enter the following command to review the contents from the resulting hashes:
type cracked.txt
All the users on your system are listed (similar to Figure 7-3), whether you run this on a stand-alone Windows NT/2000 system or Windows Primary Domain Controller (PDC).
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 90
90 Part II: Putting Ethical Hacking in Motion
Figure 7-3:
Cracked
password
file hashes
from
pwdump2.
6. Enter the following command to run John the Ripper against the Windows SAM password hashes to display the cracked passwords: john cracked.txt
You should see something similar to the following:
Loaded 3 passwords with no different salts (NT LM DES [24/32 4K]) 123
(Weak:1)
PASS
(Newuser:1)
GUESS
(Lame:1)
guesses: 3 time: 0:00:00:00 (3) c/s: 165146 trying: SAMELL - SANDIT
This process can take seconds or days, depending on the number of users and the complexity of their associated passwords. My Windows example took only five seconds to crack five weak passwords.
John the Ripper can crack UNIX passwords. You need root access to your system and to the password (etcpasswd) and shadow password (etcshadow) files. Perform the following steps for cracking UNIX
passwords:
1. Download the UNIX source files from www.openwall.com/john.
2. Extract the program by entering the following command: tar -zxf john-1.6.tar.gz
3. Change into the /src directory that was created when you extracted the program, and enter the following command:
make generic.
4. Change into the /run directory, and enter the following command to use the unshadow program to combine the passwd and shadow files and copy them to the file cracked.txt:
./unshadow etcpasswd etcshadow > cracked.txt
5. Enter the following command to start the cracking process:
./john cracked.txt
When John the Ripper is complete (and this could take some time), you get an output similar to the results of the preceding Windows process.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 91
After completing the preceding Windows or UNIX steps, you can either ߜ Force users to change passwords that don't meet specific password policy requirements.
ߜ Create a password policy from scratch.
Be careful handling the results of your password cracking. Password information for others is confidential and should be treated with care.
Checking for null passwords in NetWare
Using the chknull program, you can test for NetWare users that have empty passwords, passwords that match their username, or passwords that match a specific password that you supply on the command line. Figure 7-4 shows the output of a chknull session against a NetWare server without being logged in: Four users have blank passwords, three users have the password "123,"
and one user's password is the same as his username (avadminuser).
Figure 7-4:
NetWare
password
weaknesses
found with
chknull.
General password-hacking
countermeasures
A password for one system usually equals passwords for many other systems, because many people use the same passwords on every system they use. For this reason, instruct users to create different passwords for different systems, especially on the systems that protect more sensitive information.
Strong passwords are important, but balance security and convenience: ߜ You can't expect users to memorize passwords that are insanely complex and changed every week.
ߜ You can't afford weak passwords or no passwords at all.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 92
92 Part II: Putting Ethical Hacking in Motion
Passwords by the numbers
One hundred twenty-eight different ASCII char---
more realistic combination of 95 or so ASCII let---
acters are used in typical computer passwords.
ters, numbers, and standard punctuation char-
(Technically, only 126 characters are used,
acters, such a file would still fill thousands of
because you can't use the NULL and the car---
terabytes of storage space. These storage
riage return characters.) A truly random eight---
requirements require password-cracking pro---
character password that uses 126 different
grams to form the password combinations on
characters can have 63,527,879,748,485,376 dif---
the fly, instead of reading all possible combina---
ferent combinations. Taking that a step further,
tions from a text file. That's why brute-force
if it were possible (and it is, in Linux and UNIX)
attacks are more effective at cracking pass---
to use all 256 ASCII characters (254, without
words than dictionary attacks.
NULL and carriage return) in a password,
Given the effectiveness of brute-force pass---
17,324,859,965,700,833,536 different combina---
word attacks, it's not unrealistic to think that in
tions are possible. This is approximately 2.7 bil---
the future, anyone will be able to crack all pos---
lion times more combinations than there are
sible password combinations, given the current
people on earth!
technology and average lifespan. It probably
A text file containing all these possible pass---
won't happen, but many of us also thought in the
words would require millions of terabytes of
mid-1980s that 640KB of RAM and 10MB hard
storage space. Even if you included just the
drives in our PCs were all we needed.
Storing passwords
If you have to choose between weak passwords that your users can memorize and strong passwords that your users must write down, I recommend having readers write down passwords and store the information securely.
Train users to store their written passwords in a secure place --- not on keyboards or in easily cracked password-protected computer files (such as spreadsheets). Users should store a written password in either of these locations: ߜ A locked file cabinet or office safe
ߜ An encrypted file or database, using such tools as
• PGP (www.pgpi.org for the free open-source version or www.
pgp.com for the commercial version)
• Open-source Password Safe, originally developed by Counterpane (passwordsafe.sourceforge.net)
No sticky notes!
Policy considerations
As an ethical hacker, you should show users the importance of securing their passwords. Here are some tips on how to do that:
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 93
ߜ Demonstrate how to create secure passwords. You may want to refer to them as pass codes or pass phrases, because people tend to take the word passwords literally and use only words, which can be less secure.
ߜ Show what can happen when weak passwords are used or passwords are shared.
ߜ Diligently build user awareness of social-engineering attacks.
Enforce (or encourage the use of) a strong password-creation policy that includes the following criteria:
ߜ Use upper-and lowercase letters, special characters, and numbers.
(Never use only numbers. These passwords can be cracked quickly.) ߜ Misspell words or create acronyms from a quote or a sentence. (An acronym is a word created from the initials of a phrase. For example, ASCII is an acronym for American Standard Code for Information Interchange.)
ߜ Use punctuation characters to separate words or acronyms.
ߜ Change passwords every 6 to 12 months.
ߜ Use different passwords for each system. This is especially important for network-infrastructure hosts, such as servers, firewalls, and routers.
ߜ Use variable-length passwords. This can throw off the hackers, because they won't know the required minimum or maximum length of passwords and must try all password length combinations.
ߜ Don't use common slang words or words that are in a dictionary.
ߜ Don't use similar-looking characters, such as 3 instead of E, 5 instead of S, or ! instead of 1. Password-cracking programs can check for this.
ߜ Don't reuse the same password within 12 months.
ߜ Use password-protected screen savers.
ߜ Don't share passwords.
ߜ Avoid storing user passwords in a central place, such as an unsecured spreadsheet on a hard drive. This is an invitation for disaster. Use PGP, Password Safe, or a similar program to store user passwords.
Other considerations
Here are some other password-hacking countermeasures that I recommend: ߜ Enable security auditing to help monitor and track password attacks.
ߜ Test your applications to make sure they aren't storing passwords in memory or writing them to disk.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 94
94 Part II: Putting Ethical Hacking in Motion
Some password-cracking Trojan-horse applications are transmitted through worms or simple e-mail attachments, such as VBS.Network.B and PWSteal.SoapSpy. These applications can be lethal to your password-protection mechanisms if they're installed on your systems. The best defense is malware protection software, such as antivirus protection (from a vendor like Norton or McAfee), spyware protection (such as PestPatrol or Spybot), or malicious-code behavioral protection (such as Finjan's offerings).
ߜ Keep your systems patched. Passwords are reset or compromised during buffer overflows or other DoS conditions.
ߜ Know your user IDs. If an account has never been used, delete or disable the account until it's needed. You can determine unused accounts by manual inspection or by using a tool such as DumpSec (www.somarsoft.com), which can enumerate the Windows operating system and gather user ID and other information.
As the security administrator in your organization, you can enable account lockout to prevent password-cracking attempts. Most operating systems and some applications have this capability. Don't set it too low (less than five failed logins), and don't set it too high to give a malicious user a greater chance of breaking in. Somewhere between 5 and 50 may work for you. I usually recommend a setting of around 10 or 15.
ߜ To use account lockout and prevent any possibilities of a user DoS condition, require two different passwords, and don't set a lockout time for the first one.
ߜ If you permit auto reset of the account after a certain time period ---
often referred to as intruder lockout --- don't set a short time period.
Thirty minutes often works well.
A failed login counter can increase password security and minimize the overall effects if the account is being compromised by an automated attack. It can force a password change after a number of failed attempts. If the number of failed login attempts is high, and they all occurred in a short period of time, the account has likely experienced an automated password attack.
Some more password-protection countermeasures include the following: ߜ Use stronger authentication methods, such as challenge/response, smart cards, tokes, biometrics, or digital certificates.
ߜ Automate password reset. This functionality lets users to manage most of their password problems without getting others involved. Otherwise, this support issue becomes expensive, especially for larger organizations.
ߜ Password-protect the system BIOS (basic input/output system). This is especially important on servers and laptops that are susceptible to physical-security threats and vulnerabilities.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 95
Password-protected files
Do you wonder how vulnerable word-processing, spreadsheet, and zip files are as users send them into the wild blue yonder? Wonder no more. Some great utilities can show how easily passwords are cracked.
Cracking files
Most password-protected files can be cracked in seconds or minutes. You can demonstrate this "wow-factor" security vulnerability to users and management. Here's a real-world scenario:
ߜ Your CFO wants to send some confidential financial information in an Excel spreadsheet to the company's outside financial advisor.
ߜ She protects the spreadsheet by assigning a password to it during the file-save process in Excel 2002.
ߜ For good measure, she uses WinZip to compress the file, and adds another password to make it really secure.
ߜ The CFO sends the spreadsheet as an e-mail attachment, assuming that it will reach its destination securely.
The financial advisor's network has content filtering, which monitors incoming e-mails for keywords and file attachments. Unfortunately, the financial advisory firm's network administrator is looking in the content-filtering system to see what's coming in.
ߜ This rogue network administrator finds the e-mail with the confidential attachment, saves the attachment, and realizes that it's password-protected.
ߜ The network administrator remembers some great password-cracking utilities from ElcomSoft (www.elcomsoft.com) that can help him out. He may see something like Figures 7-5 and 7-6.
Cracking password-protected files is as simple as that! Now all that the rogue network administrator must do is forward the confidential spreadsheet to his buddies or the company's competitors.
If you carefully select the right options in Advanced ZIP Password Recovery and Office XP Password Recovery, you can drastically shorten your testing time. For example, if you know that a password is not over 5 characters or is lowercase letters only, you can cut the cracking time in half.
I recommend performing these file password-cracking tests on files that you capture with a content-filtering or network-analysis tool.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 96
96 Part II: Putting Ethical Hacking in Motion
Figure 7-5:
ElcomSoft's
Advanced
ZIP
Password
Recovery
cracking a
zip file.
Figure 7-6:
ElcomSoft's
Advanced
Office XP
Password
Recovery
cracking
a spreadsheet.
Countermeasures
The best defense against weak file password protection is to require your users to use a stronger form of file protection, such as PGP, when necessary.
Ideally, you don't want to rely on users to make decisions about what they should use this method to secure, but it's better than nothing. Stress that a file-encryption mechanism such as PGP is secure only if users keep their passwords confidential and never transmit or store them in clear text.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 97
If you're concerned about nonsecure transmissions through e-mail, consider one of these options:
ߜ Block all outbound e-mail attachments that aren't protected on your e-mail server.
ߜ Use an encryption program, such as PGP, to create self-extracting encrypted files.
ߜ Use content-filtering applications.
Other ways to crack passwords
Over the years, I've found other ways to crack passwords, both technically and through social engineering.
Keystroke logging
One of the best techniques for cracking passwords is remote keystroke logging --- the use of software or hardware to record keystrokes as they're being typed into the computer.
Be careful with keystroke logging. Even with good intentions, monitoring employees can raise some legal issues. Discuss what you'll be doing with your legal counsel, and get approval from upper management.
Logging tools
With keystroke-logging tools, you can later assess the log files of your application to see what passwords people are using:
ߜ Keystroke-logging applications can be installed on the monitored computer. I recommend that you check out eBlaster and Spector Pro by SpectorSoft (www.spectorsoft.com). Another popular tool that you can use is Invisible KeyLogger Stealth, at www.amecisco.com/iks.htm, as well as the hardware-based KeyGhost (www.keyghost.com). Dozens of other such tools are available on the Internet.
ߜ Hardware-based tools fit between the keyboard and the computer or replace the keyboard altogether.
A shared computer can capture the passwords of every user who logs in.
Countermeasures
The best defense against the installation of keystroke-logging software on your systems is a spyware-detection program or popular antivirus products.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 98
98 Part II: Putting Ethical Hacking in Motion
The potential for hackers to install keystroke-logging software is another reason to ensure that your users aren't downloading and installing random shareware or opening attachments in unsolicited e-mails. Consider locking down your desktops by setting the appropriate user rights through local or group security policy in Windows. Alternatively, you could use a commercial lock-down program, such as Fortres 101 (www.fortres.com) for Windows or Deep Freeze (www.deepfreezeusa.com) for Windows and Mac OS X.
Weak password storage
Many legacy and stand-alone applications such as e-mail, dial-up network connections, and accounting software store passwords locally, making them vulnerable to password hacking. By performing a basic text search, I've found passwords stored in clear text on the local hard drives of machines.
Searching
You can try using your favorite text-searching utility --- such as the Windows search function, findstr, or grep --- to search for password or passwd on your drives. You may be shocked to find what's on your systems. Some programs even write passwords to disk or leave them stored in memory.
This is a hacker's dream. Head it off if you can.
Countermeasures
The only reliable way to eliminate weak password storage is to use only applications that store passwords securely. This may not be practical, but it's your only guarantee that your passwords are secure.
Before upgrading applications, contact your software vendor or search for a third-party solution.
Network analyzer
A network analyzer sniffs the packets traversing the network. This is what the bad guys do if they can gain control over a computer or gain physical network access to set up their network analyzer. If they gain physical access, they can look for a network jack on the wall and plug right in!
Testing
Figure 7-7 shows how crystal-clear passwords can be through the eyes of a network analyzer. This figure shows the password packet from an EtherPeek capture of a POP3 session using Microsoft Outlook to download messages from an e-mail server. Look in the POP --- Post Office Protocol section for the password of "MyPassword". These same cleartext password vulnerabilities can apply to instant messaging, Website logins, telnet sessions, and more.
Basically, if traffic is not being tunneled through a VPN, SSH, SSL, or some other form of encrypted link, it's vulnerable to attack.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 99
Figure 7-7:
An
EtherPeek
capture
of a POP3
password
packet.
Although you can benefit from using a commercial network analyzer such as EtherPeek, you don't need to buy one for your testing. An open-source program, Ethereal, runs on Windows and UNIX platforms. You can search for password traffic on the network a million ways. For example, to capture POP3
password traffic, set up a trigger to search for the PASS command. When the network analyzer sees the PASS command in the packet, it starts capturing data until your specified time or number of packets.
Capture this data on a hub segment of your network, or plug your network-analyzer system into a monitor port on a switch. Otherwise, you can't see anyone else's data traversing the network --- just yours. Check your switch's user's guide for whether it has a monitor or mirror port and instructions on how to configure it. You can connect your network analyzer to a hub on the public side of your firewall. You'll capture only those packets that are entering or leaving your network --- not internal traffic.
Countermeasures
Here are some good defenses against network-analyzer attacks: ߜ Use switches on your network, not hubs.
If you must use hubs on network segments, a program such as sniffdet, cpm, and sentinel can detect network cards in promiscuous mode (accepting all packets, whether destined for it or not). Network cards in this mode are signs of a network analyzer running on the network.
ߜ Don't let a hacker gain physical access to your switches or the network connection on the public side of your firewall. With physical access, a hacker can connect to a switch monitor port, or tap into the unswitched network segment outside the firewall and capture packets.
Switches do not provide complete security because they are vulnerable to ARP poisoning attacks, which I cover in Chapter 9.
Most computer BIOSs allow power-on passwords and/or setup passwords to protect the computer's hardware settings that are stored in the CMOS chip.
Here are some ways around these passwords:
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 100
100 Part II: Putting Ethical Hacking in Motion
ߜ You can usually reset these passwords by either unplugging the CMOS
battery or changing a jumper on the motherboard.
ߜ Password-cracking utilities for BIOS passwords are available.
Some systems (especially laptops) can't be reset easily. You can lose all the hardware settings and lock yourself out of your own computer. If you plan to hack your own BIOS passwords, check for information in your user manual or on labmice.techtarget.com/articles/BIOS\_hack.htm on doing this safely.
Weak passwords in limbo
Bad guys often exploit user accounts that have just been reset by a network administrator or help desk. Accounts may need to be reset if users forget their passwords, or if the accounts have been locked out because of failed attempts.
Weaknesses
Here are some reasons why user accounts can be vulnerable: ߜ When user accounts are reset, they often are assigned an easily cracked password (such as the user's name or the word password). The time between resetting the user account and changing the password is a prime opportunity for a breakin.
ߜ Many systems have either default accounts or unused accounts with weak passwords or no passwords at all. These are prime targets.
Countermeasures
The best defenses against attacks on passwords in limbo are solid help-desk policies and procedures that prevent weak passwords from being available at any given time during the password-reset process. Perhaps the best ways to overcome this vulnerability are as follows: ߜ Require users to be on the phone with the help desk, or have a help-desk member perform the reset at the user's desk.
ߜ Require that the user immediately log in and change his password.
ߜ If you need the ultimate in security, implement stronger authentication methods, such as challenge/response, smart cards, or digital certificates.
ߜ Automate password-reset functionality on your network so users can manage most of their password problems without help from others.
For a good list of default system passwords for vendor equipment, check www.cirt.net/cgi-bin/passwd.pl.
Password-reset programs
Network administrators occasionally use administrator password-resetting programs, which can be used against a network.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 101
Tools
One of my favorites for Windows is NTAccess (www.mirider.com/ntaccess.
html). This program isn't fancy, but it does the job.
Countermeasures
The best safeguard against a hacker using a password-reset program against your systems is to ensure the hacker can't gain physical access. When a hacker has physical access, all bets are off.
Securing Operating Systems
You can implement various operating-system security measures to ensure that passwords are protected.
Regularly perform these low-tech and high-tech password-cracking tests to make sure that your systems are as secure as possible --- perhaps as part of a monthly, quarterly, or biannual audit.
Windows
The following countermeasures can help prevent password hacks on Windows systems:
ߜ Some Windows passwords can be gleaned by simply reading the clear text or crackable cipher text from the Windows Registry. Secure your registries by doing the following:
• Allowing only administrator access.
• Hardening the operating system by using well-known hardening best practices, such as such as those from SANS (www.sans.org), NIST (csrc.nist.gov), the National Security Agency Security Recommendation Guides (www.nsa.gov/snac/index.html), and the ones outlined in Network Security For Dummies, by Chey Cobb (Wiley Publishing, Inc.).
ߜ Use SYSKEY for enhanced Windows password protection.
• By default, Windows 2000 encrypts the SAM database that stores hashes of the Windows account passwords. It's not the default in Windows NT.
• You can use the SYSKEY utility to encrypt the database for Windows NT machines and to move the database-encryption key from Windows 2000 and later machines.
Don't rely only on the SYSKEY utility. Tools such as ElcomSoft's Advanced EFS Data Recovery program can crack SYSKEY encryption.
11 55784x Ch07.qxd 3/29/04 4:15 PM Page 102
102 Part II: Putting Ethical Hacking in Motion
ߜ Keep all SAM-database backup copies secure.
ߜ Disable the storage of LM hashes in Windows for passwords that are shorter than 15 characters.
For example, in Windows 2000 SP2 and later, you can create and set the NoLMHash registry key to a value of 1 under HKEY\_LOCAL\_MACHINE\
SYSTEM\CurrentControlSet\Control\Lsa.
ߜ Use passfilt.dll or local or group security policies to help eliminate weak passwords on Windows systems before they're created.
ߜ Disable null sessions in your Windows version:
• In Windows XP, enable the Do Not Allow Anonymous Enumeration of SAM Accounts and Shares option in the local security policy.
• In Windows 2000, enable the No Access without Explicit Anonymous Permissions option in the local security policy.
• In Windows NT, enable the following Registry key:
HKLM/System/CurrentControlSet/Control/LSA/RestrictAnonymous=1
Linux and UNIX
The following countermeasures can help prevent password cracks on Linux and UNIX systems:
ߜ Use shadowed MD5 passwords.
ߜ Help prevent weak passwords from being created. You can use either built-in operating-system password filtering (such as cracklib in Linux) or a password auditing program (such as npasswd or passwd+).
ߜ Check your etcpasswd file for duplicate root UID entries. Hackers can exploit such entries as root backdoors.
12 55784X PP03.qxd 3/29/04 4:15 PM Page 103
12 55784X PP03.qxd 3/29/04 4:15 PM Page 104
In this part . . .
Now that you're off and running with your ethical
hacking tests, it's time to take things to a new level.
The previous tests --- at least the social engineering and physical security tests --- have started at a high level and were not that technical. Times are a-changin'! You now need to look at network security. This is where things start getting more technical.
This part starts out by looking into one of the most overlooked information security vulnerabilities. By that, I mean rogue modems installed on computers randomly throughout your network. This part then moves on to look at the network as a whole from the inside and the outside for everything from perimeter security to network scanning to DoS vulnerabilities and more. Finally, this part takes a look at how to assess the security of the wireless LAN
technology that's introducing some serious security vulnerabilities into networks these days.
13 55784x Ch08.qxd 3/29/04 4:15 PM Page 105
In This Chapter
ᮣ Controlling dial-up access
ᮣ Testing for war dialing weaknesses
ᮣ Preventing war dialing
W ar dialing--- the act of using a computer to scan other computers automatically for accessible modems --- was made popular in the movie War Games. War dialing seems old-fashioned and less sexy than other hacking techniques these days; however, it's a very critical test to run against your network. This chapter shows how to test for war dialing vulnerabilities and outlines countermeasures to help keep your network from being victimized.
War Dialing
It's amazing how often end users and careless network administrators connect modems to computers inside the network. Some companies spend an astonishing amount of money and effort to roll out intrusion-prevention software, application firewalls, and forensics protection tools while ignoring that an unsecured modem on the network can render that protection worthless.
Modem safety
Modems are still on today's networks because of leftover remote access servers (RAS) that provide remote connectivity into the corporate network.
Many network administrators --- hesitant to deploy a VPN --- still have modems on their servers and other hosts for other reasons, such as for administering the network, troubleshooting problems remotely, and even providing connectivity to remote offices. Some network administrators have legitimate modems installed for third-party monitoring purposes and business continuity; modems are a low-cost alternative network access method if the Internet connection is down. Many of these modems --- and their software --- run in default mode with weak passwords or none at all.
13 55784x Ch08.qxd 3/29/04 4:15 PM Page 106
106 Part III: Network Hacking
Practically every computer sold today has a modem. End users create dial-up networking connections so they can bypass the firewall-blocking and employee-monitoring systems in place on the corporate network. Many users want to dial into their work computers from home. Some users even set up their modems to send and receive faxes so that they eliminate every possible reason to leave their desks during the work day.
It's not as big a deal if the modem is configured for outbound access only, but there's always a chance that someone can use it to obtain inbound access. A software misconfiguration or a weak password can give a hacker access.
So what's the bottom line? Unsecured modems inside the network --- and even ones with basic passwords --- can put your entire network at risk. Many of these modems have remote-connectivity software such as pcAnywhere, Procomm Plus, and even Apple Remote Access and Timbuktu Pro for Apple computers. This software can provide backdoor access to the entire network.
In many cases, a hacker can take over the computer with the modem attached and communications software running, gaining full access to everything the currently logged-in user can access. Ouch!
General telephone-system vulnerabilities
A war-dialing attack can uncover other telephone-system vulnerabilities: ߜ Dial tone: Many phone switches support a repeat, or second dial tone, for troubleshooting or other outbound call purposes. This allows a phone technician, a user, or even a hacker to enter a password at the first dial tone and make outbound calls to anywhere in the world --- all on your organization's dime. Many hackers use war dialing to detect repeat dial tones so they can carry out these phone attacks in the future.
ߜ Voice mail: Voice-mail systems --- especially PC-based types --- and entire private branch exchange (PBX) phone switches can be probed by war-dialing software and later compromised by a hacker.
Attacking
War dialing is not that complicated. Depending on your tools and the amount of phone numbers you're testing, this can be an easy test. War dialing involves these basic hacking methodologies:
ߜ Gathering public information and mapping your network ߜ Scanning your systems
ߜ Determining what's running on the systems discovered ߜ Attempting to penetrate the systems discovered
13 55784x Ch08.qxd 3/29/04 4:15 PM Page 107
A case study in war dialing with David Rhoades
In this case study, David Rhoades, a well-known
for a large German bank. The only catch was
war dialing and Web-application security expert,
that the project called for an ISDN war dial,
shared an experience performing an ISDN war
because ISDN was popular in Europe and his
dial. Here's an account of what happened.
customer knew that the bank had lots of ISDN
circuits. Mr. Rhoades soon found himself on a
The situation
flight to Frankfurt with his software and ISDN
A few years ago, Mr. Rhoades had an
terminal adapter.
Integrated Services Digital Network (ISDN) cir-
The outcome
cuit in his home office for two voice lines. ISDN
also allowed him 128Kbps Internet access. His
Mr. Rhoades found several ISDN and analog
ISDN terminal adapter (sometimes incorrectly
lines within the bank's system. His biggest chal---
called an ISDN modem) allowed him to call
lenge was becoming familiar with the dial-in
other ISDN numbers extremely fast. He decided
software packages, which were popular in
to write an ISDN war dialer that would take
Europe but unknown in the United States.
advantage of the amazing speed of ISDN. In
Fortunately for Mr. Rhoades, most vendors
about one second, he could dial the number and
offered free demos of their software, which he
determine whether the other side was ISDN,
could use to access the remote systems.
ISDN with a busy signal, or a regular analog
The bottom line is that if you want to be certain
line. Analog war dialing is much slower. An
that no dial-up connections to your network
analog modem would require at least 30 sec---
exist, consider other methods of communica---
onds to dial the number and recognize the other
tion, such as ISDN. Also, never assume that
end as a modem --- and that assumes the other
well-known communications software is being
end answers on the first ring. So an ISDN war
used on the dial-up connection. If you don't rec---
dialer is very fast at locating other ISDN lines.
ognize what's answering, explore it further. The
The only downsides are that not all ISDN equip---
bad guys most certainly will.
ment can detect analog modems, and you may
have to dial in a second time to detect them
David Rhoades is a principal consultant
properly. Why bother locating ISDN numbers
with Maven Security Consulting Inc. (www.
with a war dial? If the other end is ISDN, a ter---
mavensecurity.com) and teaches at secu---
minal adapter or some other piece of equipment
rity conferences around the globe for USENIX,
might be remotely accessible just by calling it.
the MIS Training Institute, and ISACA.
Shortly after Mr. Rhoades wrote the ISDN war
dialer, his company got a request for a war dial
The process of war dialing is as simple as entering phone numbers into your freeware or commercial war-dialing software and letting the program work its magic --- preferably overnight, so you can get some sleep!
Before you get started, keep in mind that it might be illegal to war-dial in your jurisdiction, so be careful! Also, make sure you war-dial only the numbers you're authorized to dial. Even though you will most likely perform your war dialing after hours --- at night or over a weekend --- make sure that upper 13 55784x Ch08.qxd 3/29/04 4:15 PM Page 108
108 Part III: Network Hacking
management and possibly even the people who are working know what you're doing. You don't want anyone being surprised by this!
War dialing is slow, because it can take anywhere from 30 to 60 seconds or longer to dial and test one number. A war-dialing test can take all night or even a weekend to dial all the numbers in one exchange. To counter this, if you use ToneLoc for your war dialing, there's a neat utility called Prescan, part of the ToneLoc Utilities Phun-Pak (www.hackcanada.com/ice3/phreak) that will let you fill in ToneLoc data files with known exchanges before you ever get started. This can save a ton of time!
You may have several thousand phone numbers to test if you need to test an entire exchange, so this process can take some time. If you use several modems at once for your tests, you can speed the testing time dramatically.
However, before you can do this, several things have to be in place: ߜ You need multiple analog lines to dial out from. Today, these analog lines can be hard to get.
ߜ Given the complexities involved, you may have to do one of the following:
• Be present during the tests so you can manage all the war-dialing sessions you have to load.
• Automate the tests with batch files.
• Use a commercial war-dialing utility that supports simultaneous testing with multiple modems.
Gathering information
To get started, you need phone numbers to test for modems. You can program these numbers into your war-dialing software and automate the process.
You need to find two kinds of phone numbers for testing: ߜ Dialing ranges assigned to your organization, such as the following:
• 555-0000 through 555-9999 (10,000 possible numbers)
• 555-0100 through 555-0499 (400 possible numbers)
• 555-1550 through 555-1599 (50 possible numbers)
ߜ Nonstandard analog numbers that have a different exchange from your main digital lines. These numbers may not be publicly advertised.
To find or verify your organization's phone numbers, check these resources: ߜ Local telephone white and yellow pages. Either refer to hard copies or check out Internet sites such as www.switchboard.com.
ߜ Internet searches for your company name and main phone number.
(Check your organization's Web site, too.)
13 55784x Ch08.qxd 3/29/04 4:15 PM Page 109
Google may find published numbers in surprising places, such as cham-ber of commerce and industry association listings.
ߜ Internet domain name Whois entries at a lookup site such as www.
samspade.org. The Whois database often contains direct phone numbers and other contact information that can give a hacker a leg up on the phone-number scheme within your organization.
ߜ Phone-service documentation, such as monthly phone bills and phone-system installation paperwork
Selecting war-dialing tools
War dialing requires outbound phone access, software tools, and a compatible modem.
Software
Most war-dialing tools are freeware or shareware, but a few commercial war-dialing tools are also available, such as PhoneSweep by Sandstorm Enterprises (www.sandstorm.net/products/phonesweep).
These two freeware tools are very effective:
ߜ ToneLoc (www.securityfocus.com/data/tools/auditing/pstn/
tl110.zip), written by Minor Threat and Mucho Maas
ߜ THC-Scan, written by The Hacker's Choice (www.thc.org/releases.php) There's a list of war-dialing programs at www.pestpatrol.com/pestinfo/
phreaking\_tool.asp. If the freeware tools don't have features you need, consider a commercial product, such as PhoneSweep.
Modems
A plain Hayes-compatible modem usually is fine for outbound war dialing.
I've had trouble running both ToneLoc and THC-Scan on various modems, so you may have to tinker with COM port settings, modem initialization strings, and even modem types until you find a combinations that works.
The best way to determine what type of modem to use is to consult your war-dialing software's documentation:
ߜ If in doubt, go with a name-brand model, such as U.S. Robotics, 3Com, or an older Hayes unit.
ߜ As a last resort, check the modem documentation for features that the modem supports.
You can use this information to ensure you have the best software and hardware combination to minimize any potential headaches.
13 55784x Ch08.qxd 3/29/04 4:15 PM Page 110
110 Part III: Network Hacking
Some modems can increase war-dialing efficiency by detecting ߜ Voices, which can speed up the war-dialing process ߜ Second dial tones, which allows more dialing from the system Dialing in from the outside War dialing is pretty basic --- you enter the phone numbers you want to dial into your war-dialing software, kick off the program, and let it do its magic.
When the war-dialing software finds a carrier (which is basically a valid modem connection), the software logs the number, hangs up, and tries another number you programmed it to test.
Keep the following in mind to maximize your war-dialing efforts: ߜ Configure your war-dialing software to dial the list of numbers randomly instead of sequentially, if possible.
Some phone switches, war-dialing detection programs (such as Sandstorm Enterprises' Sandtrap), and even the phone company itself may detect and stop war dialing --- especially when an entire exchange of phone numbers is dialed sequentially or quickly.
ߜ If you're dialing from a line that can block Caller ID, dial \*67 immediately before dialing the number so your phone number isn't displayed. This may not work if you're calling toll-free numbers.
ߜ If you're dialing long-distance numbers during your testing, make sure that you know about the potential charges. Costs can add up fast!
Using tools
ToneLoc and THC-Scan are similar in usage and functionality: ߜ Run a configuration utility to configure your modem and other dial settings.
ߜ Run the executable file to war-dial.
There are a few differences between the two, such as timeout settings and other enhanced menu functionality that was introduced in THC-Scan. You can get an outline of all the differences at web.textfiles.com/software/toneloc.txt.
Configuration
In this example, I use my all-time favorite tool --- ToneLoc --- for war dialing.
To begin the configuration process for ToneLoc, run the tlcfg.exe utility.
You can tweak modem, dialing, and logging settings.
Two settings on the ModemOptions menu are likely to need adjustments, as shown in Figure 8-1:
13 55784x Ch08.qxd 3/29/04 4:15 PM Page 111
ߜ Serial port
• Enter 1, 2, 3, or 4 for the specific COM port where your modem is installed.
• Leave the Port Address and Port IRQ settings at 0 for the default settings unless you've made configuration changes to your modem.
If you're not sure what port your modem is installed on, run msinfo32.
exe from the Windows Start/Run prompt, and browse to the Components/
Modem folder. The modem's COM port value is listed in the Attached To item, as shown in Figure 8-2.
ߜ Baud rate. Enter at least 19,200 if your modem supports it --- preferably 115,000 if you have a 56K modem.
You may not be able to war-dial some older --- and much slower ---
modems if the rates don't match.
Figure 8-1:
Configuring
the modem
in ToneLoc's
TLCFG
utility.
Figure 8-2:
Determining
your
modem's
port COM
port with the
Windows
System
Information
tool.
13 55784x Ch08.qxd 3/29/04 4:15 PM Page 112
112 Part III: Network Hacking
Testing
After you've configured ToneLoc, you're ready to start war dialing with one of the following options:
ߜ Number range. For a range of numbers from 770-555-1200 through 770-555-1209, enter the following command at a command prompt: toneloc 770-555-12XX /R:00-09
This command tells ToneLoc to dial all numbers beginning with 404-555-15
numbers and then use the range of 00 through 99 in place of XX.
ߜ Single number. To test one number (770-555-1234), enter it at a command prompt like this:
toneloc 770-555-123X /R:4-4
To see all the command-line options, enter toneloc by itself at a command prompt.
After you enter the appropriate command (if you've configured the program correctly and your modem is working), ToneLoc produces test results in two forms:
ߜ Activity and counter display. As shown in Figure 8-3, ToneLoc displays its activity and increments its counters, such as the number of carriers and busy signals.
ߜ tone.log file. The following information is stored in this log file:
• Records of all activities during testing. You can peruse this file for failed attempts (such as busy signals) to retest later.
• Lists the carriers that ToneLoc discovered and such as the information displayed as a login prompt. You can use this information to penetrate your systems further.
Figure 8-3:
ToneLoc in
the middle
of a war
dial.
13 55784x Ch08.qxd 3/29/04 4:15 PM Page 113
An abbreviated tone.log file is as follows:
01:18:20 ¯
01:18:20 ToneLoc v1.10 (Sep 29 1994)
01:18:20 ToneLoc started on 31-Jan-104
01:18:20 Using COM1 (16450 UART)
01:18:20 Data file: 770-555-.DAT
01:18:20 Config file: TL.CFG
01:18:20 Log file: TONE.LOG
01:18:20 Mask used: 770-555-12XX
01:18:20 Range used: 00-09
01:18:20 Scanning for: Carriers
01:18:20 Initializing Modem ... Done
01:18:24 770-555-1208 - Timeout (0)
01:19:02 770-555-1201 - Busy
01:19:40 770-555-1205 - No Carrier
. . .
01:22:52 770-555-1207 - \* CARRIER \*
01:23:30 770-555-1204 - Timeout (0)
01:24:08 Autosaving
01:24:48 770-555-1206 - Timeout (0)
01:25:20 All 10 numbers dialed
01:25:20 Sending exit string ... Done
01:25:21 Dials = 10, Dials/hour = 94
01:25:21 0:07 spent current scan
01:25:21 Exit with errorlevel 0
In the sixth line of the preceding example, ToneLoc is configured to read the TL.CFG file for its configuration options. With the seventh line, the findings are written to the TONE.LOG file.
The range of numbers dialed is 770-555-1200 through 770-555-1209. You can determine this by substituting the Range values (00-09) for the XX in the mask. ToneLoc dials numbers randomly, as you can see since it started with 770-555-1208, and so forth. The 1208, 1204, and 1206 numbers just timed out (meaning that no modem was detected). The 1201 number was apparently busy at the time, and the 1205 number didn't answer at all. ToneLoc found a carrier (modem) on the 1207 number. Ah ha! Time to dig deeper to see what's on the other end --- such as what you're prompted with and details about the remote system that are given.
Rooting through the systems
When you identify phone numbers with modems attached, take one of these actions to penetrate the system further and test for related vulnerabilities: ߜ Stop your testing, determine whether the modems are legitimate, and disable or remove any rogue modems.
13 55784x Ch08.qxd 3/29/04 4:15 PM Page 114
114 Part III: Network Hacking
ߜ Attempt to penetrate the systems further by
• Determining what application is listening on the other end by using a communications program, such as Carbon Copy, Procomm Plus, or the free HyperTerminal that's built into Windows.
• Attempting to crack passwords, if necessary.
Commercial tools such as PhoneSweep automate this process for you ---
making purchasing such a tool a lot more attractive.
A few questions can help you determine what's listening on the other end and decide whether to investigate this device and possibly remove it: ߜ How many rings does it take for the carrier to pick up?
ߜ Is the carrier available only during certain time periods?
ߜ What type of authentication prompt is presented (password only, user ID and password, or another combination)?
ߜ Does login screen or banner tell you about the software that's running?
Countermeasures
A few countermeasures can help protect your network against war dialing.
Phone numbers
You can protect your phone numbers --- especially those that are assigned to modems on critical computer systems --- by:
ߜ Limiting the phone numbers that are made public.
Work with human resources, marketing, and management to ensure that only necessary phone numbers are unveiled.
ߜ Obtaining analog-line phone numbers that aren't within the standard exchange of your main digital lines. This prevents hackers from finding modems within your main phone-number block.
Modem operation
You can help prevent unauthorized modem usage and operation by: ߜ Documenting, publishing, and educating all end users on modem usage.
If users need modem access, require them to present the business reason.
ߜ Requiring strong passwords on all communications software.
13 55784x Ch08.qxd 3/29/04 4:15 PM Page 115
ߜ Purchasing dial-only modems or disabling inbound access in your communications software.
ߜ Legacy applications may require occasional modem access. Make it policy --- and train your users --- to keep the modem powered off or unplugged from the phone line when it's not being used.
When installing modems into computers within the organization, require all dial-up networking through either a VPN or a modem pool connected to a RAS server that IT/security manages centrally. Review all telephone bills each month to ensure that you don't have unauthorized lines installed.
Installation
Secure modem placement maximizes security, prevents war-dialing attacks, and makes modem management and future ethical hacking tests much easier: ߜ External modems are usually easy to see, but they can be hidden under desks and forgotten.
ߜ Internal modems may require you to inspect every networked computer physically for a phone cable plugged into the back.
Digital phone-line converters can allow a user to connect an analog modem to a digital line --- which normally fries the modem.
13 55784x Ch08.qxd 3/29/04 4:15 PM Page 116
116 Part III: Network Hacking
14 55784x Ch09.qxd 3/29/04 4:14 PM Page 117
In This Chapter
ᮣ Selecting tools
ᮣ Scanning network hosts
ᮣ Assessing security with a network analyzer
ᮣ Preventing denial-of-service and infrastructure vulnerabilities Your computer systems and applications require one of the most fundamental communications systems in your organization --- your network.
Your network consists of such devices as routers, firewalls, and even generic hosts (including servers and workstations) that you must assess as part of the ethical hacking process.
Many people refer to ethical hacking in terms of performing security tests from a network-only perspective. This is only part of the overall issue. You can't discount the basics of old-fashioned network security tests. I outline them in this chapter, with some solid countermeasures to foil attacks against your network.
There are thousands of possible network vulnerabilities, equally as many tools, and even more testing techniques. You don't need to test your network for every possible vulnerability, using every tool available and technique imaginable. The tests in this chapter produce a good overall assessment of your network.
You can eliminate many well-known network vulnerabilities by simply patching your network hosts with the latest vendor software and firmware patches.
Odds are that your network will not be attacked to exploit most of these vulnerabilities. Even if it is, the results are not likely to be detrimental. You can eliminate many other vulnerabilities by following some security best practices on your network. The tests, tools, and techniques in this chapter offer the most bang for your ethical hacking buck.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 118
118 Part III: Network Hacking
A case study in hacking network infrastructures
with Laura Chappell
Laura Chappell --- one of the world's foremost
applications, but she wanted to investigate
authorities on network protocols and analysis ---
them further without the users' knowledge.
shared with me an interesting experience she
Ms. Chappell decided to use her own Kazaa and
had when assessing a customer's network.
Gnutella clients to look through the shared fold---
Here's her account of what happened.
ers of the systems. By becoming a peer member
The Situation
with the other hosts on the network, she could
perform searches through other shared folders,
Ms. Chappell had a customer call with a routine
which indicated some of the users had shared
"the network is slow" problem. Upon her arrival
their network directories! Through these shared
onsite, the customer mentioned sporadic out---
folders, she was able to obtain the corporate
ages and poor performance when connecting
personnel roster, including home phone num---
to the Internet as well. First, she examined
bers and addresses, accounting records, and
individual flows between various clients and
several confidential memos that provided time---
servers. Localized communications appeared
lines for projects under way at the company!
normal, but any communication that flowed
through the firewall to the Internet or other
Many users said they shared these folders to
branch offices was severely delayed. It was
regain access to the P2P network, because they
time to sniff the traffic going through the firewall
had previously been labeled free loaders
to see whether she could isolate the cause of
because their shares contained only a few files.
the delay.
They were under the delusion that because no
one knew the filenames contained in the net-
The Outcome
work directories, no one would search for
A quick review of the traffic crossing the fire---
matching values. Although this on-site visit
wall indicated that the outside links were satu---
started with a standard performance and com---
rated, so it was time to review and classify the
munication review, it ended with the detection
traffic. Using the Sniffer Network Analyzer, Ms.
of some huge security breaches in the com---
Chappell plugged in to examine the protocol dis---
pany. Anyone can use these P2P tools to get
tribution. She saw that almost 45 percent of the
onto the network and grab the files in the
traffic was listed as "others" and was unrecog---
shared folders --- with no authorization or
nizable. She captured some data and found sev---
authentication required!
eral references to pornographic images. Further
Laura Chappell is Senior Protocol Analyst at
examination of the packets led her to two spe---
the Protocol Analysis Institute, LLC (www.
cific port numbers that appeared consistently in
packet-level.com). A best-selling author
the trace files --- port 1214 (Kazaa) and 6346
and lecturer, Ms. Chappell has trained thou-
(Gnutella), two peer-to-peer (P2P) file sharing
sands of network administrators, security tech---
applications. She did a complete port scan
nicians, and law enforcement personnel on
of the network to see what was running and
packet-level security, troubleshooting, and opti---
found over 30 systems running either Kazaa or
mization techniques. I highly recommend that
Gnutella. Their file transfer processes were
you check out her Web site for some excellent
eating up the bandwidth and dragging down
technical content to help you become a better
all communications. It would have been simple
ethical hacker.
to shut down these systems and remove the
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 119
Network Infrastructure Vulnerabilities
Network infrastructure vulnerabilities are the foundation for all technical security issues in your information systems. These lower-level vulnerabilities affect everything running on your network. That's why you need to test for them and eliminate them whenever possible.
Your focus for ethical hacking tests on your network infrastructure should be to find weaknesses that others can see in your network so you can quantify your level of exposure.
Many issues are related to the security of your network infrastructure. Some issues are more technical and require you to use various tools to assess them properly. You can assess others with a good pair of eyes and some logical thinking. Some issues are easy to see from outside the network, and others are easier to detect from inside your network.
Network infrastructure security involves assessing such areas as ߜ Where such devices as a firewall or IDS (intrusion detection system) are placed on the network and how they are configured
ߜ What hackers see when they perform port scans and how they can exploit vulnerabilities in your network hosts
ߜ Network design, such as Internet connections, remote-access capabilities, layered defenses, and placement of hosts on the network ߜ Interaction of installed security devices
ߜ Protocols in use
ߜ Commonly attacked ports that are unprotected
ߜ Network host configuration
ߜ Network monitoring and maintenance
If any of these network security issues is exploited, bad things can happen: ߜ A DoS attack can take down your Internet connection --- or even your entire network.
ߜ A hacker using a network analyzer can steal confidential information in e-mails and files being transferred.
ߜ Backdoors into your network can be set up.
ߜ Specific hosts can be attacked by exploiting local vulnerabilities across the network.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 120
120 Part III: Network Hacking
Before moving forward with assessing your network infrastructure security, remember to do the following:
ߜ Test your systems from both the outside in and the inside out.
ߜ Obtain permission from partner networks that are connected to your network to check for vulnerabilities on their ends that can affect your network's security, such as open ports and lack of a firewall or a misconfigured router.
Choosing Tools
Your tests require the right tools. Great commercial, shareware, and freeware tools are available.
If you're looking for easy-to-use security tools with all-in-one packaging, you get what you pay for --- most of the time --- especially for the Windows platform.
Tons of security professionals swear by many free security tools, especially those that run on UNIX-based operating systems. Many of these tools offer a lot of value --- if you have the time, patience, and willingness to learn their ins and outs.
You can equip your toolbox with scanners and vulnerability-assessment tools.
You need more than one tool. No tool does everything you need.
Scanners
These scanners provide practically all the port-scanning and network-testing tools you'll need:
ߜ Sam Spade for Windows (samspade.org/ssw) for network queries from DNS lookups to traceroutes
ߜ SuperScan (www.foundstone.com) for ping sweeps and port scanning ߜ NetScanTools Pro (www.netscantools.com) for dozens of network security-assessment functions, including ping sweeps, port scanning, and SMTP relay testing ߜ Nmap (www.insecure.org/nmap) or NMapWin (sourceforge.net/
projects/nmapwin) as a happy-clicky-GUI front end for host-port probing and operating-system fingerprinting
ߜ Netcat (www.atstake.com/research/tools/network\_utilities) the most versatile security tool for such security checks as port scanning and firewall testing
ߜ WildPackets EtherPeek (www.wildpackets.com) for network analysis 14 55784x Ch09.qxd 3/29/04 4:15 PM Page 121
Vulnerability assessment
These vulnerability-assessment tools will allow you to test your network hosts for various known vulnerabilities as well as potential configuration issues that could lead to security exploits: ߜ GFI LANguard Network Security Scanner (www.gfi.com) for port scanning and other vulnerability testing
ߜ Nessus (www.nessus.org) as a free all-in-one tool for such tests as ping sweeps, port scanning, and vulnerability testing
ߜ Qualys QualysGuard (www.qualys.com) as a great all-in-one tool for in-depth vulnerability testing, if you can justify the cost Scanning, Poking, and Prodding
Performing these ethical hacks on your network infrastructure involves following basic hacking steps:
1. Gather information and map your network.
2. Scan your systems to see which are available.
3. Determine what's running on the systems discovered.
4. Attempt to penetrate the systems discovered, if you choose to.
Every network card driver and implementation of TCP/IP in most operating systems, including Windows and Linux, and even in your firewalls and routers, has quirks that result in different behaviors when scanning, poking, and prod-ding your systems. This can result in different responses from your varying systems. Refer to your administrator guides or vendor Web sites for details on any known issues and possible patches that are available to fix them. If you have all your systems patched, this shouldn't be an issue.
Port scanners
A port scanner shows you what's what on your network. It's a software tool that basically scans the network to see who's there.
Port scanners provide basic views of how the network is laid out. They can help identify unauthorized hosts or applications and network host configuration errors that can cause serious security vulnerabilities.
The big-picture view from port scanners often uncovers security issues that may otherwise go unnoticed. Port scanners are easy to use and can test 14 55784x Ch09.qxd 3/29/04 4:15 PM Page 122
122 Part III: Network Hacking
systems regardless of what operating systems and applications they're running. The tests can be performed very quickly without having to touch individual network hosts, which would be a real pain otherwise.
The real trick to assessing your overall network security is interpreting the results you get back. You can get false positives on open ports, and you may have to dig deeper. For example, UDP scans --- like the protocol itself --- are less reliable than TCP scans and often produce false positives, because many applications don't know how to respond to random incoming UDP scans.
A feature-rich scanner --- usually, a commercial product --- often can identify ports and see what's running in one step.
Port-scan tests take time. The length of time depends on the number of hosts you have, the number of ports you scan, the tools you use, and the speed of your network links.
Scan more than just the important hosts. These other systems often bite you if you ignore them. Also, perform the same tests with different utilities to see whether you get different results. Not all tools find the same open ports and vulnerabilities. This is unfortunate, but it's a reality of ethical hacking tests.
If your results don't match after you run the tests using different tools, you may want to explore the issue further. If something doesn't look right --- such as a strange set of open ports --- it probably isn't. Test it again; if you're in doubt, use another tool for a different perspective.
As an ethical hacker, you should scan all 65,535 UDP and 65,535 TCP ports on each network host that's found by your scanner. If you find questionable ports, look for documentation that the application is known and authorized.
For speed and simplicity, you can scan commonly hacked ports (listed in Table 9-1).
Table 9-1
Commonly Hacked Ports
Port Numbers
Service
Protocols
7
Echo
TCP, UDP
19 Chargen
TCP,
UDP
20
FTP data (File Transfer Protocol)
TCP
21 FTP
control
TCP
22
SSH
TCP
23
Telnet
TCP
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 123
Port Numbers
Service
Protocols
25
SMTP (Simple Mail Transfer Protocol)
TCP
37
Daytime
TCP, UDP
53
DNS (Domain Name System)
UDP
69
TFTP (Trivial File Transfer Protocol)
UDP
79
Finger
TCP, UDP
80
HTTP (Hypertext Transfer Protocol)
TCP
110
POP3 (Post Office Protocol version 3)
TCP
111
SUN RPC (remote procedure calls)
TCP, UDP
135
RPC/DCE end point mapper for Microsoft networks
TCP, UDP
137, 138, 139
NetBIOS over TCP/IP
TCP, UDP
161
SNMP (Simple Network Management Protocol)
TCP, UDP
220
IMAP (Internet Message Access Protocol)
TCP
443
HTTPS (HTTP over SSL)
TCP
512, 513, 514
Berkeley r commands (such as rsh, rexec, and rlogin) TCP
1214
Kazaa and Morpheus
TCP, UDP
1433
Microsoft SQL Server
TCP, UDP
1434
Microsoft SQL Monitor
TCP, UDP
3389
Windows Terminal Server
TCP
5631, 5632
pcAnywhere
TCP
6346, 6347
Gnutella
TCP, UDP
12345, 12346,
NetBus
TCP
12631, 12632,
20034, 20035
27444
Trinoo
UDP
27665
Trinoo
TCP
31335
Trinoo
UDP
31337
Back Orifice
UDP
34555
Trinoo
UDP
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 124
124 Part III: Network Hacking
Ping sweep
A ping sweep of all your network subnets and hosts is a good way to find out which hosts are alive and kicking on the network. A ping sweep is when you ping a range of addresses using Internet Control Message Protocol (ICMP) packets. Figure 9-1 shows the command and the results of using Nmap to perform a ping sweep of a class C subnet range.
Dozens of Nmap command-line options exist, which can be overwhelming when you just want to do a basic scan. You can just enter nmap on the command line to see all the options available.
These command-line options can be used for an Nmap ping sweep: ߜ -sP tells Nmap to perform a ping scan.
ߜ -n tells Nmap to not perform name resolution.
You may want to omit this if you want to resolve hostnames to see which systems are responding. Name resolution may take slightly longer, though.
• -T 4 option tells Nmap to perform an aggressive (faster) scan.
• 192.168.1.1-254 tells Nmap to scan the entire 192.168.1.x subnet.
Figure 9-1:
Performing
a ping
sweep of
an entire
class C
network
with Nmap.
Port scanning
Most port scanners operate in three steps:
1. The port scanner sends TCP SYN requests to the host or range of hosts you set it to scan.
Some port scanners, such as SuperScan, perform ping sweeps to determine which hosts are available before starting the TCP port scans.
Most port scanners scan only TCP ports by default. Don't forget about UDP ports. You can scan UDP ports with a UDP port scanner such as Nmap LANguard Network Security Scanner.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 125
2. The port scanner waits for replies from the available hosts.
3. The port scanner probes these available hosts for up to 65,535 possible TCP and UDP ports --- based on which ports you tell it to scan --- to see which ones have available services on them.
The port scans provide the following information about the live hosts on your network:
ߜ Hosts that are active and reachable through the network ߜ Network addresses of the hosts found
ߜ Services or applications that the hosts may be running After performing a generic sweep of the network, you can dig deeper into specific hosts you've found.
SuperScan
My favorite tool to perform generic TCP port scans is SuperScan. Figure 9-2
shows the results of my scan and a few interesting ports open on several hosts, including Windows Terminal Server and SSH.
Figure 9-2:
A TCP port
scan using
SuperScan.
In Figure 9-2, I selected the Only Scan Responsive Pings and All Selected Ports in List options. However, you may want to select some other options: 14 55784x Ch09.qxd 3/29/04 4:15 PM Page 126
126 Part III: Network Hacking
ߜ If you don't want to ping each host first --- which helps make the test run more efficiently --- deselect the Only Scan Responsive Pings option. (ICMP
can be blocked, which can cause the scanner to not find certain hosts.) ߜ If you want to scan a certain range of well-known ports or ports specific to your systems, you can configure SuperScan to do so. I recommend these settings: • If you want to perform a scan on well-known ports, at least select the All Selected Ports in List option.
• If this is your initial scan, scan all ports from 1 to 65,535.
Nmap
After you have a general idea of what hosts are available and what ports are open, you can perform fancier scans to verify that the ports are actually open and not being reported as a false positive. If you wish to do this, Nmap is the perfect tool to use. Nmap allows you to run the following additional scans: ߜ Connect: This basic TCP scan looks for any open TCP ports on the host.
You can use this scan to see what's running and determine whether IDSs, firewalls, or other logging devices log the connections.
ߜ UDP Scan: This basic UDP scan looks for any open UDP ports on the host. You can use this scan to see what's running and determine whether IDSs, firewalls, or other logging devices log the connections.
ߜ SYN Stealth: This scan creates a half-open TCP connection with the host possibly evading IDS systems and logging. This is a good scan for testing IDSs, firewalls, and other logging devices.
ߜ FIN Stealth, Xmas Tree, and Null: These scans let you mix things up a bit --- no pun intended --- by sending strangely formed packets to your network hosts so you can see how they respond. These scans basically change around the flags in the TCP headers of each packet, which allows you to test how each host handles them to point out weak TCP/IP implementations and patches that may need to be applied.
Be careful when performing these scans. You can create your own DoS attack and potentially crash applications or entire systems. Unfortunately, if you have a host with a weak TCP/IP stack (the software that controls TCP/IP communications on your hosts), there is no good way to prevent this. The best way to reduce the chance of this occurring is to use the slow Nmap timing options --- Paranoid, Sneaky, or Polite --- when running your scans.
Figure 9-3 shows the NMapWin Scan tab, where you can select all these options. If you're a command-line fan, you see the command-line parameters displayed in the lower-left corner of the NMapWin screen. This helps when you know what you want to do and the command-line help isn't enough.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 127
Figure 9-3:
In-depth
port-scanning
options in
NMapWin.
If you connect to a single port carefully enough (as opposed to several all at once) without making too much noise, you may be able evade your IDS/IDP
system. This is a good test of your IDS and firewall systems, so assess your logs to see what they saw during this process.
Countermeasures
You can implement various countermeasures to typical port scanning.
Traffic restriction
Enable only the traffic you need to access internal hosts --- preferably as far as possible from the hosts you're trying to protect. You apply these rules in two places:
ߜ External router for inbound traffic
ߜ Firewall for outbound traffic
Configure firewalls to look for potentially malicious behavior over time (such as the number of packets received in a certain period of time), and have rules in place to cut off attacks if a certain threshold is reached, such as 100 port scans in one minute.
Most firewalls, IDSs, and IDPs detect port scanning and cut it off in real time. Figure 9-4 shows an example: A basic Nmap OS fingerprint scan was detected and cut off (hence the black slash) by ISS's BlackICE personal firewall and IDP product in real time.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 128
128 Part III: Network Hacking
Figure 9-4:
BlackICE
logs
showing
how an
Nmap scan
was cut off.
Gathering network information
NetScanTools Pro is a great tool for general network information, such as the number of unique IP addresses, NetBIOS names, and MAC addresses found.
The following report is an example of the NetScanner (network scanner) output of NetScanTools Pro 2000:
Statistics for NetScanner
Scan completion time = Sat, 7 Feb 2004 14:11:08
Start IP address: 192.168.1.1
End IP address: 192.168.1.254
Number of target IP addresses: 254
Number of IP addresses responding to pings: 13
Number of IP addresses sent pings: 254
Number of intermediate routers responding to pings: 0
Number of successful NetBIOS queries: 13
Number of IP addresses sent NetBIOS queries: 254
Number of MAC addresses obtained by NetBIOS queries: 13
Number of successful Subnet Mask queries: 0
Number of IP addresses sent Subnet Mask queries: 254
Number of successful Whois queries: 254
Traffic denial
Deny ICMP traffic to specific hosts you're trying to protect. Most hosts don't need to have ICMP enabled --- especially inbound ICMP requests --- unless it's needed for a network management system that monitors hosts using this protocol.
You can break applications on your network, so make sure that you analyze what's going on, and understand how applications and protocols are working, before you disable such network traffic as ICMP.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 129
SNMP scanning
Simple Network Management Protocol (SNMP) is a protocol built into virtually every network device. Network management programs (such as HP
OpenView and LANDesk) use SNMP for remote network host management.
Unfortunately, SNMP also presents security vulnerabilities.
Vulnerabilities
The problem is that most network hosts run SNMP that isn't hardened or patched to prevent known security vulnerabilities. The majority of network devices have SNMP enabled and don't even need it!
If SNMP is compromised, a hacker can gather such network information as ARP tables and TCP connections to attack your systems. If SNMP shows up in port scans, you can bet that a hacker will try to compromise the system.
Figure 9-5 shows how GFI LANguard determined the NetWare version running (Version 6, Service Pack 3) by simply querying a host running unprotected SNMP. Here are some other utilities for SNMP enumeration: ߜ The commercial tool SolarWinds (www.solarwinds.net) ߜ Free Windows GUI-based Getif (www.wtcs.org/snmp4tpc/getif.htm) ߜ Text-based SNMPUTIL for Windows (www.wtcs.org/snmp4tpc/FILES/
Tools/SNMPUTIL/SNMPUTIL.zip)
Figure 9-5:
Information
gathered by
querying a
vulnerable
SNMP host.
Countermeasures
Preventing SNMP attacks can be as simple as A-B-C:
ߜ Always disable SNMP on hosts if you're not using it --- period.
ߜ Block the SNMP port (UDP port 161) at the network perimeter.
ߜ Change the default SNMP community string from public to another value that's more difficult to guess. This makes SNMP harder to hack.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 130
130 Part III: Network Hacking
Banner grabbing
Banners are the welcome screens that divulge software version numbers and other host information to a network host. This banner information may identify the operating system, the version number, and the specific service packs, so hackers know possible vulnerabilities. You can grab banners by using either plain old telnet or Netcat.
telnet
You can telnet to hosts on the default telnet port (TCP port 23) to see whether you're presented with a login prompt or any other information. Just enter the following line at the command prompt in Windows or UNIX: telnet ip\_address You can telnet to other commonly used ports with these commands: ߜ SMTP:
telnet ip\_address 25
ߜ HTTP:
telnet ip\_address 80
ߜ POP3:
telnet ip\_address 110
Figure 9-6 shows specific version information about an Exchange 2003 server when telnetting to it on port 25.
Figure 9-6:
Information
gathered
about
Exchange
2003 via
telnet.
Netcat
Netcat can grab banner information from routers and other network hosts, such as a wireless access point or managed Ethernet switch.
The following steps bring back information about a host that runs a Web server for remote management purposes:
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 131
1. Enter the following line to initiate a connection on port 80: nc --v ip\_address 80
2. Wait for the initial connection.
Netcat returns the message hostname [ ip\_address] 80 (http) open.
3. Enter the following line to grab the home page of the Web server: GET HTTP1.0
4. Press Enter a couple of times to load the page.
Figure 9-7 shows some typical results with Netcat.
Figure 9-7:
A Web-server
banner
grab using
Netcat.
Countermeasures
The following steps can reduce the chance of banner-grabbing attacks: ߜ If there is no business need for services that offer banner information, disable those unused services on the network host.
ߜ If there is no business need for the default banners, or if you can customize the banners displayed, configure the network host's application or operating system to either disable the banners or remove information from the banners that could give an attacker a leg up.
If you can customize your banners, check with your lawyer about adding a warning message similar to this:
Warning!!! This is a private system. All use is monitored and recorded. Any unauthorized use of this system may result in civil and/or criminal prosecu-tion to the fullest extent of the law.
Firewall rules
As part of your ethical hacking, you can test your firewall rules to make sure they're working like they're supposed to.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 132
132 Part III: Network Hacking
Testing
A few tests can verify that your firewall actually does what it says it's doing.
You can connect through it on the ports you believe are open, but what about all the other ports that can be open and shouldn't be?
Some security-assessment tools can not only test for open ports, but also determine whether traffic is actually allowed to pass through the firewall.
All-in-one tools
All-in-one tools aren't perfect, but their broad testing capabilities make the network scanning process a lot less painful and can save you tons of time!
Their reporting is really nice, too, especially if you will show your test results to upper management.
Nessus, QualysGuard, and GFI LANguard Network Security Scanner provide similar results. Figure 9-8 is partial output from LANguard. It identifies open ports on the test network and presents information on SNMP, operating-system information, and special alerts to look for.
Figure 9-8:
Information
gathered
from a
network
scan using
LANguard
Network
Security
Scanner.
You can use LANguard Network Security Scanner and QualysGuard to find operating-system vulnerabilities and patches that need to be applied. Pretty slick! I show you more on this in Chapter 11, which covers Windows.
Netcat
Netcat can test certain firewall rules without having to test a production system directly. For example, you can check whether the firewall allows port 23 (telnet) through. Follow these steps to see whether a connection can be made through port 23: 1. Load Netcat on a client machine inside the network.
This allows you to test from the inside out.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 133
2. Load Netcat on a testing computer outside the firewall.
This allows you to test from the outside in.
3. Enter the Netcat listener command on the client (internal) machine with the port number you're testing.
For example, if you're testing port 23, enter this command: nc --l --p 23 cmd.exe
4. Enter the Netcat command to initiate an inbound session on the testing (external) machine. You must include the following information:
• The IP address of the internal machine you're testing
• The port number you're testing
For example, if the IP address of the internal (client) machine is 10.11.12.2 and the port is 23, enter this command:
nc --v 10.11.12.2 23
If Netcat presents you with a new command prompt (that's what the cmd.exe is for in Step 3) on the external machine, it means that you connected and are now executing commands on the internal machine! This can serve several purposes, including testing firewall rules and --- well, uhhhmmm --- executing commands on a remote system!
Alternative testing tools
These utilities test firewall rules more robustly than Netcat: ߜ Firewalk: A UNIX-based tool (www.packetfactory.net/firewalk) ߜ Firewall Informer: A commercial tool by BLADE Software (www.
blade-software.com)
Countermeasures
The following countermeasures can prevent a hacker from testing your firewall: ߜ Limit traffic to what's needed.
Set rules on your firewall (and router, if needed) to pass only traffic that you absolutely must pass. For example, have rules in place that allow HTTP inbound to an internal Web server and outbound for external Web access.
This is the best defense against someone poking at your firewall.
ߜ Block ICMP to help prevent abuse from some automated tools, such as Firewalk.
ߜ Enable stateful packet inspection on the firewall, if you can. It can block unsolicited requests.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 134
134 Part III: Network Hacking
Looking through a network analyzer
A network analyzer is a tool that allows you to look into a network and analyze data going across the wire for network optimization, security, and/or troubleshooting purposes. Like a microscope for a lab scientist, a network analyzer is a must-have tool for any security professional.
Network analyzers are often generically referred to as sniffers, though that's actually the name and trademark of a specific product from Network Associates, Sniffer (the original network-analysis tool).
A network analyzer is handy for sniffing packets. Watch for the following network traffic behavior:
ߜ What do packet replies look like? Are they coming from the host you're testing or from an intermediary device?
ߜ Do packets appear to traverse a network host or security device, such as a router, a firewall, IDS, or a proxy server?
When assessing security and responding to security incidents, a network analyzer can help you
ߜ View anomalous network traffic and even track down an intruder.
ߜ Develop a baseline of network activity and performance before a security incident occurs, such as protocols in use, usage trends, and MAC
addresses.
When your network behaves erratically, a network analyzer can help you
• Track and isolate malicious network usage
• Detect malicious Trojan-horse applications
• Monitor and track down DoS attacks
You can use one of the following programs for network analysis: ߜ EtherPeek by WildPackets (www.wildpackets.com) is my favorite network analyzer. It delivers a ton of features that the higher-end network analyzers of yesterday have for a fraction of their cost.
EtherPeek is available for the Windows operating systems.
ߜ I download the open-source Ethereal network analyzer from www.
ethereal.org if I need a quick fix and don't have my laptop nearby.
It's not as user-friendly as EtherPeek, but it is very powerful if you're willing to learn its ins and outs. Ethereal is available for both Windows and UNIX-based operating systems.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 135
ߜ Two other powerful and free utilities can perform such functions as network analysis:
• ettercap (ettercap.sourceforge.net) for Windows and UNIX-based operating systems. I cover ettercap in more detail in "ARP
spoofing," later in the chapter.
• dsniff (www.monkey.org/~dugsong/dsniff) for UNIX-based operating systems.
A network analyzer is just software running on a computer with a network card. It works by placing the network card in promiscuous mode, which enables the card to see all the traffic on the network, even traffic not destined to the network-analyzer host. The network analyzer performs the following functions: ߜ Captures all network traffic ߜ Interprets or decodes what is found into a human-readable format ߜ Displays it all in chronological order
Here are a few caveats for using a network analyzer:
ߜ To capture all traffic, you must connect the analyzer to either
• A hub on the network
• A monitor/span/mirror port on a switch
ߜ You should connect the network analyzer to a hub on the outside of the firewall, as shown in Figure 9-9, as part of your testing so you can see traffic similar to what a network-based IDS sees: • What's entering your network before the firewall filters eliminates the junk traffic
• What's leaving your network after the traffic goes past the firewall Internet
Router
Figure 9-9:
Connecting
LAN
a network
analyzer
Ethernet Hub
outside the
firewall.
Network analyzer
Firewall
computer
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 136
136 Part III: Network Hacking
Whether you connect your network analyzer inside or outside your firewall, you see immediate results. It can be an overwhelming amount of information, but you can look for these issues first: ߜ Odd traffic, such as
• Unusual amount of ICMP packets
• Excessive amounts of multicast or broadcast traffic
• Packet types that don't belong, such as NetBIOS in a NetWare environment
ߜ Internet usage habits, which can help point out malicious behavior of a rogue insider or system that has been compromised, such as
• Web surfing
• IM
ߜ Questionable usage, such as
• Many lost or oversized packets
• High bandwidth consumption that may point to a Web or FTP
server that doesn't belong
ߜ Reconnaissance probes and system profiling from port scanners and vulnerability-assessment tools, such as a significant amount of inbound traffic from unknown hosts --- especially over ports that are not used very much, such as FTP or telnet.
ߜ Hacking in progress, such as tons of inbound UDP or ICMP echo requests, SYN floods, or excessive broadcasts.
ߜ Nonstandard host names on your network. For example, if your systems are named Computer1, Computer2, and so on, a computer named GEEKz4evUR should raise a red flag.
ߜ Hidden servers (especially Web, SMTP, FTP, and DHCP) that may be eating network bandwidth or serving illegal software or even access into your network hosts.
ߜ Attacks on specific applications that show such commands as binrm,
binls, echo, and cmd.exe.
You may need to let your network analyzer run for quite a while --- several hours to several days, depending on what you're looking for.
Before getting started, configure your network analyzer to capture and store the most relevant data:
ߜ If your network analyzer permits it, configure your network analyzer software to use a first-in, first-out buffer.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 137
This overwrites the oldest data when the buffer fills up, but it may be your only option if memory and hard drive space are limited on your network-analysis computer.
ߜ If your network analyzer permits it, record all the traffic into a capture file, and save it to the hard drive. This is the ideal scenario --- especially if you have a large hard drive, such as 50GB or more.
You can easily fill a several-gigabyte hard drive in a short period of time.
ߜ When network traffic doesn't look right in a network analyzer, it probably isn't. It's better to be safe than sorry.
Run a baseline when your network is working normally. You can see any obvious abnormalities when an attack occurs.
Clearas-day decoding makes a network analyzer worth every penny you may pay.
Figure 9-10 shows what a Smurf DoS attack can do to a network in just 30
seconds. (I created this attack with BLADE Software's IDS Informer, but you can use other tools.) On a small network with very little traffic, the utilization number is 823 kilobits/second --- not too large a number for a 100-megabit/
second Ethernet network. However, on a busy network with a lot more traffic, the number would be staggering.
Figure 9-10:
What a
Smurf DoS
attack looks
like through
a network
analyzer.
Figure 9-11 shows the Smurf DoS attack on EtherPeek's conversation monitor.
Three million bytes were transmitted in this short period of time --- from one host.
Figure 9-12 shows what a WANRemote backdoor remote administration tool (RAT) looks like across the network using EtherPeek. It shows the commands sent to get files from the local C: drive, kill UNIX processes, and unload X-Window.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 138
138 Part III: Network Hacking
Figure 9-11:
A Smurf
DoS
conversation via
EtherPeek.
Figure 9-12:
WANRemote
RAT-attack
traffic.
If one workstation consumes considerably more bandwidth than the others ---
such as the 10.11.12.203 host in Figure 9-13 --- dig deeper to see what's going on. (Such network hosts as servers often send and receive more traffic than other hosts.)
Figure 9-14 shows an indication that a port scan is being run on the network.
It shows all the different protocols and the small number of packets this analysis found, including Gnutella, telnet, and rlogin.
Figure 9-13:
Higher---
than-normal
network
usage (as
shown
by the
10.11.12.203
host).
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 139
Figure 9-14:
Many
nonstandard
protocols
can indicate
that a port
scan is
taking
place.
Check your network for a high number of ARP requests and ICMP echo requests proportionate to your overall traffic, as shown in Figure 9-15.
Countermeasures
A network analyzer can be used for good or evil. All these tests can be used against you, too. A few countermeasures can help prevent someone from using an unauthorized network analyzer, but there's no way to completely prevent it.
If hackers can connect to your network (physical or wireless), they can capture packets on the network, even if you're using a switch.
Figure 9-15:
Abnormally
high ICMP
and ARP
requests
show
potential
malicious
behavior.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 140
140 Part III: Network Hacking
Physical security
Ensure that adequate physical security is in place to prevent a hacker from plugging into your network:
ߜ Keep the bad guys out of your server room and wiring closet.
A special monitor port on a switch where a hacker can plug in a network analyzer is especially sensitive. Make sure it's extra secure.
ߜ Make sure that such unsupervised areas as unoccupied desks don't have live network connections.
Network-analyzer detection
You can use a network-or host-based utility to determine if someone is running an unauthorized network analyzer on your network: ߜ sniffdet (sniffdet.sourceforge.net) for UNIX-based systems ߜ PromiscDetect (ntsecurity.nu/toolbox/promiscdetect) for Windows These tools enable you to monitor the network for Ethernet cards that are running in promiscuous mode. You simply load the programs on your computer, and the programs alert you if they see promiscuous behaviors on the network (sniffdet) or local system (PromiscDetect).
The MAC-daddy attack
Attackers can use ARP (Address Resolution Protocol) running on your network to make their systems appear to be either your system or another authorized host on your network.
ARP spoofing
An excessive amount of ARP requests can be a sign of an ARP poisoning attack (or ARP spoofing) on your network.
What happens is that a client running a program such as the UNIX-based dsniff or the UNIX-and DOS/Windows-based ettercap can change the ARP
tables --- the tables that store IP addresses to media access control (MAC) mappings --- on network hosts. This causes the victim computers to think they need to send traffic to the attacker's computer, rather than the true destination computer, when communicating on the network. This is often referred to as a Man-in-the-Middle (MITM) attack.
This security vulnerability is inherent in how TCP/IP communications are handled.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 141
Here's a typical ARP spoofing attack with a hacker's computer (Hacky) and two legitimate network users' computers (Joe and Bob): 1. Hacky poisons the ARP caches of victims Joe and Bob by using dsniff, ettercap, or a utility he wrote.
2. Joe associates Hacky's MAC address with Bob's IP address.
3. Bob associates Hacky's MAC address with Joe's IP address.
4. Joe's traffic and Bob's traffic are sent to Hacky's IP address first.
5. Hacky's network analyzer captures Joe's traffic and Bob's traffic.
If Hacky is configured to act like a router and forward packets, it forwards the traffic to its original destination. The original sender and receiver never know the difference!
Figure 9-16 shows the juicy e-mail stuff I found with ettercap. I loaded ettercap on my Windows computer, selected 10.11.12.204 as the source and 10.11.12.2
as the destination, and used ARP poisoning. Voilà!
Figure 9-16:
A sample
of what
hackers
can find
with ARP
poisoning.
Spoofed ARP replies can be sent to a switch very quickly, which often crashes the switch. The switch reverts to broadcast mode, which makes it work like a hub. When this occurs, an attacker can sniff every packet going through the switch without bothering with ARP spoofing.
MAC-address spoofing
MAC-address spoofing tricks the switch into thinking you (actually, your computer) are someone else. You simply change your MAC address and masquerade as another user.
You can use this trick to test such access control systems as your IDS, firewall, and even operating-system login controls that check for specific MAC
addresses.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 142
142 Part III: Network Hacking
UNIX-based systems
In UNIX and Linux, you can spoof MAC addresses with the ifconfig utility.
Follow these steps:
1. While logged in as root, use ifconfig to enter a command that disables the network interface. Insert the network interface number that you want to disable (usually, eth0) into the command, like this:
[root@localhost root]# ifconfig eth0 down
2. Enter a command for the MAC address you want to use.
Insert the fake MAC address and the network interface number (eth0) into the command again, like this:
[root@localhost root]# ifconfig eth0 hw ether new\_mac\_address You can use a more feature-rich utility called MAC Changer (www.alobbs.
com/macchanger) for Linux systems.
Windows
You can use regedit to edit the Windows Registry, but I like using a neat Windows utility called SMAC (www.klcconsulting.net/smac), which makes MAC spoofing a simple process. Follow these steps to use SMAC: 1. Load the program.
2. Select the adapter for which you want to change the MAC address.
3. Enter the new MAC address in the New Spoofed MAC Address fields, and click Update MAC.
4. Stop and restart the network card with these steps: i. Right-click the network card in Network and Dialup Connections.
ii. Select Disable, and then right-click again and click Enable for the change to take effect.
You may have to reboot for this to work properly.
5. Click Refresh in the SMAC interface.
You should see something similar to the SMAC screen capture in Figure 9-17.
To reverse Registry changes with SMAC, follow these steps: 1. Select the adapter for which you want to change the MAC address.
2. Click Remove MAC.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 143
3. Stop and restart the network card with these steps: i. Right-click the network card in Network and Dialup Connections.
ii. Select Disable, and then right-click again and click Enable for the change to take effect.
You may have to reboot for this to work properly.
4. Click Refresh in the SMAC interface.
You should see your original MAC address again.
Figure 9-17:
SMAC
showing a
spoofed
MAC
address.
Countermeasures
A few countermeasures on your network can minimize the effects of a hacker attack against ARP and MAC addresses on your network.
Prevention
You can prevent MAC-address spoofing if your switches can enable port security to prevent automatic changes to the switch MAC address tables.
No realistic countermeasures for ARP poisoning exist. The only way to prevent ARP poisoning is to create and maintain static ARP entries in your switches for every host on the network. This is definitely something that no network administrator has time to do!
Detection
You can detect these two types of hacks through either an IDS or a stand-alone MAC address monitoring utility.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 144
144 Part III: Network Hacking
Arpwatch is a UNIX-based program alerts you via e-mail if it detects changes in MAC addresses associated with specific IP addresses on the network.
Denial of service
Denial-of-service (DoS) attacks are among the most common hacker attacks. A hacker initiates so many invalid requests to a network host that it uses all its resources responding to them and ignores legitimate requests.
DoS attacks
The following types of DoS attacks are possible against your network and hosts, and can cause systems to crash, data to be lost, and every user to jump on your case, wondering when Internet access will be restored.
Individual attacks
Here are some common DoS attacks:
ߜ SYN floods: The attacker literally floods a host with TCP SYN packets.
ߜ Ping of Death: The attacker sends IP packets that exceed the maximum length of 65,535 bytes, which can ultimately crash the TCP/IP stack on many operating systems.
ߜ WinNuke: This attack can disable networking on older Windows 95 and NT computers.
Distributed attacks
Distributed DoS (DDoS) attacks have an exponentially greater impact on their victims. The most famous was the DDoS attack against eBay, Yahoo!, CNN, and dozens of other Web sites by the hacker known as MafiaBoy. These are some common distributed attacks: ߜ Smurf attack: An attacker spoofs the victim's address and sends ICMP
echo request (ping packets) to the broadcast address. The victim computer gets deluged with tons of packets in response to those echo requests.
ߜ Trinoo and Tribe Flood Network (TFN) attacks: Sets of client-and server-based programs launch packet floods against a victim machine, effectively overloading it and causing it to crash.
DoS attacks can be carried out with tools that the hacker either writes or downloads off the Internet. These are good tools to test your network's IDS/IDP and firewalls. You can find programs that allow actual attacks and programs, such as BLADE Software's IDS Informer, that let you send controlled attacks.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 145
Testing
Your first DoS test should be a search for DoS vulnerabilities from a port-scanning and network-analysis perspective.
Don't test for DoS unless you have test systems or can perform controlled tests with the proper tools. Poorly planned DoS testing is a job search in the making. It's like trying to delete data from a network share remotely and hoping that the access controls in place are going to prevent it.
Countermeasures
Most DoS attacks are difficult to predict, but they can be easy to prevent: ߜ Test and apply security patches as soon as possible for such network hosts as routers and firewalls, as well as for server and workstation operating systems.
ߜ Use IDS and IDP systems to monitor regularly for DoS attacks.
You can run a network analyzer in continuous capture mode if you can't justify the cost of an all-out IDS or IDP solution.
ߜ Configure firewalls and routers to block malformed traffic. You can do this only if your systems support it, so refer to your administrator's guide for details.
ߜ Minimize IP spoofing by either
• Using authentication and encryption, such as a Public Key Infrastructure (PKI)
• Filtering out external packets that appear to come from an internal address, the local host (127.0.0.1), or any other private and non-routable address such as 10.x.x.x, 172.16.x.x--172.31.x.x, or 192.168.x.x ߜ Block all ICMP traffic inbound to your network unless you specifically need it. Even then, you should allow it only in to specific hosts.
ߜ Disable all unneeded TCP/UDP small services (such as echo and chargen).
Establish a baseline of your network protocols and traffic patterns before a DoS attack occurs. That way, you know what to look for. And periodically scan for such potential DoS vulnerabilities as rogue DoS software installed on network hosts.
Work with a minimum necessary mentality when configuring your network devices such as firewalls and routers:
ߜ Identify traffic that is necessary for approved network usage.
ߜ Allow the traffic that's needed.
ߜ Deny all other traffic.
14 55784x Ch09.qxd 3/29/04 4:15 PM Page 146
146 Part III: Network Hacking
General network defenses
Regardless of the specific attacks against your system, a few good practices can help prevent many network problems:
ߜ Stateful inspection on firewalls. This can help ensure that all traffic traversing it is legitimate and can prevent DoS attacks and other spoofing attacks.
ߜ Rules to perform packet filtering based on traffic type, TCP/UDP ports, IP addresses, and even specific interfaces on your routers before the traffic is ever allowed to enter your network.
ߜ Proxy filtering and Network Address Translation (NAT).
ߜ Finding and eliminating fragmented packets entering your network (from Fraggle or other type of attack) via an IDS or IDP system.
ߜ Segmenting and firewalling these network segments:
• The internal network in general
• Critical departments, such as accounting, finance, HR, and research
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 147
In This Chapter
ᮣ Understanding risks of wireless LANs
ᮣ Selecting wireless LAN hacking tools
ᮣ Hacking against wireless LANs
ᮣ Minimizing wireless network security risks
Wireless local area networks (WLANs) --- specifically, the ones based on the IEEE 802.11 standard --- are increasingly being deployed into both business and home networks. Next to instant messaging and personal video recorders, WLANs are the neatest technology I've used in quite a while. Of course, with any new technology come security issues, and WLANs are no exception. In fact, the 802.11b wireless technology has been the poster child for weak security and network hack attacks for several years running.
WLANs offer a ton of business value, from convenience to reduced network deployment time. Whether your organization allows wireless network access or not, testing for WLAN security vulnerabilities is critical. In this chapter, I cover some common wireless network security vulnerabilities that you should test for. And I discuss some cheap and easy countermeasures you can implement to help ensure that WLANs are not more of a risk to your organization than they're worth.
Understanding the Implications of
Wireless Network Vulnerabilities
WLANs are very susceptible to hacker attacks --- even more so than wired networks are (discussed in Chapter 9). They have vulnerabilities that can allow a hacker to bring your network to its knees and allow your information to be gleaned right out of thin air. If a hacker comprises your WLAN, you can experience the following problems: 15 55784x Ch10.qxd 3/29/04 4:14 PM Page 148
148 Part III: Network Hacking
ߜ Loss of network access, including e-mail, Web, and other services that can cause business downtime
ߜ Loss of confidential information, including passwords, customer data, intellectual property, and more
ߜ Legal liabilities associated with unauthorized users Most of the wireless vulnerabilities are in the 802.11 protocol and within wireless access points (APs) --- the central hublike devices that allow wireless clients to connect to the network. Wireless clients have some vulnerabilities as well.
Various fixes have come along in recent years to address these vulnerabilities, but most of these fixes have not been applied or are not enabled by default. You may also have employees installing rogue WLAN equipment on your network without your knowledge; this is the most serious threat to your wireless security and a difficult one to fight off. Even when WLANs are hardened and all the latest patches have been applied, you still may have some serious security problems, such as DoS and man-in-the-middle attacks (like you have on wired networks), that will likely be around for a while.
Choosing Your Tools
Several great WLAN security tools are available for both the Windows and UNIX platforms. The UNIX tools --- which mostly run on Linux and BSD --- can be a bear to configure and run properly if the planets and stars are not properly aligned. The PC Card services in Linux are the trickiest to set up, depending on your type of WLAN card and your Linux version.
Don't get me wrong --- the UNIX-based tools are excellent at what they do.
Programs such as Kismet (www.kismetwireless.net), AirSnort (airsnort.
shmoo.com), AirJack (802.11ninja.net/airjack), and Wellenreiter (www.
wellenreiter.net) offer many features that most Windows-based applications don't have. These programs run really well if you have all the Linux dependencies installed. They also offer many features that you don't need when assessing the security of your WLAN.
In the spirit of keeping things simple, the tests I outline in this chapter require only Windows-based utilities. My favorite tools for assessing wireless tools in Windows are as follows:
ߜ NetStumbler (www.netstumbler.com) for AP discovery and enumeration ߜ Wireless client management software --- such as Orinoco's Client Manager software --- for AP discovery and enumeration
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 149
ߜ WildPackets' AiroPeek (www.wildpackets.com) or your favorite WLAN
analyzer for detailed information on wireless hosts, decryption of encrypted traffic, and more
ߜ LANguard Network Security Scanner (www.gfi.com) for WLAN enumeration and vulnerability scanning
A case study with Matt Caldwell
on hacking wireless networks
Matt Caldwell, shared with me a wild story of a
The Outcome
wireless warflying experience --- yes, it's
As Mr. Caldwell and his colleague climbed
wardriving, but in an airplane! Here's his
above 500 feet, NetStumbler (the wireless
account of what happened.
assessment software they were using) began
The Situation
chiming over the engine noise with its "bongs."
It seemed like every second, a new wireless AP
Mr. Caldwell's employer --- the state of
was being discovered. They made their way
Georgia --- wanted to have the state's wireless
around downtown Atlanta and detected over
networks assessed. The problem with terrestrial
300 unique APs at about 2,000 feet AGL. They
wardriving is that it's very slow, so Mr. Caldwell
proved that warflying can be an effective
and his team conducted an experiment to deter---
method of detecting access points and a great
mine the most economical way to assess the
statistical-gathering activity. They collected
access points across the state of Georgia, which
data on 382 APs in less than one hour in the air!
comprised 47,000 employees and 70 agencies.
They knew the location of the buildings and
Matt Caldwell's Lessons Learned
knew they had to visit all of them. As a test, they
ߜ Don't eat a McDonald's double cheese---
drove around one building to count the number
burger before flying --- or at least carry a
of access points they detected and concluded
barf bag!
that it would take almost six months to assess all
the state buildings.
ߜ Use extra duct tape and a safety rope, or
put the antenna in the aircraft.
In his spare time, Mr. Caldwell flies single---
engine aircraft, and he decided that if the mili---
ߜ Use good software to do triangulation so
tary could gather intelligence via aircraft, so
you don't have to calculate the position
could he! After getting through some political
manually.
red tape, he and a fellow aviator used duct tape
ߜ Seventy percent of the APs detected had no
to mount an antenna on a Cessna 172RG (he
WEP encryption!
thanks MacGyver for this idea!). He mounted
the antenna at a 90-degree angle from the
ߜ Almost 50 percent of the APs detected had
plane's nose so that he could make notes on the
default SSIDs.
direction of the plot point. By doing some simple
Matt Caldwell, CISSP, is founder of and chief
math, plus 90 degrees gave them radial on the
security officer for GuardedNet, Inc.
approximate bearing of the target access point.
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 150
150 Part III: Network Hacking
You also need the proper hardware. A good setup I've used is a laptop PC
with an Orinoco (formerly made by Lucent, now Proxim) 802.11b PC Card.
This card is not only compatible with NetStumbler, but also has an antenna connector that allows you to connect an external antenna. Another bonus is that most wireless security tools are very friendly with the Orinoco card. A lot of security tool support is available for the Prism2 chipset found in wireless cards by Belkin, D-Link, Linksys, and more. Before you purchase a wireless PC Card or PCI adapter, verify what chipset it has to ensure compatibility with the majority of security tools. The SeattleWireless HardwareComparison page (www.seattlewireless.net/index.cgi/HardwareComparison) is a good reference for this type of information.
You can also use a handheld wireless security testing device such as an AirMagnet (www.airmagnet.com) or the Fluke WaveRunner (www.fluke networks.com). Both devices have their own built-in programs that are great for testing security settings on your WLAN.
An external antenna is also something to consider as part of your arsenal. I have had good luck running tests without an antenna, but your mileage may vary. If you're performing a walkthrough of your facilities to test for wireless signals, for example, adding an additional antenna increases your odds of finding legitimate --- and, more important, unauthorized APs. You can choose among three main types of wireless antennas: ߜ Omnidirectional: Transmits and receives wireless signals 360 degrees over shorter distances, such as in boardrooms or reception areas. These antennas, also known as dipoles, typically come installed on APs from the factory.
ߜ Semidirectional: Transmits and receives directionally focused wireless signals over medium distances, such as down corridors and across one side of an office.
ߜ Directional: Transmits and receives highly focused wireless signals over long distances, such as between buildings. This antenna, also known as a high-gain antenna, is the antenna of choice for wireless hackers driving around cities looking for vulnerable APs --- an act also known as wardriving.
As an alternative to the antennas described in the preceding list, you can use a nifty Pringles-can design. If you're interested in trying this, check out the article at www.oreillynet.com/cs/weblog/view/wlg/448 for details. You can even try other alternatives, such as a pork-and-beans can! A simple Internet search turns up a lot of information on this subject, if you're interested. One site in particular sells a Cantenna kit pretty cheaply at mywebpages.comcast.net/
hughpep.
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 151
Wireless LAN Discovery
After you have an Internet connection, wireless hardware (a wireless card, at a minimum), and wireless testing software (NetStumbler or similar client management software, at a minimum), you're ready to roll.
Checking for worldwide recognition
The first test requires only the MAC address of your AP and access to the Internet. You're testing to see if someone has discovered your WLAN and posted information about it for the world to see. If you're not sure what your AP's MAC address is, you should be able to view it by using the arp -a command in DOS. You may have to ping the access point's IP address first so the MAC address is loaded into your ARP cache. Figure 10-1 shows what this may look like.
Figure 10-1:
Finding
the MAC
address
of an AP
using arp.
After you have the AP's MAC address, browse to the WiGLE database of WLANs (www.wigle.net) to see if your AP is listed. You have to register with the site to perform a database query, but it's worth it. After you select the Query link and login, you see a screen similar to Figure 10-2. You can enter such AP information as geographical coordinates, but the simplest thing to do is enter your MAC address in the format shown.
If your AP is listed, that means that someone has discovered it --- most likely via wardriving --- and has posted the information for others to see. You need to start implementing the security countermeasures listed in this chapter as soon as possible to keep others from using this information against you! You can also check www.wifimaps.com to see if your AP is listed at another WLAN lookup site.
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 152
152 Part III: Network Hacking
Figure 10-2:
Searching
for your
wireless
APs using
the WiGLE
database.
Scanning your local airwaves
Monitor the airwaves around your building to see what authorized and unauthorized APs you can find. You're looking for the SSID (service set identifier), which is your WLAN's name. If you have multiple WLANs, each one has a network SSID associated with it.
Here's where NetStumbler comes into play. NetStumbler can discover SSIDs and other detailed information about wireless APs, including the following: ߜ MAC address
ߜ Name
ߜ Radio channel in use
ߜ Vendor name
ߜ Whether encryption is on or off
ߜ RF signal strength (signal-to-noise ratio)
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 153
Figure 10-3 shows an example of what you might see when running NetStumbler in your environment. The information that you see here is what others can see. NetStumbler and most other tools work by sending a probe-request signal from the client. Any APs within signal range must respond to with their SSIDs --- that is, if they're configured to broadcast their SSIDs.
Figure 10-3:
NetStumbler
displays
detailed
data on APs.
Kismet --- the popular wireless sniffer (network analyzer) for Linux and BSD
UNIX --- looks not only for probe responses from APs like NetStumbler does, but also for other 802.11 management packets, such as association responses and beacons. This allows Kismet to detect the presence of a WLAN even when probe-response packets are disabled in the AP --- something that NetStumbler can't do.
When you're using certain wireless security assessment tools, including NetStumbler and AiroPeek, your adapter may be put in passive monitoring mode. This means you can no longer communicate with other wireless hosts or APs while the program is loaded. Also, some programs require a specialized driver for your wireless card that often disables normal WLAN functionality. If this is the case, you need to roll back (reinstall) the original adapter's driver (supplied by the vendor) to restore the standard functions of your adapter.
The best way to search for APs that are not broadcasting their SSIDs from within Windows is to use a WLAN analyzer such as AiroPeek (my favorite) --- which is the sister product of the excellent wired network analyzer EtherPeek --- or TamoSoft's CommView for Wi-Fi (www.tamos.com/
products/commwifi), which I've heard great things about. You can do this by enabling a capture filter on 802.11 management packets, as shown in AiroPeek's options in Figure 10-4.
An ad-hoc mode --- a peer-to-peer type setup --- in WLANs can allow wireless clients to communicate directly with one another without having to pass through an AP. These types of WLANs operate outside the normal wireless security controls and, thus, can cause serious security issues above and beyond the normal 802.11 vulnerabilities. The best way to detect these rogue networks is to use NetStumbler. You can also use a WLAN analyzer or wireless IDS and search for beacon packets where the ESS field is not equal to 1.
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 154
154 Part III: Network Hacking
Figure 10-4:
AiroPeek
detects APs
that don't
broadcast
SSIDs.
Wireless Network Attacks
Various malicious hacks --- including various DoS attacks --- can be carried out against your WLAN. This includes APs that are forced to reveal their SSIDs during the process of being disassociated from the network and rejoining. In addition, hackers can literally jam the RF signal of an AP --- especially in 802.11b and 802.11g systems --- and force the wireless clients to reassociate to a rogue AP masquerading as the victim AP. Hackers can create man-in-the-middle attacks by maliciously using tools such as ESSID-jack and monkey-jack and can flood your network with thousands of packets per second by maliciously using packet-generation tools such as Gspoof or LANforge --- enough to bring the network to its knees. Even more so than with wired networks, this type of DoS attack is practically impossible to prevent on WLANs.
Various hacking tools for the UNIX platform can perform these types of hacks, including Cqure AP, HostAP, and AirJack. After hackers carry out these types of attacks against your WLAN, they can attempt to capture traffic and penetrate into any systems that attach to it.
You can carry out several --- nonmalicious --- attacks against your WLAN. The associated countermeasures help protect your network from these vulnerabilities, as well as from the malicious attacks previously mentioned. When testing your WLAN security, look out for the following weaknesses: ߜ Unencrypted wireless traffic ߜ Unauthorized APs
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 155
ߜ RF signals that are too strong
ߜ Wireless equipment that's easy to access physically
ߜ Default configuration settings
A good starting point for testing is to attempt to attach to your WLAN as an outsider and run a vulnerability-assessment tool, such as LANguard Network Security Scanner. This test enables you to see what others can see on your network, including information on the OS version, open ports on your AP, and even network shares on wireless clients. Figure 10-5 shows the type of information that can be revealed about an AP on your network.
Figure 10-5:
A LANguard
scan of a
potentially
vulnerable
AP.
Encrypted traffic
Wireless traffic can be captured directly out of the airwaves, making this communications medium susceptible to malicious eavesdropping. Unless the traffic is encrypted, it's sent and received in cleartext just like on a standard wired network. On top of that, the 802.11 encryption protocol, Wired Equivalent Privacy (WEP), has its own weakness that allows hackers to crack the encryption keys and decrypt the captured traffic. This vulnerability has helped put WLANs on the map --- so to speak.
WEP, in a certain sense, actually lives up to its name: It provides the privacy equivalent to that of a wired network and then some. However, it was not intended to be cracked so easily. WEP uses a fairly strong symmetric (shared-key) encryption algorithm called RC4. Hackers can observe encrypted wireless traffic and recover the WEP key due to a flaw in how the RC4 initialization 15 55784x Ch10.qxd 3/29/04 4:14 PM Page 156
156 Part III: Network Hacking
vector (IV) is implemented in the protocol. This weakness is due to the fact that the IV is only 24 bits long, which causes it to be repeated every 16.7 million packets --- even sooner in many cases, based on the amount of wireless clients entering and leaving the network.
Most WEP implementations initialize WLAN hardware with an IV of 0 and increment it by one for each packet sent. This can lead to the IV's being reinitialized --- started over at 0 --- approximately every five hours. Given this, WLANs that have a small number of clients transmitting a relatively small rate of wireless packets are normally more secure than large WLANs that transmit a lot of wireless data.
Using various UNIX-based tools such as WEPCrack (wepcrack.
sourceforge.net), AirSnort (airsnort.shmoo.com), and WepAttack (wepattack.sourceforge.net), hackers need to collect only a few hours'
up to a few days' (depending on how much wireless traffic is on the network) worth of packets to be able to break the WEP key.
A longer key length, such as 128 bit or 192 bit, doesn't make WEP exponentially more difficult to crack. This is because WEP's static key scheduling algorithm requires only that about 20,000 or so additional packets be captured to crack a key for every extra bit in the key length.
Although WEP is crackable, it's still much better than no encryption at all.
Similar to the effect that home-security-system signs have on would-be home intruders, a wireless LAN running WEP is not nearly as attractive to a hacker as one without it. The hacker is likely to just move on to easier targets.
You can carry out this attack against your network, but it probably won't prove anything other than WEP is vulnerable. After you implement the WEP
countermeasures mentioned in the next section, you can always run some of the WEP cracking tools to ensure that the countermeasures are working.
If you need to use your WLAN analyzer to view traffic as part of your security assessment, you won't be able to see any traffic if WEP is enabled unless you know your WEP key. You can enter your key into your analyzer, but just remember that hackers can do the same thing if they're able to crack your WEP key using one of the tools I mention earlier!
Figure 10-6 shows an example of how you can view protocols on your WLAN
by entering your WEP key into AiroPeek via the 802.11 tab in the Capture Options window before you start your packet capture.
Countermeasures
The simplest solution to the WEP problem is to use a VPN for all wireless communications. You can easily implement this in a Windows environment --- for
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 157
free --- by enabling PPTP for client communications. You can also use the IPSec support built into Windows, as well as SSH, SSL/TLS, and other proprietary vendor solutions, to keep your traffic secure.
Figure 10-6:
Using
AiroPeek
Client
Manager to
search for
rogue APs.
Newer 802.11-based solutions exist as well. If you can configure your wireless hosts to regenerate a new key dynamically after a certain number of packets have been sent, the WEP vulnerability can't be exploited. Many AP vendors have already implemented this fix as a separate configuration option, so check for the latest firmware with features to manage key rotation. For instance, the proprietary Cisco LEAP protocol uses peruser WEP keys that offer a layer of protection if you're running Cisco hardware.
The wireless industry has come up with a solution to the WEP problem called Wi-Fi Protected Access (WPA). WPA uses the Temporal Key Integrity Protocol (TKIP) encryption system, which fixes all the known WEP issues. WPA requires an 802.1x authentication server, such as a RADIUS server, to manage user accounts for the WLAN. Check with your vendor for WPA updates.
A forthcoming 802.11i standard from the IEEE integrates the WPA fixes and more. This standard is an improvement over WPA but is not compatible with older 802.11b hardware, due to its implementation of the Advanced Encryption Standard (AES) for encryption. The workaround for this is to use TKIP, which is backward-compatible with older hardware because it uses the RC4 encryption scheme. Keep an eye out for 802.11i support for your wireless hardware.
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 158
158 Part III: Network Hacking
Rogue networks
Watch out for unauthorized APs and wireless clients attached to your network that are running in ad-hoc mode.
Using NetStumbler or your client manager software, you can test for APs that don't belong on your network. You can also use the network monitoring features in a WLAN analyzer such as AiroPeek.
Look for the following rogue AP characteristics:
ߜ Odd SSIDs, including the popular default ones linksys, tsunami, comcom-com, and wireless.
ߜ Odd AP system names --- that is, the name of the AP if your hardware supports this feature --- not to be confused with the SSID.
ߜ MAC addresses that don't belong on your network. Look at the first three bytes of the MAC address (the first six numbers), which specify the vendor name. You can perform a MAC-address vendor lookup at coffer.com/mac\_find to find information on APs you're unsure of.
ߜ Weak radio signals, which can indicate that an AP has been hidden away or is on the outside of your building.
ߜ Communications across a different radio channel than what your network communicates on.
ߜ A degradation in network throughput for any WLAN client.
Figure 10-7 shows how you can use AiroPeek's Monitor utility to spot an odd network host (the NETGEAR system) when you have a Cisco Aironet-only network, or vice versa.
My test network for this example is small compared to what you might see, but you get the idea of how an odd system can stand out.
Don't rely solely on this method. Hackers can spoof their MAC addresses, making them look like Cisco Aironet systems that belong on your network.
Walk around your building or campus to perform this test to see what you can find. Physically look for devices that don't belong --- a well-placed AP or WLAN client that's turned off won't show up in your network analysis tools.
Search near the outskirts of the building or near any publicly accessible areas. Scope out boardrooms and the offices of upper-level managers for any unauthorized devices. These are places that are typically off-limits but often are used as locations for hackers to set up rogue APs.
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 159
Figure 10-7:
Using
AiroPeek's
Monitor to
spot a
product that
doesn't
belong.
WLANs authenticate the wireless devices, not the users. Hackers can use this to their advantage by gaining access to a wireless client via remote-access software such as telnet or SSH or by exploiting a known application or OS vulnerability. After they're able to do that, they potentially have full access to your network.
Countermeasures
The only way to detect rogue APs and hosts on your network is to monitor your WLAN proactively, looking for indicators that wireless clients or rogue APs might exist. But if rogue APs or clients don't show up in NetStumbler or in your client manager software, that doesn't mean you're off the hook. You may also need to break out the WLAN analyzer, wireless IDS, or other network management application.
You can enable MAC-address filtering controls on your AP so that wireless clients must have an authorized MAC address before being allowed to connect. The problem with this countermeasure is that hackers can easily spoof MAC addresses in UNIX by using the ifconfig command and in Windows with the SMAC utility, as I describe in Chapter 9. However like WEP, MAC-address-based access controls are another layer of protection and better than nothing at all. If a hacker spoofs one of your MAC addresses, the only way to detect malicious behavior is to spot the same MAC address being used in two or more places on the WLAN.
You may be able to make a couple of configuration changes --- depending on your AP --- to keep hackers from carrying out these tests against you: ߜ If possible, increase your wireless beacon broadcast interval to the maximum setting, which is around 65,535 milliseconds (roughly 66 seconds).
This can help hide the AP from hackers who are wardriving or walking by your building quickly.
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 160
160 Part III: Network Hacking
ߜ Disable probe responses to prevent your AP from responding to NetStumbler requests.
Use personal firewall software such as BlackICE --- my favorite --- (blackice.
iss.net) or ZoneAlarm (www.zonelabs.com) on all client computers to prevent unauthorized remote access to your network.
Physical-security problems
Various physical-security vulnerabilities can result in physical theft, the reconfiguration of wireless devices, and the capturing of confidential information. You should look for the following security vulnerabilities when testing your systems: ߜ APs mounted on the outside of a building and accessible to the public.
ߜ Poorly mounted antennas --- or the wrong types of antennas --- that broadcast too strong a signal and that are accessible to the public.
You can view the signal strength in NetStumbler or your wireless client manager.
These issues are often overlooked due to rushed installations, improper planning, and lack of technical knowledge, but they can come back to haunt you later.
Countermeasures
Secure APs, antennas, and other equipment in secure closets, ceilings, or other places that are difficult for a would-be intruder to access physically.
Terminate your APs outside any firewall or other network perimeter security devices --- or at least in a DMZ --- whenever possible. If you place the wireless equipment inside your secure network, it can negate any benefits you would get out of your perimeter security devices.
If wireless signals are propagating outside your building where they don't belong, either
ߜ Turn down the transmit power setting of your AP.
ߜ Use a smaller or different antenna (semidirectional or directional) to decrease the signal.
Some basic planning helps prevent these vulnerabilities.
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 161
Vulnerable wireless workstations
Wireless workstations have tons of security vulnerabilities --- from weak passwords to unpatched security holes to the storage of WEP keys locally.
One serious vulnerability is for wireless clients using the Orinoco wireless card. The Orinoco Client Manager software stores encrypted WEP keys in the Windows Registry --- even for multiple networks --- as shown in Figure 10-8.
Figure 10-8:
Encrypted
WEP key of
a wireless
card.
You can crack the key by using the Lucent Orinoco Registry Encryption/
Decryption program found at www.cqure.net/tools.jsp?id=3. Make sure that you use the -d command-line switch and put quotes around the encrypted key, as shown in Figure 10-9. This program comes in handy if you forget what your key is, but it can be used against you as well.
Figure 10-9:
Cracking a
WEP key
with Lucent
Orinoco.
If hackers remotely access a workstation via the Connect Network Registry in regedit, they can obtain these keys, crack them, and be on your network in a jiffy.
Countermeasures
You can implement the following countermeasures on your workstations to keep them from used as entry points into your WLAN.
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 162
162 Part III: Network Hacking
ߜ Regularly perform vulnerability assessments on your wireless workstations, as well as your other network hosts.
ߜ Apply the latest vendor security patches and enforce strong user passwords.
ߜ Use personal firewalls on these systems to keep malicious intruders off of those systems and out of your network.
ߜ Install antivirus software.
ߜ Consider installing an antispyware application such as PestPatrol.
Default configuration settings
Similar to wireless workstations, wireless APs have many known vulnerabilities. The most common ones are default SSIDs and admin passwords. The more specific ones occur only on certain hardware and software versions that are posted in vulnerability databases and vendor Web sites.
The one vulnerability that stands out above all others is that certain APs, including Linksys, D-Link, and more, are susceptible to a vulnerability that exposes any WEP key(s), MAC-address filters, and even the admin password!
All that hackers have to do to exploit this is to send a broadcast packet on UDP port 27155 with a string of gstsearch.
To test for this vulnerability, you can use a program called pong. This program sends the broadcast packet automatically and returns any information it discovers. To run pong, follow these steps: 1. Download the program from www.mobileaccess.de/wlan/dl.php/
pong\_v1.1.zip.
2. Unzip the program to c:\wireless (or a similar directory).
3. Drop out to a DOS prompt, and enter pong.
If pong returns no answer, as shown in Figure 10-10, you're safe. Otherwise, look out!
Figure 10-10:
The results
you should
get from
pong.
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 163
Countermeasures
You can implement some of the simplest and effective security countermeasures for WLANs --- and they're all free:
ߜ Make sure that you change default admin passwords, AP names, and SSIDs.
ߜ Disable SSID broadcasting if you don't need this feature. Figure 10-11
shows the SSID setting for a Cisco Aironet AP.
ߜ Disable SNMP if you're not using it.
ߜ Apply the latest firmware patches for your APs and WLAN cards. This countermeasure helps to prevent various vulnerabilities, including the UDP broadcast exploit. If you find that it doesn't, consider using another vendor's wireless products.
Figure 10-11:
Cisco
Aironet
setting to
disable
SSID
broadcasts.
15 55784x Ch10.qxd 3/29/04 4:14 PM Page 164
164 Part III: Network Hacking
16 55784X PP04.qxd 3/29/04 4:19 PM Page 165
Hacking
16 55784X PP04.qxd 3/29/04 4:19 PM Page 166
In this part . . .
Now that you're past the network level, it's time to
get down to the nitty-gritty --- those fun operating
systems you use on a daily basis and have come to both love and hate. There's definitely not enough room in this book to cover every operating system version or even
every operating system vulnerability, but I certainly hit the important parts --- especially the ones that aren't
easily fixed with patches.
This part starts out by looking at the most widely used (and picked on) operating system --- Microsoft Windows.
From Windows NT to Windows Server 2003, I show you
some of the best ways to attack and secure these operating systems from the bad guys. This part then takes a look at Linux and its less publicized yet still major security flaws. Many of the hacks and countermeasures I cover can apply to many other flavors of UNIX as well. This part then moves on to the tried-and-true Novell NetWare operating system --- perhaps the most secure in this lineup but still not vulnerability-free as many Novell die-hards like to believe. I cover the major issues along with solid countermeasures you can implement to keep your mighty Novell boxes secure and still mostly reboot-free.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 167
In This Chapter
ᮣ Port scanning a Windows server
ᮣ Gleaning Windows information without logging in
ᮣ Exploiting common vulnerabilities when logged into Windows
ᮣ Minimizing Windows security risks
The Microsoft Windows OS family (with such versions as NT, 2000, XP, and Server 2003) is the most widely used OS in the world. It's also the most widely hacked. Is this because Microsoft doesn't care as much about security as other OS vendors? The short answer is no. Sure, numerous security flaws were overlooked --- especially in the Windows NT days --- but because Microsoft products are so pervasive throughout networks, Microsoft is the easiest vendor to pick on, and often it's Microsoft products that end up in the crosshairs of hackers. This is the same reason that you see so many vulnerability alerts on Microsoft products. The one positive about hackers is that they're driving the requirement for better security!
Many security flaws in the headlines aren't new. They're variants of vulnerabilities that have been around for a long time in UNIX and Linux, such as the RPC vulnerabilities that the Blaster worm used. You've heard the saying "the more things change, the more they stay the same." That applies here, too.
Most Windows attacks are prevented if the patches were properly applied.
Thus, poor security management is often the real reason Windows attacks are successful, yet Microsoft takes the blame and must carry the burden.
In addition to the password attacks I cover in Chapter 7 and some of the malware attacks I cover in Chapter 14, many other attacks are possible against a Windows-based system. Tons of information can be gleaned from Windows by simply connecting to the system across a network and using tools to pull the information out. Many of these tests don't even require you to be authenticated to the remote system. All hackers need is a Windows computer with a default configuration that's not protected by such measures as a firewall.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 168
168 Part IV: Operating System Hacking
When you start poking around on your network, you may be surprised at how many of your Windows-based computers have security vulnerabilities.
After you connect to a Windows system and have a valid user name and password (by either knowing it or deriving it from using the password cracking techniques in Chapter 7), you can test other aspects of Windows security.
This chapter shows you how to test for some of the most critical attacks against the Windows OS family and outlines countermeasures to make sure your systems are secure.
Windows Vulnerabilities
Given the general ease of use of Windows, its enterprise-ready Active Directory service, and the feature-rich .NET development platform, many organizations have moved to the Microsoft platform for their networking needs. Many businesses --- especially the small to medium-sized ones --- depend solely on the Windows OS for network usage. Many large organizations run critical servers such as Web servers and database servers on the Windows platform. If security vulnerabilities aren't addressed and managed properly, they can bring a network or an entire organization to its knees.
When Windows and other Microsoft software are attacked --- especially by a widespread Internet-based worm or virus --- hundreds of thousands of organizations and millions of computers are affected. Many well-known attacks against Windows can lead to ߜ Leakage of confidential information, including files being copied and credit card numbers being stolen
ߜ Passwords being cracked and used to carry out other attacks ߜ Systems taken completely offline by DoS attacks
ߜ Entire databases being corrupted or deleted
When insecure Windows-based systems are attacked, serious things can happen to a tremendous amount of computers around the world.
Choosing Tools
Thousands of Windows hacking and testing tools are available. The key is to find a set of tools that can do what you need and that you're comfortable using.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 169
Many security tools --- including some of the tools in this chapter --- aren't designed for Windows Server 2003 and newer operating systems but work with them. However, the program documentation sometimes isn't updated to reflect its compatibility. The most recent version of each tool in this chapter is compatible with Windows NT, 2000, and Server 2003.
The more security tools and other power user applications you install in Windows --- especially programs that tie into the network drivers and TCP/IP
stack --- the more unstable Windows becomes. I'm talking about slow performance, blue screens of death, and general instability issues. Unfortunately, often the only fix is to reinstall Windows and all your applications. I've had to rebuild my system once during the writing of this book and a total of three times in the past year. Ah, the memories of those DOS and Windows 3. x days when things were much simpler!
Essential tools
Every Windows security tester needs these special tools: ߜ Nmap (www.insecure.org) for UDP and other types of port scanning Nmap is an excellent tool for OS fingerprinting.
ߜ Vision (www.foundstone.com) for mapping applications to TCP/UDP
ports
Free Microsoft tools
You can use the following Windows programs and free security tools that Microsoft provides to test your systems for various security weaknesses.
ߜ Built-in Windows programs (Windows 9x and later versions) for NetBIOS
and TCP/UDP service enumeration:
• nbtstat for gathering NetBIOS name table information
• netstat for displaying open ports on the local Windows system
• net for running various network based commands including viewing of shares on remote Windows systems
ߜ Microsoft Baseline Security Analyzer www.microsoft.com/technet/
security/tools/mbsahome.asp for testing for missing patches and basic Windows security settings.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 170
170 Part IV: Operating System Hacking
ߜ Windows Resource Kits (including some tools that are free for download at www.microsoft.com) for security and OS management.
You can get specific details about Resource Kit books published by Microsoft Press at www.microsoft.com/learning.
All-in-one assessment tools
The following tools perform a wide variety of security tests including ߜ Port scanning
ߜ OS fingerprinting
ߜ Basic password cracking
ߜ Detailed vulnerability mappings of the various security weaknesses the tools find on your Windows systems
I recommend any of these comprehensive sets of tools:
ߜ LANguard Network Security Scanner (www.gfi.com)
ߜ QualysGuard (www.qualys.com)
QualysGuard has very detailed and accurate vulnerability testing.
ߜ Nessus (www.nessus.org)
Task-specific tools
The following tools perform one or two specific tasks. These tools provide detailed security assessments of your Windows systems and insight that you may not otherwise get from all-in-one assessment tools: ߜ SuperScan (www.foundstone.com) for TCP port scanning and ping sweeps.
ߜ A tool for enumerating Windows security settings. Given the enhanced security of Windows Server 2003, these tools can't connect and enumerate a default install of Windows Server 2003 system like a Windows 2000
or NT system --- but you can use these tools nonetheless. It's a good idea to test for vulnerable "non-default" configurations in case the secure default settings have been changed.
To gather such information as security policies, local user accounts, and shares, your decision may be based on your preferred interface: 17 55784x Ch11.qxd 3/29/04 4:19 PM Page 171
• Winfo (www.ntsecurity.nu/toolbox/winfo) runs from the Windows command line.
• DumpSec (www.somarsoft.com) runs from a graphical Windows interface.
• Walksam (razor.bindview.com/tools/files/rpctools-1.0.
zip) runs from the Windows command line.
If you're scanning a network only for Windows shares, consider Legion (packetstormsecurity.nl/groups/rhino9/legionv21.zip).
ߜ Rpcdump (razor.bindview.com/tools/files/rpctools-1.0.zip) for enumerating RPC ports to search for running applications.
ߜ Network Users (www.optimumx.com/download/netusers.zip) for gathering Windows login information.
Information Gathering
When you assess Windows vulnerabilities, start by scanning your computers to see what the bad guys can see.
The hacks in this chapter are against the versions of the Windows Server OS
(NT, 2000, and Server 2003) from inside a firewall. Unless I point out otherwise, all the tests in this chapter can be run against all versions of the Windows server OS. The attacks in this chapter are significant enough to warrant testing for regardless of your current setup. Your results may vary from mine depending on these factors: ߜ OS versions
ߜ Security measures, such as patch levels and access controls (such as firewall policies and local Windows security policies) System scanning
A few straightforward processes can identify weaknesses. Other steps can minimize your vulnerability.
Testing
Start gathering information about your Windows systems by running an initial port scan:
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 172
172 Part IV: Operating System Hacking
1. Run basic scans to find which ports are open on each Windows system:
• Scan for TCP ports with a port scanning tool, such as SuperScan or Nmap.
• Scan for UDP ports with a port scanning tool, such as Nmap.
2. Perform OS enumeration (such as scanning for shares and specific OS
versions) by using an all-in-one assessment tool, such as LANguard Network Security Scanner.
3. Scan your Windows systems for open ports that could point to potential security vulnerabilities.
The tool you use depends on whether you need a basic summary of vulnerable ports or a comprehensive system report:
• If you need a basic summary of open ports, scan your Windows systems with SuperScan.
The SuperScan results in Figure 11-1 show several potentially vulnerable ports open on a Windows Server 2003 system, including those for SMTP (port 25), a Web server (port 80), RPC (port 135), and the ever popular --- and easily hacked --- NetBIOS (ports 139
and 445).
Figure 11-1:
Scanning a
Windows
Server 2003
system with
SuperScan.
• If you need a comprehensive system report, scan your Windows systems with LANguard Network Security Scanner.
In Figure 11-2, LANguard shows the server version (identified as Windows XP initially and then later as Windows 2003), the system's current date and time setting and system uptime, and the server's domain (PL).
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 173
Figure 11-2:
Gathering
system
details with
LANguard
Network
Security
Scanner.
4. You can run Nmap with the -O option to confirm the OS characteristics --- the version information referred to as the OS fingerprint --- that you found with your scanning tool, as shown in Figure 11-3.
A hacker can use this information to determine potential vulnerabilities for your system. Make sure you've applied the latest patches and system hardening best practices.
In Figure 11-3, Nmap reports the OS version as Windows .NET Enterprise Server --- the original name of Windows Server 2003.
Figure 11-3:
Using Nmap
to determine
the
Windows
version.
Countermeasures
You can prevent a hacker from gathering certain information about your Windows systems by implementing the proper security settings on your network and on the Windows hosts themselves.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 174
174 Part IV: Operating System Hacking
Information
If you don't want anyone gathering information about your Windows systems, you have two options:
ߜ Protect Windows with either of these countermeasures:
• A firewall that blocks the Windows-specific ports for RPC (port 135) and NetBIOS (ports 137--139 and 445)
• An intrusion prevention system, such as the host-based BlackICE
software
ߜ Disable unnecessary services so that they don't appear when a connection is made
Fingerprinting
You can prevent OS fingerprinting tests by either
ߜ Using a host-based intrusion prevention system
ߜ Denying all inbound traffic with a firewall --- this just may not be practical for your needs
NetBIOS
You can gather Windows information by poking around with NetBIOS
(Network Basic Input/Output System) functions and programs. NetBIOS
allows applications to make networking calls and communicate with other hosts within a LAN.
These Windows NetBIOS ports can be compromised if they're not properly secured:
ߜ UDP ports for network browsing:
• Port 137 (NetBIOS name services)
• Port 138 (NetBIOS datagram services)
ߜ TCP ports for Server Message Block (SMB):
• Port 139 (NetBIOS session services)
• Port 445 (runs SMB over TCP/IP without NetBIOS)
Windows NT doesn't support port 445.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 175
Hacks
The following hacks can be carried out on unprotected systems running NetBIOS.
Unauthenticated enumeration
When you're performing your unauthenticated tests, you can gather configuration information about the local or remote systems with either ߜ All-in-one assessment tools, such as LANguard Network Security Scanner.
ߜ The nbtstat program that's built into Windows (nbtstat stands for NetBIOS
over TCP/IP Statistics). Figure 11-4 shows information that you can gather from a Windows Server 2003 system with a simple nbtstat query.
Figure 11-4:
Using
nbtstat to
gather
critical
Windows
information.
nbtstat shows the remote computer's NetBIOS name table, which you gather by using the nbtstat -A command. This displays the following information: ߜ Computer name
ߜ Domain name
ߜ Computer's MAC address
You may even be able to glean the ID of the currently logged user from a Windows NT or Windows 2000 server.
A GUI utility such as LANguard Network Security Scanner isn't necessary to gather this basic information from a Windows system. The graphical interface offered by commercial software such as this just presents its findings in a prettier fashion!
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 176
176 Part IV: Operating System Hacking
Shares
Windows uses network shares to share out certain folders or drives on the system so other users can access them across the network. Shares are easy to set up and work very well. However, they're often misconfigured, allowing hackers and other unauthorized users to access information they shouldn't be able to get to. You can search for Windows network shares by using the Legion tool. This tool scans an entire range of IP addresses looking for Windows shares. It uses the SMB protocol (TCP port 139) to discover these shares and displays them in a nice graphical fashion sorted by IP address, as shown in Figure 11-5.
Figure 11-5:
Using
Legion to
scan your
network for
Windows
shares.
The shares displayed in Figure 11-5 are just what hackers are looking for ---
especially because the share names give hackers a hint at what type of files might be available if they connect to the shares. After hackers discover these shares, they're likely to dig a little further to see if they can browse the files and more within the shares. I cover shares in more detail in the "Share Permissions" section, later in this chapter.
Countermeasures
You can implement the following security countermeasures to minimize NetBIOS attacks on your Windows systems.
Limit traffic
You can protect your Windows systems from NetBIOS attacks by using some basic network infrastructure protection systems as well as some general Windows security best practices:
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 177
ߜ If possible, the best way to protect Windows-based systems from NetBIOS
attacks is to put them behind a firewall.
A firewall isn't always effective. If the attack comes from inside the network, a network-perimeter-based firewall won't help.
ߜ If a perimeter-based firewall won't suffice, you can protect your Windows hosts by either
• Installing a personal firewall such as BlackICE
This is the simplest and most secure method of protecting a Windows system from NetBIOS attacks.
• Disabling NetBIOS on your systems.
This often requires disabling Windows file and printer sharing --- which may not be practical in a network mixed with Windows 2000, NT, and even Windows 9 x systems that rely on NetBIOS for file and printer sharing.
Hidden shares --- those with a dollar sign ($) appended to the end of the share name --- don't really help hide the share name. Hackers found out long ago that they can easily get around this form of security by obscurity by using the right methods and tools.
Passwords
If NetBIOS network shares are necessary, make strong passwords mandatory.
With the proper tools, hackers can easily crack NetBIOS passwords across the network. NetBIOS passwords aren't case sensitive, so they can be cracked more easily than case sensitive passwords that require both capital and small letters. Chapter 7 explains password security in detail.
RPC
Windows uses remote procedure call (RPC) and DCE internal protocols to ߜ Communicate with applications and other OSs.
ߜ Execute code remotely over a network.
RPC in Windows uses TCP port 135.
RPC exploits can be carried out against a Windows host --- perhaps the best-known being the Blaster worm that reared its ugly head after a flaw was found in the Windows RPC implementation.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 178
178 Part IV: Operating System Hacking
Enumeration
Hackers use RPC enumeration programs to see what's running on the host.
With that information, hackers can then penetrate the system further.
Rpcdump is my favorite tool for enumerating RPC on Windows systems. Figure 11-6 shows the abbreviated output of Rpcdump run against a Windows 2000
server. Rpcdump found the RPC listeners for MS SQL Server and even a DHCP
server running on this host --- and this is a hardened Windows 2000 server with all the latest patches running BlackICE intrusion prevention software!
Figure 11-6:
Rpcdump
shows RPC-based
services.
Countermeasures
The appropriate step to prevent RPC enumeration depends on whether your system has network-based applications, such as Microsoft SQL and Microsoft Outlook:
ߜ Without network-based applications, the best countermeasure is a firewall that blocks access to RPC services (TCP port 135).
This firewall may disable network-based applications.
ߜ If you have network-based applications, one of these options can reduce the risk of RPC enumeration:
• If highly critical systems such as Web or database servers need access only from trusted systems, give only trusted systems access to TCP port 135.
• If your critical systems must be made accessible to the public, make sure your RPC-based applications are patched and configured to run as securely as possible.
Don't try to disable the RPC server within Windows with such "fixes" as Registry hacks. You may end up with a Windows server or applications that stop working on the network, forcing you to reinstall and reconfigure the system.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 179
Null Sessions
A well-known vulnerability within Windows can map an anonymous connection (null session) to a hidden share called IPC$ (interprocess communication). This attack method can be used to ߜ Gather Windows host configuration information, such as user IDs and share names.
ߜ Edit parts of the remote computer's Registry.
Hacks
Although Windows Server 2003 doesn't allow null session connections by default, Windows 2000 Server and NT Server do --- and plenty of those systems are still around to cause problems on most networks.
Windows Server 2003 and Windows XP at the desktop are much more secure out of the box than their predecessors. Keep this in mind when it comes time to upgrade your systems.
Mapping
To map a null session, follow these steps for each Windows computer to which you want to map a null session:
1. Format the basic net command, like this:
net use \\host\_name\_or\_IP\_address\ipc$ "" "/user:"
The net command to map null sessions requires these parameters:
• net (the built-in Windows network command) followed by the use command
• IP address of the system to which you want to map a null connection
• A blank password and username
The blanks are why it's called a null connection.
2. Press Enter to make the connection.
Figure 11-7 shows an example of the complete command when mapping a null session. After you map the null session, you should see the message The command completed successfully.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 180
180 Part IV: Operating System Hacking
Figure 11-7:
Mapping
a null
session to a
Windows
2000 server.
To confirm that the sessions are mapped, enter this command at the command prompt:
net use
As shown in Figure 11-7, you should see the mappings to the IPC$ share on each computer to which you're connected.
Gleaning information
With a null session connection, you can use other utilities to remotely gather critical Windows information. Dozens of tools can gather this type of information.
You --- like a hacker --- can take the output of these enumeration programs and attempt (as an unauthorized user) to try such gleaning of information as ߜ Cracking the passwords of the users found. (See Chapter 7 for more on password cracking.) ߜ Mapping drives to the network shares.
You can use the following applications for system enumeration against server versions of Windows prior to Server 2003.
Windows Server 2003 is much more secure than its predecessors against such system enumeration vulnerabilities as null session attacks. If the server is in its default configuration, it should be secure; however, you should perform these tests against your Windows Server 2003 systems to be sure.
net view
The net view command shows shares that the Windows host has available.
You can use the output of this program to see information that the server is advertising to the world and what can be done with it, such as:
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 181
ߜ Share information that a hacker can use to attack your systems, such as mapping drives and cracking share passwords.
ߜ Share permissions that may need to be removed, such as the permission for the Everyone group to at least see the share on Windows NT and 2000 systems.
To run net view, enter the following at a command prompt: net view
Figure 11-8 shows an example.
Figure 11-8:
net view
displays
drive shares
on a remote
Windows
host.
Configuration and user information
Winfo and DumpSec can gather useful information about users and configuration, such as
ߜ Windows domain to which the system belongs
ߜ Security policy settings
ߜ Local usernames
ߜ Drive shares
Your preference may depend on whether you like graphical interfaces or a command line:
ߜ Winfo (www.ntsecurity.nu/toolbox/winfo) is a command-line tool.
Because Winfo is a command-line tool, you can create batch (script) files that automate the enumeration process. The following is an abbreviated version of Winfo's output of a Windows NT server, but you can glean the same information from a Windows 2000 server: Winfo 2.0 - copyright (c) 1999-2003, Arne Vidstrom
- http://www.ntsecurity.nu/toolbox/winfo/
SYSTEM INFORMATION:
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 182
182 Part IV: Operating System Hacking
- OS version: 4.0
PASSWORD POLICY:
- Time between end of logon time and forced logoff: No forced logoff
- Maximum password age: 42 days
- Minimum password age: 0 days
- Password history length: 0 passwords
- Minimum password length: 0 characters
USER ACCOUNTS:
\* Administrator
(This account is the built-in administrator account)
\* doctorx
\* Guest
(This account is the built-in guest account)
\* IUSR\_WINNT
\* kbeaver
\* nikki
SHARES:
\* ADMIN$
- Type: Special share reserved for IPC or administrative share
\* IPC$
- Type: Unknown
\* Here2Bhacked
- Type: Disk drive
\* C$
- Type: Special share reserved for IPC or administrative share
\* Finance
- Type: Disk drive
\* HR
- Type: Disk drive
This information cannot be gleaned from Windows Server 2003 by default.
ߜ DumpSec produces Windows configuration and user information in a graphical interface. Figure 11-9 shows the local user accounts on a remote system.
DumpSec can save reports as delimited files that can be imported into another application (such as a spreadsheet) when you create your final reports. You can peruse the information for user IDs that don't belong on your system, such as • Ex-employee accounts
• Potential backdoor accounts that a hacker may have created If hackers get this information, they can attempt to exploit potential weak passwords and log in as those users.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 183
Figure 11-9:
DumpSec
displays
users on a
server.
Walksam
Walksam gleans information about Windows users by walking the SAM database through an established null session. Figure 11-10 is an example of its output. This output is obviously similar to the DumpSec output, but the main difference here is that this attack can be scripted to somewhat automate the process.
Figure 11-10:
User
information
gathered
with
Walksam.
Network Users
Network Users (www.optimumx.com/download/netusers.zip) can show who has logged into a remote Windows computer. You can see such information as
ߜ Abused account privileges
ߜ Users currently logged into the system
Figure 11-11 shows the history of local logins of a remote Windows 2000
workstation.
Figure 11-11:
The
Network
Users tool.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 184
184 Part IV: Operating System Hacking
This information can help you track who's logging into a system for auditing purposes. Unfortunately, this information can be useful for hackers when they're trying to figure out what user IDs are available to crack. They may even determine the system's daily use if the user IDs are descriptive, such as backup (for a backup server) or devuser (for a development server).
Countermeasures
You can easily prevent null session connection hacks by implementing one or more of the following security measures.
Secure versions
If it makes good business sense and the timing is right, upgrade to the more secure Windows Server 2003. It doesn't have these vulnerabilities by default.
Blocking NetBIOS
It's absolutely critical that you block NetBIOS on systems that don't need to advertise to the world that it's running and available to be hacked.
ߜ Block NetBIOS on your Windows server by preventing these TCP ports from passing through your network firewall or personal firewall:
• 139 (NetBIOS sessions services)
• 445 (runs SMB over TCP/IP without NetBIOS)
Windows NT doesn't support port 445.
Although Windows Server 2003 does not have the same null session vulnerability by default as older versions of Windows server operating systems, it's still a good idea to block NetBIOS ports on these systems.
ߜ Disable File and Print Sharing for Microsoft Networks in the Properties tab of the machine's network connection.
Registry
For Windows NT and 2000, you can eliminate this vulnerability by changing the Windows Registry. Depending on the Windows version, you can select one of these security settings:
ߜ None: This is the default setting.
ߜ Rely on Default Permissions (Setting 0): This setting allows the default null session connections.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 185
ߜ Do Not Allow Enumeration of SAM Accounts and Shares (Setting 1): This is the medium security level setting. This setting still allows null sessions to be mapped to IPC$, enabling tools such as Walksam to be able to glean information from the system.
ߜ No Access without Explicit Anonymous Permissions (Setting 2): This high security setting prevents null session connections and system enumeration.
The high security setting has a few drawbacks:
• High security creates problems for domain controller communication and network browsing.
• The high security setting isn't available in Windows NT.
Microsoft Knowledge Base Article 246261 covers the caveats of using the high security setting for Restrict Anonymous. It's available on the Web at support.microsoft.com/default.aspx?scid=KB;en-us;246261.
Windows 2000
In Windows 2000, you don't have to edit the Registry. You can set local security policy in the Local Policies/Security Options of the Local Security Settings. The security setting is called Additional Restrictions for Anonymous Connections.
This setting is referred to as RestrictAnonymous, as shown in Figure 11-12.
Figure 11-12:
Local
security
policy
settings in
Windows
2000 to
prevent null
sessions.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 186
186 Part IV: Operating System Hacking
Windows NT
For Windows NT, follow these steps to change the Registry to disable null sessions:
1. Run either of the following Registry editing programs in Windows:
• regedit.exe
• regedt32.exe
2. Make a backup copy of the Registry.
• If you're using regedit, select Registry/Export Registry File.
• If you're using regedt32, select Registry/Save Key.
3. Browse to the key HKEY\_LOCAL\_MACHINE\SYSTEM\
CurrentControlSet\Control\LSA.
4. Right-click in the right window and select New/DWORD Value.
5. Enter RestrictAnonymous as the name.
6. Double-click the RestrictAnonymous key and enter 1 as the value.
7. Exit the Registry editor (regedit or regedt32).
8. Reboot the computer.
The new setting takes effect after the system is rebooted.
Share Permissions
Windows shares --- the available network drives that show up when browsing the network in Network Neighborhood or My Network Places --- are often misconfigured, allowing more people to have access to them than they should.
This is a security vulnerability that can be exploited by the casual browser, but the implications of a hacker gaining unauthorized access to a Windows system can result in serious consequences, including the leakage of confidential information and even the deletion of critical files.
Windows defaults
The default share permission depends on the Windows system version.
Windows 2000/NT
When creating shares in Windows NT and 2000, the group Everyone is given Full Control access in the share by default for all files to 17 55784x Ch11.qxd 3/29/04 4:19 PM Page 187
ߜ Browse files
ߜ Read files
ߜ Write files
Anyone who maps to the IPC$ connection with a null session (as described in the preceding section "Null Sessions") is automatically made part of the Everyone group! This means that remote hackers can automatically gain browse, read, and write access to a Windows NT or 2000 server if they establish a null session.
If share permissions are misconfigured, hackers on the Internet may gain access to these shares on an unprotected system and open, create, and delete files at will!
Windows 2003 Server
In Windows 2003 Server, the Everyone group is given only Read access to shares. This is definitely an improvement over the defaults in Windows 2000
and NT, but it's not the best setting for the utmost security. You still may have situations where you don't even want the Everyone group to have Read access to a share.
Testing
Assessing your share permissions is a good way to get an overall view of who can access what. This testing shows how vulnerable your network shares ---
and confidential information --- can be. You can find shares with default permissions and unnecessary access rights enabled.
The best test for share permissions that shouldn't exist is to log in to the Windows computer and run an enumeration program so you can see who has access to what.
DumpSec
DumpSec shows the share permissions on your servers in a graphical form.
You simply connect to the remote computer and select Dump Permissions for Shares in the Report menu. This produces shares labeled as unprotected, similar to what's shown in Figure 11-13.
This vulnerability exists in both Windows NT and Windows 2000 servers.
Thank goodness Microsoft fixed this default weakness in Windows Server 2003!
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 188
188 Part IV: Operating System Hacking
Windows workstation security
This chapter focuses on Windows Server OSs
to identify any obvious security vulnerabili-
(NT, 2000, and Server 2003) with brief mentions
ties, such as weak passwords and autologon.
of security issues involving Windows worksta---
ߜ Enable the Internet Connection Firewall
tion OSs (9 x, Me, and XP). Windows servers are (ICF). This personal firewall provides a
often the most critical servers on a network, but
tremendous amount of security over the
you shouldn't overlook the workstations.
standard configuration. It blocks all unso---
If you're running Windows 95, 98, or Me as the
licited inbound traffic unless that traffic is
OS for your network workstations, it may be
explicitly allowed.
time to upgrade. These three OSs simply aren't
ߜ There are other firewall options as well,
made for secure networking. Even the older
such as BlackICE or ZoneAlarm. You may
Windows NT has better security built-in. Why?
be able to run both ICF and a third-party
Because that's how Microsoft designed it.
firewall at the same time, but I don't rec---
Windows 9 x and Me were designed for the
ommend it for system operation and stabil---
casual home user --- not for networking in a
ity purposes.
business setting. They support networking such
as domain logins and file and printer sharing,
To enable ICF on a Windows XP Professional
but these security measures are easily circum---
system, perform the following steps:
vented. Just try pressing Esc on your keyboard
1. Load the Control Panel and then choose
the next time you're presented with a login
Networking and Internet Connections ➪
screen on one of these OSs. The login screen
Network Connections.
will go away, and you'll have full rights on
the system. Your best bet for security and
2. Right-click on the network adapter on
hacker countermeasures is to upgrade these
which you want to enable ICF and select
old OSs --- and most likely the hardware, too ---
Properties.
to the latest and greatest computers running
3. Click the Advanced tab and then select the
Windows XP Professional or newer.
Protect My Computer or Network by Limiting
Although Windows XP is much more secure by
or Preventing Access to This Computer from
default than its older siblings, take a couple
the Internet check box.
more steps to make it as secure as possible:
Supposedly, starting with Windows XP Service
ߜ Apply the latest patches as described in the Pack 2, ICF will have many more advanced fea-section "Windows Update" or by using an
tures such as firewalling being enabled by
automated patch management tool.
default, boot-time protection of the system, and
ߜ
support for various security profiles depending
Run LANguard Network Security Scanner
on how and where the user is logged in.
and the Microsoft Baseline Security Analyzer
LANguard
LANguard Network Security Scanner also shows the share permissions on your servers in a graphical fashion. Figure 11-14 shows an example.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 189
Figure 11-13:
Unprotected
shares in a
Windows
NT system.
Figure 11-14:
Unprotected
shares in a
remote
Windows
NT server.
General Security Tests
As part of your ethical hacking, you can run the following security tests to determine other potential weaknesses in your Windows systems.
Windows Update
Windows Update is the simplest way to check for missing Windows patches ---
especially critical security updates. How you run Windows Update depends on your Windows version:
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 190
190 Part IV: Operating System Hacking
ߜ If you have Windows 2000, XP, or Server 2003, run Windows Update from the Start menu.
ߜ For Windows NT, browse to windowsupdate.microsoft.com. On that page, click Scan for Updates to check your system for any missing patches.
Microsoft has announced plans to stop providing updates for Windows NT. You can't assume that Windows Update will have patches for new security vulnerabilities discovered.
Microsoft Baseline Security
Analyzer (MBSA)
Microsoft Baseline Security Analyzer (MBSA) is my preferred method for checking for missing security patches. MBSA is a free utility from Microsoft.
MBSA checks Windows NT, 2000, XP, and Server 2003 systems for missing patches and also tests Windows, SQL Server, and IIS for such basic security settings as weak passwords. You can use these tests to identify security weaknesses in your systems. Figure 11-15 shows a sample of the security settings MBSA tests.
Figure 11-15:
Testing
basic
Windows
security
settings.
With MBSA, you can scan either
ߜ The local system you're logged into
ߜ Computers across the network, if your currently logged-in user ID exists as an Administrator equivalent on the remote system you're testing
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 191
MBSA requires an administrator account on the local machines you're scanning and a manual connection to them.
LANguard
LANguard Network Security Scanner is my favorite feature-rich patch and Windows vulnerability scanning tool. With LANguard, you can ߜ Test for vulnerabilities and missing patches
ߜ Deploy patches across the network to remote systems
Figure 11-16 shows the depth of information that this program can provide when scanning Windows systems for vulnerabilities and security settings.
This type of information is very helpful when testing your own systems ---
especially if you have a large or complex network.
This information is also very helpful to hackers, especially if they have determined a local user's password. This way, they can authenticate to the system and check to see what patches and security settings are missing.
Figure 11-16:
Information
on missing
patches and
weak
security
settings.
It seems like no matter how many times you manually check local security settings and test to ensure that all patches are installed, a program such as LANguard Network Security Scanner or the popular and powerful Hyena (www.systemtools.com/hyena) always seems to find security issues you may have overlooked. This is why I recommend that you include an all-in-one assessment tool, such as one of these programs, in your security toolbox.
17 55784x Ch11.qxd 3/29/04 4:19 PM Page 192
192 Part IV: Operating System Hacking
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 193
In This Chapter
ᮣ Examining Linux hacking tools
ᮣ Port-scanning a Linux server
ᮣ Gleaning Linux information without logging in
ᮣ Exploiting common vulnerabilities when logged into Linux
ᮣ Minimizing Linux security risks
Linux --- the new darling competitor to Microsoft --- is the latest flavor of UNIX that has really taken off in corporate networks. A common misconception is that Windows is the most insecure operating system (OS). However, Linux --- and most of its sister variants of UNIX --- is prone to the same security vulnerabilities as any other operating system.
Hackers are attacking Linux in droves because of its popularity and growing usage in today's network environment. Because some versions of Linux are free --- in the sense that you don't have to pay for the base operating system --- many organizations are installing Linux for their Web servers and e-mail servers in hopes of saving money. Linux has grown in popularity for other reasons, including the following:
ߜ Abundant resources available, including books, Web sites, and consultant expertise.
ߜ Perception that Linux is more secure than Windows.
ߜ Unlikeliness that Linux will get hit with as many viruses (not necessarily worms) as Windows and its applications do. This is an area where Linux excels when it comes to security, but it probably won't stay that way.
ߜ Increased buy-in from other UNIX vendors, including IBM and Sun Microsystems. Even Novell is rewriting NetWare to be based on the Linux kernel.
ߜ Growing ease of use.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 194
194 Part IV: Operating System Hacking
In addition to the password attacks I cover in Chapter 7 and some of the malware attacks I cover in Chapter 14, many other attacks are possible against a Linux-based system. Linux can be tested remotely without being authenticated to the system. With all things being equal (that is, running the latest kernel and having the latest patches applied), it can be more difficult to glean the same amount of information from a Linux host than from a Windows or NetWare host without being logged in. After you log in to Linux with a valid username and password, you can glean a lot of information by running security tests to see how your system might stand up to a malicious internal user or hacker with a valid login.
In this chapter, I show you some critical security issues in the Linux operating system and outline some countermeasures to plug the holes so you can keep the bad guys out. A lot of this information applies to all flavors of UNIX.
I demonstrate the vulnerabilities by using Red Hat Linux versions 7.3 and 8.0, running Linux kernel version 2.4.18. I use Red Hat because it's the most popular and widely used Linux distribution. It's also the Linux that I prefer.
Linux Vulnerabilities
Vulnerabilities and hacker attacks against Linux are affecting a growing number of organizations --- especially e-commerce companies and ISPs that rely on Linux for many of their systems. When Linux systems are hacked, the victim organizations can experience the same side effects as if they were running Windows, including: ߜ Leakage of confidential intellectual property and customer information ߜ Passwords being cracked
ߜ Systems taken completely offline by DoS attacks
ߜ Corrupted or deleted databases
Choosing Tools
You can use many UNIX-based security tools to test your Linux systems.
Some are much better than others. I often find that my Windows-based commercial tools do as good a job as any. My favorites are as follows: 18 55784x Ch12.qxd 3/29/04 4:19 PM Page 195
ߜ Windows-based SuperScan (www.foundstone.com) for ping sweeps and TCP port scanning
ߜ Nmap (www.insecure.org) for OS fingerprinting and more detailed port scanning
ߜ Windows-based LANguard Network Security Scanner (www.gfi.com) for port scanning, OS enumeration, and vulnerability testing ߜ THC-Amap (www.thc.org/releases.php) for application version mapping ߜ Tiger (ftp.debian.org/debian/pool/main/t/tiger) for automatically assessing local-system security settings
ߜ Linux Security Auditing Tool (LSAT) (usat.sourceforge.net) for automatically assessing local-system security settings
ߜ VLAD the Scanner (razor.bindview.com/tools/vlad) to test for the SANS Top 10 Security Vulnerabilities
ߜ QualysGuard (www.qualys.com) for OS fingerprinting, port scanning, and very detailed and accurate vulnerability testing
ߜ Nessus (www.nessus.org) for OS fingerprinting, port scanning, and vulnerability testing
Thousands of other Linux hacking and testing tools are available. The key is to find a set of tools --- preferably as few as possible --- that can do the job that you need to do and that you feel comfortable working with.
Information Gathering
You can scan your Linux-based systems and gather information from both outside (if the system is a publicly accessible host) and inside your network.
Scan from both directions so you see what the bad guys can see from both outside and inside the network.
System scanning
Linux services --- called daemons --- are the programs that run on a system and serve up various applications for users.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 196
196 Part IV: Operating System Hacking
ߜ Internet services, such as the Apache Web server (httpd), telnet (telnetd), and FTP (ftpd), often give away too much information about the system, such as software versions, internal IP addresses, and usernames. This information can allow a hacker to attack a known weakness in the system.
ߜ TCP and UDP small services such as echo, daytime, and chargen, are often enabled by default and don't need to be.
The vulnerabilities inherent in your Linux systems depend on what services are running. You can perform basic port scans to glean information about what's running.
The SuperScan results in Figure 12-1 show many potentially vulnerable services on this Linux system, including RPC, a Web server, telnet, and FTP.
Figure 12-1:
Port-scanning
a Linux
server with
SuperScan.
In addition to SuperScan, you can run another scanner, such as Nessus or LANguard Network Security Scanner, against the system to try to glean more information, including
ߜ A vulnerable version of OpenSSH, as shown in Figure 12-2
ߜ The finger information returned by LANguard, as shown in Figure 12-3
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 197
Figure 12-2:
Using
Nessus to
discover a
vulnerability
with
OpenSSH.
Figure 12-3:
LANguard
Network
Security
Scanner
gleaning
user
information
via finger.
LANguard even determined that the server is running the Berkeley Software Distribution (BSD) r-services and more in the Alerts section of Figure 12-3. It
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 198
198 Part IV: Operating System Hacking
also displays a description of the potential vulnerability, as well as a link to the CERT Web site, which contains more information about it. Figure 12-3 also shows that LANguard thinks the remote operating system is Red Hat Linux.
This information can be handy when you come across unfamiliar open ports.
Figure 12-4 shows various r-services and other daemons that network administrators are notorious for running unnecessarily on UNIX--based operating systems. Notice that LANguard points out specific vulnerabilities associated with some of the these services, along with a recommendation to use SSH as an alternative.
Figure 12-4:
Potentially
vulnerable
r-services
found by
LANguard.
You can go a step further and find out the exact distribution and kernel version by running an OS fingerprint scan using Nmap, as shown in Figure 12-5.
Figure 12-5:
Using Nmap
to determine
the OS
kernel
version of
a Linux
server.
The QualysGuard scan of a Linux server shown in Figure 12-6 outlines threats to the system in an informative graphic form that nontechie types --- the ones to whom you may be showing the results --- just love.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 199
Figure 12-6:
Linux
threats
outlined in a
QualysGuard
scan.
Countermeasures
Although you can't completely prevent system scanning, you can still implement the following countermeasures to keep the bad guys from gleaning too much information from your systems:
ߜ Protect the systems with either
• A firewall, such as netfilter/iptables (www.netfilter.org).
• A host-based intrusion-prevention application, such as PortSentry (sourceforge.net/projects/sentrytools) now owned by
Cisco Systems (www.psionic.com) or SNARE (www.intersect alliance.com/projects/Snare).
These security systems are the best way to prevent an attacker from gathering information about your Linux systems.
ߜ Disable the services you don't need, including RPC and such daemons as HTTP, FTP, and telnet. You may very well need some of these daemons and more --- just make sure you have a business need for them.
This keeps the services from showing up in a port scan and, thus, gives an attacker less incentive to break into your system.
ߜ Make sure the latest software and patches are loaded; if a hacker determines what you're running, the chances of exploitation are reduced.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 200
200 Part IV: Operating System Hacking
Unneeded Services
When you know which applications are running --- such as FTP, telnet, and a Web server --- it's nice to know exactly which versions are running so you can look up any of their associated vulnerabilities and decide whether to just turn them off.
Searches
Several security tools can help determine vulnerabilities. These types of utilities may not be able to identify all applications down to the exact version number, but they're a very powerful way of gleaning system information.
Vulnerabilities
Be especially mindful of these known security weaknesses in a system: ߜ FTP --- especially if it's not properly configured --- can provide a way for a hacker to download and access files on your system.
ߜ Telnet is vulnerable to network-analyzer captures of the cleartext user ID and password it uses.
ߜ Old versions of sendmail --- the world's most popular e-mail server ---
have many security issues.
Make sure sendmail is patched and hardened.
ߜ R-services such as rlogin, rdist, rexecd, rsh, and rcp are especially vulnerable to hacker attacks, as I discuss in this chapter.
Tools
The following tools can perform more in-depth information gathering beyond port scanning to enumerate your Linux systems and see what the hackers see: ߜ Nmap can check for specific versions of the services loaded, as shown in Figure 12-7. Simply run Nmap with this command-line switch: -sV
ߜ Amap is similar to Nmap, but it has a couple of advantages:
• Amap is much faster for these types of scans.
• Amap can detect applications that are configured to run on nonstandard ports, such as Apache running on port 6789 instead of its default 80.
The output of an Amap scan of the localhost (hence, the 127.0.0.1
address) is shown in Figure 12-8. Amap was run with the following options to enumerate some commonly hacked ports:
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 201
-1 makes the scan run faster.
-b prints the responses in ASCII characters.
-q skips reporting of closed ports.
21 probes port.
22 probes SSH port.
23 probes telnet port.
80 probes HTTP port.
ߜ netstat shows the currently running services on a local machine. Enter this command:
netstat --anp
ߜ List Open Files (lsof) displays processes that are listening and files that are open on the system
To run lsof, enter this command at a Linux command prompt: lsof --i +M
Chapter 14 covers more on usage of lsof as well.
Figure 12-7:
Using Nmap
to check
application
versions.
Figure 12-8:
Using Amap
to check
application
versions.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 202
202 Part IV: Operating System Hacking
Countermeasures
You can and should disable the unneeded daemons on your Linux systems.
This is one of the best ways to keep your Linux system secure. It's like locking the doors and windows in your house --- the more you lock, the fewer places an intruder can enter.
Disabling unneeded services
The best method of disabling unneeded services depends on how the daemon is being loaded in the first place. There are several places to do this, depending on the version of Linux you're running.
If you don't need a service running, take the safe route. Turn it off!
inetd.conf
If it makes good business sense --- in other words, you don't need it --- disable unneeded services by commenting out the loading of daemons you don't need.
Follow these steps:
1. Enter the following command at the command prompt: ps -aux
The process ID (PID) for each daemon, including inetd, is listed on the screen. In Figure 12-9, the PID for the sshd (Secure Shell) daemon is 646.
2. Copy the PID for inetd from the screen on a notepad.
3. Open etcinetd.conf in the Linux text editor vi by entering the following command:
vi etcinetd.conf
4. When you have the file loaded in vi, enable the insert (edit) mode by pressing I.
5. Move the cursor to the beginning of the line of the daemon that you want to disable, such as httpd (Web server daemon), and type # at the beginning of the line.
This comments out the line and prevents it from loading when you reboot the server or restart inetd.
6. To exit vi and save your changes, simply press Esc to exit the insert mode, type :wq, and then press Enter.
This tells vi that you want to write your changes and quit.
7. Restart inetd by entering this command with the inetd PID: kill --HUP PID
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 203
Figure 12-9:
Viewing the
process IDs
for running
daemons
using
ps -aux.
chkconfig
If you don't have an inetd.conf file, your version of Linux is probably running xinetd (www.xinetd.org) --- a more secure replacement for inetd --- to listen for incoming network application requests. You can edit the etc xinetd.conf file if this is the case. For more information on the usage of xinetd and xinetd.conf, enter man xinetd or man xinetd.conf at a Linux command prompt. If you're running Red Hat 7.0 or later, you can run the sbinchkconfig program to turn off the daemons you don't want to load.
For example, you can enter the following to disable the snmp daemon: chkconfig --del snmpd
You can also enter chkconfig ---list at a command prompt to see what services are enabled in the xinetd.conf file.
The chkconfig program can be used to disable other services, such as FTP, telnet, and Web server.
Access control
TCP Wrappers can control access to critical services that you run, such as FTP or HTTP. This program controls access for TCP services and logs their usage, helping you control access via hostname or IP address and track malicious activities.
You can download it from www.stanford.edu/group/itss-ccs/security/
unix/tcpwrappers.html.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 204
204 Part IV: Operating System Hacking
.rhosts and hosts.equiv Files
Linux --- and all the flavors of UNIX --- are very file-based operating systems.
Practically everything that's done on the system involves the manipulation of files. This is why so many attacks against Linux are at the file level.
Hacks
If hackers can capture a user ID and password by using a network analyzer, or can crash an application and gain root access via a buffer overflow, one thing they look for is what users are trusted by the local system. The etchosts.
equiv and .rhosts files list this information.
.rhosts
The $home/.rhosts files in Linux specify which remote users can access the Berkeley Software Distribution (BSD) r-commands (such as rsh, rcp, and rlogin) on the local system without a password. This file is in a specific user's home directory, such as homejsmith. A .rhosts file may look like the this: tribe scott tribe eddie
This file allows users Scott and Eddie on the remote-system tribe to login to the local host with the same privileges as the local user. If a plus sign (+) is entered in the remote-host and user fields, any user from any host could log in to the local system. The hacker can add entries into this file by ߜ Manually manipulating it.
ߜ Running a script that exploits an insecure Common Gateway Interface (CGI) script on a Web-server application that's running on the system.
This configuration file is a prime target for a hacker attack. On most Linux systems I've tested, these files aren't enabled by default. However, a user can create one in his or her home directory on the system --- intentionally or accidentally --- which can create a major security hole on your system.
hosts.equiv
The etchosts.equiv specifies which accounts on the system can access services on the local host. For example, if tribe were listed in this file, all users on the tribe system would be allowed access! As with the .rhosts file, external hackers can read this file and then spoof their IP address and hostname to gain unauthorized access to the local system. Hackers can also use the names located in the .rhosts and hosts.equiv files to look for names of other computers to attack.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 205
Countermeasures
Use both of the following countermeasures to prevent hacker attacks against the .rhosts and hosts.equiv files in your Linux system.
Disabling commands
A good way to prevent abuse of these files is to disable the BSD r-commands altogether. This can be done by either
ߜ Commenting out the lines starting with shell, login, and exec in inetd.conf.
ߜ Editing the rexec, rlogin, and rsh files located in the etc
xinetd.d directory. Open each file in a text editor, and change disable=no to disable=yes, as shown in Figure 12-10.
Figure 12-10:
The rexec
file showing
the disable
option.
In Red Hat Linux, you can disable the BSD r-commands with the setup program: 1. Enter setup at a command prompt.
2. Select System Services from the menu.
3. Remove the asterisks next to each of the r-services.
Blocking access
A couple of countermeasures can block rogue access of the .rhosts and hosts.equiv files:
ߜ Block spoofed addresses at the firewall, as I outline in Chapter 9.
ߜ Set the permissions on these files so that only the owners can read them.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 206
206 Part IV: Operating System Hacking
• .rhosts: Enter this command in each user's home directory: chmod 600 .rhosts
• hosts.equiv: Enter this command in the /etc directory: chmod 600 hosts.equiv
You can also use Tripwire (www.tripwire.org) to monitor these files and be alerted when access or changes are made.
NFS
The Network File System (NFS) is used to mount remote file systems (similar to shares in Windows) from the local machine.
Hacks
If NFS was setup improperly or its configuration has been tampered with ---
namely, the etcexports file containing a setting that allows the world to read the entire file system --- remote hackers can easily obtain remote access and do anything they want on the system. All it takes is a line such as the following in the etcexports file: / rw
This line basically says anyone can remotely mount the root partition in a read-write fashion. Of course, the following conditions must also be true: ߜ The NFS daemon (nfsd) must be loaded, along with the portmap daemon that would map NFS to RPC.
ߜ The firewall must allow the nfs traffic through.
ߜ The remote systems that are allowed into the server running the NFS
daemon must be placed into the etchosts.allow file.
This remote-mounting capability is easy to misconfigure. It's often related to a Linux administrator's not understanding what it takes to share out the NFS
mounts and just resorting to the easiest way possible to get it working. After hackers can gain remote access, the system is theirs.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 207
Countermeasures
The best defense against NFS hacking depends on whether you actually need the service running.
ߜ If you don't need NFS, disable it altogether.
ߜ If you need NFS, implement both of the following countermeasures:
• Filter NFS traffic at the firewall --- typically, TCP port 111 if you want to filter all RPC traffic.
• Make sure that your etcexports and etchosts.allow files are configured properly to keep the world outside your network.
File Permission
In Linux, special file types allow programs to run with the file owner's rights: ߜ SetUID (for user IDs)
ߜ SetGID (for group IDs)
SetUID and SetGIF are required when a user runs a program that needs full access to the system to perform its tasks. For example, when a user invokes the passwd program to his or her password, the program is actually loaded and run with root or any other user's privileges. This is done so that the user can run the program, and the program can update the password database without root's having to get involved in the process manually.
Hacks
By default, rogue programs that run with root privileges can be easily hidden.
A hacker may do this to hide such hacking files as rootkits on the system.
Countermeasures
You can test for these rogue programs by using both manual and automated testing methods.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 208
208 Part IV: Operating System Hacking
Manual testing
The following commands can identify SetUID and SetGID programs: ߜ Programs that are configured for SetUID:
find / -perm -4000 --print
ߜ Programs that are configured for SetGID:
find / -perm -2000 --print
ߜ Files that are readable by anyone in the world:
find / -perm -2 -type f --print
ߜ Hidden files:
find / -name ".\*"
You probably have hundreds of files in each of these categories, so don't be alarmed. When you discover files with these attributes set, you'll need to make sure that they are actually supposed to have those attributes by researching in your documentation, on the Internet, or even by comparing them to a known secure system or data backup.
Keep an eye on your systems to detect any new SetUID or SetGID files that suddenly appear.
Automatic testing
You can use an automated file-modification auditing program to alert you when these types of changes are made. This is what I recommend --- it's a lot easier on an ongoing basis.
ߜ A change-detection application, such as Tripwire, can help you keep track of what changed and when.
ߜ A file-monitoring program, such as COPS (dan.drydog.com/cops), finds files that have changed in status (such as a new SetUID or removed SetGID).
Buffer Overflows
RPC and other vulnerable daemons are common methods for buffer-overflow attacks. Buffer-overflow attacks are often how the hacker can get in to modify system files, read database files, and more.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 209
Attacks
In a buffer-overflow attack, the hacker either manually sends strings of information to the victim Linux machine or writes a script to do so. These strings contain
ߜ Instructions to the processor to basically do nothing.
ߜ Malicious code to replace the attacked process.
For example, exec ("binsh") creates a shell command prompt.
ߜ A pointer to the start of the malicious code in the memory buffer.
If an attacked application (such as FTP or RPC) is running as root (many programs do), this can give the hacker root permissions in his remote shell.
You can run securitytesting tools against your systems to test for buffer overflows, but I don't recommend it, because it can crash your system!
Countermeasures
Three main countermeasures can help prevent buffer-overflow attacks: ߜ Disable unneeded services.
ߜ Protect your Linux systems with either a firewall or host-based intrusion prevention.
ߜ Enable another access control mechanism, such as TCP Wrappers, that authenticates users with a password.
Don't just enable access controls via an IP address or hostname. That can easily be spoofed.
Always make sure that your systems have been updated with the latest kernel and security patches.
Physical Security
Some Linux vulnerabilities involve the hacker's actually being at the system console.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 210
210 Part IV: Operating System Hacking
Hacks
When a hacker is at the system console, anything goes, including rebooting the system (even if no one is logged in) simply by pressing Ctrl+Alt+Del. After the system is rebooted, the hacker can start it up in single-user mode, which allows the hacker to zero out the root password or possibly even read the entire etcpasswd or etcshadow file.
Countermeasures
Edit your etcinittab file and remark out (place a # sign in front of) the line that reads ca::ctrlaltdel:sbinshutdown -t3 -r now , as shown in the last line of Figure 12-11.
Figure 12-11:
etcini
ttab
showing the
line that
allows a
Ctrl+Alt+Del
shutdown.
If you believe that a hacker has recently gained access to your system either physically or by exploiting a vulnerability such as a weak password or buffer overflow, you can use the last program to view the last few logins into the system to check for strange login IDs or login times. This program peruses the varlog/wtmp file and displays the users who logged in last. You can enter last | head to view the first part of the file (the first ten lines) if you want to see the most recent logins.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 211
General Security Tests
You can assess critical, and often-overlooked, security issues on your Linux systems, such as the following:
ߜ Misconfigurations or unauthorized entries in the etcpasswd and
etcshadow files
ߜ Password policies
ߜ Users equivalent to root
ߜ Suspicious automated tasks configured in cron
ߜ Signature checks on system binary files
ߜ Checks for rootkits
ߜ Network configuration, including measures to prevent packet spoofing and other DoS attacks
ߜ Permissions on system log files
You can do all these assessments manually --- or, better yet, use an automated tool to do it for you! Figure 12-12 shows the initiation of the Tiger security auditing tool, and Figure 12-13 shows a portion of the audit results. Talk about some great bang for no buck with this tool!
Figure 12-12:
Running
the Tiger
security
auditing
tool.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 212
212 Part IV: Operating System Hacking
Figure 12-13:
Partial
output of the
Tiger tool.
I like to run the Red Hat--focused Linux Security Auditing Tool (LSAT) in addition to Tiger. It's similar to Tiger, but it also searches for Red Hat Linux-specific security issues.
You can use to test for the SANS Top 20 (www.sans.org/top20) Vulnerabilities is VLAD the Scanner by the Bindview Razor security team. A portion of its output is shown in Figure 12-14.
Figure 12-14:
Partial
output of the
VLAD the
Scanner
tool.
Patching Linux
Ongoing patching is perhaps the best thing you can do to enhance the security of your Linux systems. Regardless of the Linux distribution you use, using a tool to assist in your patching efforts makes your job a lot easier.
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 213
Distribution updates
The distribution process is different on every distribution of Linux. You can use the following tools, based on your specific distribution.
Red Hat
You can use the following tools to update Red Hat Linux systems: ߜ Red Hat Package Manager (RPM), which is the GUI-based application that runs in the Red Hat GUI desktop. It manages those files with a .rpm extension that Red Hat and other freeware and open-source developers use to package their programs.
ߜ up2date, a command-line text-based tool that is included in Red Hat.
ߜ AutoRPM (www.autorpm.org).
ߜ The open-source NRH-up2date (www.nrh-up2date.org).
Debian
You can use the Debian Package System (dpkg) included with the operating system to update Debian Linux systems.
Slackware
You can use the Slackware Package Tool (pkgtool) tool included with the operating system to update Slackware Linux systems.
SuSE/Novell
SuSE (now owned by Novell) includes the YaST2 Package Manager.
Multiplatform update managers
Commercial tools add nice features over the standard package managers (which I describe in this chapter), such as correlating patches with vulnerabilities and automatically deploying appropriate patches. Commercial tools that can help with Linux patch management include BigFix Patch Manager (www.bigfix.com) and SysUpdate (www.securityprofiling.com).
18 55784x Ch12.qxd 3/29/04 4:19 PM Page 214
214 Part IV: Operating System Hacking
19 55784x Ch13.qxd 3/29/04 4:18 PM Page 215
In This Chapter
ᮣ Selecting NetWare hacking tools
ᮣ Port-scanning a NetWare server
ᮣ Gleaning NetWare information without logging in
ᮣ Exploiting common vulnerabilities when logged into NetWare
ᮣ Minimizing NetWare security risks
As much as some of Novell's competitors like to say that NetWare is a thing of the past, it's still alive and kicking quite strongly. There are millions of NetWare users around the world. The organizations running NetWare and other Novell products demand a solid directory-services infrastructure and stable environment.
NetWare administrators --- some of the best around --- often overlook or deny that NetWare is hackable. This chapter shows you how to test for the most critical NetWare exploits and outlines countermeasures to prevent the problems.
NetWare Vulnerabilities
Novell NetWare has a reputation as one of the most secure operating systems available. This is one reason that you rarely hear of NetWare servers' getting hacked or having new vulnerabilities that crop up constantly. However, NetWare has its security issues. Various NetWare vulnerabilities can be exploited --- from NDS (now called eDirectory) enumeration to remote password testing to spoofing NetWare packets. Hackers can exploit many of NetWare's vulnerabilities without even logging into the server!
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 216
216 Part IV: Operating System Hacking
NetWare servers are frequently the most vital servers within a network. They often perform the following functions:
ߜ House critical files
ߜ Store replicas of the eDirectory database for hosting, replicating, and managing such directory-service objects as user IDs, printers, organizational units, and application licenses
ߜ Host e-mail with Novell GroupWise
ߜ Host Web sites and Web applications with such programs as Apache and Tomcat
ߜ Serve as firewalls with Novell BorderManager
Starting with NetWare 7, Novell will release a version of NetWare that's Linux-based. So, if you do a lot of work with NetWare, now's the time to start beef-ing up on your Linux skills!
Choosing Tools
The following are my favorite NetWare-specific tools --- they can offer up everything you need:
ߜ SuperScan (www.foundstone.com) for port scanning ߜ LANGuard Network Security Scanner (www.gfi.com) for port scanning, OS enumeration, and vulnerability testing ߜ NCPQuery (razor.bindview.com/tools/index.shtml) for server and eDirectory enumeration
ߜ Remote (packetstormsecurity.nl/Netware/penetration) for Remote Console password cracking
Make sure that you have the latest version of Novell's Client32 software from download.novell.com on your test computer before running these tests.
Getting Started
Although NetWare doesn't have many serious security vulnerabilities (relatively speaking), a few stand out. The hacks in this chapter are against a default installation of NetWare 5.1 from inside the firewall. However, these 19 55784x Ch13.qxd 3/29/04 4:19 PM Page 217
vulnerabilities and tests apply to most versions of NetWare 4. x and newer ---
the ones running NDS and eDirectory. I also point out a few critical NetWare 3. x vulnerabilities.
Patches on your specific systems may have fixed some of these vulnerabilities. If you don't get the exact same results as shown in this chapter, you're probably safe!
If you have the latest Novell-supplied patches on your systems, your systems are likely to be secure. However, the hacks in this chapter are significant, so you should test for them to make sure that your server is safe.
Older versions of NetWare such as 4.2 and 5.0 are being phased out of support. You'll no longer receive security updates for these versions.
Server access methods
You can access a NetWare server in the following four ways --- each of which affects how you can test:
ߜ Not-logged in: This is a connection where you simply perform port scans or make NCP calls across the network without actually logging in.
ߜ Logged in: This connection requires you to log in with a valid bindery or eDirectory user ID and password.
This is the basic method for accessing standard NetWare services.
ߜ Web access: This connection may be available if you're running GroupWise WebAccess e-mail services, various NetWare management tools, or other basic Web-server applications.
ߜ Console access: This access method requires you to be either at the server console or using a remote-connectivity product (such as NetWare's built-in rconsole or even a console that shipped with NetWare 3. x and earlier systems).
When you finish scanning your NetWare systems for open ports and general information gathering, you can test for common NetWare security vulnerabilities.
Port scanning
Start testing your NetWare systems by performing an initial port scan to check what hackers can see. You can perform these scans in two main ways:
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 218
218 Part IV: Operating System Hacking
ߜ If the server has a public IP address, scan from outside the firewall, if possible.
ߜ If the server doesn't have a public IP address, you can scan internally on the network.
Hackers can be inside your network, too!
The SuperScan results in Figure 13-1 show several potentially vulnerable ports open on this NetWare server, including FTP and the commonly exploited Echo and Character Generator ports. In addition, the NetWare specific port 524 is NCP (NetWare Core Protocol). NetWare uses this protocol for its internal communications with such hosts as clients and other servers --- similar to SMB in Windows.
Figure 13-1:
Using
SuperScan
to scan a
default
installation
of NetWare
5.1.
You may also find that GroupWise is running (TCP port 1677), as well as potentially a Web server and other Web-based remote-access ports, such as 80, 443, 2200, 8008, and 8009.
You can also perform a scan with LANguard Network Security Scanner. Using a commercial tool such as this can often provide more details about the systems you're scanning than a basic port scanner. Figure 13-2 shows that it can determine more information about the server, such as the NetWare version and SNMP information. It also tells you what's listening on the open ports without your having to look them up.
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 219
Figure 13-2:
Gathering
details with
LANguard
Network
Security
Scanner.
NCPQuery
You can run NCPQuery with command line options to gather information about your server and directory tree, including the server information shown in Figure 13-3.
Figure 13-3:
Server and
eDirectory
information
gleaned
with
NCPQuery.
This is a lot of information for a hacker to see without being logged in!
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 220
220 Part IV: Operating System Hacking
Countermeasures
The following countermeasures can prevent the malicious enumeration of your NetWare systems:
ߜ Installing the latest patches can eliminate many NetWare server vulnerabilities.
If your NetWare version has been or will be phased out by Novell ---
meaning that it no longer provides security patches --- you should seriously consider upgrading to the latest version.
ߜ Port scanning can be performed with two steps:
1. Unload any unneeded services, which in turn closes any associated ports.
2. Place the server behind a firewall to help block outsider attacks.
ߜ Blocking NCP port 524 at the firewall is the only way to disable an NCPQuery type of attack from outside.
This may not help much for insider attacks. Internal network communications require the NCP port 524 to be available.
ߜ Use strong passwords for all user IDs in case a hacker discovers an ID
and attempts to log in.
Authentication
If a hacker can gather information such as the server, eDirectory, and user ID
information, he may be able to exploit a known vulnerability or even try to log in by using the user IDs that he discovered. When he's in, all bets are off, and anything goes. He could
ߜ Log into your network as a regular user.
ߜ Log into your network as admin.
ߜ Obtain physical access to the server console.
It's wise to assume that a hacker could log in as a user or administrator on your NetWare system and test for the worst-case scenario.
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 221
Rconsole
One of the most serious NetWare security vulnerabilities is the NetWare Remote Console program (referred to as rconsole). Rconsole is an SPX
protocol--based remote-control program similar to telnet and Windows Terminal Services. It gives users full access to the NetWare console if they know the password. rconsole consists of the following: ߜ The remote.nlm and rspx.nlm files on the server ߜ The rconsole.exe client program in the sys:\public directory ߜ For rconsole to work, you must load the rspx NLM with one of these methods:
• Enter load rspx at the console.
• Place it in your autoexec.ncf or ldremote.ncf file just below your load remote line.
Attacks
Rconsole is vulnerable because its passwords can be easily obtained. The passwords are stored in either clear text or an easily crackable hash format on the server in the sys:\system\autoexec.ncf file or sys:\system\ ldremote.ncf files.
If you encrypt your rconsole passwords, cracking them is simple. The following steps demonstrate how vulnerable the rconsole password really is: 1. Enter load remote to load the remote NetWare Loadable Module (NLM) on the server.
2. Enter the password you want to use when prompted.
3. Enter remote encrypt and enter your rconsole password again when prompted.
The server generates the encrypted password and displays the entire command you need to run on the screen, including the hashed password. It looks similar to the response in Figure 13-4.
The server may also enter the command into the ldremote.ncf file, but it sometimes fails. For simplicity, just enter the load remote -E
password command manually into your autoexec.ncf file. Don't write this password down somewhere that's easily accessible to others.
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 222
222 Part IV: Operating System Hacking
Figure 13-4:
Encrypting
your
rconsole
password.
Now it's time to try cracking the encrypted rconsole password. For this, I use the remote cracking program --- not to be confused with the remote NLM
that's part of rconsole.
Simply run the remote.exe cracking program against the rconsole password hash that's displayed on the screen (or stored in the server's autoexe.ncf or ldremote.ncf file). Enter a line like the following at a command prompt: remote password\_hash The result is the rconsole password.
You can try the preceding steps against my password. Figure 13-4 shows the hash:
287502221D2EBB4BCDD44BDC68
Anyone using the following three items can even capture the encrypted rconsole password traveling across the wire and decrypt it: ߜ Network analyzer
ߜ Rcon program (packetstormsecurity.nl/Netware/penetration/
rcon.zip)
ߜ The steps outlined in the rconfaq.txt file at packetstormsecurity.
nl/Netware/audit/rconfaq.zip
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 223
The remote NLM stores its password in server memory. Anyone with console access can go into the NetWare debugger by pressing Shift+Alt+Shift+Esc (yes, you use both Shift keys) on the server keyboard and view it in clear text. The process is explained at packetstormsecurity.nl/Netware/
audit/rconfaq.zip.
Countermeasures
The following can prevent attacks against NetWare servers running rconsole: ߜ Don't use rconsole --- at least, don't use it on critical NetWare servers.
(Does anyone have a server that isn't critical?)
ߜ If you must use rconsole, secure it with one of the following steps for your version of NetWare:
• In NetWare 4. x or earlier, lock your server by using the monitor NLM.
• With NetWare 5 and newer, load the scrsaver NLM. It displays the fancy text-based NetWare snake and requires a valid NetWare account to unlock.
ߜ Consider using one of these remote NetWare management programs instead of rconsole:
• Rconj is a Java-based version of rconsole that's able to work over using TCP. It comes with NetWare 5. x and later but has limited functionality.
Be sure to patch Rconj if you run it on NetWare 6. Rconj has a known authentication vulnerability when running on NetWare 6 that allows a hacker to gain access without a password.
• AdRem Software (www.adremsoft.com) offers a couple of great rconsole replacements that I highly recommend you check out.
• AdRem Free Remote Console runs on NetWare 4. x SP9 and later servers.
As the name implies, it's free!
AdRem Free Remote Console doesn't encrypt remote-console communications, but it does require a valid NetWare login with a user ID that has console operator privilege (such as admin or equivalent). This adds a level of security that plain old rconsole just can't offer.
• AdRem sfConsole is a commercial product with a ton of features, including encrypted communications and a Web-based interface.
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 224
224 Part IV: Operating System Hacking
Server-console access
Physical access to the server console is a hacker's pot of gold. After hackers obtain this access, they can do practically anything they want to with the server. This includes accessing the NetWare debugger to retrieve passwords and potentially other confidential information stored in memory --- not to mention crash the server and more.
The following countermeasures help ensure that NetWare console access is minimized to only those who are authorized:
ߜ Physical security is a must. Chapter 6 explains how to secure server rooms.
ߜ Lock the server screen. You can keep the server console secure by either selecting the Lock Server Console option in the monitor NLM or loading the scrsaver NLM.
Intruder detection
Intruder detection is one of the most critical security features built into NetWare. It locks a user account for a specific period of time after a certain number of failed login attempts.
Make sure that intruder detection is enabled on your system. It's disabled by default.
Testing
Default settings for intruder detection --- after it's enabled --- in NetWare 5.1
are shown in Figure 13-5. Chapter 7 details intruder detection.
Try logging in with invalid passwords for several test users --- preferably, users from different organizational units (OUs) within eDirectory --- to see whether intruder detection is working. Make sure that you type bad passwords; blank ones don't seem to work well for this test. Here's how you know whether intruder detection is working: ߜ If intruder detection is on, you should get a response similar to Figure 13-6.
ߜ If intruder detection is off, you get prompted over and over again for a password.
This is how hackers test whether intrusion detection is enabled on your NetWare server.
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 225
Figure 13-5:
Intruder---
detection
settings in
NetWare
5.1.
Figure 13-6:
A Novell
Client32
message.
Countermeasures
You can implement the following countermeasures to ensure that unauthorized logins are minimized and intruder detection is not abused: ߜ Enable intruder detection as high in the directory tree as possible --- preferably, at the uppermost organization level.
This is one of the best hacking countermeasures you can implement in a NetWare environment.
ߜ Look for evidence that the console NLM was unloaded by searching for entries in the sys:\etc\console.log file.
ߜ Consider logging all events to a remote syslog server to help prevent a hacker from tampering with evidence.
Rogue NLMs
If a hacker gains console access to your server, a legitimate yet potentially dangerous NLM can be loaded, which can do bad things to the system.
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 226
226 Part IV: Operating System Hacking
Testing
The following tests look for rogue NLMs running on your server.
Modules command
You can use the modules command at the server console prompt to view loaded modules. As shown in Figure 13-7, you simply enter the command modules at the server-console screen, and it displays a listing of NLMs that are loaded --- from first to last in order of loading.
Figure 13-7:
Viewing
loaded
applications
on a
NetWare
server.
Look for these NLMs in the modules output. If neither you nor another administrator has loaded the following NLMs, you have a problem: ߜ Password reset tools:
• setpwd
This third-party NLM can reset any user's password on the server ---
including admin! It's located at ftp.cerias.purdue.edu/pub/
tools/novell/setpwd.zip.
• setspwd
This program resets the supervisor/admin password for NetWare 3. x and 4. x.
• setspass
This program resets the supervisor password for NetWare 3. x systems.
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 227
ߜ dsrepair: This built-in NLM can corrupt or destroy eDirectory. It's actually intended to repair and maintain the eDirectory database.
ߜ netbasic: This built-in NLM can copy eDirectory files from the hidden sys:\\_netware directory. It accesses a DOS-like prompt on the server.
Check whether the nwconfig NLM is loaded. This built-in NLM is often used for day-to-day server maintenance, such as installing patches and editing system files. However, a hacker can load it and back up or restore the eDirectory database so that its files can be copied for malicious purposes.
You can look to see if the NLM is loaded by either
ߜ Looking at the modules output
ߜ Pressing Ctrl+Esc to view all loaded applications
ߜ Pressing Alt+Esc to toggle through all loaded applications Many NLMs can load on a NetWare server --- especially in the more recent versions. If you have a question about what an NLM does or want to see whether it's valid, you can search on the filename at www.google.com or at support.novell.com to get more information.
A port scan of the server from another computer can find rogue applications as well.
Tcpcon
The tcpcon NLM shows ports that are listening and connected. Follow these steps to use it:
1. Enter load tcpcon at the server prompt.
2. Select Protocol Information from the main menu.
3. Select TCP and then TCP Connections to view the TCP ports that are open.
4. Select UDP and then UDP Listeners to view the UDP ports that are open.
Figure 13-8 shows the TCP ports that are open and listening on this server, including chargen, FTP, and NCP.
If something doesn't look right, it may not be, so investigate the port number further. My favorite port number reference is at www.iana.org/assignments/
port-numbers, but a simple Google search usually is productive.
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 228
228 Part IV: Operating System Hacking
Figure 13-8:
Using
tcpcon to
show open
TCP ports
on a
NetWare
server.
Admin utilities
If hackers can successfully log in to a NetWare server or eDirectory, they can use, in malicious ways, some of the great --- and free --- NetWare admin utilities from JRB Software (www.jrbsoftware.com). For example, hackers can ߜ Run the downsrvr program to reboot a NetWare server --- most likely at the worst possible time.
ߜ Use the serv\_cmd program to disable logins, remotely load NLMs, and add bindery contexts to the system.
Countermeasures
The following countermeasures can minimize the chances that malicious NLMs will be running on your servers.
Documentation
The best way to keep track of loaded NLMs is to document, document, and document your server. It's critical to know what's supposed to be loaded on your server at all times.
ߜ For each loaded NLM, you need to know its name, version, and date.
Keeping up-to-date records can get tedious, especially with a large number of servers. Consider purchasing a commercial product ---
NetServerMon or AdRem Server Manager --- to help you manage this task.
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 229
ߜ Save and print recent versions of your startup.ncf and autoexec.ncf files.
ߜ Document --- at least, at a high level --- your eDirectory structure. You can either
• Take a screen capture of eDirectory as it looks in NetWare Administrator or ConsoleOne.
• Run cx t a /r, and save the output of the program to a text file by entering the following at a command prompt:
cx t a /r > filename.txt
Update your documentation after any system changes are made or any new patches are applied.
Unauthorized logins
To prevent rogue NLMs or remote applications from being loaded or run from a workstation, apply these security measures to your NetWare systems: ߜ Make strong passwords on every NetWare account. I outline minimum password requirements in Chapter 7.
ߜ Secure the server console.
ߜ Enable intruder detection.
ߜ Neutralize dangerous NLMs, such as netbasic. You can either rename them or remove them.
If you remove dangerous NLMs, make a backup of the files first. You may need them in the future.
Cleartext packets
Most internal LAN traffic --- regardless of the operating system in use --- travels across the wire in clear text. The clear text can be captured and used against you.
Packet capture
Cleartext packets can be captured with either
ߜ A network analyzer
ߜ Components of the Pandora NetWare hacking suite (www.nmrc.org/
project/pandora)
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 230
230 Part IV: Operating System Hacking
Pandora can spoof NCP packets, which can give them admin equivalency on the network after the hacker logs in via a standard user account that he previously compromised. A hacker could log in as a normal user with a weak or blank password and then use Pandora to manipulate NetWare traffic and get admin rights on the network.
Countermeasures
You can easily set up NCP packet signing within a NetWare environment. This encrypts and provides proof that a packet actually originated from the sending host. NCP packet signing has four levels, but the level for the utmost security is level 3, which requires packet signatures.
This can slow network traffic and place a larger processing burden on your server. Level-3 packet signing can decrease network performance on busy NetWare servers --- sometimes, by more than 50 percent.
The following steps explain how to enable level-3 packet signing: ߜ Enable level-3 packet signing on the server and at the top of the autoexec.ncf file with the following command:
set ncp packet signature option=3
ߜ Enable level-3 packet signing on NetWare clients with these steps: 1. Right-click your red Novell icon in your Windows system tray.
2. Select Novell Client Properties and Advanced Settings.
3. Set the Signature Level to 3 (Required).
In NetWare 3. x and earlier, passwords are sent in clear text across the network. For these versions, you can enter the following command on your server and in the autoexec.ncf file to help prevent passwords from being captured with a network analyzer: set allow unencrypted passwords=off
General Best Practices for Minimizing
NetWare Security Risks
Although you can't completely defend NetWare servers against attacks, you can come close, which is more than you can say for other leading operating systems. These NetWare hacking countermeasures can help improve security on your NetWare server above and beyond what I've already recommended.
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 231
Rename admin
Rename the admin account. Figure 13-9 shows how this can be done in the Novell ConsoleOne utility.
Figure 13-9:
Renaming
the
NetWare
admin
account
with
ConsoleOne.
Be careful. Other applications, such as the server backup software, may depend on this ID.
If you rename admin, be sure to edit any backup jobs or startup scripts that depend on the admin account. It's actually best to not use the admin account for these purposes anyway, so this may be a good time to make a change by creating an admin equivalent for each application that's dependent on an admin ID. This can help make your system more secure by reducing the number of places that the admin account is exposed and vulnerable to cracking on the network.
Disable eDirectory browsing
A good way to ward off attacks is to disable Public's right to browse the directory tree in either NetWare Administrator for NetWare 4. x or Novell ConsoleOne for NetWare 5. x and later. This right is enabled by default to enable users to browse the eDirectory tree easily.
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 232
232 Part IV: Operating System Hacking
Disabling the Public Browse right or any other eDirectory or file rights can cause problems, such as locking users (including you) out of the network, disabling login scripts, and disabling printing. The potential risk depends on how you configure eDirectory. If you remove Public's Browse right, you can usually grant specific object rights lower in the tree where they're needed to keep everything working. Make sure that you test these types of critical changes before applying them to your production environment.
NetWare Administrator
Follow these steps to disable the Public browse right to eDirectory with NetWare Administrator (sys:\public\win32\nwadmn32.exe): 1. Right-click the Root object in your directory tree.
2. Select Trustees of this Object.
3. Select the [Public] trustee, as shown in Figure 13-10.
4. Uncheck the Browse object right.
Figure 13-10:
The default
Browse
right for
[Public],
shown in
NetWare
Administrator.
Novell ConsoleOne
Follow these steps to disable the Public browse right to eDirectory with Novell ConsoleOne (sys:\public\mgmt\ConsoleOne\1.2\bin\
ConsoleOne.exe):
1. Right-click your tree object.
2. Select Trustees of this Object.
19 55784x Ch13.qxd 3/29/04 4:19 PM Page 233
3. Select the [Public] trustee and then click Assigned Rights.
4. Uncheck the Browse right, as shown in Figure 13-11.
Figure 13-11:
The default
Browse
right for
[Public],
shown in
ConsoleOne.
Removing bindery contexts
Remove any bindery contexts loaded on your server. Bindery contexts are in place in NetWare 4. x and later to provide backward compatibility with older clients that need to access the servers as though they're NetWare 3. x or earlier servers. This is typically due to either older applications or NetWare clients (such as netx and VLMs) that make bindery calls instead of eDirectory calls.
Removing bindery contexts can help prevent hacker attacks against bindery weaknesses. To disable the bindery context on your server, simply remark out the set Bindery Context line in your server's autoexec.ncf file.
If you remove your bindery contexts, make sure that no clients or applications depend on NetWare bindery emulation.
System auditing
Turn on system auditing by running the auditcon program at a command prompt. This can help you track down a future intruder by auditing files, volumes, and even the directory tree. It's just good security practice as well. You 19 55784x Ch13.qxd 3/29/04 4:19 PM Page 234
234 Part IV: Operating System Hacking
can get specific instructions on using auditcon for system auditing purposes in the Novell Technical Information Document How to setup Auditing on your Network at support.novell.com/cgi-bin/search/searchtid.cgi?/
10068513.htm.
TCP/IP parameters
In NetWare 5. x and above, based on your specific version, you can prevent several types of DoS attacks as shown below by entering the following TCP/IP
parameters at the server console:
set discard oversized ping packets=on
set discard oversized UDP packets=on
set filter subnet broadcast packets=on
set filter packets with IP header options=on
set ipx netbios replication option=0
set tcp defend land attacks=on
set tcp defend syn attacks=on
You can enter the preceding commands into the server's autoexec.ncf file so that they load each time the server starts.
Patching
Patch, patch, and patch again! Novell lists the latest patches for the NetWare versions it supports on its Web site:
support.novell.com/produpdate/patchlist.html#nw
20 55784X PP05.qxd 3/29/04 4:18 PM Page 235
Hacking
20 55784X PP05.qxd 3/29/04 4:18 PM Page 236
In this part . . .
Well, this book has covered everything from nontechnical hacks to network hacks to operating
system hacks. One major category is left to cover: the applications that run on top of all of this.
This part first covers malware (you know, those darn
viruses, worms, and so on) and malware prevention tools, along with some various countermeasures. Although malware is not particularly an application ethical hackers use (at least try not to use), it still affects everything else done on networks from a security perspective, including messaging systems and Web applications, which are also in this part. This part then takes a look at various messaging hacks and countermeasures affecting e-mail and instant messaging systems. Finally, this part takes a look at common Web application hacks, along with some countermeasures to secure them from the elements.
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 237
In This Chapter
ᮣ Distributing malware
ᮣ Testing your systems
ᮣ Preventing malware
Malicious software (malware) has long been one of the biggest problems computer users face. Viruses and worms have proved to be the biggest nuisances, but these types of malware are ineffective if adequate controls are in place. On the other hand, such types of malware as Trojan horses and rootkits can inflict serious harm against computers and information, and are much harder to defend against.
The implications of testing your own systems with malware attacks --- as hackers would do --- are similar to some of the social-engineering and physical-security attacks I cover elsewhere in the book. Introducing known malware into your production systems is just not a good idea, considering that your business is at stake. In this chapter, although I cover some benign tests you can run against your systems, I focus on how malware gets onto your systems, how to find and remove it after an infection is found, and what proven countermeasures you can take to increase the odds that malware stays out of your systems.
Implications of Malware Attacks
Malware is one of the greatest threats to the security of your information. Not only do you have to deal with the well-known malware --- the ILoveYous and Code Reds of the world --- infecting your computers, but also, hackers are constantly developing new ways to wreak havoc on systems. It seems that every month, widespread malware attacks take place around the globe. The more recent attacks are mostly self-propagating --- which means that they need no user intervention to spread across computer networks and the Internet.
These programs attack unpatched software and gullible users opening malicious e-mail attachments
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 238
238 Part V: Application Hacking
A case study in malware with Ed Skoudis
In this case study, Ed Skoudis, an information---
should not install rootkits or introduce self---
security consultant for International Network
replicating code, such as viruses and worms,
Services, shared an experience he had related
because they can make a production machine
to malware. Here's his account of what extremely unstable.
happened.
With the Netcat backdoor firmly lodged on the
The situation
target system, the team set up shop on the
victim Windows Web server. They installed their
Mr. Skoudis and his penetration-testing team
scanning tools on this machine, including the
were hired by a large financial institution to
Nmap port scanner. Using the conquered Web
determine whether they could break into the
server as a jump-off point to scan further into
bank's updated Internet gateway infrastructure.
the network, the team found another vulnerable
This penetration test focused on the new ele---
system. This time, they discovered a poorly con---
ments of their infrastructure, including several
figured Solaris machine on the internal network
VPN gateways, firewalls, routers, and a handful
that allowed SSH access with an easily
of servers. The goal of the test was to search for
guessed password. After he and his team com---
vulnerabilities and see how deep into the target
promised the Solaris server, they installed
production network the team could penetrate.
another Netcat backdoor on that system.
The Web server was where things started to get
With two relatively common flaws --- an
interesting for Mr. Skoudis and his team. During
unpatched Windows Web server and an easily
the test in mid-2003, while scanning all of the
guessed password --- Mr. Skoudis and his team
target systems for vulnerabilities with the free
managed to gain deep access into the target
Nessus tool, the team discovered that the Web
network. He emphasized the possibility of this
server was vulnerable to the WebDAV buffer---
type of attack by a not-so-ethical hacker, along
overflow exploit. This flaw was originally
with the widespread availability of the malware
announced by Microsoft in March 2003, but no
needed to carry it out, and underscored the
one had patched the server for 60 days.
importance of having a solid security program.
The outcome
This includes keeping systems patched and
educating users and administrators in selecting
Mr. Skoudis and his team were able to execute
difficult-to-guess passwords.
commands on the machine by tickling WebDAV
and installed the Netcat tool to create a back---
Ed Skoudis uses his exceptional technical
door. Then they scheduled the Netcat backdoor
expertise to perform security assessments,
to restart every 10 minutes, to make sure they
design secure network architectures, and
could reenter the system continually if they
respond to computer attacks for his customers.
were ever knocked off. Mr. Skoudis emphasized
He is a well-known speaker on issues associ---
that penetration testers need to be extremely
ated with hacker tools and defenses, and has
careful in choosing the type of malware they uti---
authored the excellent Prentice Hall books
lize in their testing regimen. As a side note, he
Malware: Fighting Malicious Code and Counter stated that he installs only application-level
Hack: A Step-by-Step Guide to Computer
backdoors that are well understood, like Netcat.
Attacks and Effective Defenses.
In addition, he stressed that penetration testers
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 239
Most malware attacks --- especially the recent ones --- exploit well-known vulnerabilities that should've been fixed months before the attacks occur.
Unfortunately, the general practice within IT and security is to install patches when people get around to it. This is mostly because people either don't make it a priority to patch or simply can't keep up with all the patches required across all their systems. The hackers know this and take full advantage of it.
The widespread malware attacks that you hear about on the news aren't the ones to worry about. Trojan horses, rootkits, spyware, and other devious programs are the scary ones. These applications can do the following: ߜ List running processes and applications ߜ Load and kill running processes and applications
ߜ Capture keystrokes
ߜ Search and copy files
ߜ Steal passwords
ߜ Edit system files
ߜ Turn on Web cams and microphones
ߜ Remotely reboot computers
ߜ Perform practically any administrative function
Bad things can happen if any of these events occurs on your network, including confidential information being stolen, computers being taken offline, and data being deleted.
Types of Malware
Most malware is platform-specific: It targets specific operating systems, applications, and vulnerabilities to spread more quickly.
Trojan horses
Trojan horses --- named after the infamous Greek wooden horse used to penetrate the city of Troy --- are executable files, often transmitted via e-mail, that masquerade as legitimate programs but actually perform malicious acts.
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 240
240 Part V: Application Hacking
Trojan-horse code works in the background --- doing things like deleting information, gathering passwords, and capturing keystrokes --- while a legitimate-looking program, such as a screen saver or game, runs in the foreground.
Many Trojans --- called remote-access Trojans, or RATs --- set up backdoors on the systems they infect, allowing hackers to access them remotely and control them from across the Internet. Many Trojans aren't detected by antivirus programs. With all things being equal (and antivirus software running), this is the malware you should be afraid of. Some common RATs are NetBus, SubSeven, and Back Orifice.
Viruses
Computer viruses are the best-known malware category. Viruses are programs that are often self-replicating --- meaning that they can make copies of themselves --- and attach to executable files, deleting information and crashing computers whenever a user or other process runs the program. Even PDA viruses exist, some of which drain batteries and call 911 for you --- how thoughtful!
Worms
Worms are self-propagating programs that travel around the Internet at lightning speed. They load up in memory, effectively exploit known software vulnerabilities, and often end up crashing the systems.
Rootkits
Rootkits are nasty applications that hackers can use to control a computer completely, with the ultimate prize of crashing the system or stealing information. Rootkits are mostly found on UNIX systems but are becoming popular on the Windows platform. Rootkits are sets of programs that either ߜ Masquerade as typical administrator command-line programs ߜ Integrate into the kernel, or core, of the operating system Kernel-based rootkits, such as Knark for Linux and the FU rootkit for Windows, tie into the actual operating system. With these programs, hackers can 21 55784x Ch14.qxd 3/29/04 4:18 PM Page 241
ߜ Hide system processes and applications from the Windows Task Manager or the process list in UNIX
ߜ Change the group membership of processes and applications so that a malicious program can run as the system, administrator, or root account ߜ Modify environment variables
ߜ Make programs look like they were run by another user, concealing the hacker's identity in audit logs
Spyware
Spyware programs spy on you and sometimes even capture and transmit confidential information from your computer. They're installed as cookies, Windows Registry entries, and even executables on the local computer.
"Legitimate" spyware that may be installed by an administrator or other person to watch someone's computer usage includes SpectorSoft's eBlaster and Spector Pro, and TrueActive (formerly known as WinWhatWhere).
These programs are extremely powerful and capture video screen shots, turn on the local microphone, track Web browsing, and even forward copies of e-mails sent and received to a third-party address. Powerful and scary!
Adware is similar to spyware but a little less intrusive. It tracks Internet usage and pulls targeted ads to specific users, based on their habits.
Built-in programming interfaces
Programming interfaces built into operating systems can be used maliciously: ߜ Java applets are programs written in the Sun Microsystems programming language. Although these programs run in a sandbox --- or safe area --- to ensure that the local system is not compromised by malicious code, they can still cause security problems.
ߜ Microsoft .NET applications are programs written based on the new application framework from Microsoft. Like Java applets, these programs have their own playpen that helps ensure that malicious code is not executed.
ߜ ActiveX controls are Microsoft-based programs that everyone loves to hate. ActiveX controls can be executed with minimal effort in such applications as Internet Explorer, Outlook, and other Microsoft programs.
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 242
242 Part V: Application Hacking
Their control over a computer can potentially cause serious harm to a computer system and its stored information.
ߜ VBScripts are scaled-down versions of Microsoft's Visual Basic programming language. Similar to ActiveX controls, these scripts can wreak havoc on local data.
Many of the common malware programs traversing the Internet today are VBScripts.
ߜ Windows Script Host (WSH) is a script processor built into Windows ---
similar to DOS batch files --- that can be used to perform malicious acts.
ߜ JavaScript programs, which are similar to ActiveX and VBScripts, are written in Netscape's scripting language. They can cause computers harm if users willingly run them within Web browsers and e-mails.
Not all applications written in these programming interfaces are malicious.
Many legitimate programs are used every day that run just fine and don't do any harm.
Logic bombs
A logic bomb is a program --- often, an automated script using regular network administration tools --- that is scheduled to run when it's triggered by a certain event, such as someone's logging in, or run on a specific date or time, such as two weeks after an employee is let go.
Logic bombs are a common way for disgruntled employees to seek revenge on their former employers. Some logic bombs have destroyed entire databases of information, including the famous logic bomb planted by Tim Lloyd at Omega Engineering a few years back. This program erased all the information from the company's NetWare server, putting a stop to its manufacturing processes. This event resulted in $10 million in damages to the company, and ultimately, 80 employees got laid off.
Security tools
Your own security tools can be used against you. This includes the following tools:
ߜ Vulnerability scanners, such as Nessus and even the tried-and-true Netcat tool, can place backdoors in your systems.
ߜ Network analyzers, including the ARP poisoning tools ettercap and dsniff.
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 243
ߜ The DOS debug program that still ships with Windows.
ߜ The NetWare debugger backdoor.
You access the backdoor by pressing Shift+Alt+Shift+Esc all at the same time (using both Shift keys) at the server console.
How Malware Propagates
Some time back --- practically forever, in computer time --- most malware propagated via floppy disks. In 1981, the first computer virus was released: the Apple II Elk Cloner virus. In 1986, the first virus that affected the Microsoft/Intel platform --- the Brain virus --- was released. Both of these viruses were floppy-disk--based, but neither packed the punch that many viruses have come to inflict on their victims since that time.
Some of the first malware exploited vulnerabilities in computer hardware and software architectures --- like what happens today. These old-fashioned viruses spread very slowly by today's standards. It could take months and sometimes years for a few thousand systems to be infected. What's different about today's malware? It's the method of propagation. The Internet allows malware to spread around the world quickly. Malware can affect hundreds of thousands of systems within a few weeks, as happened with the Code Red and Nimda worms, or within a few minutes, as we saw with the Slammer/Sapphire worm.
Hackers from anywhere in the world can try penetrating your systems --- at their convenience.
Automation
Automated attacks are the wave of the future for malware. The Internet is not going away. In fact, more systems are going online --- more users, more hackers, and a greater number of applications are emerging that can be affected.
This includes Web services; peer-to-peer (P2P) software, such as instant messaging (IM); and other file-sharing technologies, such as Gnutella, Kazaa, Morpheus, and mobile-device applications that run on PDAs and cell phones.
The most common malware attack channel is through e-mail. A hacker simply attaches a virus or Trojan horse to an e-mail --- often, through an automated mechanism --- and sends the message to unsuspecting users. This process is 21 55784x Ch14.qxd 3/29/04 4:18 PM Page 244
244 Part V: Application Hacking
automated with self-propagating worms making an attack even easier. The text of the e-mail says, "See the attached note" or "Check out this game."
Many gullible users open the attachment, thinking it's something that will brighten up their day. Instead, it's malware looking to copy or delete local files and often glean e-mail addresses from the user's address book to send itself on to other users. If antivirus software is missing, outdated, or disabled at the time, this can spell bad news for the computer or network.
Hacker backdoors
Malware is propagated on computer systems by hackers compromising a host from across the network or Internet, obtaining administrator or root access by exploiting a known vulnerability and then installing the malware to their heart's content. They can set up backdoors, giving them remote access so they can come back and play in the future.
Many of these infections go unnoticed indefinitely, usually until the network administrator suspects that something strange is going on, or the system crashes, or information gets stolen or erased.
Testing
You can carry out various tests to check for malware infections on your network, as described in the following sections.
Vulnerable malware ports
You should look for Trojan ports when assessing your systems. Here are some common ones to look out:
ߜ 31337, 54320, and 54321 (Back Orifice and Back Orifice 2000) ߜ 12345 and 12346 (NetBus)
ߜ 1243 and 27374 (SubSeven)
When testing, look for computers listening on these ports. These port numbers can usually be changed in most malware applications, so don't rely on these completely.
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 245
Two great Web sites I refer to a lot when I want to see how a particular piece of malware works are the following:
ߜ www.simovits.com/trojans/trojans.html is a comprehensive listing of Trojan horses.
ߜ PestPatrol's catalog of pests at research.pestpatrol.com/PestInfo/
pestdatabase.asp.
Manual assessment
It helps to know your systems --- what software is installed and what services are running. Document your baseline environment, if you haven't already, by using the same methods I describe in this chapter.
If you suspect that one of your systems may be infected by malware, or you want to see which applications are loaded on your system, there are tools and techniques you can use. The key here is to search for things that just don't look right.
Windows
Because most malware affects Windows, there are various tests specific to that platform you can carry out to test for malware infections.
Odd file names
If you're unsure what a specific file does or want more details on file-format and header information, you have a couple of options for information: ߜ Check Wotsit's Format at www.wotsit.org for information on file formats and headers.
ߜ Search for the filename in Google with both Web and Groups searches.
Netstat
Run netstat -an at a command prompt.
ߜ The a option displays all connections and listening ports.
ߜ The n option displays IP addresses and port numbers in numeric form to make them easier to read.
You see something similar to the following list:
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 246
246 Part V: Application Hacking
Active Connections
Proto Local Address Foreign Address State TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 10.11.12.202:139 0.0.0.0:0 LISTENING
TCP 10.11.12.202:1044 208.215.179.139:80 CLOSE\_WAIT
TCP 10.11.12.202:2099 10.11.12.204:139 ESTABLISHED
TCP 10.11.12.202:2100 10.11.12.2:139 TIME\_WAIT
UDP 0.0.0.0:445 :
UDP 10.11.12.202:137 :
UDP 10.11.12.202:138 :
The preceding example shows several Microsoft NetBIOS networking ports (135, 137, 138, 139, and 445) and an HTTP connection in progress (port 80).
The NetBIOS connections may be questionable, but I've actually initiated those connections, so I trust that they're legitimate.
Look for connections to the following ports to scope out possible malware or other hacker behavior in progress:
ߜ NetBIOS ports
ߜ Common malware ports
ߜ Ports that can indicate malicious behavior, including telnet (TCP port 23) and FTP sessions that shouldn't be occurring (TCP ports 20 and 21) Port mapping
A port-mapper program shows which applications are actually connected to the specific open ports.
My favorite port mapper is a free tool called Vision by Foundstone (www.
foundstone.com). I recommend this tool for your toolbox.
Figure 14-1 shows the detailed information that Vision can provide. Ports 12345 and 12346 are mapped to c:\temp\Patch.exe. That's the NetBus server executable --- yikes!
Task Manager
Press Ctrl+Alt+Del to load the Windows Task Manager and see whether any strange applications or processes are loaded.
Many strange-looking processes are legitimate. Make sure that you know what you're dealing with, so you don't stop a legitimate program. A quick Google search on the filename usually provides enough information. Just because it's not there doesn't mean it's not loaded, though, because some processes, such as the FU rootkit for Windows, have the ability to hide themselves.
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 247
Figure 14-1:
Running
Vision to
map ports
to actual
applications
running on a
system.
Net use
You can run net use at a command prompt to see what drives are mapped to external systems. Look for drive mappings that should not be there.
Registry
Look in your Windows Registry under the following HKEY\_LOCAL\_MACHINE
(HKLM) keys for strange-looking applications that are loading. This is a common place for malware to be initiated upon startup.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx Startup files
Check your Windows startup folder and files such as autoexec.bat and config.sys in the root directory of the C: drive for any applications that don't belong. Unknown programs can signal that a rogue application is configured to start every time the computer boots.
Linux
For your Linux-based systems, you can run various tests to find out more about what's running on your systems.
netstat
Run netstat -at to view active network connections.
Figure 14-2 shows that a Web server and SSH server are running with two computers connected to these services. In addition, you see that the X11 service for X Window along with the domain service (DNS), sunrpc, and SMTP
service for e-mail. Check these types of things before a suspected attack occurs so that you know what belongs and what doesn't.
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 248
248 Part V: Application Hacking
Figure 14-2:
Running
netstat in
Linux shows
the network
connections.
lsof
The lsof utility lists open files, as shown in Figure 14-3, so you can check for strange connections. This is similar to the Vision program for Windows.
Figure 14-3:
Using the
lsof utility to
look for
potential
malware
applications
that are
loaded.
ps
The ps utility displays running processes, as shown in Figure 14-4. You can check for strange applications that don't look right.
This is why it helps to know what's supposed to be loaded!
Startup files
Check your Linux startup files (such as inetd.conf and xinetd.conf) for any applications that don't belong. Unknown programs can signal that a rogue application is configured to start every time the computer boots.
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 249
Figure 14-4:
Running the
ps utility to
display
running
processes.
Network card
Determine whether someone or some malware has placed the machine's network card into promiscuous mode, indicating the use of a network analyzer.
Enter this line at the command prompt:
ifconfig --a | grep PROMISC
If the return value is not empty, an interface is running in promiscuous mode.
You can enter this command into a cron job that runs every few hours that can alert you if one is found.
Antivirus software testing
For starters, check whether your antivirus software is actually working.
Before you begin testing your antivirus software, make sure that you have the latest virus software engine and signatures loaded.
You have a couple of safe options for checking the effectiveness of your antivirus software, as described in the following two sections. This is by no means a comprehensive method of testing your malware-protection mechanisms, but it serves as a good, safe start.
Eicar test string
Eicar is a European-based malware think tank that has worked in conjunction with malware vendors to provide this basic system test. The eicar test string
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 250
250 Part V: Application Hacking
is transmitted in the body of an e-mail or as a file attachment so that you can see how your server and workstations respond. You basically access this file ---
which contains the following 68-character string --- on your computer to see whether your antivirus or other malware software detects it: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR STANDARD-ANTIVIRUS-TEST-FILE!$H+H\*
You can download a text file with this string from www.eicar.org/anti\_
virus\_test\_file.htm. Several versions of the file are available on this site.
One version is a zip file. I recommend testing with this file to make sure that your antivirus software can detect malware within compressed files.
When you run this test, you may see results similar to Figure 14-5 from your antivirus software.
Figure 14-5:
Using the
eicar test
string to test
antivirus
software.
GFI's Email Security Testing Zone
A freebie at www.gfi.com/emailsecuritytest is a good e-mail malware test to run against your server and clients. This series of tests sends e-mails with malicious-like scripts in such programming languages as Visual Basic and ActiveX to check exactly what gets through your e-mail system. These aren't malicious tests --- just tests that should invoke your antivirus software or other protective measures on your e-mail server or gateway if your software is configured and working correctly.
Network scanning
Use Nmap, SuperScan, or your favorite port-scanning tool to check for abnormal ports open on your network hosts.
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 251
Some connections that show as open aren't necessarily accurate and depend-able. You may need to investigate unknown ports on the systems further by using a port-mapping tool such as Vision for Windows or lsof for Linux, as described previously in this chapter.
Using SuperScan, you may find the following results in a quick network scan:
\* - 10.10.1.1 fs1
|\_\_\_ 12345 Win95/NT Netbus backdoor
\* - 10.10.1.2 [Unknown]
\* - 10.10.1.4 laser
\* + 10.10.1.204 PC100
|\_\_\_ 12345 Win95/NT Netbus backdoor
\* + 10.10.1.209 DQ
|\_\_\_ 12345 Win95/NT Netbus backdoor
You can also use Nmap to find specific malware ports, as shown in Figure 14-6.
Figure 14-6:
Nmap
results
showing the
NetBus
server
listening on
ports 12345
and 12346.
During a recent incident response project that I was on, I found dozens of computers listening on TCP port 12345 --- the default port of the NetBus Trojan! Needless to say, I was quite concerned. After some poking around, I discovered that NetBus had not infested the network, as it originally appeared. It was the OfficeScan NT antivirus product by Trend Micro that was listening on that port --- who would've thought? Major lesson learned.
I recommend scanning your entire network for spyware with PestPatrol Auditor's Edition (www.pestpatrol.com) or a similar program. Figure 14-7
shows the results of a stand-alone PestPatrol scan on the local computer; it found NetBus and several spyware cookies. PestPatrol detects spyware, adware, Trojans, and some rootkits.
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 252
252 Part V: Application Hacking
Figure 14-7:
Sample
results from
a PestPatrol
scan.
Every time I run a full scan on my system, tools are called suspect, and my software --- antivirus software especially --- tends to "clean up" those tools for me. I must either replace my security tools from backup or download and install them again. If any of your security tools or security testing software may look like malware on your computer, either ߜ Keep backup copies of the original installation files.
ߜ Have your malware-protection software skip the files or directories where your security tools are installed.
Of course, if an infection is suspected --- and periodically, such as once a month, even when infections aren't suspected --- run your antivirus software against all the computers on your network. Another tool to double-check your systems is McAfee's AVERT Stinger (vil.nai.com/vil/stinger). This stand-alone antivirus executable checks for several dozen of the latest common malware items and known variants of each.
Behavioral-analysis tools
For a neat set of tests to find whether your Windows-based systems are susceptible to behavioral-based malware attacks --- that is, attacks that don't match a specific signature, but perform a function such as writing to the local hard drive --- check out the demos at the Finjan Software Test Center at www.
finjan.com/mcrc/sec\_test.cfm. These tests --- which include "malicious"
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 253
executables, JavaScript, ActiveX, and Visual Basic --- safely show you just what can happen without the proper malware protection in place on your systems.
In my testing, few antivirus and personal firewall applications actually detected any wrongdoings when running these tests. The scripting tests require you to grant permission to load the scripts --- many users just do this automatically!
Malware Countermeasures
You can implement various countermeasures to prevent malware attacks against your systems, as described in the following sections.
General system administration
Security countermeasures within your organization can help prevent attacks: ߜ Your first and foremost goal should be to keep hackers and malware out of your systems in the first place. If you perform the other countermeasures and system-hardening best practices mentioned throughout this book and referenced in Appendix A, you're on your way.
ߜ Create an incident-response plan. The FedCIRC Incident Handling Checklists at www.fedcirc.gov/incidentResponse/IHchecklists.
html is a good place to start.
No matter what measures you have in place to protect your systems from malware infections, you'll probably be attacked sometime. Plan ahead so you don't have to make critical decisions under pressure.
ߜ Before deploying networkwide any programs downloaded from the Internet, test and analyze the programs for malicious behavior on isolated systems.
ߜ Use malware-protection software (such as antivirus, spyware protection, and Trojan testers).
Two guidelines can increase the effectiveness of your protection:
• Load the software on the layers of your network wherever possible, including on firewalls, content-filtering servers, e-mail gateways/
firewalls, e-mail servers, and e-mail clients.
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 254
254 Part V: Application Hacking
• Use different malware-protection applications (from multiple vendors) or a program that combines the scanning engines of several antivirus vendors in one fell swoop, such as Antigen from Sybari Software (www.sybari.com/home).
ߜ Apply the latest software patches --- especially critical security updates.
ߜ Back up critical systems regularly. This could include performing the following:
• Image or other backup that can be restored quickly in the event of a serious infection
• Copies and MD5 or SHA checksums of critical executables in case you need to restore or compare existing ones for authenticity
• Emergency repair disks for critical systems in case of a malware infection
ߜ Enable heuristics protection in your antivirus software, if possible, to help detect behavioral anomalies that need to be blocked or cleaned.
ߜ Never rely on digitally signed code --- such as ActiveX controls that Internet Explorer downloads and prompts you to load --- to run properly on your systems. Digital signatures on this code verify only that it came from a trustworthy source --- not how it actually behaves when it's loaded.
ߜ Don't just disable such application interfaces as ActiveX, Windows Script Host, JavaScript, and Java without a good reason.
All these programming interfaces have some legitimate uses. Applications can stop working if these interfaces are disabled haphazardly. If the other security controls I mention here are in place, your systems should be pretty secure from malware written in these languages. You want to find a good balance between security and usability for your users so that security doesn't get in the way of people doing their jobs.
ߜ Make sure that a firewall is always in place on your network. Use it to look for
• Suspicious ports in use (or trying to be used)
• Heavy traffic patterns that can signal a malware infection ߜ Use IDS and IDP systems to stop potential malware infections in their tracks when they try to enter your network.
ߜ Run a rootkit-detection application:
• Rkdet (vancouver-Webpages.com/rkdet) for Linux checks for someone installing a rootkit or other malware on your systems.
• chkrootkit (www.chkrootkit.org) tests after the fact for over 50
different installed rootkits on many popular flavors of UNIX.
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 255
E-mails
In addition to the preceding security countermeasures, you can implement several e-mail--specific malware-protection measures:
ߜ Make it policy for users not to open unsolicited e-mails and any attachments --- especially those from unknown senders.
ߜ Plan for users who ignore or forget about the policy of leaving unsolicited e-mails and attachments unopened.
These automatic technical measures can help prevent malware from infecting user systems:
• At the server or e-mail gateway, filter e-mails that have executable attachments, such as .com, .exe, .pif, .scr, and .vbs. The File Extension Source at filext.com has information about more than 8,500 file types.
• Always run antivirus software wherever it can be installed --- at the handheld, desktop, and server levels, if possible.
• Run antivirus software at the server or gateway levels, if possible.
Make sure that encrypted files and emails can be protected against malware.
• Encryption won't keep malware out of files or e-mails. You'll just have encrypted malware within the files or e-mails.
• Encryption keeps your server or gateway antivirus from detecting the malware until it reaches the desktop.
Files
You must perform regular malware protective maintenance on your file systems. The following countermeasures will help:
ߜ Periodically scan all possible systems on your network, and enable real-time malware protection that can't easily be disabled by users.
Scan all files --- not just executable ones --- to help prevent unknown malware issues.
ߜ Consider changing file associations for potentially malicious executables, such as com, .exe, .pif, .scr, and .wsh.
For example, you can change the Windows Script Host file associations to something like Notepad.exe in case they're ever launched. That way, Notepad will load the file instead of the Windows Script Host engine.
21 55784x Ch14.qxd 3/29/04 4:18 PM Page 256
256 Part V: Application Hacking
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 257
In This Chapter
ᮣ Attacking e-mail systems
ᮣ Assailing instant messaging
ᮣ Securing your servers and clients
Messaging systems --- those e-mail and instant messaging (IM) applications that we depend on --- are often hacked within a network. Why?
Well, from my experience, messaging software --- both at the server and client level --- is vulnerable because network administrators forget about securing these systems, believe that antivirus software is all that's needed to keep trouble away, and ignore the existing security vulnerabilities.
In this chapter, I show you how to test for common e-mail and instant-messaging issues. I also outline key countermeasures to help prevent these hacks against your systems.
Messaging-System Vulnerabilities
E-mail and instant-messaging applications are hacking targets on your network. In fact, e-mail systems are some of the most targeted. Given the prolif-eration and business value of instant messaging and other P2P applications, attacks against networks launched via instant-messaging channels will be at least as common as e-mail attacks.
A ton of vulnerabilities are inherent in messaging systems. The following factors can create weaknesses:
ߜ Security is rarely integrated into software development.
ߜ Convenience and usability often outweigh the need for security.
ߜ Many of the messaging protocols were not designed with security in mind --- especially those developed several decades ago, when security wasn't nearly the issue it is today.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 258
258 Part V: Application Hacking
Many hacker attacks against messaging systems are just minor nuisances; others can inflict serious harm on your information and your organization's reputation. The hacker attacks against messaging systems include these: ߜ Transmitting malware (as I describe in Chapter 14) ߜ Crashing servers
ߜ Obtaining remote control of workstations
ߜ Capturing and modifying confidential information as it travels across the network
ߜ Perusing e-mails in e-mail databases on servers and workstations ߜ Perusing instant-messaging log files on workstation hard drives ߜ Gathering messaging trend information, via log files or a network analyzer, that can tip off the hacker about conversations between people and organizations ߜ Gathering internal network configuration information, such as hostnames and IP addresses
Hacker attacks like these can lead to such problems as lost business, unauthorized --- and potentially illegal --- disclosure of confidential information, and loss of information.
E-Mail Attacks
The following e-mail attacks exploit the most common e-mail security vulnerabilities I've seen. The good news is that you can eliminate or minimize most of them to the point where your information is not at risk. You may not want to carry out all these attacks against your e-mail system --- especially during peak traffic times --- so be careful!
Some of these attacks require the basic hacking methodologies: gathering public information, scanning and enumerating your systems, and attacking.
Others can be carried out by sending e-mails or capturing network traffic.
E-mail bombs
E-mail bombs can crash a server and provide unauthorized administrator access. They attack by creating DoS conditions against your e-mail software and even your network and Internet connection by taking up so much bandwidth and requiring so much storage space.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 259
A case study in e-mail hacking with Thomas Akin
In this case study, Thomas Akin, a well-known
that, Laura and John listed their phone numbers
expert in e-mail systems and forensics, shared
so potential customers could contact them
with me an experience in e-mail hacking. Here's
easily --- 555-1234. How nice of them!
his account of what happened.
The outcome
The situation
A quick search online turned up a phone---
Mr. Akin was involved in a case where a client's
number match to a Laura and John living in East
e-mail system was blacklisted for sending hun---
Bumble, USA. Bingo! It turned out that John
dreds of thousands of spam e-mails. The client
was a former employee and that his dial-up
spent two weeks reconfiguring its e-mail server
account had not been disabled when he was
in an attempt to stop the spam e-mails from
fired from the company. A quick glance at the
going through the system. The client looked at
log files showed that the "john" account had
every technical possibility --- including making
used the company's dial-up access during the
sure that the server was not an open SMTP
exact times the spam e-mails were sent out.
relay --- but nothing worked. Over 100,000 spam
The company immediately disabled the
e-mails a day were being sent through the com---
account, and the spam e-mails stopped.
pany. After losing several customers because
Even though the spamming was stopped, the
the company couldn't send them any e-mails,
company was desperate to know how the
the company called Mr. Akin to see whether he
e-mails were being sent through its system. The
could help.
dial-up account should have allowed only lim---
Mr. Akin first checked to see whether the e-mail
ited access through a menu system --- not full
system was acting as an open relay, but it was
access to the organization's network. After
not. Because the e-mail system wasn't miscon---
some research, Mr. Akin determined that John
figured, there shouldn't have been any reason
had bypassed the dial-up's menu system and
for blacklisting the client. Then he reviewed the
was using a program called slirp to turn his
spam e-mail headers, expecting to see a stan---
internal dial-up connection into a full Internet
dard spoofed e-mail. Instead, after reviewing
connection. Because John was dialing into the
the headers, he saw that they were coming
company's modem bank, the e-mail system saw
from the company's e-mail system. Not only
him as an internal user, letting him send e-mail
that, but they were also originating from a
to anyone and anywhere he wanted. The com---
reserved IP address --- an address that isn't
pany quickly reviewed all dial-up accounts and
even allowed on the Internet.
found that over two dozen accounts were still
active and being used by former employees!
Momentarily stumped, Mr. Akin looked at the
text of the e-mail messages themselves. "One
Thomas Akin is the founding director of the
time only!" "Buy me now!" "Best deal ever!"
Southeast Cybercrime Institute at Kennesaw
This is the standard spam nonsense, except that
State University. He is a CISSP, holds several
these e-mails were signed by Laura and John
networking certifications, and is a member of
(names disguised to protect the guilty). Not only
Mensa.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 260
260 Part V: Application Hacking
Attachments
An attacker can create an attachment-overloading attack by sending hundreds or thousands of e-mails with very large attachments.
Attacks
Attachment attacks may have a couple of different goals: ߜ The whole e-mail server may be targeted for a complete interruption of service with these failures:
• Storage overload
Multiple large messages can quickly fill the total storage capacity of an e-mail server. If the messages aren't automatically deleted by the server or manually deleted by individual user accounts, the server will be unable to receive new messages.
This can create a serious DoS problem for your e-mail system, either crashing it or requiring you take your system offline to clean up the junk that has accumulated. A 100MB file attachment sent ten times to 80 users can take 80GB of storage space. Yikes!
• Bandwidth blocking
An attacker can crash your e-mail service or bring it to a crawl by filling the incoming Internet connection with junk. Even if your system automatically identifies and discards obvious attachment attacks, the bogus messages eat resources and delay processing of valid messages.
ߜ An attack on a single e-mail address can have serious consequences if the address is for a really important user or group.
Countermeasures
These countermeasures can help prevent attachment-overloading attacks: ߜ Limit the size of either e-mails or e-mail attachments. Check for this option in e-mail server configuration options (such as those provided in Novell GroupWise and Microsoft Exchange), e-mail content filtering, and e-mail clients.
This is the best protection against attachment overloading.
ߜ Limit each user's space on the server. This denies large attachments from being written to disk. Limit message sizes for inbound and even outbound messages if you want to prevent a user from launching this attack inside your network. I've found 10MB to 20MB to be good limits.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 261
Consider using FTP or HTTP instead of e-mail for large file transfers. By doing so, you can store one copy of the file on a server and have the recipient download it on his or her own. This can help keep message store sizes at a minimum.
Connections
A hacker can send a huge amount of e-mails simultaneously to addresses on your network. These connection attacks can cause the server to give up on servicing any inbound or outbound TCP requests. This can lead to a complete server lockup or a crash, often resulting in a condition where the attacker is allowed administrator or root access to the system!
Attacks
This attack is often carried out in spam attacks, which are covered later in this chapter.
Countermeasures
Many e-mail servers allow you to limit the number of resources used for inbound connections, as shown in the Number of SMTP Receive Threads option for Novell GroupWise in Figure 15-1. It can be next to impossible to completely stop an unlimited amount of inbound requests. However, you can minimize the impact of the attack. This setting limits the amount of server processor time, which can help prevent a DoS attack.
Figure 15-1:
Limiting the
number of
resources to
handle
inbound
messages.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 262
262 Part V: Application Hacking
Even in large companies, there's no reason that thousands of thousands of inbound e-mail deliveries should be necessary within a short time period.
Some e-mail servers, especially UNIX-based servers, can be programmed to deliver e-mails to a daemon or service for automated functions. If DoS protection isn't built into the system, a hacker can crash both the server and the application that receives these messages.
Autoresponders
An interesting attack I've seen is to find two or more users on the same or different e-mail systems that have autoresponder configured. Autoresponder is that annoying automatic e-mail response you often get back from random users when you're subscribing to a mailing list. A message goes to the mailing-list subscribers, and then users have their e-mail configured to automatically respond back, saying they're out of the office or, worse, on vacation. This is a great way to tell thousands of people that your house and belongings are possibly available for taking --- but I digress.
Attacks
An autoresponder attack is a pretty easy hack. Many unsuspecting users and e-mail administrators never know what hit them! The hacker sends each of the two (or more) users an e-mail from the other simply by masquerading as that person (an easy hack I outline in this chapter). This attack can create a never-ending loop that bounces thousands of messages back and forth between users. This can create a DoS condition by filling either the user's individual disk space quota on the e-mail server or the e-mail server's entire disk space.
Countermeasures
The best countermeasure for an autoresponder attack is to make it policy that no one sets up an autoresponder message. Those messages are too annoying to be of value anyway, right?
Prevent e-mail attacks as far out on your network perimeter as you can. The more traffic or malicious behavior you keep off your e-mail servers and clients, the better.
Automatic e-mail security
You can implement the following countermeasures as an additional layer of security for your e-mail systems.
Tarpitting
Tarpitting detects inbound messages destined for unknown users. If your e-mail server supports tarpitting, it can help prevent spam or DoS attacks against your server. If a predefined threshold is exceeded --- say, more than
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 263
ten messages --- the tarpitting function effectively blocks traffic from the sending IP address for a period of time.
E-mail firewalls
E-mail firewalls and content-filtering applications (such as CipherTrust's IronMail and NetIQ's MailMarshal, respectively) can prevent various e-mail attacks. These tools protect practically every aspect of an e-mail system.
Perimeter protection
Although not e-mail--specific, many firewall, IDS, and IDP systems can detect various e-mail attacks and shut off the attacker in real time. This can come in handy during an attack at an inconvenient time.
Banners
One of the first orders of business for a hacker when hacking an e-mail server is performing a basic banner grab to see whether he can tell what e-mail server software is running. This is one of the most critical tests to find out what the world knows about your SMTP, POP3, and IMAP servers.
Gathering information
Figure 15-2 shows the banner displayed on an e-mail server when a basic telnet connection is made on port 25 (SMTP). To do this, at a command prompt, simply enter telnet ip\_or\_hostname\_of yourserver 25. This brings up a telnet session on TCP port 25.
Figure 15-2:
An SMTP
banner
showing
server-version
information.
In Figure 15-2, it's pretty obvious what e-mail software type and version the server is running. This information can give hackers some ideas about possible attacks, especially if they search a vulnerability database for known vulnerabilities of that software version. Figure 15-3 shows the same e-mail server with its SMTP banner changed from the default (okay, the previous one was, too) to disguise such information as the e-mail server's version number.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 264
264 Part V: Application Hacking
Figure 15-3:
An SMTP
banner that
disguises
the version
information.
You can gather information on POP3 and IMAP e-mail services as well by telnetting to either port 110 (POP3) or port 143 (IMAP).
If you've changed your default SMTP banner, don't think that no one can figure out the version. One Linux-based tool called smtpscan (www.greyhats.org/
outils/smtpscan) determines e-mail server version information based on how the server responds to malformed SMTP requests. Figure 15-4 shows the results from smtpscan against the same server shown in Figure 15-3. It detected the product and version number of the e-mail server!
Figure 15-4:
smtpscan
gathers
version info
when the
SMTP
banner is
disguised.
Countermeasures
There isn't a 100 percent secure way of disguising banner information. I suggest these banner security tips for your SMTP, POP3, and IMAP servers: ߜ Change your default banners to cover up the information.
ߜ Make sure that you're always running the latest software patches.
ߜ Harden your server as much as possible by using well-known best practices from such resources as SANS (www.sans.org), NIST (csrc.nist.
gov), National Security Agency Security Recommendation Guides (www.
nsa.gov/snac/index.html), and Network Security For Dummies, by Chey Cobb (Wiley Publishing, Inc.).
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 265
SMTP attacks
Some hacker attacks exploit weaknesses in the Simple Mail Transfer Protocol (SMTP). This e-mail communications protocol --- which is over 20 years old ---
was designed for functionality, not security.
Account enumeration
A clever way that hackers can verify whether e-mail accounts exist on a server is simply to telnet to the server on port 25 and run the VRFY command. The VRFY --- short for verify --- command makes a server query to check whether a specific user ID exists. Spammers often automate this method to perform a directory harvest attack (DHA). It's a way of gleaning valid e-mail addresses from a server or domain so hackers know who to send spam messages.
Attacks
Figure 15-5 shows how easy it is to verify an e-mail address on a server with the VRFY command enabled. Scripting this attack can test thousands of e-mail address combinations.
Figure 15-5:
Using VRFY
to verify that
an e-mail
address
exists.
The SMTP command EXPN --- short for expand --- may allow attackers to verify what mailing lists exist on a server as well. You can simply telnet to your e-mail server on port 25 and try EXPN on your system if you know of any mailing lists that may exist. Figure 15-6 shows what this result may look like. It's simple to script this attack and test thousands of mailing-list combinations.
You may get bogus information from your server when performing these two tests. Some SMTP servers don't support the VRFY and EXPN commands, and some e-mail firewalls simply ignore them or return false information.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 266
266 Part V: Application Hacking
Figure 15-6:
Using EXPN
to verify that
a mailing list
exists.
Countermeasures
The best solution for preventing this type of e-mail account enumeration depends on whether you need to enable the VRFY and EXPN commands: ߜ Disable VRFY and EXPN unless you need your remote systems to be able to gather user and mailing-list information from your server.
ߜ If you need VRFY and EXPN functionality, check your e-mail server or content filtering documentation for the ability to limit these commands to specific hosts on your network or the Internet.
Relay
SMTP relay lets users send e-mails through external servers. Open e-mail relays are one of the greatest problems on the Internet. Spammers and hackers can use an e-mail server to send spam or attack through e-mail under the guise of the unsuspecting open-relay owner.
Keep in mind the following key points when checking your e-mail system for SMTP-relay weaknesses:
ߜ Test your e-mail server by using more than one tool or testing method.
Multiple tests minimize any errors or oversights.
ߜ Test for open relay from outside your network. If you test from the inside, you may get a false positive, because outbound e-mail relaying may be configured and necessary for your internal e-mail clients.
Automatic testing
Here are a couple of easy ways to test your server for SMTP relay: ߜ Free online tools.
One of my favorite online tools is located at www.abuse.net/relay.
html. You can perform the anonymous test without entering your e-mail address --- unless you're an abuse.net member. It immediately displays the test results in your browser.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 267
ߜ Other Windows-based tools, such as Sam Spade for Windows. Figure 15-7
shows how you can run an SMTP Relay check on your e-mail server.
Figure 15-8 contains the results of this test on my test server, showing that relaying is enabled.
Some SMTP servers accept inbound relay connections and make it look like relaying works. This isn't always the case, because the filtering may take place behind the scenes. Check whether the e-mail actually made it through by checking the account you sent the test relay message to.
Figure 15-7:
SMTP relay
check tool
in Sam
Spade for
Windows.
Figure 15-8:
Positive
results from
testing for
an open
SMTP relay.
Manual testing
You can manually test your server for SMTP relay by telnetting to the e-mail server on port 25. Follow these steps:
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 268
268 Part V: Application Hacking
1. Telnet to your server on port 25.
You can do this two ways:
• Use your favorite graphical telnet application, such as HyperTerminal (which comes with Windows) or SecureCRT (www.vandyke.com).
• Enter the following command at a Windows or UNIX command prompt:
telnet mailserver\_address 25
To see what's entered, you may have to enable local echoing of characters in your telnet program, such as Hyper Terminal.
You should see the SMTP welcome banner when the connection is made.
2. Enter a command to tell the server, "Hi, I'm connecting from this domain." Enter the command like this:
helo yourdomain.com
After each command in these steps, you should receive a different-numbered message, like 999 OK. You can ignore these messages.
3. Enter a command to tell the server your e-mail address, like this: mail from:yourname@yourdomain.com
4. Enter a command to tell the server who to send the e-mail to, like this: rcpt to:yourname@yourdomain.com
5. Enter a command to tell the server that the message body is to follow, like this:
data
6. Enter the following text as the body of the message: A relay test
7. End the command with a period on a line by itself.
This marks the end of the message. After you enter this final period, your message will be sent if relaying is allowed.
8. Check for relaying on your server:
• Look for a message like Relay not allowed to come back from the server.
If you get a message like this returned, SMTP relaying is not allowed on your server.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 269
You may get this message after you enter the rcpt to: command.
• If you don't receive a message back from your server, check your inbox for the relayed e-mail.
If you receive the test e-mail you sent, SMTP relaying is enabled on your server.
Countermeasures
You can implement the following countermeasures on your e-mail server to disable or at least control SMTP relaying:
ߜ Disable SMTP relay on your e-mail server. If you don't know whether you need SMTP relay, you probably don't. You can enable SMTP relay for specific hosts if needed.
www.mailabuse.org/tsi/ar-fix.html provides information on disabling SMTP relay on e-mail servers.
ߜ Enforce authentication, if your e-mail server allows it. You may be able to require such authentication methods as password authentication or an e-mail address that matches the e-mail server's domain. Check your e-mail server and client documentation for details on setting up this type of authentication.
E-mail header disclosures
If your e-mail client and server are configured with typical defaults, a malicious hacker may find critical pieces of information:
ߜ Internal IP address of your e-mail client machine (maybe the entire IP
addressing scheme)
ߜ Software versions of your client and server and their vulnerabilities ߜ Hostname
Testing
Figure 15-9 shows the header information revealed in a test e-mail I sent to my free Web account. As you can see, it shows off quite a bit of information about my e-mail system.
ߜ The third Received line discloses my system's hostname, IP address, server name, and e-mail client software version.
ߜ The X-Mailer line displays the Microsoft Outlook version I used to send this message.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 270
270 Part V: Application Hacking
Figure 15-9:
Critical
information
revealed in
headers.
Countermeasures
The best countermeasure to prevent information disclosures in e-mail headers is to configure your e-mail server/gateway/firewall to rewrite your e-mail headers, either changing the information shown or removing it altogether.
Check your e-mail server documentation to see whether this is an option.
If full-fledged header rewriting is not available, you may at least be able to prevent the sending of some critical information, such as server software version numbers and internal IP addresses.
Capturing traffic
E-mail traffic can be captured with a network analyzer or an e-mail packet sniffer and reconstructor.
Mailsnarf is an e-mail packet sniffer and reconstructor. It's part of the dsniff package. You can get dsniff from www.monkey.org/~dugsong/dsniff (UNIX
variants) or www.datanerds.net/~mike/dsniff.html (Windows).
If traffic is captured, a hacker can do one of the following: ߜ Compromise one host and potentially have full access to another adjacent host, such as your e-mail server.
ߜ Exploit known security vulnerabilities in e-mail server, e-mail client, and software.
Malware
E-mail systems are regularly attacked by such malware as viruses and worms.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 271
ߜ E-mail is one of the best ways for malware to propagate. Chapter 14
covers malware.
ߜ Hackers often compromise systems by running e-mail services that aren't being used or that need to be updated.
General best practices for minimizing
e-mail security risks
The following countermeasures help keep messages as secure as possible.
Software solutions
The right software can neutralize many threats:
ߜ Use malware-protection software on the e-mail server --- better, the e-mail gateway --- to prevent malware from reaching e-mail clients.
ߜ Apply the latest operating system and e-mail application security patches consistently and after any security alerts are released.
ߜ If it makes good business sense, encrypt messages. You can use S/MIME
or PGP to encrypt sensitive messages or use e-mail encryption at the desktop level or the server or e-mail gateway. (You can use SSL/TLS
between your e-mail client and server via POP3S or IMAPS or between your e-mail gateway and remote e-mail gateways. I prefer to implement encryption between gateways so that the user doesn't have to be involved.) It's best not to depend on your users to encrypt messages. Use an enterprise solution to encrypt messages.
Operating guidelines
Some simple operating rules can keep your walls high:
ߜ Put your e-mail server behind a firewall, preferably in a DMZ that's on a different network segment from the Internet and from your internal LAN.
ߜ Disable unused protocols and services on your e-mail server.
ߜ Run your e-mail server on a dedicated server, if possible, to help keep hackers out of other servers and information if the server is hacked.
ߜ Log all transactions with the server in case you need to investigate malicious use in the future.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 272
272 Part V: Application Hacking
ߜ If your server doesn't need e-mail services running (SMTP, POP3, and IMAP), disable them --- immediately.
ߜ For Web-based e-mail such as Microsoft's Outlook Web Access (OWA), properly secure your Web-server application and operating system by using the hardening resources I mention throughout this book.
ߜ If you're running sendmail --- especially an older version --- consider running a secure alternative, such as Postfix or qmail.
Instant Messaging
The hottest new technology taking networks by storm is instant messaging (IM). Although IM offers a lot of business value, some serious security issues are associated with it. This is especially true if it's not managed properly and end users are free to install, configure, and use it in any way they want.
Vulnerabilities
IM has several critical security vulnerabilities, including the following: ߜ Name hijacking, allowing a hacker to assume the identity of an IM user ߜ Launching a DoS attack on an IM client, allowing the attacker to take remote control of the computer ߜ Capturing internal IP address information (similar to the way it's disclosed in e-mail headers)
ߜ Transferring malware, including viruses and malicious Trojan horses You can remedy most of these vulnerabilities by applying the latest software patches and keeping antivirus signatures up to date. However, two IM vulnerabilities are susceptible to malicious attack, so they deserve a little more discussion. These affect most of the popular IM clients, including AOL Instant Messenger (AIM) and ICQ. These vulnerabilities are just problems with file sharing and log files, but these weaknesses can make all the difference in the world when it comes to securing your network.
Sharing network drives
The biggest problem with IM clients is the ability to share files. This feature may be pretty neat for home users or others with stand-alone computers, but it can pose a real security risk to your network and information. Practically
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 273
every IM client gives users the ability to share both local and network files.
Figure 15-10 shows an example of file sharing configured in AIM.
Figure 15-10:
File-sharing
options
under end-user control.
Once untrained or careless users share your network drives via their IM
clients, they've just granted potentially anyone on their IM network permission to view and copy those files. Figure 15-11 shows a sample of what you can see over the AIM network.
Figure 15-11:
When users
share files
via IM,
others
may see
information
like this.
Figure 15-12 shows some AIM File Transfer settings that can allow any remote user to place files on your network --- malware and all!
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 274
274 Part V: Application Hacking
Figure 15-12:
Options to
receive files
in AOL
Instant
Messenger.
If you know of IM users on your network, follow these steps to assess the security of their software and configuration:
1. Determine IM clients that are running on your network.
You can detect IM software with
• Manual inspection of the local workstation
• A third-party workstation hardware and software inventory program
• A network analyzer that shows IM traffic. For instance, you can use Ethereal to capture and display various types of IM protocols, such as AOL Instant Messenger (AIM protocol), ICQ (ICQ protocol), and MSNMS (MSN Messenger).
2. Install the IM clients on your own system.
Avoid creating your own security holes: Download and install the latest client versions, and don't enable file sharing.
3. Find your network's IM users.
You can identify IM users by either looking up users with a directory search in the IM client (many IM clients publish this information by default) or asking users for their handles for all their IM clients.
4. For each user, check settings to see whether they're sharing files.
It's often just a simple right-click on their IM handle within the IM software to copy files to and from their system.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 275
Log files
Many IM clients can log all IM conversations. Some clients log all conversations by default. Have users enabled logging and inadvertently shared their log files with the world? It's a smoking gun for a hacker to use! Figure 15-13
shows part of an ICQ conversation stored in communications gobbledygook in a log file found in the c:\Program Files\ICQ folder.
Figure 15-13:
IM log files
revealing
juicy
information.
Countermeasures
IM vulnerabilities can be difficult to detect, because most rogue IM software is desktop-based. If you have a large network, checking every computer for these vulnerabilities is pretty much impossible. Spot checks can be inaccurate, because every desktop and every user can be different.
Even if you disallow IM --- or any messaging software --- on your network, users always install it. If you implement these countermeasures, you're better prepared to protect your users from themselves and hackers.
Detecting IM traffic
In addition to a network analyzer, you can detect IM traffic by using the following tools:
ߜ IM traffic-detection tools from Akonix (www.akonix.com) work like a network analyzer.
ߜ Rogue Aware (www.akonix.com/products/rogueaware.asp) is a free tool. As shown in Figure 15-14, Rogue Aware detects such traffic on the network as IM and other P2P communications (such as Kazaa and Gnutella) and file sharing on the network. I recommend that you check it out and use this tool as part of your ethical hacking toolkit. Ideally, you install it on a computer that's connected to a monitor port on a switch or a hub adjacent to your firewall to ensure that you see all the traffic.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 276
276 Part V: Application Hacking
Figure 15-14:
Akonix
Rogue
Aware
detects IM
logins and
file sharing.
ߜ Akonix's Enforcer and L7 Enterprise are commercial utilities that have more functionality. Other vendors offer similar solutions, such as FaceTime Communications (www.facetime.com) and IM Logic (www.imlogic.com).
If you can justify the cost --- which is relatively easy --- I recommend that you check these products out.
ߜ Desktop auditing utilities can show you which applications are installed and their specific settings. Such products as Ecora's Enterprise Auditor (www.ecora.com/ecora/products/enterprise\_auditor.asp), Microsoft's Systems Management Server (www.microsoft.com/
smserver/default.asp) and some lower-end shareware tools can offer this type of functionality.
Maintenance and configuration
In addition to the tools listed in the previous section, you can implement these IM hacking countermeasures:
ߜ User behavior:
• Have a policy banning or limiting the usage of all P2P software.
• Instruct users not to open file attachments or configure their IM
software to share or receive file attachments.
• Instruct users to keep their buddy lists private and not share their information.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 277
ߜ System configuration:
• Change default IM software installation directories to help eliminate automated attacks.
• Apply all the latest IM software patches.
• Ensure that the latest antivirus software and personal-firewall software is loaded on each instant-messaging client.
• Ensure that proper file and directory access controls are in place to effectively give your users the minimum necessary rights for their jobs. This countermeasure helps keep prying eyes out if someone can exploit an IM vulnerability.
• If you allow IM on your network for business purposes, consider standardizing an enterprise-based IM application such as Jabber or Lotus Sametime. These applications have more-robust and manageable security options, which can ensure control.
22 55784x Ch15.qxd 3/29/04 4:18 PM Page 278
278 Part V: Application Hacking
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 279
In This Chapter
ᮣ Attacking Web applications
ᮣ Countering application hacking
Web applications, like e-mail, are common hacker targets because they're everywhere and often open for anyone to poke around in. Basic Web sites used for marketing, contact information, document downloads, and so on are a common target for hackers --- especially the script-kiddie types --- to deface. However, for criminal hackers, Web sites that store valuable information, like credit-card and Social Security numbers, are especially attractive.
This is where the money is, so to speak.
Why are Web applications so vulnerable? The general consensus is they're vulnerable because of poor software development and testing practices.
Sound familiar? It should, because this is the same problem that affects operating systems and practically all computer systems. This is the side effect of relying on software compilers to perform error checking, lack of user demand for higher-quality software, and emphasizing time-to-market instead of security and stability.
This chapter presents Web application hacks to check on your systems. You can test for literally thousands of vulnerabilities, but I focus on the ones I see most often. I also outline countermeasures to help minimize the chances that a hacker can carry out these attacks against your Web applications.
Web-Application Vulnerabilities
Hacker attacks against insecure Web applications --- via Hypertext Transfer Protocol (HTTP) --- make up the majority of all Internet-related attacks. Most of these attacks can be carried out even if the HTTP traffic is encrypted (via HTTPS or HTTP over SSL) because the communications medium has nothing to do with these attacks. The security vulnerabilities actually lie within either the Web applications themselves or the Web server and browser software that the applications run on and communicate with.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 280
280 Part V: Application Hacking
Many attacks against Web applications are just minor nuisances or may not affect confidential information or system availability. However, some attacks can wreak havoc on your systems. Whether the Web attack is against a basic brochureware site or against the company's most critical customer server, these attacks can hurt your organization.
Choosing Your Tools
Freeware and commercial tools can help ensure that your tests are comprehensive and minimize your testing time. All these tools basically work the same way, with such capabilities as scanning for script vulnerabilities, testing for invalid user input, and viewing critical files.
My favorite tools are Nikto (www.cirt.net/code/nikto.shtml), Nessus (www.nessus.org), and SPI Dynamics' WebInspect (www.spidynamics.com).
These certainly are not the only tools available. It's still a young market for commercial tool vendors, so keep your eyes peeled for emerging products.
Insecure Login Mechanisms
Many Web sites require users to login before they can do anything with the application. These login mechanisms often do not handle incorrect user IDs or passwords gracefully. They often divulge too much information that a hacker can use to gather valid user IDs and passwords.
Testing
To test for insecure login mechanisms, browse to your application and login in the following ways:
ߜ Using an invalid user ID with a valid password
ߜ Using an valid user ID with an invalid password
ߜ Using an invalid user ID and password
After you enter this information, the Web application probably responds with a message like Your user ID is invalid or Your password is invalid.
The Web application may also return a generic error message, such as Your user ID and password combination is invalid and, at the same time, return different error codes in the URL for invalid user IDs and invalid passwords, as shown in Figures 16-1 and 16-2.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 281
Case study in hacking Web applications
with Caleb Sima
In this case study, Caleb Sima, a well-known
admin was running, he wanted to see what else
penetration-testing expert, shared an experi---
he could find.
ence performing a Web-application security
Mr. Sima continued to manipulate the URL from
test. Here's his account of what happened.
the application by adding & characters within
The Situation
the statement to control the custom script. This
allowed him to capture all source codes files!
Mr. Sima was hired to perform a Web-applica---
He noted some interesting filenames, including
tion penetration test to assess the security of a
VerifyLogin.htm, ApplicationDetail.
well-known financial Web site. Equipped with
htm, CreditReport.htm, and Change
nothing more than the URL of the main financial
Password.htm. Then he tried to connect to
site, Mr. Sima set out to find what other sites
each file by issuing a specially formatted URL to
existed for the organization and began by using
the server. The server returned a User not
Google to search for possibilities. He initially ran
logged in message for each request and stated an automated scan against the main servers to
that the connection must be made from the
discover any low-hanging fruit. This scan pro---
intranet.
vided information on the Web-server version
and some other basic information, but nothing
The Outcome
that proved useful without further research. And
Mr. Sima knew where the files were located
while Mr. Sima performed the scan, neither the
and was able to sniff the connection and deter---
IDS nor the firewall noticed any of his activity!
mine that the ApplicationDetail.htm file
Then he issued a request to the server on the
set a cookie string. With little manipulation of
initial Web page, which returned some interest---
the URL, he hit the jackpot! This file returned
ing information. The Web application appeared
client information and credit cards when a new---
to be accepting many parameters, but as he
customer application was being processed.
continued to browse the site, he noticed that the
CreditReport.htm allowed him to view
parameters in the URL stayed the same. He
customer credit-report status, fraud informa---
decided to delete all the parameters within the
tion, declined-application status, and a multi---
URL to see what information the server would
tude of other sensitive information. The lesson
return when queried. The server responded
to be learned: Hackers can utilize many types of
with an error message describing the type of
information to break through Web applications.
application environment.
The individual exploits in this case study were
Next, Mr. Sima performed a Google search on
minor, but when combined, they resulted in
the application that resulted in some detailed
severe vulnerabilities.
documentation. He found several articles and
Caleb Sima was a charter member of the X-Force
tech notes within this information that showed
team at Internet Security Systems and the
him how the application worked and what
first member of the Penetration Testing team.
default files might exist. In fact, the server had
He went on to co-found SPI Dynamics (www.
several of these default files. He used this infor---
spidynamics.com) and become its CTO, as
mation to probe the application further. He
well as director of SPI Labs, the application-secu---
quickly discovered internal IP addresses, as
rity research and development group within SPI
well as what services the application was offer---
Dynamics.
ing. Now that he knew exactly what version the
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 282
282 Part V: Application Hacking
Figure 16-1:
A login
error in
the URL for
an invalid
user ID.
Figure 16-2:
A login
error in
the URL for
an invalid
password.
In either case, this is bad news, because the application is telling you not only which parameter is invalid, but also which one is valid. This means that the hackers now know either a good user name or password --- their work has been cut in half! If they know the username (which usually is easier to guess), they can simply write a script to automate the password-cracking process, and vice versa. They can also use a remote Web login-cracking tool, such as Brutus (www.hoobie.net/brutus), to attempt to break in, using a preconfigured file with user IDs and passwords, or even use it to perform brute-force attacks.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 283
Countermeasures
You can implement the following countermeasures to prevent hackers from attacking weak login systems in your Web applications: ߜ Any login errors that are returned to the end user should be as generic as possible, saying something like Your user ID and password combination is invalid.
ߜ The application should never return error codes in the URL that differen-tiate between an invalid user ID and invalid password, as shown in Figures 16-1 and 16-2.
If a URL message must be returned, the application should keep it as generic as possible. Here's an example:
www.your\_Web\_app.com/login.cgi?success=false
This URL message may not be as convenient to the user, but it helps hide the mechanism and the behind-the-scenes actions from a hacker.
Directory Traversal
A directory traversal is a really basic attack, but it can turn up interesting information about a Web site. This attack is basically browsing a site and looking for clues about the server's directory structure.
Testing
Perform the following tests to determine information about your Web site's directory structure.
robots.txt
Start your testing with a search for the Web server's robots.txt file. This file tells search engines which directories not to index. Thinking like a hacker, you may deduce that the directories listed in this file may contain some information that needs to be protected. Figure 16-3 shows a robots.txt file that gives away information.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 284
284 Part V: Application Hacking
Figure 16-3:
A Web
server's
robots.
txt listing.
Filenames
Confidential files on a Web server may have names like those of publicly accessible files. For example, if this year's product line is posted as www.your\_Web\_
app.com/productline2004.pdf, confidential information about next year's products may be www.your\_Web\_app.com/productline2005.pdf.
A user may place confidential files on the server without realizing that they are accessible without a direct link from the Web site.
Crawlers
A spider program like BlackWidow (www.softbytelabs.com/BlackWidow) can crawl your site to look for every publicly accessible file. Figure 16-4
shows the crawl output of a basic Web site.
Complicated sites often reveal more information that should not be there, including old data files and even application scripts and source code.
Figure 16-4:
Using
BlackWidow
to crawl
a Web site.
Look at the output of your crawling program to see what files are available.
Regular HTML and PDF files are probably okay, because they're most likely needed for normal Web-application operation. But it wouldn't hurt to open each file to make sure it belongs.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 285
Countermeasures
You can employ two main countermeasures to having files compromised via malicious directory traversals:
ߜ Don't store old, sensitive, or otherwise nonpublic files on your Web server. The only files that should be in your /htdocs or DocumentRoot folder are those that are needed for the site to function properly. These files should not contain confidential information that you don't want the world to see.
ߜ Ensure that your Web server is properly configured to allow public access only to those directories that are needed for the site to function. Minimum necessary privileges are key here, so provide access only to the bare-minimum files and directories needed for the Web application to perform properly.
Check your Web server's documentation for instructions to control public access. Depending on your Web-server version, these access controls are set in
• The httpd.conf file and the .htaccess files for Apache Refer to httpd.apache.org/docs/configuring.html for more information.
• Internet Information Services Manager settings for Home Directory and Directory (IIS 5.1)
• Internet Information Services Manager settings for Home Directory and Virtual Directory (IIS 6.0)
The latest versions of these Web servers have good directory security by default, so if possible, make sure you're running the latest versions: ߜ Check for the latest version of Apache at httpd.apache.org.
ߜ The most recent version of IIS (for Windows Server 2003) is 6.0.
Input Filtering
Web applications are notorious for taking practically any type of input, assuming that it's valid, and processing it further. Not validating input is one of the greatest mistakes that Web-application developers can make. This can lead to system crashes, malicious database manipulation, and even database corruption.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 286
286 Part V: Application Hacking
Input attacks
Several attacks can be run against a Web application that insert malformed data --- often, too much at once --- which can confuse, crash, or make the Web application divulge too much information to the attacker.
Buffer overflows
One of the most serious input attacks is a buffer overflow that specifically targets input fields in Web applications.
For instance, a credit-reporting application may authenticate users before they're allowed to submit data or pull reports. The login form uses the following code to grab user IDs with a maximum input of 12 characters, as denoted by the maxsize variable: <form name="Webauthenticate" action="www.your\_Web\_app.com/login.cgi"
method="POST">
...
<input type="text" name="inputname" maxsize="12">
...
A typical login session would be presented a valid login name of 12 characters or less. However, hackers can manipulate the login form to change the maxsize parameter to something huge, such as 100 or even 1,000. Then they can enter bogus data in the login field. What happens next is anyone's call --- they may lock up the application, overwrite other data in memory, or crash the server.
Automated input
An automated-input attack is when a malicious hacker manipulates a URL and sends it back to the server, directing the Web application to add bogus data to the Web database, which can lead to various DoS conditions.
Suppose, for example, that you have a Web application that produces a form that users fill out to subscribe to a newsletter. The application automatically generates e-mail confirmations that new subscribers must respond to. When users receive their e-mail confirmations, they must click a link to confirm their subscription. Users can tinker with the hyperlink in the e-mail they received --- possibly changing the username, e-mail address, or subscription status in the link --- and send it back to the server hosting the application. If the Web server doesn't verify that the e-mail address or other account information being sub-mitted has recently subscribed, the server will accept practically anyone's bogus information. The hacker can automate the attack and force the Web application to add thousands of invalid subscribers to its database. This can cause a DoS condition on the server or the server's network due to traffic overload, which can lead to other issues.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 287
I don't necessarily recommend that you carry out this test in an uncontrolled fashion with an automated script you may write or download off the Internet.
Instead, you may be better off carrying out this type of attack with an automated testing tool ,such as WebInspect or, or one of its commercial equivalents, such as Sanctum's AppScan (www.sanctuminc.com).
Code injection
In a code-injection attack, hackers modify the URL in their Web browsers or even within the actual Webpage code before the information gets sent back to the server. For example, when you load your Web application from www.
your\_Web\_app.com, it modifies the URL field in the Web browser to something similar to the following:
http://www.your\_Web\_app.com/script.php?info\_variable=X
Hackers, seeing this variable, can start entering different data into the info\_variable field, changing X to something like one of the following lines: http:// www.your\_Web\_app.com/script.php?info\_variable=Y
http:// www.your\_Web\_app.com/script.php?info\_variable=123XYZ
The Web application may respond in a way that gives hackers more information --- even if it just returns an error code --- such as software version numbers and details on what the input should be. The invalid input may also cause the application or even the server itself to hang. Similar to the case study earlier in the chapter, hackers can use this information to determine more about the Web application and its inner workings, which can ultimately lead to a serious system compromise.
Code injection can also be carried out against back-end SQL databases --- an attack known as SQL injection. Hackers insert rogue SQL statements to attempt to extract information from the SQL database that the Web application interacts with. Microsoft has a good Web site dedicated to Microsoft SQL Server security, including Slammer prevention and cleanup, at www.microsoft.com/
sql/techinfo/administration/2000/security/slammer.asp. Also check out the popular and effective Shadow Database Scanner at www.safety-lab.
com/en/products/6.htm.
Hidden field manipulation
Some Web applications embed hidden fields within Web pages to pass state information between the Web server and the browser. Hidden fields are represented in a Web form as <input type="hidden">. Due to poor coding practices, hidden fields often contain confidential information (such as product prices for an e-commerce site) that should be stored only in a back-end database. Users should not be able to see hidden fields --- hence, the name --- but the curious hacker can discover and exploit them with these steps:
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 288
288 Part V: Application Hacking
1. Save the page to the local computer.
2. View the HTML source code.
To see the source code in Internet Explorer, choose View➪Source.
3. Change the information stored in these fields.
For example, a hacker may change the price from $100 to $10.
4. Re-post the page back to the server.
This allows the hacker to obtain ill-gotten gains, such as a lower price on a Web purchase.
Cross-site scripting
Cross-site scripting (XSS) is a well-known Web application vulnerability that occurs when a Web page displays user input --- via JavaScript --- that isn't properly validated. A hacker can take advantage of the absence of input filtering and cause a Web site to execute malicious code on any user's computer that views the page.
For example, an XSS attack can display the user ID and password login page from another rogue Web site. If users unknowingly enter their user IDs and passwords in the login page, the user IDs and passwords are entered into the hacker's Web server log file. Other malicious code can be sent to a victim's computer and run with the same security privileges as the Web browser or e-mail application that's viewing it on the system; the malicious code could provide a hacker with full read/write access to the entire hard drive!
A simple test shows whether your Web application is vulnerable to XSS. Look for any parts of the application that accept user input (such as a login field or search field), and enter the following JavaScript statement: <script>alert('You have been scripted')</script> If a window pops up that says You have been scripted, as shown in Figure 16-5, the application is vulnerable.
Figure 16-5:
A sample
JavaScript
pop-up
window.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 289
Countermeasures
Web applications must filter incoming data. The applications must check and ensure that the data being entered fits within the parameters of what the application is expecting. If the data doesn't match, the application should generate an error and not permit the data to be entered. The first input validation of the form should be matched up with an input validation within the application to ensure that the input parameter meets the requirement.
Developers should know and implement these best practices: ߜ To reduce hidden-field vulnerabilities, Web applications should never present static values that the Web browser and the user don't need to see. Instead, this data should be implemented within the Web application on the server side and retrieved from a database only when needed.
ߜ To minimize XSS vulnerabilities, the application should filter out <script> tags from the input fields.
ߜ You can also disable JavaScript in the Web browser on the client side as an added security precaution.
Some secure software coding practices can eliminate all these issues from the get-go if they're made a critical part of the development process.
Default Scripts
Poorly written Web programs, such as Common Gateway Interface (CGI) and Active Server Pages (ASP) scripts, can allow hackers to view and manipulate files on a Web server that they're not authorized to access, as well as upload tons of files that can eventually fill the Web server's hard drive. Attacks such as the Poison Null attack and Upload Bombing attack against vulnerable CGI scripts written in Perl permit unauthorized access.
Attacks
Default script attacks are common because so many poorly written scripts are floating around the Internet. Hackers can also take advantage of various sample scripts that install on Web servers --- especially older versions of Microsoft's IIS Web server.
Many Web developers and Webmasters use these scripts without understanding how they really work or testing them, which can introduce serious security vulnerabilities.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 290
290 Part V: Application Hacking
Some poorly written scripts contain confidential information, such as usernames and passwords! To test for this, you can peruse scripts manually or use a text search tool --- such as the Search function built into the Windows Start menu or the find program in Linux or UNIX --- to find any hard-coded usernames and passwords. Look for such words as admin, root, user, ID, login, password, pass, and pwd.
Confidential or critical information that's embedded in scripts like this is rarely necessary and is often the result of poor coding practices --- convenience over security.
Countermeasures
You can help prevent attacks against default Web scripts: ߜ Know how scripts work before deploying them within a Web application.
ߜ Make sure that all default or sample scripts are removed from the Web server before using them.
Don't use scripts that have confidential information that's hard coded.
They're a security incident in the making.
URL Filter Bypassing
It's possible for internal employees to bypass Web-content filtering applications and logging mechanisms to browse to sites that they shouldn't go to ---
potentially covering up malicious behavior and Internet usage.
Bypassing filters
Malicious employees bypass URL filtering mechanisms by using proxy servers, tunneling Web traffic over nonstandard ports, spoofing IP addresses, and so on. But an even-easier hack is to exploit the general mechanism built into URL
filtering systems that filter Web traffic based on specific URLs and keywords (words that match a list or meet a certain criteria). Users take advantage of this practice by converting the URL to an IP address and then to its binary equivalent. The following steps can bypass URL filtering in such browsers as Netscape and Mozilla: 1. Obtain the IP address for the Web site.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 291
For example, a gambling Web site (www.go-gamblin.com) blocked in Web-content filtering software has this IP address:
10.22.33.44
This is an invalid public address, but it's okay for this example; you may want to filter out Web addresses on your internal network as well.
2. Convert each individual number in the IP address to an eight-digit binary number.
Numbers that may have fewer than eight digits in their binary form must be padded with leading zeroes to fill in the missing digits. For example, the binary number 1 is padded to 00000001 by adding seven zeroes.
The four individual numbers in the IP address in Step 1 have these equivalent eight-digit binary numbers:
10 = 00001010
22 = 00010110
33 = 00100001
44 = 00101100
The Windows Calculator can automatically convert numbers from decimal to binary notation:
i. Choose View➪Scientific.
ii. Click the Dec option button.
iii. Enter the number in decimal value.
iv. Click the Bin option button to show the number in binary format.
3. Assemble the four 8-digit binary numbers into one 32-digit binary number.
For example, the complete 32-digit binary equivalent for 10.22.33.44 is 00001010000101100010000100101100
Don't add the binary numbers. Just organize them in the same order as the original IP address without the separating periods.
4. Convert the 32-digit binary number to a decimal number.
For example, the 32-digit binary number
00001010000101100010000100101100 equals the decimal number 169222444.
The decimal number doesn't need to be padded to a specific length.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 292
292 Part V: Application Hacking
5. Plug the decimal number into the Web browser's address field, like this:
http://169222444
The Web page loads easy as pie!
The preceding steps won't bypass URLs in Internet Explorer.
Countermeasures
If the bypassing of certain Web-content filters is an issue for your network, ask your content-filtering vendor if it has a solution.
Automated Scans
Automated application-security-assessment tools can find vulnerabilities within a Web application that are next to impossible to find otherwise.
You can't solely rely on automated tools to test your Web applications. But I can't imagine comprehensive security testing without them.
Nikto
Figure 16-6 shows the partial results of a Nikto scan against a default IIS 5.0
installation. This scan found that the remote scripts directory is browsable and that the server is vulnerable to XSS. It also identified default scripts.
Nikto found 16 potential vulnerabilities out of the 2,000 items checked.
WebInspect
Figure 16-7 shows the output of a WebInspect scan against the default IIS 5.0
installation. This scan found XSS vulnerabilities, the IIS-specific Microsoft Data Access Components, and the null.printer vulnerabilities. WebInspect found a total of 208 potential vulnerabilities out of the 3,000 items checked.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 293
Figure 16-6:
The results
of a Nikto
Web
application
scan.
Figure 16-7:
The results
of a
WebInspect
Web-application
scan.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 294
294 Part V: Application Hacking
General Best Practices for Minimizing
Web-Application Security Risks
Keeping your Web applications secure requires ongoing vigilance from an ethical hacking perspective and from your Web-application developers and vendors. Keep up with the latest hacks and testing tools and techniques.
Obscurity
The following forms of security by obscurity can help prevent automated attacks from worms or scripts that are hard-coded to attack specific script types or default HTTP ports.
ߜ To protect Web applications and related databases, use different machines to run each Web server, application, and database server.
The operating systems on these individual machines should be tested for security vulnerabilities and hardened based on best practices and the countermeasures. in Chapter 11 (Windows), Chapter 12 (Linux), and Chapter 13 (NetWare).
ߜ Use built-in Web-server security features to handle access controls and process isolation, such as the application-isolation feature in IIS 6.0.
This helps ensure that if one Web application is attacked, it won't necessarily risk any other applications running on the same server.
ߜ If you're concerned about platform-specific attacks being carried out against your Web application, you can trick the attacker into thinking the Web server or operating system is something completely different.
Here are a few examples:
• If you're running a Microsoft IIS server and applications, you may be able to rename all your ASP scripts to have a .cgi extension.
• If you're running a Linux Web server, use a program such as IP
Personality (ippersonality.sourceforge.net) to change the OS fingerprint so the system looks like it's running something else.
ߜ Change your Web application to run on a nonstandard port. Change from the default HTTP port 80 or HTTPS port 443 to a high port number, such as 8877.
Don't rely on obscurity alone; it isn't foolproof. A dedicated hacker may be able to determine that the system isn't what it claims to be.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 295
Firewalls
Consider using these Web-application firewalls to protect your systems and information:
ߜ A network-based firewall that can detect and block attacks against Web applications.
• Commercial firewalls are available from such companies as NetScreen (www.netscreen.com), TippingPoint Technologies (www.
tippingpoint.com), and Check Point (www.checkpoint.com).
• An open-source firewall project called CodeSeeker is maintained by OWASP (www.owasp.org/development/codeseeker).
ߜ Host-based Web-application intrusion-prevention applications such as
• BlackICE --- my all-time-favorite software application
• Ubizen DMZ/Shield Enterprise (www.ubizen.com)
• Eeye SecureIIS (www.eeye.com)
• McAfee Entercept (www.nai.com)
These programs can detect Web-application attacks in real time and cut them off before they have a chance to do any harm.
ߜ Find security holes in Web applications before they're deployed. Use a third-party code-examiner expert or an automated tool, such as Flawfinder (www.dwheeler.com/flawfinder), ITS4 (www.cigital.
com/its4), and RATS (www.securesoftware.com/auditing\_tools\_
download.htm)
Software development is where security holes begin and should end --- but rarely do. If you can influence your Web developers, you can really make a difference in the security of your Web applications by encouraging secure development practices from the start. See Appendix A for resources.
23 55784x Ch16.qxd 3/29/04 4:18 PM Page 296
296 Part V: Application Hacking
24 55784X PP06.qxd 3/29/04 4:18 PM Page 297
Aftermath
24 55784X PP06.qxd 3/29/04 4:18 PM Page 298
In this part . . .
Well, now that the hard --- or at least technical --- stuff is over with, it's time to pull everything together,
fix what's broken, and establish some good practices to move forward with.
First off, this part covers reporting the vulnerabilities you discovered to help get upper management buy-in and
(more) budget to fix the security problems you've found.
This part then covers some good practices on plugging the various security holes within your systems and patching everything up to keep from being hacked. Finally, this part covers what it takes to manage change within your security systems for long-term success, including outsourcing ethical hacking so you can add even more projects to your overflowing plate! That's what working in information technology is all about anyway, right?
25 55784x Ch17.qxd 3/29/04 4:18 PM Page 299
In This Chapter
ᮣ Bringing your test data together
ᮣ Categorizing the vulnerabilities you discovered
ᮣ Documenting and presenting the final results
If you're looking for a break after testing, now isn't the time to rest on your laurels. The reporting phase of your ethical hacking is the most critical piece. The last thing you want to do is to run your tests, find security problems, and leave it at that. It's important to make sure that all your time and effort is put to good use by thoroughly analyzing and documenting what you found to ensure that security vulnerabilities are fixed.
Ethical hacking reporting includes debriefing upper management or your client on the various security issues found. You share the information you gathered and give the other parties guidance on where to go from here.
Reporting also shows that time, effort, and money are put to good use.
Pulling the Results Together
When you have gobs of test data --- from manual observations you documented to detailed reports from the various tools you used --- what do you do with it all? The task at hand is to go through your documentation with a fine-tooth comb and highlight with a marker all the areas that stand out. Base your decisions on ߜ Your knowledge as a security professional
ߜ Vulnerability ratings from your assessment tools
25 55784x Ch17.qxd 3/29/04 4:18 PM Page 300
300 Part VI: Ethical Hacking Aftermath
Many feature-rich security tools assign each vulnerability a risk rating, explain the details of the vulnerability and give possible solutions, and even reference a specific link to the Common Vulnerabilities and Exposures (CVE) Web site at cve.mitre.org so you can find out more information about the vulnerability.
For further research, you may also need to reference the vendor's Web site to find out more and see whether the vulnerability affects your particular system.
You can plug this information into a table in Excel or in Word. I prefer to go through everything in hard-copy form because it's easier for me to read, but your choice may depend on how much data there is. If you think more highly of trees, you may want to just read the results off the computer screen and copy and paste the items that stand out into a new Vulnerabilities to Address document.
In your document, you may want to organize the vulnerabilities as shown in the following list:
ߜ Nontechnical Issues
• Social Engineering Vulnerabilities
• Physical Security Vulnerabilities
• Miscellaneous
ߜ Workstations
• Operating Systems
• Applications
• Miscellaneous
ߜ Servers
• Operating Systems
• Applications
• Miscellaneous
ߜ Other Network Hosts
• Hubs and Switches
• Routers
• Firewalls
• Intrusion-Detection Systems
• Miscellaneous
25 55784x Ch17.qxd 3/29/04 4:18 PM Page 301
Consider creating a couple of separate lists for these security vulnerabilities: ߜ Internal vulnerabilities, such as internal hosts and organizational issues ߜ External vulnerabilities, such as public hosts, business-partner network connections, and telecommuters Prioritizing Vulnerabilities
It's critical to prioritize the security vulnerabilities you've found, because many may not be fixable or not worth fixing. You may not be able to eliminate some vulnerabilities due to various technical reasons, and you may not be able to afford to eliminate others. You need to factor in whether the benefit is worth the effort and cost involved. For instance, if you determine that it will cost $8,000 to encrypt a sales-leads database worth $5,000 to the organization, it may not make sense. You need to study each vulnerability carefully and weigh whether it's worth fixing.
Analyze each vulnerability carefully, and determine your worst-case scenarios.
It's not possible --- or not worth trying --- to fix every vulnerability that you've found.
Here's a quick-and-dirty method you can use when prioritizing your vulnerabilities. You should tweak it based on your needs. You need to consider two major factors for each of the vulnerabilities you've discovered: ߜ Likelihood of use: How likely is it that the specific vulnerability you're analyzing will be taken advantage of in a malicious way by a hacker, a rogue insider, or malware?
ߜ Impact if exploited: The impact is rated based on how detrimental it would be to the information systems you're assessing and the organization as a whole.
Rank each vulnerability, using criteria such as High, Medium, and Low or a 1-through-5 rating (where 1 is the lowest and 5 is the highest) for each of the two categories. Table 17-1 shows a sample table and a representative vulnerability for each category.
25 55784x Ch17.qxd 3/29/04 4:18 PM Page 302
302 Part VI: Ethical Hacking Aftermath
Table 17-1
Prioritizing Vulnerabilities
Impact Likelihood
High
Medium
Low
High
Unsecured
No admin pass---
Unencrypted emails
wireless AP
word on SQL server
being sent
Medium
End users with
Unauthorized
Tape backups that
Internet-only
access when
are not password---
access having weak
user is away
protected
login passwords
from computer
Low
Outdated virus
Weak encryption
Cleaning-crew
signatures on a
being exploited
personnel gaining
stand-alone PC
unauthorized net
dedicated to
work access
Internet browsing
The vulnerability prioritization shown in Table 17-1 is based on the qualitative method of assessing risks. It's subjective, based on your knowledge of the systems and vulnerabilities, but you can also consider any risk ratings you get from your security tools. Chapter 18 identifies vulnerabilities to focus on.
Reporting Methods
You need to organize your vulnerability information into a nice, pretty document for upper management or your customer. Ferret out the critical findings, and document them in a way that other parties can understand them without having to be security experts.
Graphs and charts are a plus but not required. Screen captures of your findings --- especially when it's more difficult to save the data to a file ---
can add a really nice touch to your reports.
Document the vulnerabilities in a concise, nontechnical manner: ߜ Every report should contain the following information:
• Tests that were performed
• Specific dates and times the testing was carried out
• Summary of the vulnerabilities discovered
• Prioritized list of vulnerabilities that need to be addressed (action items)
25 55784x Ch17.qxd 3/29/04 4:18 PM Page 303
ߜ If it will add value to upper management or your customer, add this information to your report:
• Steps on how to plug the security holes found
• List of general recommendations to improve overall security Most people want the hard-copy report to include a summary of the findings ---
not everything. The last thing most people want to see is a 5-inch stack of papers to sift through.
Many managers and customers like receiving raw-data reports from the security tools on a CD-ROM. They can reference the data later if they want but don't have to get mired in hundreds of hard-copy pages of technical gobbledygook.
Your list of action items may include something similar to the following: ߜ Enable Windows auditing on all servers.
ߜ Put lock on server-room door.
ߜ Harden operating systems based on best practices from SANS (www.
sans.org), NIST (crsc.nist.gov), the National Security Agency Security Recommendation Guides (www.nsa.gov/snac/index.html), and Network Security For Dummies.
ߜ Use a paper shredder for the destruction of confidential hard-copy information.
ߜ Install personal firewall/IDP software on all laptops.
ߜ Apply the latest vendor patches to the Web server.
As part of the final report, you may want to document employee reactions you observed when carrying out your ethical hacking tests. For example, were employees completely oblivious or even belligerent when you carried out an obvious social-engineering attack? Did IT or security staff completely miss technical tip-offs, such as the performance of the network degrading during testing or various attacks listed in system log files? You can also document other security issues you observed, such as how quickly IT or security staff responded to your tests or whether they even responded at all.
If an ethical hacking report and all the associated documentation and files were to fall into the hands of a competitor, hacker, or malicious insider, that could spell disaster for the organization. Here are some ways to prevent this from happening: ߜ Keep the report and associated documentation and files confidential, and deliver them only to those who need to know.
25 55784x Ch17.qxd 3/29/04 4:18 PM Page 304
304 Part VI: Ethical Hacking Aftermath
ߜ Remove these programs and data that a hacker or rogue insider could use from the report in malicious ways:
• Tools, such as password crackers and network analyzers
• Log files
• Test data
I recommend leaving the actual testing steps out of the report. Just answer any questions on that subject as needed.
26 55784x Ch18.qxd 3/29/04 4:17 PM Page 305
In This Chapter
ᮣ Determining which vulnerabilities to address first
ᮣ Patching your systems
ᮣ Looking at your security in a new light
Now it's time to head down the road to greater security. You've found some security vulnerabilities --- ideally, not too many serious ones!
These security holes must be plugged before someone exploits them. This is going to require rolling up your sleeves and using a little elbow grease to make things happen. First, you need to come up with your game plan and decide which security vulnerabilities to address first. A few patches may be in order, and possibly even some system hardening. This may be a time to reevaluate your network design and security infrastructure as well. I touch on some of the critical areas here. You may also want to refer to the fine book Network Security For Dummies, by Chey Cobb (Wiley Publishing Inc.). Chey does a great job of covering each of these topics in depth.
Turning Your Reports into Action
It may seem obvious which security vulnerabilities to address first, but it's often not that black-and-white. The variables involved with each host that need addressing include
ߜ Whether the vulnerability can be fixed
ߜ How critical the host is
ߜ Whether you can take the system offline to fix the problem ߜ How easy the vulnerability is to fix
ߜ Costs involved in purchasing new hardware or software to plug the holes 26 55784x Ch18.qxd 3/29/04 4:17 PM Page 306
306 Part VI: Ethical Hacking Aftermath
In Chapter 17, I cover the more basic issues of how important and how urgent the security problem is. You should look at this from a time-management perspective and address the issues that are both important (high-impact) and urgent (high-likelihood). You don't want to try to fix the vulnerabilities that are just high-impact or just high-likelihood. You may have some high-impact vulnerabilities that will likely never be exploited. Likewise, you probably have some vulnerabilities that have a high likelihood of being exploited, yet won't really make a big difference in the future of the company.
Focus on the highest-payoff tasks --- those that are both high-impact and high-likelihood. Ideally, this will be the minority of your overall number of vulnerabilities. Then you can go after the less important and less urgent tasks, such as a renaming the administrator ID on a handful of noncritical stand-alone workstations, as time and money permit, if that's what you choose to do.
Patching for Perfection
Do you ever feel like all you do is patch your systems to fix security vulnerabilities? If you answer yes to this question, good for you --- at least you're doing it!
If you constantly feel pressured to patch your systems but can't seem to find time --- at least it's on your radar! Many IT and security professionals don't even think about patching their systems until they get hacked. If you're reading this book, you're obviously concerned about security and way past that.
Whatever you do, whatever tool you choose, and whatever procedures work best in your environment --- keep your systems patched!
Patching is a necessary evil. The only real solution to eliminating the need for patches is developing secure software in the first place, but that's not going to happen any time soon. The majority of security incidents can be prevented with some good patching practices, so there's simply no reason not to patch.
Patch management
Whether you can keep up with the deluge of security patches for all of your systems, don't despair; there are some ways to get a handle on the problem.
Here are my three basic tenets of applying patches to keep your systems secure:
ߜ Make sure all the people and departments that are involved in applying patches in your organization's systems are on the same page and follow the same procedures.
26 55784x Ch18.qxd 3/29/04 4:18 PM Page 307
ߜ Have procedures in place for these critical processes:
• Obtaining patch alerts from your vendors.
• Assessing which patches affect your systems.
• Determining when patches are applied.
Appendix A lists links to patch-notification systems.
ߜ Make it policy and have a procedure in place for testing patches before you apply them to your production servers, if that's possible. Many patches have undocumented features and subsequent unintended side effects --- believe me, I've experienced this before. An untested patch is an invitation for system termination!
Patch automation
There are various patch-deployment tools you can use to lower the burden of constantly having to keep up with patches, as described in the following sections.
Commercial tools
I recommend a robust patch-automation application --- especially if you have ߜ A large network
ߜ A network with several different operating systems (Windows, Linux, NetWare, and so on)
ߜ More than a dozen or so computers
There are various patch-automation solutions. Be sure to at least check out: ߜ Patch Manager from BigFix (www.bigfix.com)
ߜ HFNetChk Pro from Shavlik Technologies (www.shavlik.com) ߜ Ecora Patch Manager from Ecora (www.ecora.com)
ߜ SysUpdate from SecurityProfiling (www.securityprofiling.com) The GFI LANguard Network Scanner product that I use to demonstrate a vulnerability-assessment tool in this book can both check for patches to be applied and deploy the patches.
Watch the other major vulnerability-assessment tool vendors. They are starting to integrate logic in those programs to deploy patches to address the vulnerabilities their products find --- a process called vulnerability management.
26 55784x Ch18.qxd 3/29/04 4:18 PM Page 308
308 Part VI: Ethical Hacking Aftermath
Free tools
If you're running Windows, use one of these free automated tools: ߜ Windows Update, which is built into Microsoft Windows systems ߜ Microsoft Baseline Security Analyzer (MBSA)
ߜ Microsoft Software Update Services (SUS) Server
Hardening Your Systems
Even after you patch your systems, you're still not done. You've got to make sure your systems are hardened from the other security vulnerabilities that patches cannot fix. I've found over the years that many people stop with patching, thinking their systems are secure, but that's just not possible. Throughout the years, I've seen network administrators ignore recommended hardening best practices from organizations such as SANS (www.sans.org), NIST (www.
nist.gov), and the National Security Agency (www.nsa.gov/snac/index.
html), leaving many security holes wide open.
Network Security For Dummies contains a lot of great resources for hardening various systems on your network.
I was once involved in cleaning up a hack attack on a Windows NT server for a customer of mine. I had been telling them ever since they hired me that they needed to let me harden their network from attack. They basically had a server wide open on the Internet with a public IP address (ouch!) and no firewall installed. They were willing to pay me to patch the server, but that was it. There was only so much that could be done to secure it completely from the elements, given their environment and specific needs. They didn't heed my advice on at least getting the server behind a firewall, if not reconfiguring the way their application worked. Neither of these was an option.
Time passed, and nothing happened until one day, a hacker compromised the server, uploaded FTP server software, and started hosting illegal movies and music --- effectively locking everyone out the server. After the downtime, lost business, and cost of paying me to finally fix the problem, it ended up costing them way more than the price of a firewall and a couple of hours of installation time.
This book presents hardening countermeasures that you can implement for your network, computers, and even physical systems and people. These are the ones I've found to work the best for the respective systems.
It's absolutely critical to implement at least the basic security best practices.
Whether installing a firewall on the network or requiring users to have strong passwords --- you must do the basics if you want any modicum of security.
26 55784x Ch18.qxd 3/29/04 4:18 PM Page 309
Beyond patching, if you follow the countermeasures I've documented in this book, along with the other well-known security best practices that are freely available on the Internet for such network systems (routers, servers, workstations, and so on), as well as perform ethical hacking tests on an ongoing basis, you can rest assured that you're doing your best to keep your organization's information secure.
Assessing Your Security Infrastructure
A review of your overall security infrastructure can add oomph to your systems.
Look at the big picture. How is your network actually designed? What about your building? You should even consider organizational issues such as whether policies are in place, maintained, or even taken seriously. Does upper management take information security seriously, or do they simply shrug it off as another unnecessary expense?
Using the information you gathered by performing the ethical hacking tests in this book, map your network. Update existing documentation --- a major necessity. Outline IP addresses, running services, and whatever else you've found out. Although I prefer Visio or other, more-capable network diagram-ming tools, you could even draw out your map on a napkin! Just draw it out.
Network design and overall security issues are a whole lot easier to assess when you can see them visually.
Are you focusing all your efforts on the perimeter and not on a layered security approach? Think about how most convenience stores and banks are protected.
Their security cameras are focused on the cash registers, teller computers, and surrounding areas --- not just on the parking lot or entrance areas. Look at security from a defense in-depth perspective. Make sure that several layers of security are in place just in case one measure fails, so the malicious user must go through various other barriers and jump through other hoops to carry out a hack attack successfully.
Do the same thing with organizational issues as well. Document what security policies and procedures are in place and how effective they are. Look at the overall security culture within your company, and see what it looks like from an outsider's perspective. What would customers or business partners think about how your organization is treating their confidential information?
Looking at your security from a high-level and nontechnical perspective will give you a new outlook on what else still needs to be done. It takes some time and effort at first, but after you establish a baseline of security, it will be much easier to manage and keep a handle on moving forward as new threats and vulnerabilities emerge.
26 55784x Ch18.qxd 3/29/04 4:18 PM Page 310
310 Part VI: Ethical Hacking Aftermath
27 55784x Ch19.qxd 3/29/04 4:17 PM Page 311
In This Chapter
ᮣ Automating tasks
ᮣ Watching for misbehavior
ᮣ Outsourcing testing
ᮣ Keeping security on everyone's mind
Information security is an ongoing process that must be managed effectively to be successful. This goes beyond applying patches and hardening systems every so often. Performing your ethical hacking tests again and again is critical; information security threats and vulnerabilities constantly emerge. Combine this with the fact that ethical hacking tests are just a snapshot in time view of your overall information security, so you have to perform your tests on an ongoing basis to keep up with the latest security issues.
You need to consider a few key issues in your ongoing efforts, such as automating some of the testing, monitoring for malicious use, and even outsourcing some or all of your ethical hacking and security services. In this chapter, I cover the critical issues that you can consider to help ensure long-term success in your security efforts.
Automating the Ethical Hacking Process
The ethical hacking tests that can be automated are covered in this book: ߜ Port scans
ߜ Password-cracking tests
ߜ Vulnerability-assessment tests
You've got to have the right tools to automate tests:
ߜ Some commercial tools can set up ongoing assessments and create nice reports for you without any hands-on intervention --- just a little setup and scheduling time up front. This is why I like many of the commercial 27 55784x Ch19.qxd 3/29/04 4:17 PM Page 312
312 Part VI: Ethical Hacking Aftermath
security testing tools. This often helps justify the price of the tools ---
especially if you don't have to be up at 2:00 in the morning or on call 24
hours a day to monitor the testing.
ߜ Stand-alone security tools such as Nmap, John the Ripper, and Nessus aren't enough. You can use the Windows Scheduler and AT commands on Windows systems and cron jobs on UNIX--based systems, but manual steps are still required.
True security isn't possible by automating everything. Certain issues can't be set on autopilot, such as enumeration of new systems, social engineering, and physical-security walkthroughs. Even the smartest computer "expert system" will never be able to accomplish some security tests. Good security requires both technical know-how and good old-fashioned experience.
Monitoring Malicious Use
Monitoring for security events is essential for ongoing security efforts. This can be as basic --- and mundane --- as monitoring log files on routers, firewalls, and critical servers every day or as advanced --- and, often, expensive --- as implementing an event-correlation system to keep tabs on every little thing happening on the network. A common method is to deploy an IDS or IDP system and monitor for malicious behavior. The problem with this and most security monitoring solutions is that it can be a very boring yet very difficult task to do effectively.
Consider dedicating a time every day --- such as first thing in the morning ---
to check your critical log files from the previous night or weekend to ferret out intrusions and other computer and network problems that could be security-related. You could also dedicate a person to this task, but do you really want to subject someone to that kind of torture?
ߜ Finding some --- much less all --- critical security events in system log files is difficult or impossible. It's just too tedious a task for the average human to accomplish effectively.
ߜ Some security events, such as IDS evasion techniques and hacks coming into allowed ports on the network, may not be detected at all, depending on the type of logging and security equipment you have in place.
Enable as much event logging as possible. You don't necessarily need to capture all computer and network events, but you should definitely look for certain obvious ones, such as login failures, packets, and unauthorized file access.
The preferable way to log security events is to use a syslog server on your network and not keep logs on the local host, if at all possible. This can help prevent hackers from tampering with log files to cover their tracks. Check out www.log analysis.org for great logging resources.
27 55784x Ch19.qxd 3/29/04 4:17 PM Page 313
A couple of good solutions to the security monitoring dilemma are to ߜ Purchase an event-logging system. A few low-priced yet effective solutions are available, such as GFI's Security Event Log Monitor (www.gfi.com/
lanselm). Just keep in mind that typically lower-priced event-management systems usually support only one OS platform: Microsoft Windows. Higher-end solutions, such as GuardedNet's neuSECURE (www.guardednet.net), offer both basic log management and event correlation to help track down the source of security problems, as well as the various systems that were affected during an incident.
ߜ Outsource security monitoring to a third-party managed security services provider (MSSP). Dozens and dozens of MSSPs were around during the Internet boom days, but only a few strong ones still remain. The value in outsourcing security monitoring is that the MSSP often has facilities and tools that you may not be able to afford. They also have analysts working around the clock and can take the security experiences and knowledge they gain from other customers and share it with your systems.
When these MSSPs discover a security vulnerability or intrusion, they can usually address the issue immediately often without even getting you involved. I recommend at least checking whether third-party firms and their services can free up some of your time and resources so you can focus on other things. Just don't depend solely on their monitoring efforts; an MSSP can't catch insider abuse or social-engineering attacks.
You're still going to have to be involved in a limited capacity.
Outsourcing Ethical Hacking
Outsourcing ethical hacking is very popular. It's a great way for organizations to get an unbiased third-party perspective on their information security.
Outsourcing ethical hacking is expensive. Many organizations will have to spend thousands --- often, tens of thousands --- of dollars, depending on the testing needed. But it's not cheap to do all of this yourself!
Outsourcing allows you to have a sort of checks-and-balances system.
Outsourcing isn't free or inexpensive. A lot of confidential information is at stake, so you must be able to trust your outside consultants and vendors.
Consider the following questions when looking for a vendor to partner with: ߜ Is your ethical hacking vendor on your side or third-party vendors' side?
Is the vendor trying to sell you products, or is it vendor-neutral? Many vendors may try to make a few more dollars off the deal --- which may not be necessary for your needs. This may be okay, but just make sure that no major conflicts of interest are making you uncomfortable.
27 55784x Ch19.qxd 3/29/04 4:17 PM Page 314
314 Part VI: Ethical Hacking Aftermath
ߜ What other IT or security services does the vendor offer? Does it focus solely on security?
It can help to find an ethical hacking specialist instead of an IT generalist organization to do this testing for you.
ߜ What are your vendor's hiring/termination policies?
Look for measures the vendor takes to minimize the chances that an employee will walk off with all of your confidential information.
ߜ Does the vendor understand your business needs behind ethical hacking?
Have the vendor repeat the list of your needs back to you to make sure you're both on the same page.
ߜ How well does the vendor communicate? Do you trust that the vendor will keep you informed and will follow up with you in a timely manner?
ߜ Do you know exactly who will be performing the tests? Will one person do all the testing, or will subject-matter experts focus on the different areas? This isn't a deal breaker --- it's just nice to know.
ߜ Does the vendor have the experience to recommend practical and effective countermeasures to the vulnerabilities found?
ߜ Do you get the impression that the vendor is in this to make a quick buck off the services, with minimal effort and value added, or is the vendor in this to build loyalty with you?
Find a good organization to work with long-term. That will make your ongoing efforts much simpler.
ߜ Ask for several references, and sample sanitized deliverables from your vendor. If the vendor cannot produce these, or it seems overly difficult, look for another vendor.
ߜ Run criminal-background checks on every person involved on the ethical hacking project. It's really cheap. I even slap my own customers'
hands when they don't ask for permission to run a background check before hiring me for ethical hacking projects. If criminal-background checks aren't an option, make a thorough Internet search via search engine.
If your vendor won't agree to background checks of everyone involved in the ethical hacking projects, run --- fast --- to find another vendor. In addition, if the vendor won't disclose the details of what it's going to test for (not necessarily how the testing will be carried out), or won't commit to being available in case problems arise, find another vendor. Also, be wary if your vendor talks openly about the security (or general lack of it) of other clients. The vendor may just do the same for your organization as well!
Your vendor should have its own services agreement for you to sign, which should include a mutual nondisclosure statement. Make sure you both sign off on this to help protect your organization in the future.
27 55784x Ch19.qxd 3/29/04 4:17 PM Page 315
Thinking about hiring a reformed hacker?
Former hackers --- I'm referring to the black-hat
your organization possesses. This informa---
hackers who have hacked into computer sys---
tion in the wrong hands --- even ten years
tems in the past --- can be very good at what
after being gathered --- could be used
they do. Many people swear by it. Others com---
against your organization. Some hackers
pare this to hiring the proverbial fox to guard the
hang out in tight social groups. You may not
chicken house. If you're thinking about bringing
want your information being shared in their
in a former unethical hacker to test your sys---
circles.
tems, consider these issues:
Everyone deserves a chance to explain what
ߜ Do you really want to reward hacker behav-happened in the past. Zero tolerance is sense-ior with your organization's business?
less. Listen to his or her story, and use common---
ߜ
sense discretion as to whether or not you trust
Claiming to be reformed doesn't mean he or
this person to help you. The supposed black-hat
she is. There could be deep-rooted person---
hacker may have actually just been a gray hat
ality issues you're going to have to contend
or even a misguided white-hat hacker who
with. Buyer beware!
makes a good fit in your organization.
ߜ Information gathered during ethical hacking
is some of the most sensitive information
Outsourcing ethical hacking may make good business sense for you, especially if you don't have the time or internal resources. Stay educated on the process, and keep tabs on what your vendor is doing during the process.
Instilling a SecurityAware Mindset
Your employees are often your first and last line of defense. Make sure all of your ethical hacking-efforts and money spent on all of your information-security initiatives aren't wasted due to a simple employee slip-up that gives a hacker the keys to the kingdom.
These elements can help establish a securityaware culture in an organization: ߜ Make employee awareness of security an active and ongoing process.
ߜ Treat awareness and training programs as a long-term business investment.
It doesn't have to be expensive. You can buy posters to hang up in break rooms, as well as mouse pads, screen savers, pens, and sticky notes to help get the word out and keep security on the top of everyone's mind.
Some great vendors are Greenidea, Inc. (www.greenidea.com), Security Awareness, Inc. (www.securityawareness.com), and Interpact, Inc.
(www.interpactinc.com).
27 55784x Ch19.qxd 3/29/04 4:17 PM Page 316
316 Part VI: Ethical Hacking Aftermath
ߜ Get the word on security out to upper management!
ߜ Align your security message with your audience, and keep it as nontechnical as possible.
ߜ Lead by example. Show that you take this seriously, and offer evidence that helps to prove that everyone else should, too.
If you can get the ear of upper managers and end users alike, and put enough effort forth to make security a priority day after day, you may be able to help shape the culture in your organization. This can provide security value beyond your wildest imagination. I've seen the difference it makes!
Keeping Up with Other Security Issues
Ethical hacking isn't the be all, end all solution to information security. It cannot even guarantee security, but it's certainly a great start. Ethical hacking must be integrated as part of an overall information-security program that includes ߜ Higher-level information-risk assessments
ߜ Strong security policies that are enforced
ߜ Solid incident-response and business-continuity plans ߜ Effective security awareness and training initiatives This may require hiring more staff or outsourcing more security help as well.
Don't forget about formal training for yourself and any colleagues. You've got to educate yourself consistently to stay on top of this game.
28 55784X PP07.qxd 3/29/04 4:17 PM Page 317
28 55784X PP07.qxd 3/29/04 4:17 PM Page 318
In this part . . .
Well, here's the end of the road, so to speak. In this part, I've compiled what I believe are the absolute
critical success factors to make ethical hacking --- and information security in general --- work in any organization. Bookmark, dog-ear, or do whatever you need to do with these pages so you can refer to them over and over again. This is the meat of what you need to know about information security --- even more so than all of the technical hacks and countermeasures I've covered thus far.
Read it, study it, and make it happen. You can do it!
29 55784x Ch20.qxd 3/29/04 4:20 PM Page 319
Management Buy-In
In This Chapter
ᮣ Staying away from fear, uncertainty, and doubt
ᮣ Proving yourself
ᮣ Communicating on their level
ᮣ Highlighting the benefits
Several key steps exist for obtaining the buy-in and sponsorship that you need to support your ethical hacking efforts. In this chapter, I describe the ones that I find to be the most effective.
Cultivate an Ally and Sponsor
Selling ethical hacking and information security to upper managers isn't something you want to tackle alone. Get an ally --- preferably, your manager or someone at that level or higher in the organization --- who understands the value of ethical hacking. Although this person may not be able to speak for you directly, she can be seen as an unbiased third-party sponsor and can give you more credibility.
Don't Be a FUDdy Duddy
Sherlock Holmes said, "It is a capital offense to theorize before one has data."
It's up to you to make a good case and to put information security and the need for ethical hacking on upper management's radar. Just don't blow stuff out of proportion for the sake of stirring up fear, uncertainty, and doubt (FUD).
Managers worth their salt see right through that. Focus on educating upper management with practical advice. Rational fears proportional to the threat are fine --- just don't take the Chicken Little route, claiming that the sky's falling.
29 55784x Ch20.qxd 3/29/04 4:20 PM Page 320
320 Part VII: The Part of Tens
Demonstrate How the Organization
Can't Afford to Be Hacked
Show how dependent the organization is on its information systems. Create what-if scenarios --- kind of a business-impact assessment --- to show what can happen and how long the organization can go without using the network, computers, and data. Ask upper-level managers what they would do without their computer systems and IT personnel. Show them real-world anecdotal evidence on hacker attacks, including malware, physical security, and social-engineering issues --- but be positive about it. Don't approach this in a negative way with FUD. Rather, keep them informed on serious security happenings in their industry. Find stories related to similar businesses or industries so that they can relate. Clip magazine and newspaper articles.
Google is a great tool to find practically everything you need here.
Show management that the organization has what a hacker wants --- a common misconception among those ignorant to the threats and vulnerabilities. And be sure to point out the potential costs from damage caused by hacking: ߜ Missed opportunity costs ߜ Loss of intellectual property
ߜ Liability issues
ߜ Legal costs
ߜ Lost productivity
ߜ Cleanup time and costs
ߜ Costs of fixing a tarnished reputation
Outline the General Benefits
of Ethical Hacking
In addition to the potential costs listed in the previous section, talk about how ethical hacking can help find security vulnerabilities in information systems that normally may be overlooked. Tell management that ethical hacking is a way of thinking like the bad guys so you can protect yourself from the bad guys --- the Art of War mindset.
29 55784x Ch20.qxd 3/29/04 4:20 PM Page 321
Chapter 20: Ten Tips for Getting Upper Management Buy-In 321
Show How Ethical Hacking Specifically
Helps the Organization
Document benefits that support the overall business goals: ߜ Demonstrate how security doesn't have to be that expensive and can actually save the organization money long-term.
• Security is much easier and cheaper to build in up front than to add on later.
• Security doesn't have to be inconvenient and can enable productivity if it's done properly.
ߜ Talk about how new products or services can be offered for a competitive advantage if secure information systems are in place.
• Certain federal regulations are met.
• Managers and the company look good to customers.
• Ethical hacking shows that the organization is protecting customer and other critical information.
Get Involved in the Business
Understand the business --- how it operates, who the key players are, and what politics are involved:
ߜ Go to meetings to see and be seen. This can help prove that you're concerned about the business.
ߜ Be a person of value who's interested in contributing to the business.
ߜ Know your opposition. Again, use The Art of War and the "know your enemy" mentality --- if you understand what you're dealing with, buy-in is much easier to get.
Establish Your Credibility
Focus on these three characteristics:
ߜ Be positive about the organization, and prove that you really mean business. Your attitude is critical.
ߜ Empathize with managers, and show them that you understand the business side.
29 55784x Ch20.qxd 3/29/04 4:20 PM Page 322
322 Part VII: The Part of Tens
ߜ To create any positive business relationship, you must be trustworthy.
Build up that trust over time, and selling security will be much easier.
Speak on Their Level
No one is really that impressed with techie talk. Talk in terms of the business.
This key element of obtaining buy-in is actually part of establishing your credibility but deserves to be listed by itself.
I've seen countless IT and security professionals lose upper-level managers as soon as they start speaking. A megabyte here; stateful inspection there; packets, packets everywhere! Bad idea! Relate security issues to everyday business processes and job functions. Period.
Show Value in Your Efforts
Here's where the rubber meets the road. If you can demonstrate that what you're doing offers business value on an ongoing basis, you can maintain a good pace and not have to constantly plead to keep your ethical hacking program going. Keep these points in mind: ߜ Document your involvement in IT and information security, and create ongoing reports for upper-level managers regarding the state of security in the organization. Give them examples of how their systems will be secured from known attacks.
ߜ Outline tangible results as a proof of concept. Show sample vulnerability-assessment reports you've run on your own systems or from the security tool vendors.
ߜ Treat doubts, concerns, and objections by upper management as requests for more information. Find the answers, and go back armed and ready to prove your ethical hacking worthiness.
Be Flexible and Adaptable
Prepare yourself for skepticism and rejection at first --- it happens a lot ---
especially from such upper managers as CFOs and CEOs, who are often completely disconnected from IT and security in the organization.
Don't get defensive. Security is a long-term process, not a short-term product or single assessment. Start small --- with a limited amount of such resources as budget, tools, and time --- if you must, and then build the program over time.
30 55784x Ch21.qxd 3/29/04 4:20 PM Page 323
In This Chapter
ᮣ Obtaining written approval
ᮣ Assuming that you can find and fix everything
ᮣ Testing only once
ᮣ Having bad timing
Several deadly mistakes --- when properly executed --- can wreak havoc on your ethical hacking outcomes and even your job or career. In this chapter, I discuss the potential pitfalls that you need to be keenly aware of.
Not Getting Approval in Writing
Getting approval for your ethical hacking efforts --- whether it's from upper management or the customer --- is an absolute must. It's your get out of jail free card.
Obtain documented approval that includes the following: ߜ Explicitly lay out your plan, your schedule, and the affected systems.
ߜ Get the authorized decision-maker to sign off on the plan, agreeing to the terms and agreeing not to hold you liable for malicious use or other bad things that can happen unintentionally.
ߜ Get the signed original copy of the agreement.
No exceptions here!
30 55784x Ch21.qxd 3/29/04 4:20 PM Page 324
324 Part VII: The Part of Tens
Assuming That You Can Find All
Vulnerabilities During Your Tests
So many security vulnerabilities exist --- some known and just as many or more unknown --- that you can't find them all during your testing. Don't make any guarantees that you'll find all security vulnerabilities. You'll be starting something that you can't finish.
Stick to the following tenets:
ߜ Be realistic.
ߜ Use good tools.
ߜ Get to know your systems, and practice honing your techniques.
Assuming That You Can Eliminate
All Security Vulnerabilities
When it comes to computers, 100 percent security has never been attainable and never will be. You can't possibly prevent all security vulnerabilities. You'll do fine if you
ߜ Follow best practices.
ߜ Harden your systems.
ߜ Apply as many security countermeasures as reasonably possible.
Performing Tests Only Once
Ethical hacking is a snapshot in time of your overall state of security. New threats and vulnerabilities surface continuously, so you must perform these tests regularly to make sure you keep up with the latest security defenses for your systems.
30 55784x Ch21.qxd 3/29/04 4:20 PM Page 325
Pretending to Know It All
No one working with computers or information security knows it all. It's basically impossible to keep up with all the software versions, hardware models, and new technologies emerging all the time --- not to mention all the associate security vulnerabilities! Good ethical hackers know their limitations --- they know what they don't know. However, they certainly know where to go to get the answers (try Google first).
Running Your Tests without Looking
at Things from a Hacker's Viewpoint
Think about how an outside hacker can attack your network and computers.
You may need a little bit of inside information to test some things reasonably, but try to limit that as much as possible. Get a fresh perspective, and think outside that proverbial box. Study hacker behaviors and common hack attacks so you know what to test for.
Ignoring Common Attacks
Focus on the systems and tests that matter the most. You can hack away all day at a stand-alone desktop running MS-DOS from a 51⁄4-inch floppy disk with no network card and no hard drive, but does that do any good?
Not Using the Right Tools
Without the right tools for the task, it's almost impossible to get anything done --- at least not without driving yourself nuts! Download the free tools I mention throughout this book and list in Appendix A. Buy commercial tools if you have the inclination and the budget. No security tool does it all. Build up your toolbox over time, and get to know your tools well. This will save you gobs of effort, plus you can impress others with your results.
30 55784x Ch21.qxd 3/29/04 4:20 PM Page 326
326 Part VII: The Part of Tens
Pounding Production Systems
at the Wrong Time
One of the best ways to lose your job or customers is to run hack attacks against production systems when everyone and his brother is using them. Mr.
Murphy's Law will pay a visit and take down critical systems at the absolute worst time. Make sure you know when the best time is to perform your testing. It may be in the middle of the night. (I never said being an ethical hacker was easy!) This may be reason enough to justify using security tools and other supporting utilities that can help automate certain ethical hacking tasks.
Outsourcing Testing and
Not Staying Involved
Outsourcing is great, but you must stay involved. It's a bad idea to hand over the reins to a third party for all your security testing without following up and staying on top of what's taking place. You won't be doing anyone a favor except your outsourced vendors by staying out of their hair. Get in their hair.
(But not like gum --- that just makes everything more difficult.) 31 55784X PP08.qxd 3/29/04 4:20 PM Page 327
31 55784X PP08.qxd 3/29/04 4:20 PM Page 328
In this part . . .
In this final part of the book, Appendix A contains a
listing of my favorite ethical hacking tools that I cover throughout this book, broken down into various categories for easy reference. In addition, I list various other ethical hacking resources that I think you'll benefit from in your endeavors. Appendix B talks about the book's companion Web site. Hope it all helps!
32 55784x AppA.qxd 3/29/04 4:20 PM Page 329
Appendix A
Tools and Resources
In order to stay up to date with the latest and great ethical hacking tools and resources, you've got to know where to turn to. This Appendix contains my favorite security sites, tools, resources, and more that you can benefit from too in your ongoing ethical hacking program.
Awareness and Training
Greenidea, Inc. Visible Statement (www.greenidea.com)
Interpact, Inc. Awareness Resources (www.interpactinc.com) SANS Security Awareness Program (store.sans.org)
Security Awareness, Inc. Awareness Resources (www.securityawareness.com) Dictionary Files and Word Lists
ftp://ftp.cerias.purdue.edu/pub/dict
ftp://ftp.ox.ac.uk/pub/wordlists
packetstormsecurity.nl/Crackers/wordlists
www.outpost9.com/files/WordLists.html
Default vendor passwords www.cirt.net/cgi-bin/passwd.pl 32 55784x AppA.qxd 3/29/04 4:20 PM Page 330
330 Part VIII: Appendixes
General Research Tools
CERT/CC Vulnerability Notes Database www.kb.cert.org/vuls ChoicePoint www.choicepoint.com
Common Vulnerabilities and Exposures cve.mitre.org/cve Google www.google.com
Hoover's business information www.hoovers.com
NIST ICAT Metabase icat.nist.gov/icat.cfm
Sam Spade www.samspade.org
U.S. Securities and Exchange Commission www.sec.gov/edgar.shtml Switchboard.com www.switchboard.com
U.S. Patent and Trademark Office www.uspto.gov
US Search.com www.ussearch.com
Yahoo! Finance site finance.yahoo.com
Hacker Stuff
2600 --- The Hacker Quarterly magazine www.2600.com Computer Underground Digest www.soci.niu.edu/~cudigest Hackers: Heroes of the Computer Revolution book by Steven Levy Hacker t-shirts, equipment, and other trinkets www.thinkgeek.com Honeypots: Tracking Hackers www.tracking-hackers.com The Online Hacker Jargon File www.jargon.8hz.com
PHRACK www.phrack.org
32 55784x AppA.qxd 3/29/04 4:20 PM Page 331
Appendix A: Tools and Resources
331
Linux
Bastille Linux hardening utility www.bastille-linux.org Debian Linux Security Alerts www.debian.org/security
Linux Administrator's Security Guide www.seifried.org/lasg Linux Kernel Updates www.linuxhq.com
Linux Security Auditing Tool (LSAT) usat.sourceforge.net Red Hat Linux Security Alerts www.redhat.com/support/alerts Slackware Linux Security Advisories www.slackware.com/security Suse Linux Security Alerts www.suse.com/us/business/security.html Tiger ftp.debian.org/debian/pool/main/t/tiger VLAD the Scanner razor.bindview.com/tools/vlad
Log Analysis
LogAnalysis.org system logging resources www.loganalysis.org Malware
chkrootkit www.chkrootkit.org
EICAR testing string www.eicar.org/anti\_virus\_test\_file.htm McAfee AVERT Stinger vil.nai.com/vil/stinger
PestPatrol's database of pests research.pestpatrol.com/PestInfo/
pestdatabase.asp
Rkdet vancouver-webpages.com/rkdet
The File Extension Source filext.com
Wotsit's Format at www.wotsit.org
32 55784x AppA.qxd 3/29/04 4:20 PM Page 332
332 Part VIII: Appendixes
Messaging
GFI e-mail security test www.gfi.com/emailsecuritytest smtpscan www.greyhats.org/outils/smtpscan
How to disable SMTP relay on various e-mail servers www.mailabuse.org/
tsi/ar-fix.html
mailsnarf www.monkey.org/~dugsong/dsniff or ww.datanerds.net/
~mike/dsniff.html for the Windows version
Rogue Aware by Akonix www.akonix.com
NetWare
chknull www.phreak.org/archives/exploits/novell
Craig Johnson's BorderManager resources nscsysop.hypermart.net NCPQuery razor.bindview.com/tools/index.shtml
Novell Product Updates support.novell.com/filefinder
Remote packetstormsecurity.nl/Netware/penetration
Rcon program at packetstormsecurity.nl/Netware/penetration/
rcon.zip
Userdump www.roy.spang.org/freeware/userdump.html
Networks
dsniff www.monkey.org/~dugsong/dsniff
Ethereal network analyzer www.ethereal.com
ettercap ettercap.sourceforge.net
Firewalk www.packetfactory.net/firewalk
Firewall Informer www.blade-software.com
32 55784x AppA.qxd 3/29/04 4:20 PM Page 333
Appendix A: Tools and Resources
333
Foundstone FoundScan www.foundstone.com
GFI LANguard Network Scanner www.gfi.com
MAC address vendor lookup coffer.com/mac\_find
Nessus vulnerability assessment tool www.nessus.org
Netcat www.atstake.com/research/tools/network\_utilities NetScanTools Pro all-in-one network testing tool www.netscantools.com Nmap port scanner www.insecure.org/nmap
Port number listing www.iana.org/assignments/port-numbers Qualys QualysGuard vulnerability assessment tool www.qualys.com SuperScan port scanner www.foundstone.com
WildPackets EtherPeek www.wildpackets.com
Password Cracking
LC4 www.atstake.com/research/lc
John the Ripper www.openwall.com/john
pwdump2 razor.bindview.com/tools/desc/pwdump2\_readme.html NetBIOS Auditing Tool www.securityfocus.com/tools/543
Crack ftp://coast.cs.purdue.edu/pub/tools/unix/pwdutils/crack Brutus www.hoobie.net/brutus
Pandora www.nmrc.org/project/Pandora
NTFSDOS Professional www.winternals.com
NTAccess www.mirider.com/ntaccess.html
TSCRACK softlabs.spacebitch.com/tscrack/index.html
TSGrinder www.hammerofgod.com/download/tsgrinder-2.03.zip 32 55784x AppA.qxd 3/29/04 4:20 PM Page 334
334 Part VIII: Appendixes
War Dialing
Palm ToneLoc Viewer chroot.ath.cx/fade/projects/palm/pTLV.html PhoneSweep www.sandstorm.net/products/phonesweep
THC-Scan www.thc.org/releases.php
ToneLoc www.securityfocus.com/data/tools/auditing/pstn/tl110.zip ToneLoc Utilities Phun-Pak www.hackcanada.com/ice3/phreak Web Applications
2600's Hacked Pages www.2600.com/hacked\_pages
Archive of Hacked Websites www.onething.com/archive
BlackWidow www.softbytelabs.com/BlackWidow
Flawfinder www.dwheeler.com/flawfinder
ITS4 www.cigital.com/its4
Netcraft www.netcraft.com
Nikto www.cirt.net/code/nikto.shtml
RATS www.securesoftware.com/auditing\_tools\_download.htm Sanctum AppScan www.sanctuminc.com
Shadow Database Scanner www.safety-lab.com/en/products/6.htm SPI Dynamics WebInspect www.spidynamics.com
Windows
Amap www.thc.org/releases.php
DumpSec www.somarsoft.com
Legion packetstormsecurity.nl/groups/rhino9/legionv21.zip Microsoft Office Patches office.microsoft.com/officeupdate 32 55784x AppA.qxd 3/29/04 4:20 PM Page 335
Appendix A: Tools and Resources
335
Microsoft Security Resources www.microsoft.com/technet/security/
Default.asp
Network Users www.optimumx.com/download/netusers.zip
Rpcdump razor.bindview.com/tools/files/rpctools-1.0.zip SMAC MAC address changer www.klcconsulting.net/smac
Vision www.foundstone.com
Windows Update Utility for Patching windowsupdate.microsoft.com Winfo www.ntsecurity.nu/toolbox/winfo
Wireless Networks
AirJack 802.11ninja.net/airjack
AirMagnet www.airmagnet.com
AirSnort airsnort.schmoo.com
Cantenna wardriving kit mywebpages.comcast.net/hughpep Fluke WaveRunner www.flukenetworks.com
Kismet www.kismetwireless.net
Lucent Orinoco Registry Encryption/Decryption program www.cqure.net/
tools.jsp?id=3
Making a wireless antenna from a Pringles can www.oreillynet.com/cs/
weblog/view/wlg/448
NetStumbler www.netstumbler.com
Pong wireless firmware vulnerability testing program www.mobileaccess.de/
wlan/dl.php/pong\_v1.1.zip
Security of the WEP Algorithm www.isaac.cs.berkeley.edu/isaac/
wep-faq.html
The Unofficial 802.11 Security Web Page www.drizzle.com/~aboba/IEEE
Wellenreiter www.wellenreiter.net
WiGLE database of wireless networks at www.wigle.net
WildPackets AiroPeek www.wildpackets.com
32 55784x AppA.qxd 3/29/04 4:20 PM Page 336
336 Part VIII: Appendixes
33 55784x AppB.qxd 3/29/04 4:20 PM Page 337
Appendix B
About the Book Web Site
This book's companion Website contains links to all the tools and resources listed in Appendix A. Check it out at www.dummies.com.
33 55784x AppB.qxd 3/29/04 4:20 PM Page 338
338 Part VIII: Appendixes
34 55784X index.qxd 3/29/04 4:20 PM Page 339
Index
• Numbers & Symbols • AirSnort wireless LAN security tool system analysis, 148
802.11b/802.11i standards (IEEE), 157
WEP-encryption cracking, 156
2600 -- The Hacker Quarterly (magazine), 27
airwaves, scanning local, 152--154
Akin, Thomas (Southeast Cybercrime
• A •
Institute), 259
Akonix IM traffic-detection tools, 275--276
all-in-one security-assessment tools, 170
access controls
Amap application-detection software,
Linux systems, 203
200--201
Web servers, 285
anonymity, of hackers, protecting, 27--28
access points (AP), wireless networks
antennas (wireless-network attacks), 150
unauthorized, 158--160
Antigen (Sybari Software) malware---
vulnerabilities, 76, 148
prevention software, 254
accounts, user
antivirus software, testing, 249--250
lockouts, 94
AOL Instant Messenger security risks, 274
unused, 94
AP (access points), wireless networks
Active Server Pages (ASP) script attacks,
default configurations, 162
289--290
unauthorized, 158--160
ActiveX controls malware attacks, 241--242
vulnerabilities, 148
Address Resolution Protocol (ARP)
APNIC (Regional Internet Registry for
poisoning/spoofing, 140--143
Africa) lookup site, 44
ad-hoc mode (wireless LANs), 153
Apple Remote Access remote-connectivity
admin account (NetWare), 231
software, 106
admin utilities (NetWare), 228
application servers, security testing, 32
AdRem NetWare management
Application Service Providers (ASPs), 33
programs, 223
application-based attacks, 13--14
Advanced EFS Data Recovery program
approvals, written, importance of,
(ElcomSoft), 101
29--30, 323
AES (Advanced Encryption Standard), 157
ARIN (Regional Internet Registry for North
African Whois (lookup) sites, 44
America) lookup site, 44
AIM File Transfer security risks, 273
ARP (Address Resolution Protocol)
AirJack wireless LAN security tool, 148
poisoning/spoofing, 140--144
AirMagnet wireless testing device, 150
ASP (Active Server Pages) script
Aironet (Cisco) wireless card, 163
attacks, 289
AiroPeek (WildPackets) wireless LAN
ASPs (Application Service Providers), 33
security tools
assumptions, documenting, 36
local airwave scans, 153--154
attachment attacks (e-mail), 260
Monitor utility, 158--159
authentication
system analysis, 149
identifying requirements for, 48
weak, 84
34 55784X index.qxd 3/29/04 4:20 PM Page 340
340 Hacking For Dummies
authorization
Brutus password-cracking software
importance of, 15, 29--30
cracking system passwords, 85
tips for obtaining, 319--322
cracking Web logins, 282
written approvals, 323
buffer-overflow attacks, 208--209, 286
automated malware attacks, 243
building infrastructure, 72--73
automated scans (Web applications),
bulletin board systems (BBSs), 26
292--293
business goals, for ethical hacking plan, 30
automated security assessments,
35, 311--312
• C •
automated-input attacks, 286--287
autoresponder attacks (e-mail), 262
Cain and Abel password-capture
AVERT Stringer (McAfee) antivirus
software, 85
program, 250--252
Caldwell, Matt (GuardedNet, Inc.), 149
called IDs, 62
• B •
Cantenna kits, 150
case studies
backdoor system access
hacking e-mail, 259
for propagating malware, 244
hacking network infrastructures, 118
using unsecured modems, 106
hacking Web applications, 281
background checks, 60
hacking wireless networks, 149
banner-grabbing attacks
malware attack, 238
Netcat for, 130--131
physical security issues, 71
telnet for, 130
social-engineering attack, 57
testing for, 263--264
war dialing, 107
BBSs (bulletin board systems), 26
Windows password vulnerabilities, 81
behavioral-analysis tools, 252--253
CERT/CC Vulnerability Notes Database
believability, 63
Web site, 49
BigFix Patch Manager software, 213, 307
CGI (Common Gateway Interface) script
bindery contexts (NetWare), removing,
attacks, 289--290
232--233
Chappell, Laura (Protocol Analysis
BIOS passwords, cracking, 100
Institute), 118
black-hat (malicious) hackers, 10, 22, 24--25
CheckPoint firewall software, 295
BlackICE Web-application intrusion---
Chirillo, John ( Hack Attacks
prevention software, 295
Encyclopedia), 12
BlackWidow Web-crawling tool
chkconfig service (Linux), disabling, 203
directory traversals, 284
Chknull password-cracking utility, 85
function of, 42
chkrootkit rootkit-detection tool, 254
blind assessments
Cisco LEAP protocol WERP keys, 156--157
versus knowledge assessments, 35
Cisco routers, password vulnerabilities, 85
pros and cons, 40--41
client applications, 32
bombs, e-mail, 258
Client Manager (Orinoco) wireless LAN
bounced e-mail messages, 49
security tool, 148
Browse rights (NetWare), 231--233
client operating systems, 32
browsers, Web, scanning for
Cobb, Chey ( Network Security For
information, 41
Dummies), 101, 264, 308
brute-force password attacks, 88
code-injection attacks, 286--287
34 55784X index.qxd 3/29/04 4:20 PM Page 341
Index
341
COM ports, identifying, 111
Network File System protection, 207
Common Gateway Interface (CGI) script
network-analyzer attack prevention,
attacks, 289
99--100, 139--140
Common Vulnerabilities and Exposures
network-infrastructure attack
(CVE) Web site, 49, 300--301
prevention, 146
community of hackers, 26
null connection attack prevention,
CommView for Wi-Fi (TamoSoft) wireless
184--186
LAN-analyzer, 153
ongoing ethical hacking, 311--312
comprehensive assessment tools, 37--38
operating system protection, 101--102
Computer Underground Digest
password protection, 91--94, 96--98, 100
(magazine), 27
port scanning prevention, 127--128
computers. See physical-security attacks
.rhosts and hosts.equiv file attack
confidential information
prevention, 205--206
and file sharing, 272--273
remote procedure call protection, 178
removing from Google Groups, 45
script attack prevention, 290
stealing off networks, 13
SNMP attack prevention, 129
configuration settings
social-engineering attack prevention,
Web servers, 285
65--67
wireless LANs, 162
URL filter bypass prevention, 290--292
connection attacks (e-mail), 261--262
war dialing prevention, 114--115
console access (NetWare), 217
Web directory traversal prevention, 285
contingency plans, 16, 35
Web-application attack prevention, 283,
COPS file-monitoring program, 208
289, 294--295
copyrighted material, theft of, 26
for Windows systems, 173--174
countermeasures, security. See also
wireless LAN protection, 156--157,
security awareness training; security
159--160, 163
patches
wireless workstation protection, 161--162
Address Resolution Protocol protection,
Crack password-cracking software, 85
143--144
crackers, defined, 10
autoresponder attack prevention, 262
cracking passwords
awareness training, 56, 66--67, 92--93,
brute-force attacks, 88
315--316
dictionary attacks, 87--88
banner grab prevention, 131, 264
documenting testing process, 34
buffer-overflow attack prevention, 209
inference attacks, 84
denial of service attack prevention, 145
keystroke logging, 97--98
disabling SMTP relays, 269
NetWare systems, 221--223
disabling unneeded services, 201
network analyzers, 98--100
e-mail protections, 260--263, 269--272
in password-protected files, 95--97
firewall testing, 133
password-reset programs, 100--101
high-impact risks and responses, 305--306
shoulder surfing, 83
instant messaging protections, 275--277
social-engineering attacks, 83
keystroke logging, 97--98
in systems with weak authentication, 84
for Linux systems, 199, 210, 212--213
tools for, 79, 85--87
malware attack prevention, 253--254
weak storage systems, 98
NetBIOS attack prevention, 176--177
on wireless LANs, 156
for NetWare systems, 220, 223--225,
crashing system during tests, 15
228--234
34 55784X index.qxd 3/29/04 4:20 PM Page 342
342 Hacking For Dummies
crawlers, Web, 284
Draper, John (hacker), 22
criminal hackers, 24--25
drop ceilings, security risks, 72
cross-site scripting (XSS) Web-application
dsniff network analyzer
attacks, 288
analyzing UNIX systems, 135
customer notification, importance of, 31
e-mail packet sniffing, 270
CVE (Common Vulnerabilities and
malware attacks using, 242
Exposures) Web site, 49, 300--301
dsrepair NLM (NetWare), 227
cyberterrorists, 23--24
D-Tective reverse Whois service, 44
DumpSec vulnerability-assessment tool
• D •
operation system information, 48
security settings, 171
daemons (Linux), scanning, 195--199
share permissions, 187
database server testing, 32
user and configuration settings, 182--183
DDoS (distributed DoS) attacks, 144
dumpster diving
Debian Linux system updates, 213
preventing, 74
Deep Freeze lock down program, 98
risks from, 12, 61
defaced Web pages, 25
delimited files, 182
• E •
deliverables, clarifying, 30
denial of service (DoS) attacks
eBlaster (SpectorSoft)
defined, 13
keystroke-logging tool, 97
indications of, 137--138
spyware, 241
during testing, 15
Ecora
types of, 144
Enterprise Auditor IM traffic-detection
using IM (instant messaging), 272
tool, 276
desktop auditing utilities, 276
Patch Manager patch-automation
DHAs (directory harvest attacks), 265
software, 307
dictionary password attacks, 87--88
Edgar Web site, 43
directional (wardriving) antennas, 150
eDirectory (NetWare) directory service
directory-harvest attacks (DHAs), 265
disabling Public browse right, 231--233
directory-traversal attacks, 283--285
vulnerabilities, 84
distributed DoS (DDoS) attacks, 144
Eeye SecureIIS intrusion-prevention
DMZ/Shield Enterprise (Ubizen) intrusion---
software, 295
prevention software, 295
eicar test string, 249--250
DNS queries, 43
802.11b/802.11i standards (IEEE), 157
documentation
ElcomSoft
of assumptions, 36
Advanced EFS Data Recovery
of test results and recommendations,
program, 101
40, 303--304
password-cracking utilities, 95--96
of testing process, 34--35
elite hackers, 23
domain-name information, 43
e-mail attacks
DOS debug program malware attacks, 243
account enumeration, 265--266
DoS
anonymous addresses, 26
defined, 13
bounced messages, 49
indications of, 137--138
e-mail bombs, 258
during testing, 15
malware propagation, 243--244, 255,
types of, 144
270--271
using IM (instant messaging), 272
using attachments, 260
34 55784X index.qxd 3/29/04 4:20 PM Page 343
Index
343
using autoresponders, 262
network analyses, 43--49, 134--140
using connections, 260--261
network-infrastructure attacks, 117--121
e-mail packet sniffers, 270
obtaining sponsorship, authorization,
e-mail servers
15, 29--30, 319--322
SMTP relay, 269
planning and preparation, 15--19
testing, 32
port scanning, 121--128
employees
retesting, 20
securityawareness training, 56, 66--67,
scheduling tests, 30
92--93, 315--316
similarity to beta testing, 39
and social-engineering attacks, 55--56, 64
similarity to malicious hacking, 39
encryption
SNMP scans, 129
e-mail messages, 271
social-engineering attacks, 56--59
password databases, 101
stealthy versus open approaches, 40--41
for test results, 19
system crashes, 15
TKIP (Temporal Key Integrity
timing of tests, 326
Protocol), 157
values, 14--15
user passwords, 82
war dialing, 105--115
Enforcer and L7 (Akonix) IM traffic---
Windows systems scans, 171--178
detection tools, 276
wireless LAN attacks, 148--163, 158--159
Enterprise Auditor (Ecora) IM traffic---
ettercap (Source Forge) network analyzer
detection tool, 276
ARP spoofing, 135, 141
enumerating (mapping out) networks, 46
malware attacks, 242
Ethereal network analyzer, 17, 134
event-logging systems, 312--313
EtherPeek (WildPackets) network analyzer,
Exchange e-mail system, 84
98--100, 134
EXPN command (SMTP), 265--266
ethical hacking. See also software and
external hacks, 36
testing tools; testing process
external system scans, 47
ARP (Address Resolution Protocol)
poisoning/spoofing, 140--144
• F •
automating application of, 311--312
benefits of, 31
FaceTime Communications IM traffic---
collating data and test results, 299--301
detection tool, 276
cracking passwords, 82--91, 97--102
false employees, dangers from, 55--56.
data analysis and recommendations,
See also social-engineering attacks
20, 302--304
FedCIRC Incident Handling Checklist,
defined, 9--10
244--245
evaluating results, 20
file names
footprinting, 41
illegitimate, 245
goals, 10--12, 30--32
on Web servers, 284
grabbing banner information, 130--131
file system. See also password attacks
identifying Web-based risks, 279--293
file-sharing risks, 272--273
keeping up-to-date, 316
malware attacks using, 255--256
limits of, 324
File Transfer Protocol (FTP)
Linux file attacks, 204--209
vulnerabilities, 200
Linux system scans, 195--199, 211--212
file-modification auditing programs, 208
malware intrusion scans, 244--253
file/print server testing, 32
NetWare system scans, 216--219
financial information, scanning for, 60
34 55784X index.qxd 3/29/04 4:20 PM Page 344
344 Hacking For Dummies
find command (Linux), 207
Google search engine
fingerprinting
Google Groups, 45
Linux OS, 196--197, 294
locating security tools using, 18
Windows OS, 174
public information searches, 41--42
Finjan Software Test Center Web site,
government Whois (lookup) sites, 44
252--253
Greenidea, Inc. Web site, 315
Firewalk (Packet Factory) firewall-testing
tool, 133
• H •
Firewall Informer (BLADE Software)
firewall-testing tool, 133
Hack Attacks Encyclopedia (Chirillo), 12
firewalls
hacked Web sites, defacing of, 25
e-mail, 263, 271
hacker Web sites, 26
Linux systems, 199
hackers. See also ethical hacking
NetBIOS attacks, 177
changing view of, 21--22
testing, 32, 131--133
cyberterrorists, 24
Web applications, 295
elite hackers, 23
Windows systems, 173--174
ethical versus malicious, 9--10
Flawfinder security-hole software, 295
government agencies, 23
Fluke WaveRunner wireless testing
hacker community, 26
device, 150
hackers for hire, 24
footprinting, 41
hacktivists, 23--24
Fortres 101 for Windows lock-down
importance of anonymity to, 27--28
program, 98
intermediate hackers, 23
fping ping utility (UNIX systems), 46
outsourcing, 312--315
FreeZip decompression tool, 89
personality profiles, 22--23
FTP (File Transfer Protocol)
reasons for hacking, 24--26
vulnerabilities, 200
script kiddies, 21, 23
FU rootkit, 240--241
work methods, 26--27
The Hacker's Choice software
• G •
THC-Amap application-version-mapping
tool, 195
GetPass login-decryption software, 85
THC-Scan war-dialing programs,
GFI Email Security Testing Zone, 250
46, 109--110
GFI LANguard Network Security Scanner
hacking tools. See software and testing
vulnerability-assessment tool
tools
event logging, 312--313
hardening operating systems, 101, 308--309
firewall testing, 132
hardening servers, 264
patch checking, 307
hardware. See also physical-security
testing Linux systems, 195, 197--198
attacks
testing NetWare systems, 216, 218--219
network, vulnerabilities of, 75--77
testing Windows systems,
for wireless-network attacks, 150
170, 172--173, 191
headers, e-mail, 269--270
testing wirelessLANs, 149
HFNetChk Pro (Shavlik Technologies)
uses for, 121
patch-automation software, 307
viewing share permissions, 188--189
hidden field manipulation, 287--288
goals, ethical hacking, 10--12, 30--32
high impact security vulnerabilities, 302
34 55784X index.qxd 3/29/04 4:20 PM Page 345
Index
345
honeypots, 27
insurance, personal liability, 30
Hoovers.com Web site, 42--43, 60
intermediate hackers, 23
host names, 46
internal hacks, 36
hosts.equiv file(Linux) attacks, 204
internal system scans, 46--47
Hyena security-assessment software, 191
Internet Relay Chat (IRC), 26. See also
Hypertext Transfer Protocol (HTTP)
instant messaging (IM)
attacks involving, 14
Internet vulnerabilities, 243. See also Web---
vulnerabilities, 279--280
application attacks
Internet Service Providers (ISPs), 33
• I •
Interpact, Inc. Web site, 315
intruder lockout, 94
ICAT Metabase list of password
Intrusion Detection Systems (IDSs)
vulnerabilities, 82
for Novell NetWare systems, 224--225
IDSs (Intrusion Detection Systems), 33
for service providers, 33
IEEE 802.11b standard, 157
IP addresses and host names
IM (instant messaging)
capturing using instant messaging, 272
reducing risks from, 275--277
scanning for, 46
vulnerabilities from, 272--275
viewing, 46
IM Logic IM traffic-detection tool, 276
IP Personality Web site, 294
inbound access (modems), 106
IRC (Internet Relay Chat), 26. See also
individualism, 24
instant messaging (IM)
inetd.conf service (Linux), disabling,
ISO 177799 security framework, 30
202--203
ISPs (Internet Service Providers), 33
inference password attacks, 84
ITS4 security-hole software, 295
information-gathering attacks
ITsecurity.com security portal, 18
banner grabs, 263--264
IZArc decompression tool, 89
footprinting, 41
identifying vulnerabilities, 49--51
• J •
mapping the network, 43--45
penetrating security holes, 51--52
Java applets, malware attacks using, 241
for social-engineering attacks, 60--62
JavaScript programs, malware attacks
system scans, 45--49
using, 242
Web searches, 41--42
John the Ripper password-cracking tool,
information-security vulnerabilities
17, 85, 88--91
importance of identifying, 11--12
network-infrastructure attacks, 13
• K •
nontechnical attacks, 12
sharing system information, 45
Kerberos authentication system, 84
infrastructure vulnerabilities, 309
KeyGhost keystroke-logging tool, 97
input attacks (Web applications)
KeyLogger Stealth software, 97
automated input, 286
keystroke logging, 97--98
code injection, 287
Kismet wireless LAN security tool
cross-site scripting (XSS), 287
scanning local airwaves, 153
hidden field manipulation, 287--288
uses for, 148
instant messaging (IM)
Knark for Linux rootkit, 240--241
reducing risks from, 275--277
knowledge versus blind assessments, 35
vulnerabilities from, 272--275
34 55784X index.qxd 3/29/04 4:20 PM Page 346
346 Hacking For Dummies
• L •
unauthorized scans, 195--199
unneeded services, 200--201
LACNIC (Latin American and Caribbean
lock-down programs, 98
Internet Address Registry) lookup
logged in NetWare server access, 217
site, 44
logging
LANguard Network Security Scanner (GFI)
e-mail, 271
vulnerability-assessment tool
instant messages, 275
firewall testing, 132
system events, 40, 312--313
testing Linux systems, 195, 197--198
logic bombs, 242
testing NetWare systems, 216, 218--219
logins
testing Windows systems, 170,
insecure, 171, 280--282
172--173, 191
unauthorized, 224--225, 229
testing wireless LANs, 149
lookup sites (Whois lookups), 43--44
viewing share permissions, 188--189
low impact security vulnerabilities, 302
LANs (local area networks). See wireless
LSAT (Linux Security Auditing Tool), 195
LANs (WLANs)
lsof tool (Linux)
laptop computers
testing for malware intrusions, 248
resetting passwords, 100
uses for, 201
testing, 32
Latin American and Caribbean Internet
• M •
Address Registry (LACNIC) lookup
site, 44
MAC (media access control) addresses
LC4 password-cracking tool, 17, 85
vulnerabilities, 140, 151--152
LEAP protocol (Cisco), 157
Macintosh system lock-down programs, 98
legacy application configurations, 115
magazines for hackers, 27
legal warnings, 131
malicious hackers
Legion vulnerability-assessment tool,
defined, 10
171, 176
monitoring for, 312--313
likeability, 62
malware attacks
Linux Security Auditing Tool (LSAT), 195
automated, 243
Linux systems
dangers from, 237--239
buffer overflows, 208--209
defined, 237
general security tests, 211--212
logic bombs, 242
hosts.equiv file attacks, 204--205
reporting, 253
malware attacks, 247--249
rootkits, 240--241
Network File System attacks, 206--207
spyware, 241
operating system access, 102
testing systems for, 245--247
password storage locations, 87
Trojan houses, 239--240
physical-security vulnerabilities, 209--210
using e-mail, 243--244, 270--271
.rhosts file attacks, 204
using instant messages, 272
rogue file permissions, 207--208
using internal security tools, 242--243
rootkits for, 240
using programming interfaces, 241--242
security patches, 212--213
using vulnerable ports, 244
system vulnerabilities, 193--194
viruses, 239--240
tools for, 194--195
worms, 240
34 55784X index.qxd 3/29/04 4:20 PM Page 347
Index
347
Malware: Fighting Malicious Code
• N •
(Skoudis), 238
malware-protection software, 253--254, 271
NAT (NetBIOS Auditing Tool) password---
Man-in-the-Middle (MITM) attacks, 140
cracking tools, 85, 86
mapping networks
National Institute of Standards and
Google Groups, 45
Technology (NIST)
Whois lookups, 43--44, 46
ICAT Metabase Web site, 49
mapping null sessions, 179--180
operating system hardening practices,
Maven Security Consulting, Inc.
101, 264, 308
Web site, 107
National Security Agency
MBSA (Microsoft Baseline Security
operating system hardening practices,
Analyzer) tool, 169--170, 190--191, 308
264, 308
media access control (MAC) address
Security Recommendation
vulnerabilities, 140, 151--152
Guidelines, 101
medium impact security
nbtstat NetBIOS attack program, 175
vulnerabilities, 302
NCP packet signing (NetWare),
messaging-system attacks
enabling, 230
banner grabbing, 263--264
NCPQuery enumeration software, 216
system vulnerabilities, 257--258
Nessus vulnerability-assessment tool
using e-mail, 258--263
features, 50, 121
using instant messaging, 272--275
firewall testing, 132
using Simple Mail Transfer Protocol,
malware attacks using, 242
265--272
testing Linux systems, 195, 196--197
Microsoft. See also Windows (Microsoft)
testing Windows systems, 170
systems
net use command, 247
Baseline Security Analyzer (MBSA) tool,
net view command, 180--181
169--170, 190--191, 308
netbasic NLM (NetWare), 227
.NET application vulnerabilities, 241
NetBIOS
Software Update Services (SUS)
attacks on, 175--177
Server, 308
blocking access to, 184
Virtual PC system-scanning software, 46
vulnerability of, 13
military Whois (lookup) sites, 44
NetBIOS Auditing Tool (NAT) password---
Minor Threat (ToneLoc software), 109
cracking utilities, 85
MITM (Man-in-the-Middle) attacks, 140
Netcat banner-grabbing tool
Mitnick, Kevin (hacker), 22
features, 130--131
mobile device testing, 32. See also wireless
firewall testing, 132--133
LANs (WLANs)
malware attacks using, 242
modems
network scanning, 120
identifying COM port, 111
Netcraft Web server-versioning tool, 48--49
physical placement, 115
netfilter/iptables Linux firewall, 199
protecting against war dialing, 114--115
NetScanTools Pro
unsecured, 46, 105--106
network scanning program, 120, 128
vulnerability testing, 113--114
ping tool, 46
for war dialing, 109--110
NetScreen firewall software, 295
monitoring security events, 312--313
Mucho Maas (ToneLoc software), 109
34 55784X index.qxd 3/29/04 4:20 PM Page 348
348 Hacking For Dummies
netstat command
network-analyzer tools
testing for malware intrusions, 245--248
capturing e-mail traffic using, 270
testing Linux services, 201
malware attacks using, 242
NetStumbler wireless LAN security tool
monitoring network traffic, 46
features, 148
network-infrastructure attacks
scanning local airwaves, 152--153
application-based attacks, 13--14
testing unauthorized wireless LAN access
ARP (Address Resolution Protocol)
points, 158
poisoning/spoofing, 140--144
NetWare Loadable Module (NLM)
banner grabbing, 130--131
password storage location, 223
case study, 118
rconsole attacks, 221
firewall vulnerabilities, 131--133
rogue programs, 225--229
locations for, 36
NetWare (Novell) systems
network analyzers, 134--140
cleartext packets, 229--230
operating-system attacks, 13
debugger, 243
password vulnerability, 85--86
intruder detection settings, 224--225
port scanning, 46
NCPQuery information, 219
scanning tools, 120
Novell ConsoleOne access, 232--233
shares authentication, 48
password testing, 85
Simple Network Management Protocol
port scanning, 217--219
scans, 129
Remote Console attacks, 221--223
sniffers, 134--140
rogue NLM programs, 225--229
testing process, 32
server-console attacks, 224
vulnerability assessments, 119--121
system vulnerabilities, 215--216
NFS (Network File System) attacks, 206--207
testing tools, 216
Nikto Web-application-evaluation tool
network cards
automated scans, 292--293
promiscuous mode, 135
features, 280
testing for malware intrusions, 249
NIST (National Institute of Standards and
Network File System (NFS) attacks, 205--206
Technology)
Network Mapper (NMap) port scanner
ICAT Metabase Web site, 49
identifying host IP addresses, 46
operating system hardening practices,
limits of, 37--38
101, 264, 308
uses for, 17, 18
NLM (NetWare Loadable Module)
network mapping
password storage location, 223
Google Groups, 45
rconsole attacks, 221--222
Web site privacy policies, 45
rogue programs, 225--229
Whois (lookup) sites, 43--44
Nmap (Network Mapper) port scanner
network scanning software, 120, 250--252
features, 17--18, 46
Network Security For Dummies (Cobb),
limits of, 37--38
101, 264, 308
ping sweeps, 124
Network Solutions Web site, 43
scanning systems using, 173
Network Users (Optimum X)
testing for malware intrusions, 250--251
login-scanning tool, 171
testing Linux systems, 195, 198, 200--201
vulnerability-assessment tool, 183--184
testing Windows systems, 169
network-analyzer attacks
using, 120, 126--127
how they work, 134--140
NMapWin port scanner, 46, 48, 120
packet sniffing, 98--100
nontechnical attacks, 12
running, 136--139
not-logged in NetWare server access, 217
tools for, 17
34 55784X index.qxd 3/29/04 4:20 PM Page 349
Index
349
Novell NetWare
• P •
cleartext packets, 229--230
debugger, 243
Pandora
intruder detection settings, 224--225
NetWare hacking suite, 229--230
NCPQuery information, 219
password-cracking tool, 85
Novell ConsoleOne access, 232--233
password attacks
password testing, 85
brute-force attacks, 88
port scanning, 217--219
cracking tools, 85--87
Remote Console attacks, 221--223
dictionary attacks, 87--88
rogue NLM programs, 225--229
how they work, 86
server-console attacks, 224
inference attacks, 84
system vulnerabilities, 215--216
keystroke logging, 97--98
testing tools, 216
locations for, 36
NTAAccess password-resetting
network analyzers, 98--100
program, 101
recognizing, 79--80
NTFSDOS Profession password-cracking
resetting programs, 100--101, 226--227
utilities, 85
shoulder surfing, 83--84
null session attacks (Windows), 179--184
social-engineering attacks, 83--84
success of, 82
• O •
Trojan horses, 94
password vulnerabilities
Oechslin, Philippe (Swiss Federal Institute
authentication systems, 84
of Technology), 81
Novell NetWare systems, 221--223
office layout, risks associated with, 74--75
organizational end-users, 80--81
omnidirectional antennas, 150
passwords in limbo, 100
open ports, scanning for, 48
privacy issues, 64
open source software
protecting against, 79, 91--94
hacking tools, 37--38
storage issues, 87, 92, 98
PasswordSafe encryption tool, 92
Windows shares, 177
OpenSSH (Linux) vulnerability testing, 196
password-protected files, 95--97
operating systems
Patch Manager (Ecora) patch-automation
access limits, 101
software, 307
fingerprinting, 174
patches, security
hardening, 264, 303, 308--309
automated, 307--308
rootkits attacks, 240--241
for e-mail attacks, 271
vulnerabilities, 48--49, 198--199
for Linux systems, 212--213
operating-system attacks, 13
managing, 306--307
organizational (end-user) password
for NetWare systems, 220, 234
vulnerabilities, 80--81
for Windows systems, 188--190, 308
Orinoco Registry Encryption/Decryption
PatchManager (Big Fix) patch-automation
(Lucent) program, 161
software, 307
outbound access (modems), 106
pcAnyware remote-connectivity
outcomes, identifying before starting
software, 106
hacking process, 30
penetration testing, 10, 34
outsourcing
perimeter e-mail protection, 263
ethical hacking, 313--315
personal liability insurance, 30
security monitoring, 312--313
34 55784X index.qxd 3/29/04 4:20 PM Page 350
350 Hacking For Dummies
personnel
Pretty Good Privacy (PGP) encryption
securityawareness training, 56, 66--67,
for password databases, 92
92--93, 315--316
using, 19
and social-engineering attacks, 55--56, 64
privacy
PestPatrol Web site
and civil liberty, 26
Auditor's Edition scanning tool, 251--252
need for, during hacking process, 19
catalog of pests, 245
policies, vulnerabilities from, 45
war-dialing programs, 109
respecting, during hacking process, 14--15
PGP (Pretty Good Privacy) encryption
Procomm Plus remote-connectivity
for password databases, 92
software, 106
using, 19
programming interface vulnerabilities,
phone line vulnerabilities, 114--115
241--242
PhoneSweep
PromiscDetect network-analyzer attack
telephone line-scanning program, 114
detector, 140
war-dialing software, 46
promiscuous mode, 135
phone-switch software, accessing, 62
propagation of malware
PHRACK (magazine), 27
automated, 243
physical-security attacks
backdoor access, 244
common, 69--71
using e-mail, 243--244, 255, 270--271
on Linux systems, 209--210
using instant messaging, 272
network components and computers,
property, physical, protecting, 69--70
75--77
protocols, identifying, 47
versus social-engineering attacks, 55
ps malware-intrusion testing tool, 248--249
types of, 12
public information, locating, 41--43
using buildings and offices, 71, 74--75
pwdump, pwdump2 password-cracking
using utility systems, 73--74
tools, 17, 85, 88--91
on wireless LANs, 160
Ping of Death DoS attacks, 144
• Q •
ping tool
scanning systems using, 46
QualysGuard (Qualys) vulnerability---
using from external location, 47
assessment tool
planning and preparation, 15--19
features, 50
port scanning
testing Linux systems, 195, 198--199
commonly hacked ports, 122--123
testing Windows systems, 170
indications of, 139
information provided by, 121--122,
• R •
124--125
mapping programs, 246
RAS (remote access servers), 105
NetWare systems, 217--219, 227
RATs (remote-access Trojans),
number assignments, viewing, 48
138, 239--240
for open ports, 46--47
RATS security-hole software, 295
ping sweeps, 124
RC4 encryption algorithm, 155
tools for, 46
Rconj NetWare-management program, 223
portals, security, 18
rconsole (Remote Console, NetWare)
PortSentry intrusion-prevention
attacks, 221--223
software, 199
reconnaissance missions
Prescan tool (ToneLoc), 108
banner grabs, 263--264
footprinting, 41
34 55784X index.qxd 3/29/04 4:20 PM Page 351
Index
351
identifying vulnerabilities, 49--51
rootkits
mapping the network, 43--45
detection tools, 254
penetrating security holes, 51--52
uses for, 240--241
for social-engineering attacks, 60--62
routers, testing, 32
system scans, 45--49
RPC (remote procedure call) enumeration,
Web searches, 41--42
177--178
Recording Industry Association of America
Rpcdump port scanning tool, 171, 178
(RIAA) copyright lawsuits, 26
r-services (Linux) vulnerabilities, 198, 200
Red Hat Linux system updates, 213
red teams, 31
• S •
reformed hackers, hiring, 315
Regional Internet Registry for Africa
SAM (Security Account Manager)
(APNIC) lookup site, 44
database, 87
Regional Internet Registry for North
Sam Spade for Windows network scanning
America (ARIN) lookup site, 44
program, 43, 109, 120, 267
Register Fly Web site, 43
sandboxes, 241
relays (SMTP), vulnerabilities, 266
SANS Institute
remote access servers (RAS), 105
operating system hardening practices,
Remote Console (rconsole, Novell
101, 264, 308
NetWare) attacks, 221--223
Top 20 Internet Security Vulnerabilities
Remote password-cracking software, 216
consensus list, 50
remote procedure call (RPC) enumeration,
SATAN (Security Administrator Tool for
177--178
Analyzing Networks), 18, 38
remote-access services, 48
scanning local airwaves, 152--154
remote-access Trojans (RATs),
scans, system
138, 239--240
banner grabbing, 263--264
repeat dial tones, 106
information obtained from, 47--49
reports, 302--304. See also documentation
penetrating security holes, 51--52
resetting passwords
using network analyzers, 46--47
cautions about, 100--101
using port scanners, 46--47
in NetWare systems, 226--227
using unsecured modems, 46
results, test data, evaluating, 20, 302--304
screen captures, as documentation, 40
reverse Whois services, 44
script attacks (Web applications), 289--290
Rhoades, David (Maven Security Consult,
script kiddies, 21, 23
Inc.), 107
scripting program vulnerabilities, 241--242
.rhosts files (Linux), attacks on, 204
SearchSecurity.com security portal, 18
RIAA (Recording Industry Association of
SeattleWireless Hardware Comparison Web
America) copyright lawsuit, 26
page, 150
RIPE Network Coordination Centre lookup
SEC filings Web site, 60
site, 43--44
second dial tones, 106, 110
risks, evaluating and ranking, 300--302
SecureIIS (Eeye) Web-application intrusion---
Rkdet rootkit-detection tool, 254
prevention software, 295
robots.txt file, searching for, 283--284
Security Account Manager (SAM)
Rogue Aware (Akonix) IM traffic-detection
database, 87
tool, 275--276
Security Administrator Tool for Analyzing
rogue modems, 13
Networks (SATAN), 18
root passwords, cracking, 82
Security Awareness, Inc. Web site, 315
34 55784X index.qxd 3/29/04 4:20 PM Page 352
352 Hacking For Dummies
security awareness training, 56, 66--67,
Web-application attack prevention,
92--93, 315--316
283, 289, 294--295
security holes, 26--27, 36, 51--52
for Windows systems, 173--174
security infrastructure, assessing and
wireless LAN protection, 156--157,
enhancing, 309
159--160, 163
security measures. See also security
wireless workstation protection, 161--162
awareness training; security patches
security patches
Address Resolution Protocol protection,
automated, 307--308
143--144
for e-mail attacks, 271
autoresponder attack prevention, 262
for Linux systems, 212--213
awareness training, 56, 66--67, 92--93,
managing, 306--307
315--316
for NetWare systems, 220, 234
banner grab prevention, 131, 264
for Windows systems, 188--190, 308
buffer-overflow attack prevention, 209
security policies, 66
denial of service attack prevention, 145
security portals, 18
disabling SMTP relays, 269
security seals, 30
disabling unneeded services, 201
security vulnerabilities, ranking, 300--301
e-mail protections, 260--263, 269--272
SecurityFocus.com security portal, 18
firewall testing, 133
SecurityProfiling Syspdate patch---
high-impact risks and responses, 305--306
automation software, 307
instant messaging protections, 275--277
securitytesting tools, overview,
keystroke logging, 97--98
18--19, 37--38. See also software
for Linux systems, 199, 210, 212--213
and testing tools
malware attack prevention, 253--254
self-replicating viruses and worms, 239--240
NetBIOS attack prevention, 176--177
semidirectional antennas, 150
for NetWare systems, 220, 223--225,
sendmail security vulnerabilities, 200
228--234
server-console (NetWare)-attacks, 224
Network File System protection, 207
servers
network-analyzer attack prevention,
identifying software used by, 48
99--100, 139--140
viewing operating systems,
network-infrastructure attack
applications, 32
prevention, 146
services
null connection attack prevention,
unneeded, disabling, 199, 272
184--186
in use, identifying, 47
ongoing ethical hacking, 311--312
setpwd NLM (NetWare), 226
operating system protection, 101--102
setspass NLM (NetWare), 226
password protection, 91--94, 96--98, 100
setspwd NLM (NetWare), 226
port scanning prevention, 127--128
shares (Windows) attacks, 176, 186--189
.rhosts and hosts.equiv file attack
Shavlik technologies HFNetChk Pro patch---
prevention, 205--206
automation software, 307
remote procedure call protection, 178
shoulder surfing, 83
script attack prevention, 290
Sima, Caleb (SPI Dynamics, Inc.), 281
SNMP attack prevention, 129
Simple Mail Transfer Protocol (SMTP)-
social-engineering attack prevention,
based attacks
65--67
account enumeration attacks, 265--266
URL filter bypass prevention, 290--292
banner grabs, 263--264
war dialing prevention, 114--115
e-mail header disclosures, 269--270
Web directory traversal prevention, 285
e-mail relays, 266--269
types of, 14
34 55784X index.qxd 3/29/04 4:20 PM Page 353
Index
353
Simple Network Management Protocol
spyware scanning, 250--252
(SNMP) attacks, 129
testing SMTP relays, 266--267
Skoudis, Ed (security expert
vulnerability assessment, 50--51, 280
and author), 238
war dialing, 108--111
Slackware Linux system updates, 213
Windows security testing, 168--171
SMAC MAC-spoofing software, 142--143
Wired Equivalent Privacy encryption
SMTP
cracking, 156
account enumeration attacks, 265--266
wireless LAN security testing, 148--149
banner grabs, 263--264
software, malicious
e-mail header disclosures, 269--270
automated, 243
e-mail relays, 266--269
dangers from, 237--239
types of, 14
defined, 237
smtpscan banner-grabbing software, 264
logic bombs, 242
Smurf DoS attack, 137--138, 144
reporting, 253
SNARE intrusion-prevention software, 199
rootkits, 240--241
sniffdet network-analyzer attack
spyware, 241
detector, 140
testing systems for, 245--247
SNMP (Simple Network Management
Trojan houses, 239--240
Protocol) attacks, 129
using e-mail, 243--244, 270--271
social-engineering attacks
using instant messages, 272
behaviors associated with, 62--64
using internal security tools, 242--243
case study, 57
using programming interfaces, 241--242
cracking passwords, 83
using vulnerable ports, 244
deceptive practices, 63--65
viruses, 239--240
defending against, 65--67
worms, 240
defined, 12, 55--56
Spector Pro (SpectorSoft)
and ethical hacking, 56--59
keystroke-logging tool, 97
versus physical-security attacks, 55
spyware, 241
system reconnaissance, 43, 60--62
SPI Dynamics
software and testing tools
Web site URL, 65
banner grabbing, 264
WebInspect application-evaluation
behavioral-analysis, 252--253
tool, 280
capturing e-mail traffic, 270
spider programs, 284
cautions when using, 38
Spies Among Us (Winkler), 57
choosing correctly, 325
Spitzner, Lance, Web site, 27
desirable features, 38
sponsorship for ethical hacking
e-mail header disclosures, 269--270
importance of obtaining, 15
e-mail malware propagation, 243--244
tips for obtaining, 319--322
firewall testing, 132
written approvals, 323
instant message monitoring, 275--276
spyware, 241
keystroke logging, 97
startup files, testing for malware
Linux security testing, 195, 213
intrusions, 247--248
Linux service assessments, 200--201
stealthy versus open hacking approaches,
MAC spoofing, 142--143
40--41
NetWare security testing, 216, 229--230
A Step-by-Step Guide to Computer Attacks
network analyzers, 134--135
and Effective Defenses (Skoudis), 238
null session attacks, 179--180
strangers, responding to with caution,
password-cracking utilities, 85--87, 95--96
67, 75
rootkit detection, 254
34 55784X index.qxd 3/29/04 4:20 PM Page 354
354 Hacking For Dummies
SuperScan port scanner
Temporal Key Integrity Protocol (TKIP)
features, 17, 125--126
encryption, 157
identifying malware intrusions, 250--251
testing. See also ethical hacking; software
limits of, 37
and testing tools
ping sweeps and port scanning, 46, 120
capturing cleartext packets, 229--230
testing Linux systems, 195, 195--196
choosing test systems, 32--33
testing NetWare systems, 216, 218
crashing system during, 15
testing Windows systems, 170--173
for DoS attacks, 145
SUS (Microsoft Software Update Services)
for e-mail header disclosures, 269--270
Server, 308
for firewall vulnerabilities, 132--133
SuSE/Novell Linux system updates, 213
goals for, 30--32
switches, in Google searches, 42
IM (instant messaging) security, 274--275
SYN flood DoS attacks, 144
for insecure Web logs in, 280--282
SYSKEY encryption tool, 101
Linux security, 195--201
system auditing feature (NetWare), 233--234
locations for, 36
system crashes, 14--15
logging and documenting, 40
system login files, 88
for malware intrusions, 244--253
system scans
for NetBIOS attacks, 174--176
information obtained from, 47--49
NetWare security systems, 216--224
IP addresses and host names, 46
process of, 19
Linux systems, 195
results from, 19--20, 299--301
network analyzers for, 46--47
retesting, 20, 324
penetrating security holes, 51--52
for rogue file permissions, 207
port scanners for, 46--47
for rogue NLMs, 226
unsecured modems, 46
for share permissions, 187--189
Windows systems, 171--173
for SMTP relays, 266--267, 266--269
SysTrust security seal, 30
timing and timelines for, 33--36, 326
SysUpdate patch-management tool, 213
for unauthorized access points, 158--159
SysUpdate (SecurityProfiling) patch---
for unprotected shares, 187--189
automation software, 307
for URL filter bypasses, 290--292
for vulnerable malware ports, 244
• T •
Web directory security, 283--284
Windows system security, 171--173,
tablet PCs, testing, 32
180--184, 189--191
tarpitting, 262
TFN (Tribe Flood Network) DoS
TCP port scans, 125--128
attacks, 144
TCP Wrappers access-control tool, 203
Tiger Linux security-auditing tool,
tcpcon NLM (NetWare), testing, 227--228
195, 211--212
TCP/IP communications
tiger teams, 31
NetWare parameter settings, 234
Timbuktu for Apple remote-connectivity
protocol vulnerabilities, 13
software, 106
technical password vulnerabilities, 82
timing and timelines, 33--36, 326
Techno Security Web site, 71
TippingPoint Technologies firewall
telephone system vulnerabilities, 61--62, 106
software, 295
telnet tool
TKIP (Temporal Key Integrity Protocol)
banner grabbing, 130
encryption, 157
SMTP relay testing, 267--269
toneloc command, 112
security vulnerabilities, 200
34 55784X index.qxd 3/29/04 4:20 PM Page 355
Index
355
ToneLoc (Minor Threat, Mucho Maas)
URL filter bypasses, 290--292
Phun-Pak Prescan utility, 108
U.S. government, hacking by, 23
war-dialing program, 108--111
U.S. Patent Office Web site, 43
tone.log file (ToneLoc program), 112
user accounts
tools, security. See software and testing
password protection strategies, 92--94
tools
unused, eliminating, 94
traffic
user IDs for Web logins, viewing, 280--282
e-mail, monitoring, 270
utilities, physical, protecting, 73--74
instant messaging, monitoring, 275--276
network, restricting, 127--128
• V •
wireless, 154, 155--156
Tribe Flood Network (TFN) DoS
VBScripts, malware attacks using, 242
attacks, 144
viruses, 240
Trinoo DoS attacks, 144
Vision (Foundstone)
Tripwire file-monitoring program, 208
port-mapping software, 246--247
Trojan horse attacks
system-analyzer software, 169
features, 239--240
Visual Basic, VBScript vulnerabilities, 242
password-cracking, 94
VLAD the Scanner Linux security-auditing
tester software, 244--245
tool, 212, 195
types of, 245
VMware Workstation system-scanning
using instant messaging, 272
software, 46
TrueActive spyware, 241
voice-mail systems, vulnerabilities, 106
trust
VPN services, identifying, 48
and ethical hacking, 14
VRFY command (SMTP), 265--266
and social-engineering attacks, 62--63
vulnerability-assessment tools. See also
2600 -- The Hacker Quarterly (magazine), 27
GFI LANguard Network Security
Scanner vulnerability-assessment tool
• U •
DumpSec, 48, 171, 182--183, 187
Legion, 171, 176
Ubizen DMZ/Shield Enterprise Web---
Network Users (Optimum X), 183--184
application intrusion-prevention
QualysGuard, 50, 170, 195, 198--199
software, 295
Walksam, 171, 183
unauthorized logins (Novell NetWire), 229
vulnerable systems, criteria for
UNIX systems
identifying, 33
cracking passwords on, 90
e-mail packet sniffers, 270
• W •
MAC-address spoofing, 142
network-analyzer attack detectors, 140
Walksam vulnerability-assessment tool,
for operating system access, 102
171, 183
password-storage locations, 87
WANRemote RAT attacks, 138
ping utilities, 46
war dialing
rootkits for, 240--241
attack process, 106--108
network analyzer attacks, 134--135
case study, 107
wireless LAN security tools, 148
configuring programs for, 110--111
unlimited attack approach, 16, 35
defined, 105
unneeded services
dialing-in process, 110--113
disabling, 272
documenting testing process, 34
security vulnerabilities, 200--201
information gathering stage, 108--109
34 55784X index.qxd 3/29/04 4:20 PM Page 356
356 Hacking For Dummies
war dialing (continued)
patch-automation applications, 307
modems for, 109
port-mapping software, 246
protecting against, 114--115
port-number assignment listings, 48
scanning modems, ports, 46--47
Pringles-can design antenna, 150
software tools, 109
rconsole attack information, 223
wardriving (directional) antennas, 150
Security Accounts Manager (SAM)
weak authentication, 84
database, 87
weak passwords, 88
security training vendors, 315
Web access (NetWare), 217
service-disabling utilities, 202--203
Web browsers, obtaining system
SMTP relay information, 266--267, 269
information from, 41
SNMP scanners, 129
Web login-cracking tools, 281
for understanding specific malware
Web pages, defaced, 25
attacks, 245
Web servers
for understanding system vulnerabilities,
configuration settings, 285
49--50
identifying software versions, 48
war-dialing programs, 109
testing configurations, 32
Web-application security tools, 280, 295
testing directory security, 283--284
Web-crawling tools, 284
Web site privacy policies, information
Whois (lookup) sites, 43--44
from, 45
Windows security tools, 169--171,
Web sites
181, 183, 190
antivirus software testing, 250
Wired Equivalent Privacy encryption
banner-grabbing software, 264
cracking tools, 156
behavioral-analysis tools, 252
wireless hardware information, 150
Cantenna kits, 150
wireless LAN security tools, 148--149, 151
decompression tools, 89
Web-application attacks
defaced Web pages, 25
assessment tools, 17
default system passwords, 100
automated scans, 292--293
dictionary word lists, 88
cracking Web logins, 280--283
ElcomSoft password-cracking utilities, 95
directory traversals, 283--285
FedCIRC Incident Handling site, 244--245
input attacks, 285--289
fingerprint-changing tools, 294
types of, 279--280
firewall testers, 133
URL filter bypasses, 290--292
hacker community sites, 26
using default scripts, 289--290
hacker magazines, 27
Web-crawling utilities, 42
hardening practices information, 101, 264
WebInspect (SPI Dynamics) Web---
ICAT Metabase list of password
application-evaluation tool,
vulnerabilities, 82
280, 17, 292--293
INM traffic-detection tools, 275--276
Web-server security features, 294
keystroke logging tools, 97
WebTrust security seal, 30
Lance Spitzner's, 27
Wellenreiter wireless LAN security
Linux security tools, 195, 199, 213
tool, 148
lock-down programs, 98
WEP (Wired Equivalent Privacy)
logging resources, 312--313
encryption, 155--156, 161
MAC-spoofing software, 142--143
WepAttack wireless LAN-cracking tool, 156
malware-protection software, 254
WEPCrack password-cracking tool, 156
NetWare management programs, 223
WhatIsMyIP.com Web site, 46
password-cracking tools, 85, 282
Whister Web-application-assessment
password-resetting program, 101
tool, 17
34 55784X index.qxd 3/29/04 4:20 PM Page 357
Index
357
white-hat hackers, 10. See also ethical
Windows workstation security
hacking
enhancements, 188
Whois lookup tools, 43--44, 109
Windows XP security enhancements, 188
Wi-Fi Protected Access (WPA), 157
Winfo NT securitytesting tool,
WiFiMaps Web site, 151
171, 181--182
WiGLE wireless LAN database Web site,
Winkler, Ira (social engineer, author), 57
151--152
WinNuke DoS attacks, 144
WildPackets EtherPeek network-analysis
Wired Equivalent Privacy (WEP)
program, 120--121
encryption, 155--156, 161
Wiles, Jack (The Training Co.), 71
wireless access points, testing, 32
Win Sniffer password capture software, 85
wireless LANs (WLANs)
Windows (Microsoft) systems
ad-hoc mode, 153
cracking passwords on, 89--90
configuration vulnerabilities, 162--163
e-mail packet sniffers, 270
hacking tools and hardware, 148--158
lock-down programs, 98
physical-security attacks, 160
MAC-address spoofing, 142--143
reconnaissance missions, 151--154
malware infection detectors, 245--247
types of, 154--155
NetBIOS attacks, 174--177
unauthorized access points, 158--160
network-analyzer attacks, 134--135, 140
unencrypted traffic, 155--157
null session attacks, 179--186
vulnerabilities, 13, 147--148
operating system vulnerabilities,
Wired Equivalent Privacy encryption,
101--102, 167--168
155--156
password resetting program, 101
wireless workstations, 161--162
password vulnerabilities, 81, 87
working ethically, 14
ping utilities, 46
workstations
remote procedure call enumeration,
testing, 32
177--178
wireless, 161--162
rootkits for, 240--241
worms, 94, 240
security tools, 148--149, 168--171
Wotsit's Format Web site, 245
share permission vulnerabilities, 187--189
WPA (Wi-Fi Protected Access), 157
system scanning process, 171--174
WSH (Windows Script Host) malware
Windows Registry
attacks, 242
blocking access, 184--185
examining for malware attacks, 247
• X •
Windows Resource Kit security tools, 170
Windows Script Host (WSH) malware
xinetd configuration tool, replacing, 203
attacks, 242
XSS (cross-site scripting) Web-application
Windows Server 2003
attacks, 288
enhanced security, 179, 184
share permissions, 187
• Y •
Windows System Information tool, 111
Windows Task Manager, 246
Yahoo! Finance Web site, 42--43, 60
Windows 2000/NT
null connection attacks, 185--186
securitytesting tools, 171
• Z •
share permissions, 186--187
zombie computers, 28, 65
unprotected shares, 188--189
Windows Update security patches,
188--190, 308
34 55784X index.qxd 3/29/04 4:20 PM Page 358
358 Hacking For Dummies
35 55784X BOB.qxd 3/29/04 4:20 PM Page 359
ve more fun
The easy way to get more done and ha
PERSONAL FINANCE
Also available:
Estate Planning For Dummies
Personal Bankruptcy For
(0-7645-5501-4)
Dummies
401(k)s For Dummies
(0-7645-5498-0)
(0-7645-5468-9)
Quicken "X" For Dummies
Frugal Living For Dummies
(0-7645-1666-3)
(0-7645-5403-4)
Stock Investing For Dummies
Microsoft Money "X" For
(0-7645-5411-5)
Dummies
Taxes For Dummies 2003
(0-7645-1689-2)
(0-7645-5475-1)
0-7645-5231-7
0-7645-2431-3
0-7645-5331-3
Mutual Funds For Dummies
(0-7645-5329-1)
BUSINESS & CAREERS
Also available:
Business Plans Kit For
QuickBooks All-in-One Desk
Dummies
Reference For Dummies
(0-7645-5365-8)
(0-7645-1963-8)
Consulting For Dummies
Selling For Dummies
(0-7645-5034-9)
(0-7645-5363-1)
Cool Careers For Dummies
Small Business Kit For
(0-7645-5345-3)
Dummies
Human Resources Kit For
(0-7645-5093-4)
Dummies
Starting an eBay Business For
0-7645-5314-3
0-7645-5307-0
0-7645-5471-9
(0-7645-5131-0)
Dummies
Managing For Dummies
(0-7645-1547-0)
(1-5688-4858-7)
HEALTH, SPORTS & FITNESS
Also available:
Controlling Cholesterol For
Nutrition For Dummies
Dummies
(0-7645-5180-9)
(0-7645-5440-9)
Power Yoga For Dummies
Dieting For Dummies
(0-7645-5342-9)
(0-7645-5126-4)
Thyroid For Dummies
High Blood Pressure For
(0-7645-5385-2)
Dummies
Weight Training For Dummies
(0-7645-5424-7)
(0-7645-5168-X)
Martial Arts For Dummies
Yoga For Dummies
0-7645-5167-1 0-7645-5146-9
0-7645-5154-X
(0-7645-5358-5)
(0-7645-5117-5)
Menopause For Dummies
(0-7645-5458-1)
Available wherever books are sold.
Go to www.dummies.com or call 1-877-762-2974 to order direct.
35 55784X BOB.qxd 3/29/04 4:20 PM Page 360
A world of resources to help you grow
HOME, GARDEN & HOBBIES
Also available:
Auto Repair For Dummies
Poker For Dummies
(0-7645-5089-6)
(0-7645-5232-5)
Chess For Dummies
Quilting For Dummies
(0-7645-5003-9)
(0-7645-5118-3)
Home Maintenance For
Rock Guitar For Dummies
Dummies
(0-7645-5356-9)
(0-7645-5215-5)
Roses For Dummies
Organizing For Dummies
(0-7645-5202-3)
(0-7645-5300-3)
Sewing For Dummies
0-7645-5295-3
0-7645-5130-2
0-7645-5106-X
Piano For Dummies
(0-7645-5137-X)
(0-7645-5105-1)
FOOD & WINE
Also available:
Bartending For Dummies
Grilling For Dummies
(0-7645-5051-9)
(0-7645-5076-4)
Chinese Cooking For
Low-Fat Cooking For
Dummies
Dummies
(0-7645-5247-3)
(0-7645-5035-7)
Christmas Cooking For
Slow Cookers For Dummies
Dummies
(0-7645-5240-6)
(0-7645-5407-7)
Diabetes Cookbook For
0-7645-5250-3
0-7645-5390-9
0-7645-5114-0
Dummies
(0-7645-5230-9)
TRAVEL
Also available:
America's National Parks For
London For Dummies
Dummies
(0-7645-5416-6)
(0-7645-6204-5)
Mexico's Beach Resorts For
Caribbean For Dummies
Dummies
(0-7645-5445-X)
(0-7645-6262-2)
Cruise Vacations For
Paris For Dummies
Dummies 2003
(0-7645-5494-8)
(0-7645-5459-X)
RV Vacations For Dummies
Europe For Dummies
(0-7645-5443-3)
0-7645-5453-0
0-7645-5438-7
0-7645-5448-4
(0-7645-5456-5)
Walt Disney World & Orlando
Ireland For Dummies
For Dummies
(0-7645-6199-5)
(0-7645-5444-1)
France For Dummies
(0-7645-6292-4)
Available wherever books are sold. Go to www.dummies.com or call 1-877-762-2974 to order direct.
35 55784X BOB.qxd 3/29/04 4:20 PM Page 361
Plain-English solutions for everyday challenges
COMPUTER BASICS
Also available:
PCs All-in-One Desk
Upgrading & Fixing PCs For
Reference For Dummies
Dummies
(0-7645-0791-5)
(0-7645-1665-5)
Pocket PC For Dummies
Windows XP For Dummies
(0-7645-1640-X)
(0-7645-0893-8)
Treo and Visor For Dummies
Windows XP For Dummies
(0-7645-1673-6)
Quick Reference
Troubleshooting Your PC For
(0-7645-0897-0)
Dummies
0-7645-0838-5
0-7645-1663-9
0-7645-1548-9
(0-7645-1669-8)
BUSINESS SOFTWARE
Also available:
Excel Data Analysis For
Microsoft CRM For Dummies
Dummies
(0-7645-1698-1)
(0-7645-1661-2)
Microsoft Project 2002 For
Excel 2002 All-in-One Desk
Dummies
Reference For Dummies
(0-7645-1628-0)
(0-7645-1794-5)
Office XP For Dummies
Excel 2002 For Dummies
(0-7645-0830-X)
Quick Reference
Outlook 2002 For Dummies
(0-7645-0829-6)
(0-7645-0828-8)
0-7645-0822-9
0-7645-0839-3
0-7645-0819-9
GoldMine "X" For Dummies
(0-7645-0845-8)
Get smart! Visit www.dummies.com
• Find listings of even more For Dummies titles
• Browse online articles
• Sign up for Dummies eTips™
• Check out For Dummies fitness videos and other products
• Order from our online bookstore
™
Available wherever books are sold. Go to www.dummies.com or call 1-877-762-2974 to order direct.
35 55784X BOB.qxd 3/29/04 4:20 PM Page 362
our potential
Helping you expand your horizons and realize y
INTERNET
Also available:
America Online 7.0 For
The Internet For Dummies
Dummies
Quick Reference
(0-7645-1624-8)
(0-7645-1645-0)
Genealogy Online For
Internet Privacy For Dummies
Dummies
(0-7645-0846-6)
(0-7645-0807-5)
Researching Online For
The Internet All-in-One Desk
Dummies
Reference For Dummies
(0-7645-0546-7)
(0-7645-1659-0)
Starting an Online Business
0-7645-0894-6
0-7645-1659-0
0-7645-1642-6
Internet Explorer 6 For
For Dummies
Dummies
(0-7645-1655-8)
(0-7645-1344-3)
DIGITAL MEDIA
Also available:
CD and DVD Recording For
MP3 For Dummies
Dummies
(0-7645-0858-X)
(0-7645-1627-2)
Paint Shop Pro "X" For
Digital Photography
Dummies
All-in-One Desk Reference
(0-7645-2440-2)
For Dummies
Photo Retouching &
(0-7645-1800-3)
Restoration For Dummies
Digital Photography For
(0-7645-1662-0)
Dummies Quick Reference
Scanners For Dummies
(0-7645-0750-8)
0-7645-1664-7
0-7645-1675-2
0-7645-0806-7
(0-7645-0783-4)
Home Recording for
Musicians For Dummies
(0-7645-1634-5)
GRAPHICS
Also available:
Adobe Acrobat 5 PDF For
QuarkXPress 5 For Dummies
Dummies
(0-7645-0643-9)
(0-7645-1652-3)
Visio 2000 For Dummies
Fireworks 4 For Dummies
(0-7645-0635-8)
(0-7645-0804-0)
Illustrator 10 For Dummies
(0-7645-3636-2)
0-7645-0817-2
0-7645-1651-5
0-7645-0895-4
Available wherever books are sold. Go to www.dummies.com or call 1-877-762-2974 to order direct.
35 55784X BOB.qxd 3/29/04 4:20 PM Page 363
The advice and explanations you need to succeed
SELF-HELP, SPIRITUALITY & RELIGION
Also available:
The Bible For Dummies
Potty Training For Dummies
(0-7645-5296-1)
(0-7645-5417-4)
Buddhism For Dummies
Pregnancy For Dummies
(0-7645-5359-3)
(0-7645-5074-8)
Christian Prayer For Dummies
Rekindling Romance For
(0-7645-5500-6)
Dummies
Dating For Dummies
(0-7645-5303-8)
(0-7645-5072-1)
Spirituality For Dummies
Judaism For Dummies
(0-7645-5298-8)
0-7645-5302-X
0-7645-5418-2
0-7645-5264-3
(0-7645-5299-6)
Weddings For Dummies
(0-7645-5055-1)
PETS
Also available:
Labrador Retrievers For
German Shepherds For
Dummies
Dummies
(0-7645-5281-3)
(0-7645-5280-5)
Aquariums For Dummies
Golden Retrievers For
(0-7645-5156-6)
Dummies
Birds For Dummies
(0-7645-5267-8)
(0-7645-5139-6)
Horses For Dummies
Dogs For Dummies
(0-7645-5138-8)
(0-7645-5274-0)
Jack Russell Terriers For
0-7645-5255-4
0-7645-5286-4
0-7645-5275-9
Ferrets For Dummies
Dummies
(0-7645-5259-7)
(0-7645-5268-6)
Puppies Raising & Training
Diary For Dummies
EDUCATION & TEST PREPARATION
(0-7645-0876-8)
Also available:
Chemistry For Dummies
Italian For Dummies
(0-7645-5430-1)
(0-7645-5196-5)
English Grammar For
Research Papers For
Dummies
Dummies
(0-7645-5322-4)
(0-7645-5426-3)
French For Dummies
The SAT I For Dummies
(0-7645-5193-0)
(0-7645-5472-7)
The GMAT For Dummies
U.S. History For Dummies
(0-7645-5251-1)
(0-7645-5249-X)
0-7645-5194-9
0-7645-5325-9
0-7645-5210-4
Inglés Para Dummies
World History For Dummies
(0-7645-5427-1)
(0-7645-5242-2)
Available wherever books are sold. Go to www.dummies.com or call 1-877-762-2974 to order direct.
35 55784X BOB.qxd 3/29/04 4:20 PM Page 364
We take the mystery out of complicated subjects
WEB DEVELOPMENT
Also available:
ASP.NET For Dummies
FrontPage 2002 For Dummies
(0-7645-0866-0)
(0-7645-0821-0)
Building a Web Site For
HTML 4 For Dummies Quick
Dummies
Reference
(0-7645-0720-6)
(0-7645-0721-4)
ColdFusion "MX" For
Macromedia Studio "MX"
Dummies (0-7645-1672-8)
All-in-One Desk Reference
Creating Web Pages
For Dummies
All-in-One Desk Reference
(0-7645-1799-6)
0-7645-1643-4
0-7645-0723-0
0-7645-1630-2
For Dummies
Web Design For Dummies
(0-7645-1542-X)
(0-7645-0823-7)
PROGRAMMING & DATABASES
Also available:
Beginning Programming For
Perl For Dummies
Dummies
(0-7645-0776-1)
(0-7645-0835-0)
PHP and MySQL For
Crystal Reports "X"
Dummies
For Dummies
(0-7645-1650-7)
(0-7645-1641-8)
SQL For Dummies
Java & XML For Dummies
(0-7645-0737-0)
(0-7645-1658-2)
VisualBasic .NET For
Java 2 For Dummies
Dummies
0-7645-0746-X
0-7645-1657-4
0-7645-0818-0
(0-7645-0765-6)
(0-7645-0867-9)
JavaScript For Dummies
Visual Studio .NET All-in-One
(0-7645-0633-1)
Desk Reference For Dummies
Oracle9 i For Dummies
(0-7645-1626-4)
(0-7645-0880-6)
LINUX, NETWORKING & CERTIFICATION
Also available:
CCNP All-in-One Certification
Firewalls For Dummies
For Dummies
(0-7645-0884-9)
(0-7645-1648-5)
Home Networking For
Cisco Networking For
Dummies
Dummies
(0-7645-0857-1)
(0-7645-1668-X)
Red Hat Linux All-in-One
CISSP For Dummies
Desk Reference For Dummies
(0-7645-1670-1)
(0-7645-2442-9)
CIW Foundations For
TCP/IP For Dummies
0-7645-1545-4
0-7645-0772-9
0-7645-0812-1
Dummies with CD-ROM
(0-7645-1760-0)
(0-7645-1635-3)
UNIX For Dummies
(0-7645-0419-3)
Available wherever books are sold.
Go to www.dummies.com or call 1-877-762-2974 to order direct.
Document Outline

Hacking For Dummies About the AuthorDedicationAuthor�s AcknowledgmentsContents at a GlanceTable of ContentsForewordIntroduction Who Should Read This Book?About This BookHow to Use This BookWhat You Don�t Need to ReadFoolish AssumptionsHow This Book Is OrganizedIcons Used in This BookWhere to Go from HerePart I: Building the Foundation for Ethical Hacking Chapter 1: Introduction to Ethical Hacking How Hackers Beget Ethical HackersUnderstanding the Need to Hack Your Own SystemsUnderstanding the Dangers Your Systems FaceObeying the Ethical Hacking CommandmentsThe Ethical Hacking ProcessChapter 2: Cracking the Hacker Mindset What You�re Up AgainstWho HacksWhy Hackers HackPlanning and Performing AttacksMaintaining AnonymityChapter 3: Developing Your Ethical Hacking Plan Getting Your Plan ApprovedEstablishing Your GoalsDetermining What Systems to HackCreating Testing StandardsSelecting ToolsChapter 4: Hacking Methodology Setting the StageSeeing What Others SeeScanning SystemsDetermining What�s Running on Open PortsAssessing VulnerabilitiesPenetrating the SystemChapter 1: Introduction to Ethical HackingPart II: Putting Ethical Hacking in Motion Chapter 5: Social Engineering Social Engineering 101Before You StartWhy Hackers Use Social EngineeringUnderstanding the ImplicationsPerforming Social-Engineering AttacksSocial-Engineering CountermeasuresChapter 6: Physical Security Physical-Security VulnerabilitiesWhat to Look ForChapter 7: Passwords Password VulnerabilitiesCracking PasswordsSecuring Operating SystemsChapter 5: Social EngineeringPart III: Network Hacking Chapter 8: War Dialing War DialingChapter 9: Network Infrastructure Network Infrastructure VulnerabilitiesChoosing ToolsScanning, Poking, and ProddingChapter 10: Wireless LANs Understanding the Implications of Wireless Network VulnerabilitiesChoosing Your ToolsWireless LAN DiscoveryWireless Network AttacksChapter 8: War DialingPart IV: Operating System Hacking Chapter 11: Windows Windows VulnerabilitiesChoosing ToolsInformation GatheringRPCNull SessionsShare PermissionsGeneral Security TestsChapter 12: Linux Linux VulnerabilitiesChoosing ToolsInformation GatheringUnneeded Services. rhosts and hosts. equiv FilesNFSFile PermissionBuffer OverflowsPhysical SecurityGeneral Security TestsPatching LinuxChapter 13: Novell NetWare NetWare VulnerabilitiesChoosing ToolsGetting StartedAuthenticationGeneral Best Practices for Minimizing NetWare Security RisksChapter 11: WindowsPart V: Application Hacking Chapter 14: Malware Implications of Malware AttacksTypes of MalwareHow Malware PropagatesTestingMalware CountermeasuresChapter 15: Messaging Systems Messaging-System VulnerabilitiesE-Mail AttacksInstant MessagingChapter 16: Web Applications Web-Application VulnerabilitiesChoosing Your ToolsInsecure Login MechanismsDirectory TraversalInput FilteringDefault ScriptsURL Filter BypassingAutomated ScansGeneral Best Practices for Minimizing Web-Application Security RisksChapter 14: MalwarePart VI: Ethical Hacking Aftermath Chapter 17: Reporting Your Results Pulling the Results TogetherPrioritizing VulnerabilitiesReporting MethodsChapter 18: Plugging Security Holes Turning Your Reports into ActionPatching for PerfectionHardening Your SystemsAssessing Your Security InfrastructureChapter 19: Managing Security Changes Automating the Ethical Hacking ProcessMonitoring Malicious UseOutsourcing Ethical HackingInstilling a SecurityAware MindsetKeeping Up with Other Security IssuesChapter 17: Reporting Your ResultsPart VII: The Part of Tens Chapter 20: Ten Tips for Getting Upper Management Buy-In Cultivate an Ally and SponsorDon�t Be a FUDdy DuddyDemonstrate How the Organization Can�t Afford to Be HackedOutline the General Benefits of Ethical HackingShow How Ethical Hacking Specifically Helps the OrganizationGet Involved in the BusinessEstablish Your CredibilitySpeak on Their LevelShow Value in Your EffortsBe Flexible and AdaptableChapter 21: Ten Deadly Mistakes Not Getting Approval in WritingAssuming That You Can Find All Vulnerabilities During Your TestsAssuming That You Can Eliminate All Security VulnerabilitiesPerforming Tests Only OncePretending to Know It AllRunning Your Tests without Looking at Things from a Hacker�s ViewpointIgnoring Common AttacksNot Using the Right ToolsPounding Production Systems at the Wrong TimeOutsourcing Testing and Not Staying InvolvedChapter 20: Ten Tips for Getting Upper Management Buy-InPart VIII: Appendixes Appendix A: Tools and Resources Awareness and TrainingDictionary Files and Word ListsGeneral Research ToolsHacker StuffLinuxLog AnalysisMalwareMessagingNetWareNetworksPassword CrackingWar DialingWeb ApplicationsWindowsWireless NetworksAppendix B: About the Book Web SiteAppendix A: Tools and ResourcesIndex


