Lesson 5 Knowing the Threat

Unauthorized use of Computer Systems 2000 CSI/FBI Survey Trend

Frequency Point of Attack 2000 CSI/FBI Survey Trend

Foreign Corporations U.S. Corporations Likely Sources of Attack 2000 CSI/FBI Survey

E-Commerce Security Example Breaking an E-Business

WEB Server DBA Server Router Investment App servers Network User Clients Server Consider this Network How Can A Hacker Attack?

ATTACKER WEB Server DBA Server Router Investment App servers Network User Clients Server Step 1: Attacker exploits weakness in CGI script to break through firewall and gain shell privileges on host

ATTACKER WEB Server DBA Server Router Investment App servers Network User Clients Server Step 1: Attacker exploits weakness in CGI script to break through firewall and gain shell privileges on host Step 2: Attacker finds dBase PW in CGI Script and downloads all account numbers and PWs

ATTACKER WEB Server DBA Server Router Investment App servers Network User Clients Server Step 1: Attacker exploits weakness in CGI script to break through firewall and gain shell privileges on host Step 2: Attacker finds dBase PW in CGI Script and downloads all account numbers and PWs Step 3: Attacker installs NetBus and controls manager’s terminal

Going for the Kill! Customer Enters account ID and PW Customer is Authenticated and access is granted Customer Checks portfolio performance Customer updates portfolio tracking preferences Customer buys/sells shares Step 4: Attacker credits account under their control Investment bank debits/credits customer’s cash account and updates portfolios Investment bank notifies customer with confirmation of transaction

So What Happens When Computer Security Fails? Incident Response--A Six Step Process –Preparation: Proactive Computer Security –Identification –Containment –Eradication –Recovery –Hot Wash

History Lesson The Art of War, Sun Tzu Lesson for you Know the enemy Know yourself…and in a 100 battles you will never be defeated If ignorant both of your enemy and of yourself you are certain in every battle to be in peril

History Lesson The Art of War, Sun Tzu Lesson for the Hacker Probe him and learn where his strength is abundant and where deficient To subdue the enemy without fighting is the acme of skill One able to gain victory by modifying his tactics IAW with enemy situation may be said to be divine

Hacker Attacks Intent is for you to know your enemy Not intended to make you a hacker Need to know defensive techniques Need to know where to start recovery process Need to assess extent of investigative environment

Anatomy of a Hack FOOTPRINTINGSCANNINGENUMERATION GAINING ACCESS ESCALATING PRIVILEGE PILFERING COVERING TRACKS CREATING BACKDOORS DENIAL OF SERVICE Source: Hacking Exposed, McClure, Sacmbray, and Kurtz

Anatomy of The Hack FOOTPRINTINGSCANNINGENUMERATION GAINING ACCESS ESCALATING PRIVILEGE PILFERING COVERING TRACKS CREATING BACKDOORS DENIAL OF SERVICE Source: Hacking Exposed, McClure, Sacmbray, and Kurtz

Footprinting Objective Target Address Range Acquire Namespace Information Gathering Surgical Attack Don’t Miss Details Technique Open Source Search whois Web Interface to whois ARIN whois DNS Zone Transfer Source: Hacking Exposed, McClure, Sacmbray, and Kurtz

Scanning Objective Bulk target assessment Determine Listening Services Focus attack vector Technique Ping Sweep TCP/UDP Scan OS Detection Source: Hacking Exposed, McClure, Sacmbray, and Kurtz

Enumeration Objective Intrusive Probing Commences Identify valid accounts Identify poorly protected shares Technique List user accounts List file shares Identify applications Source: Hacking Exposed, McClure, Sacmbray, and Kurtz

Gaining Access Objective Informed attempt to access target Typically User level access Technique Password sniffing File share brute forcing File share brute forcing Password file grab Buffer overflows Source: Hacking Exposed, McClure, Sacmbray, and Kurtz

Escalating Privilege Objective Gain Root level access Technique Password cracking Known exploits Source: Hacking Exposed, McClure, Sacmbray, and Kurtz

Pilfering Objective Info gathering to access trusted systems Technique Evaluate trusts Search for cleartext passwords Source: Hacking Exposed, McClure, Sacmbray, and Kurtz

Cover Tracks Objective Ensure highest access Hide access from system administrator or owner Technique Clear logs Hide tools Source: Hacking Exposed, McClure, Sacmbray, and Kurtz

Creating Back Doors Objective Deploy trap doors Ensure easy return access Technique Create rogue user accounts Schedule batch jobs Infect startup files Plant remote control services Install monitors Trojanize Source: Hacking Exposed, McClure, Sacmbray, and Kurtz

Denial of Service Objective If unable to escalate privilege then kill Build DDOS network Technique SYN Flood ICMP Attacks Identical src/dst SYN requests Out of bounds TCP options DDOS Source: Hacking Exposed, McClure, Sacmbray, and Kurtz

Hacker Exploits per SANS RECONNAISSANCESCANNING EXPLOIT SYSTEMS KEEPING ACCESS COVER TRACKS Source: SANs Institute

Hacking Summary Hacking on the rise Hacktivism New crime vector Loose international laws Tools automated and readily available Blended Threats Multi-axis attacks Automated Zombies