FORESEC Academy FORESEC Academy Security Essentials (III)

FORESEC Academy Internet Security Technologies Agenda  Chapter 13 : Attack Strategies and Mitigation  Chapter 14 : Firewalls and Honeypots  Chapter 15 : Vulnerability Scanning  Chapter 16 : Host-Based Intrusion Detection  Chapter 17 : Network-Based Intrusion Detection  Chapter 18 : Risk Management and Auditing

FORESEC Academy Attack Strategies and Mitigation Chapter Outline  Mitnick-Shimomura Attack Analysis  Preventive Techniques  Methods of Attack  Chapter Summary

FORESEC Academy K. Mitnick vs. T. Shimomura  Confidentiality, integrity and availability attack  Reconnaissance probing to determine trust relationship (“r utilities”)  IP spoofing to act as one side of trust relationship  Lack of site or system perimeter defenses to retard or defeat attack

FORESEC Academy Two Systems, Trust Relationship Unix, Apple Computers, and Windows all have built-in trust relationship capabilities. If one party in a two- way trust relationship is compromised or spoofed, the other party is in great danger.

FORESEC Academy Enter the BadGuy (TM) Reconnaissance is often the first phase of an attack

FORESEC Academy Silence B With DoS Attacker is going to Pretend he is B, so B Must be silenced so it Cannot signal an alarm SYN Flood Attack to B renders B unable To reply to A

FORESEC Academy Attacker Probes for a Weakness in A.s TCP Stack Each time A is stimulated, the SYN/ACK response is predictable.

FORESEC Academy Attacker Pretends to be B The attacker, pretending to be B, uses the predictable response to open a connection.

FORESEC Academy Make “A” Defenseless Attacker sends expected ACK with fake SRC IP ADDRESS to establish a connection.

FORESEC Academy Finish the Job B sends rshell packet ‘”echo ++”>/.rhosts’ to open A to attack Attacker uses # rlogin – I root to takeover ‘A’ Attacker

FORESEC Academy What Common Techniques Could Have Prevented The Attack?

FORESEC Academy What Risk Management Techniques Could Have Detected The Attack?

FORESEC Academy Patching Systems  Although not relevant to Mitnick’s attack, per se, still very important.  Timely patching can often prevent the majority of attack vectors from being successfully executed.  Patches are often available before or very soon after exploits are announced.

FORESEC Academy Disabling Unused Services

FORESEC Academy Host-based Intrusion Detection

FORESEC Academy Network-based Intrusion Detection

FORESEC Academy Network Vulnerability Scanner Scanner Warning: A trust B A has potential rshell vulnerability

FORESEC Academy Firewalls Many attack attempts fail to penetrate well – configured firewalls, especially if they have a “deny everything not specifically allowed” policy.