October 8, 2002Bob Mahoney, MIT Network Security Team 1 Windows Security: Recent Threats and Responses (and whatever else comes up :-) Information Systems Fall Forum

October 8, 2002Bob Mahoney, MIT Network Security Team 2 Who are we? 2 full-time IS staff Various IS staff who contribute occasional time upon request (begging works wonders) 6 student staff who give 1-10 hrs/week 2 voucher employees, hrs/week total 12 departmental computing staff, mostly focused on local incidents We had the equivalent of 4.6 FTE over the Summer (something like “Full Staff”)

October 8, 2002Bob Mahoney, MIT Network Security Team 3 Team Operations Scanning for known vulnerabilities and indications of compromise Advising users of vulnerable machines what steps to take Detecting and removing compromised hosts Advising IS and the community about security issues Act as POC for outside complaints about security events at MIT

October 8, 2002Bob Mahoney, MIT Network Security Team 4 Rules of Engagement Any host that is known to be compromised is administratively removed from the network, and remains disconnected until investigation and/or recovery is complete. The system contact for a host that exhibits a known vulnerability is contacted and advised on steps to be taken to resolve the vulnerability. A date is given at this point after which unpatched systems will be disconnected.

October 8, 2002Bob Mahoney, MIT Network Security Team 5 RoE & Windows Due to the virulence of recent Windows worms, and the wide publicity of the problem, response policies are firmer: Any Windows system that is vulnerable to a known IIS exploit will be disabled upon detection. Any Windows system with missing or inadequate Administrative password will be disabled upon detection.

October 8, 2002Bob Mahoney, MIT Network Security Team 6 Contact Procedures All security-related mail is sent to the current Moira contact for the machine. This contact info can be updated by users at: In non-urgent scenarios, advisories are sent w/o deadline. Depending upon urgency, various response deadlines are set.

October 8, 2002Bob Mahoney, MIT Network Security Team 7 What are we seeing? More clueful attackers, generally targeting Windows machines. Cracking passwords, rather than guessing/stealing Attackers being much more stealthy. Attackers are operating somewhat more ‘manually’, as opposed to using dumber, wider scan/attacking probes. Attackers are keeping track of machines that they have probed, presumably for later misuse.

October 8, 2002Bob Mahoney, MIT Network Security Team 8 How much of this goes on? 1895 security cases in the last 90 days (65% Windows, down from 78% last month) 264 cases currently open 212 cases were due to Windows worm activity 285 machines were disabled in the last 90 days 85 are currently disabled as of this morning (7 for non-security issues) 57 of those were “Pubstro” warez sites

October 8, 2002Bob Mahoney, MIT Network Security Team 9 What Can You Do? Apply all security updates ASAP. Make sure ALL machines in your area have correct contact information. Make sure all machines in your area have STRONG passwords. Review all machines for appropriate file- sharing configuration.

October 8, 2002Bob Mahoney, MIT Network Security Team 10 How to make this less painful: Don’t move compromised machines Don’t use “slush” addresses Don’t use hubs/repeaters/switches Don’t take shortcuts Don’t run services you don’t need Use your vendor’s “Update Service” Subscribe to security-fyi and netusers lists Backups, Backups, Backups!

October 8, 2002Bob Mahoney, MIT Network Security Team 11 Less painful, continued… Please reply/all to the mail we send you Don’t call the Help Desk because you have received mail from us We do not have a number where you can call us Don’t run IIS (Really) Look out for specialized machines with embedded Windows Please don’t cry. We’re already a little depressed.

October 8, 2002Bob Mahoney, MIT Network Security Team 12 Final thoughts on Pain… We know your system is important to you We aren’t doing this to be annoying We cannot send someone out to help you recover (but can refer to paid consultants) Plan ahead: how much work will it take for you to recover your critical systems RIGHT NOW?

October 8, 2002Bob Mahoney, MIT Network Security Team 13 Mailing Lists = (public) Notification of maintenance events, CERT = (public) Local security news, and threat = Working list for security team. Questions or problems go Mail to “-request” to join public lists

October 8, 2002Jon Hunt, Software Release Team14 Cracking passwords, and how to make it harder Jon Hunt, Software Release Team and Security Team

October 8, 2002Jon Hunt, Software Release Team15 Cracking Passwords Active vs. Passive – Both Use –Guess (user name, machine name, blank, “test”, “help”, “student”, “password”) –Dictionary (high powered guessing) –Brute Force (try everything) Tools –GetAcct –Null Sessions with SecDump –L0pht Crack –Scripts Italics = Specific Hacker (white or black) Tool

October 8, 2002Jon Hunt, Software Release Team16 Active Password Attack Hacker will try to get account information –GetAcct or NULL Sessions –If that fails, tries standard accounts Administrator, Guest, Backup, Test, IIS… Repeatedly attempts to logon to computer remotely using a script and series of passwords

October 8, 2002Jon Hunt, Software Release Team17 GetAcct & SecDump GetAcct –Enumerates all user information (except password) on NT 4 & 2000 out of box Groups, last logon, real name, password last changed, and much more Do NOT know how to lock down NT 4 to stop it –Enter machine name and the number of accounts you want the info for NULL Sessions & DumpSec –Similar thing, more configurable, harder to use –Login as a blank user C:\>net use \\machine\ipc$ /user:”” *\\machine\ipc$

October 8, 2002Jon Hunt, Software Release Team18

October 8, 2002Jon Hunt, Software Release Team19 If you have auditing setup, you will see something like this

Bob Mahoney, MIT Network Security Team 20

October 8, 2002Jon Hunt, Software Release Team21 Passive Password Attack Sniff clear text and hashed passwords Dump the SAM Database - pwdump Crack the passwords using L0pht Crack or other tools Grab from Remote Registry (requires admin rights)

October 8, 2002Jon Hunt, Software Release Team22 L0pht Crack 560,000 dictionary words in a minute –Unlimited dictionaries available on the web Slang, scifi, names, places, mythology, yiddish, kjb, Shakespeare, common_passwds, Chinese and many more. Brute Force on Pentium III 800MHz –A-Z, 0-9 in 13 hours –A-Z, 0-9 and in 5 days –A-Z, 0-9 and in 48 Full version only costs $350 – free 15 day trial Built in sniffer for LM & NTLM hashed passwords

23

October 8, 2002Jon Hunt, Software Release Team24 What can you do? Use and require strong passwords –MiXeD cAse –Special<>characters! (in the middle is better) –Longer the better, over 14 characters much harder (only works for Win2K and later) –Change them about every 42 days –Automatically lock accounts for 30 minutes after repeated failed attempts Enable Auditing and check the logs

October 8, 2002Jon Hunt, Software Release Team25 What else can you do? Use NTFS instead of FAT Apply patches –Windows Update – all critical updates * –Application Vendors release patches too Disable stuff you do not need –NULL Sessions –LM Hashes (require NTLMv2 if possible) Do NOT connect from Win95/98/ME * Wait for IS’s recommendation for Service Packs

October 8, 2002Jon Hunt, Software Release Team26 What further can you do? Run Anti-Virus Software and keep it up to date Do NOT open attachments from people you are not expecting to receive them from Have a BACKUP SOLUTION!!! Use your Backup Solution Check that you Backup Solution is working –We have seen hackers delete client data to make room for warez

October 8, 2002Jon Hunt, Software Release Team27 What are we (IS) doing to help? Working on Security Templates –Make it easier to apply policies –Have a first pass for Windows 2000 and XP that are currently in review Working on guidelines: – Scanning MITnet for basic vulnerabilities and compromises and informing the machine contact (update your machine contact info)

October 8, 2002Jon Hunt, Software Release Team28 Should I be testing my user’s passwords? It depends, but probably not More useful to setup a good policy –Require strong passwords –Set passwords to expire (e.g. 42 days) –Disable NULL Sessions –Require NTLMv2 (disable LANMAN and NTLM) –Run regularly updated virus scans –Lockout Accounts after repeated failed attempts