Seven Deadliest Microsoft Attacks phần 10 docx

129 7 INfORMAtION IN thIS ChApteR • How Multi-tier Attacks Work • Multi-tier Attack Anatomy • Dangers with Multi-tier Attacks • How Multi-tier Attacks Will Be Used in the Future • Defens

129

7

INfORMAtION IN thIS ChApteR

• How Multi-tier Attacks Work

• Multi-tier Attack Anatomy

• Dangers with Multi-tier Attacks

• How Multi-tier Attacks Will Be Used in the Future

• Defenses against Multi-tier Attacks

SharePoint – Multi-tier

Attacks

As we near the end of our journey through this book, we address some of the security concerns associated with multi-tier attacks and how they can be leveraged to access and seize data stored in Microsoft SharePoint Services and in Microsoft Office SharePoint Server (MOSS) Although this is the last chapter in this book, its place-

ment does not imply that SharePoint is any less important to consider when

develop-ing an effective strategy to protect your network SharePoint Servers store a wealth of information for organizations and are among one of the easiest to deploy the applica-

tions that Microsoft provides today With great power and convenience comes many responsibilities for ensuring data is protected from unauthorized access

hOW MuLtI-tIeR AttACKS WORK

Multi-tier attacks are not so different than many other things in life we deal with on a daily basis Many people who approach problems in a structured, methodical manner find accomplishing goals is easier when taking on a series of smaller tasks to reach

an end result These smaller steps can provide some clarity and simplify the methods

we can use to get from where we are to the place we want to be Each step along the way is just another step closer to meeting the goal

To further explain how multi-tier attacks may relate to everyday life, we explore some tactics that may be used by sales professionals to gain access to decision makers within an organization Imagine yourself as a sales person who works in an organiza-

tion that sells computers to large enterprises Your sole source of income relies on the

chapter 7 SharePoint – Multi-tier Attacks

dif-As a sales person, it is prudent to ensure you are making your sales pitch to the people with the abilities of making the decisions to buy your product You would most likely not want to spend a lot of time winning over a supervisor’s approval if they do not have the authority to approve a large purchase of your computers In some organizations, however, you cannot walk right into a vice president’s office and make your sales pitch without trying to bypass the executive secretary or reception-ist This is where we enter our multi-tiered approach to make sure you get in front of the person who can make decisions

Identifying people within the organization who may be at a lower level in the management chain may be fruitful if you can leverage relationships with those people in order to eventually meet a decision maker at the appropriate level with the appropriate authority to act No one ever said sales was an easy or quick process, so meeting a supervisor or a manager in order to use them as a stepping stone toward meeting a vice president or an executive vice president may be a necessity

Ultimately, we can use our access to other people within the organization to ensure that you eventually meet the people who can make the decisions to purchase your prod-uct Something to remember, however, is that even though you have taken different approaches, there is no guarantee of success Such is the life of a sales person and an attacker who may be using similar techniques to gain access to your SharePoint Server

In the case of a multi-tiered attack against a SharePoint Server, we first identify the components that make up the SharePoint solution and break them down into possible avenues of attack, just as we did with our management structure example These components act as different tiers within our overall solution and when com-bined together allow us to interact with SharePoint Some of the tiers we think of right from the start include the operating system, Web Server, database, and finally the application we are attacking Figure 7.1 provides a visual reference to the concept

of how multiple tiers may contribute to the makeup of an overall solution

Each of the tiers within this layered approach to the multi-tiered attack scenario provides an attacker with countless possibilities to consider for attacks, which may provide access to the SharePoint application In many cases, compromising one layer

of the tier will allow attackers to punch forward into other layers and provide the opportunity to leverage more attacks

As an example, recall one of the attack scenarios in Chapter 3 of this book, “SQL Server – Stored Procedure Attacks,” where the attacker was able to leverage access to

a Structured Query Language (SQL) Server sysadmin level account The attacker was able to use extended stored procedures to create a user account on the local operating

How Multi-tier Attacks Work 131

system and then add the new user account to the local administrators group This attack allowed the attacker to compromise the integrity of the operating system even though the attack originated from within the SQL Server application

fIGuRe 7.1

Multi-tiered Attacks

Windows Server 2003 Microsoft SQL Server Microsoft IIS SharePoint

NOte

Although we are using the example of tiers and high-level components such as the

operating system, Web server, database, and application, the tiered approach can also

include leveraging protocol, programming logic, and a variety of other types of flaws This is

dependent on the goals of the attacker and the tiers can extend much further or be far more

granular than the three tiers we describe here.

Leveraging new attack avenues compounds the possibility of success the attacker may have with meeting his goals This, of course, is an excellent reason why it is important to be aware of all applications, patch levels, and overall security of the network environment Segregation of applications running on critical systems is also something to consider when deploying multi-tier applications, this concept will be covered later in this chapter in the “Defenses against Multi-tier Attacks” section

Attackers may look for vulnerabilities in the operating system tier to exploit and take control of the entire operating system and all applications that reside on it For instance, an attacker may identify a missing security patch for the Windows Server 2003 operating system that would allow the attacker to exploit it and gain administrator- or system-level access This would allow our attacker to perform any tasks the privileged accounts could perform, including stealing your data

chapter 7 SharePoint – Multi-tier Attacks

132

The attacker may also take advantage of a vulnerability identified in Internet Information Services (IIS)A or the SQL ServerB database residing on the server to gain access to the operating system or the data stored in the SharePoint database Attacks can also be leveraged against antivirus solutions or almost any type of soft-ware with vulnerabilities an attacker can identify on a target system

MuLtI-tIeR AttACK ANAtOMy

It is common for attackers to look for alternate avenues of attack if the primary target

is configured securely The old saying “There is more than one way to skin a cat” also applies to attacking computer networks and services If an attacker cannot gain unau-thorized access to a SharePoint Server by direct attacks, the attacker may consider leveraging flaws in other applications if it will help him gain the access he needs.The discussions about attacking a SharePoint Server for the purpose of obtaining data will revolve around leveraging the infrastructure that supports SharePoint Server and not attacking SharePoint directly This is primarily to illustrate that although applications may be well secured and locked down from a security perspective, the supporting infrastructure may not be

DANGeRS WIth MuLtI-tIeR AttACKS

Attacking applications such as SharePoint is not always a toe-to-toe battle Sometimes,

it is fruitful to take the path of least resistance Although the SharePoint application may be fully patched and all of the best security practices are being followed, the opportunity to compromise the data provided by SharePoint may still be vulnerable The following scenarios will provide a detailed look at how an attack may look from the eyes of an attacker

configuration, and content.

site:.com "all site content"

The advanced search operator “site:.com” restricts the search results to only com Web sites and the “all site content” identifies sites that have that exact string of words in the page content SharePoint Servers have the string and thus many Web sites that may not have properly protected access to all of its resources can be accessed In some cases, this

is implemented by design and the information found may be harmless, but in many cases the search reveals interesting results.

Dangers with Multi-tier Attacks 133

Scenario 1: Leveraging Operating System vulnerabilities

Our first scenario looks at how the data SharePoint Server that is hosting can be

com-promised by indirect attacks Operating systems today are fairly complex compared with those developed back in the days of Windows NT 3.1 Millions of lines of code have been added to provide organizations the tools they need to continue expanding network services and provide solutions for complex business challenges

New functionality may provide opportunities for attackers to leverage flaws found in the application This will not be a lecture on secure coding habits, but let

us be quickly reminded that no developer or development organization can account for all types of errors within applications Many references that pinpoint the top programming flaws leading to system compromise, data loss, and degradation of service exist today; however, simple mistakes are still made during development efforts allowing attackers to continue taking advantage of unforeseen exceptions One valuable resource available from the SysAdmin, Audit, Network, Security (SANS) Institute is the “CWE/SANS TOP 25 Most Dangerous Programming Errors.”C

Now that we have built the foundation for this attack scenario and we can

under-stand how operating systems, databases, and almost any other applications flaws can

be leveraged, let’s take a look at what our attacker is up to now Before attacking an application such as SharePoint, an attacker will first conduct an initial reconnais-

sance to identify the services running on a server to help determine the exploitability

of the target and the supporting infrastructure Figure 7.2 is the output from a port scanning session performed using Nmap

C www.sans.org/top25errors/

fIGuRe 7.2

Nmap Scan

chapter 7 SharePoint – Multi-tier Attacks

134

As seen in Figure 7.2, the attacker’s target has many services open and is awaiting interaction from users and applications A skilled attacker will be able to review the list of open ports and identify further steps that can be taken to enumerate information from the services Our target system has a variety of services running that provide multiple opportunities for the attacker

Some of these services may not usually be available or visible from the attacker’s perspective, if the attacks are Internet-based Attacks sourced internally will typi-cally yield similar results to what we see in our Nmap scan Attacks sourced from within the trusted internal network could be the result of malicious employees and

by attackers who have already gained access to internal resources A good example

of an internally sourced attack is described in Chapter 5, “Office – Macros and ActiveX.”

NOte

A common tool used by attackers and penetration testers to identify open ports and services is Nmap D This tool provides an attacker a very good idea of what type of

services are running on a target system, and subsequently the types of attacks an

attacker may want to consider based on the results of the scan The tool also provides many options to assist attacker with evasion, operating system fingerprinting, and

identifying applications.

The power of this tool lies in the many different types of scans that can be

performed and its capability to scan very specific or very wide ranges of targets Nmap

is also very accurate in its output of information and has a very large community of users who share different scanning techniques, based on the goal of the scans that need

to be done.

Some scanning techniques are used to limit the exposure of the attacker and run as silent as possible to avoid detection by firewall, intrusion detection system, and intrusion prevention systems On the other hand, if there is no requirement to remain stealthy, Nmap can run fast and loud to get the job done very quickly.

Without question, Nmap is a must-have application for anyone who is responsible for assessing the security of networks This tool should be a standard part of the Information Technology administrator’s toolkit.

D http://nmap.org/

The Nmap scan might provides some results that are immediately interesting

to the attacker Some of the services have widely publicized vulnerabilities with stable exploit code available on Internet Web sites An attacker will not only scan for open ports using tools such as Nmap, but they will also attempt to identify or

“fingerprint” the services running on the ports This process allows attackers to narrow down the possible attack vectors and determine what types of vulnerabili-ties may be leveraged

Dangers with Multi-tier Attacks 135

Once vulnerabilities are identified, the attacker can attempt leveraging the vulnerabilities using exploits An exploit can be anything from a simple directory traversal using a standard Web browser to an exploit leveraging a stack or a heap buffer overflow allowing unrestricted access for the attacker In our scenario, the attacker has chosen to leverage one of the many flaws against the Windows operat-

ing system to cause a stack-based buffer overflow and gain complete control of the operating system

Now that our attacker has full control of the operating system, the attacker can access the SharePoint data previously protected only by a Web login page The SharePoint Server and all of its contents have now been fully compromised and the attacker now holds all of the secrets previously protected by the system

The attacker may decide to add users to the system or connect to the database

to steal proprietary information If an attacker wanted to conduct further attacks against the organization, he may modify documents by placing malicious code in them and upload them to the SharePoint site When users log into the SharePoint site and access the malicious documents, the payload may execute allowing the attacker additional access The loss of confidentiality and integrity of the data stored in the SharePoint can cost organizations a lot of money depending on the sensitivity of the data stored on the server

Now that we have looked at this scenario and have identified how attackers can use multi-tiered attacks against the operating system platform to compromise SharePoint and other services, seriously consider what important data may be stored in your particular implementation of SharePoint Possible examples include financial infor-

mation and intellectual property contained in document libraries, contact information that could be considered private, and application defects stored in SharePoint lists, which could potentially identify vulnerabilities that could be exploited by would-be

WARNING

Classifying vulnerabilities is beyond the scope of this chapter; however, several methods

of vulnerability identification are available Manual identification of vulnerabilities can be

as simple as banner grabbing with tools, such as telnet and netcat, and cross- referencing

application versions with vulnerability databases such as Secunia, E Open Source

Vulnerability DataBase, F and SecurityFocus G When assessing a large enterprise with a

significant number of systems, however, this task may be overwhelming.

Automated scans can be performed using tools such as Nessus H or services can be

contracted by companies specializing in penetration testing and vulnerability assessment

and identification For larger organizations, this may be preferable due to the scope and

number of systems that need to be assessed.

E http://secunia.com/advisories/

F http://osvdb.org/

G www.securityfocus.com/vulnerabilities

H www.nessus.org/nessus/

chapter 7 SharePoint – Multi-tier Attacks

136

attackers, among many, many others Security of the data within your SharePoint implementation should include all of the tiers identified earlier in Figure 7.1

Scenario 2: Indirect Attacks

Another venue of attack is to leverage vulnerabilities present in other softwares ing on hosts, which are trusted within the same network as our SharePoint Server

resid-In the earlier scenario, the platform (operating system) was attacked with the goal

of compromising the SharePoint installation In this scenario, other applications are attacked in order to reach SharePoint A poorly supported patch management pro-gram can sometimes allow application flaws to be leveraged to gain access to operat-ing system resources Even applications that are installed to protect systems, such as antivirus and firewall software, can be used by attackers to take control of systems and data residing on them

This following attack scenario focuses on the attacker gaining administrative control of server hosting the SharePoint database by leveraging an application flaw This scenario involves the deployment of the SharePoint front end and IIS hosted

on one server and the SQL Server database storing all of the SharePoint data on a separate server

After the attacker has finished port scanning and identifying services running

on the target, he learns the target is running popular antivirus software with a known vulnerability The software has been identified as Symantec Antivirus 10.1, and the attacker was able to identify the vulnerability by using the Nessus vulnerabil-ity scanner The description of the vulnerability can be found in several vulnerability databases as well as on the Nessus Web site.I

well-After the attacker confirms the version of the software is vulnerable and tible to exploitation, and he feels he will be successful, he launches an attack using

suscep-an exploit included in the Metasploit Framework Upon successful exploitation of the vulnerability, the attacker has complete control of the system working under the context of the SYSTEMJ account as described in information provided on the Nessus Web site

While the attacker is working under the context of the SYSTEM account, he gains access to the SQL Server that stores all of the data stored by the SharePoint applica-tion Even though the SharePoint application itself may reside on a separate server, the attacker has been able to gain access to important data stored in the database

In addition, if the attack is successful and the payload sent to the target has opened

a remote shell, the attacker can obtain the systems password hashes and crack them offline for later use Cracking the password hashes obtained from the system may provide the attacker with passwords that may be used on other systems within the network

I www.nessus.org/plugins/index.php?view=single&id=24236

J http://support.microsoft.com/kb/120929

Defenses against Multi-tier Attacks

hOW MuLtI-tIeR AttACKS WILL Be uSeD IN the futuRe

The earlier examples have provided an overview of how multi-tier attacks may be used to gain unauthorized access to SharePoint resources These attacks provide valuable insight into how multi-tier attacks have been a valuable attack methodology used by attackers for many years with great success What does the future hold for attackers and system administrators who need to defend against them?

Over the last several years, Microsoft and other vendors have started to slowly implement controls to reduce the exposure to some multi-tiered attacks; however, multi-tier attacks will continue to be a standard attack methodology for gaining access to resources The multilayered approach to developing and deploying applica-

tions will ensure the longevity of these attack patterns

It is important to make sure implementation efforts do not hamper security efforts The necessary steps should be taken to ensure that deployment of newly commissioned systems follows best practices and that proper system maintenance procedures are followed and enforced Future attacks can be minimized by learning from the mistakes of the past (of which many are documented) An extensive list

of configuration and security guides for SharePoint 2007 server can be found at the Microsoft SharePoint Server TechCenter.K

DefeNSeS AGAINSt MuLtI-tIeR AttACKS

The tricky aspect to defending against multi-tier attacks is that you will neither be defending a single component nor be defending against a single attack method In the sections that follow, you will quickly notice that defending against multi-tier attacks requires implementing defensive controls that may also reside at multiple points within the network and implementation footprint Because of the varied methods that an attacker can employ, there is no single defense that can be deployed “Defense

in Depth” is especially relevant and applicable to this situation

The three layers described below do not necessarily present anything new; however, this one-attack approach is actually a collection of methods that aggre-

gates many defensive positions For example, an attacker may attempt to exploit

a known buffer overflow vulnerability in the operating system to gain control

of a particular server and then attempt a brute force password attack against a Web application hosted on the server to compromise a user account or launch an SQL injection attack against an instance of SQL Server to gain access to data From there, the attacker could plant documents in a folder that are infected with some form of malware The layers present broad, yet effective, ways for you

to safeguard the confidentiality, integrity, and availability of your SharePoint installation

K http://technet.microsoft.com/en-us/library/cc262788.aspx

CHAPTER 7 SharePoint – Multi-tier Attacks

138

First Defensive Layer: Failure to Plan = Plan to Fail

In security, this familiar maxim holds very true: “If you fail to plan, you had better plan to fail.” Thinking about the defenses against potential attacks ought to begin early in your implementation projects Both methods are the types of things that can

be incorporated relatively inexpensively and with little effort if they are employed from the start The costs and effort to adopt these principles will increase the further along you progress in your project Trying to achieve this once your system is in production will probably involve ripping out significant parts of your code or infra-structure and replacing it with something new While it may be necessary, it certainly will not be as cheap or as easy as if you had incorporated these principles into your approach early in the planning phase

Segregation of Applications (Function)

This defense was mentioned earlier in the first attack scenario In essence, it involves separating the components onto different platforms so that an attacker cannot com-promise the entire system through compromising a single platform In the case of SharePoint, as depicted in Figure 7.3, the SharePoint’s back end – its SQL Server database – is installed on one server and the front end – IIS and MOSS – is installed on another server This arrangement very closely resembles the well-known Information Technology (IT) security principle, Segregation (or Separation) of Duties See Figure 7.3 for a description

Figure 7.3

Separating SharePoint Components on Different Platforms

SharePoint Front End

SharePoint Back End

Defenses against Multi-tier Attacks

Incorporating security requirements into the design of the infrastructure and application architecture will prevent security from becoming an afterthought or a last resort Furthermore, new infrastructure and applications generally do not run

in isolation Public Web sites need to be exposed to the Internet; other applications may run in a highly classified network In both cases, the applications will need to interact with security hardware and software, such as firewalls, intrusion detection, and antivirus software All of these components, among many, many others, will have an impact on how new systems are accessed, how they are used, and potentially how well (or poorly) they perform The earlier these other systems are identified and figured into the overall architecture, the easier it is to make allowances for them

As mentioned in the opening paragraph in this section, the more mature a system becomes, the more expensive it is to modify

Secure Application Development

SharePoint is not merely a collaboration suite but a bona fide platform for workflow and forms-based applications Furthermore, while you can deploy SharePoint with-

out customization, the options that it offers to tailor it for your organization’s look and feel mean that it probably will not be long before requests for customization start

to roll in Security needs to be a prime consideration for each piece of custom code that is written Each batch of poorly written code is a potential vulnerability that can

be exploited

Security must be integrated into applications from the ground up Tackling the

topic of secure application development, also referred to as secure coding, is well

beyond the scope of this book In fact, there are entire books written on the subject

At a high level, security needs to be integrated in application development

through-out the development lifecycle The following are four areas where you as an IT

secu-rity professional need to be involved:2

The ISACA Glossary defines the Segregation of Duties, also referred to as the Separation

of Duties, as “a basic internal control that prevents or detects errors and irregularities by

assigning to separate individuals responsibility for initiating and recording transactions

and custody of assets to separate individuals.” 1 The intent of this principle is to reduce

the scope for error and fraud For example, users who create an output file with sensitive

data are not permitted to authorize transactions that involve the use of the data While

there is no way to absolutely prevent collusion among employees, the Segregation of Duties

is a deterrent The additional benefit is that it can reduce the possibility of unintentional

damage caused by accident or through incompetence by putting a second “set of eyes” on

the particular activity.