[CEHV3] Ethical Hacking Workshop Presentation

Presentation Outline  Part 1: Threats to Security  Part 2: Performing a Risk Assessment  Part 3: Hacker Technologies  Part 4: Buffer Overflow Exploits  Part 5: Firewalls  Part 6:

 Seminar Objectives

• Provide insight into current efforts and future plans

for network security.

Internet security risk

Presentation Outline

 Part 1: Threats to Security

 Part 2: Performing a Risk Assessment

 Part 3: Hacker Technologies

 Part 4: Buffer Overflow Exploits

 Part 5: Firewalls

 Part 6: Denial of Service and Trojans

 Part 7: Security Policy

 Part 8: How to Handle an Attack?

 Part 9: Educational Resources

Why Security

 90% of large companies & govt agencies had computer security breaches in 2001

 Three-quarters suffered financial losses

 Most frequent problems

External threats, such

as social engineering

or viruses

Internal threats, such as

internal attacks or code

vulnerabilities

Threats to Security

Addressing Internal Threats

 Failure to update hotfixes and security patches

 Blank or weak passwords

Internal attacks

Restricted Area

of Network

or competitive advantage

Organizational

Attacks

Bypasses Technology to gain network access

Social Engineering

Connection Fails

Blocks access to data

or services

DoS DoS

Organizational

Attacks

Social Engineering

Denial of Service (DoS)

Automated Attacks

Viruses, Trojan Horses, and Worms

Harmful code, malicious programs, self replicating

Organizational

Attacks

Social Engineering

Denial of Service (DoS)

Automated Attacks

Viruses, Trojan Horses,

Organizational

Attacks

Social Engineering

Viruses, Trojan Horses,

and Worms

Denial of Service (DoS)

Automated Attacks

Accidental Breaches

in Security

General Prevention

 Test and apply service packs and hotfixes

 Run and maintain antivirus software

 Run an intrusion detection system at the perimeter to your network

 Block all messages containing Readme.exe or

Admin.dll attachments

 Reinstall infected systems

the Outlook address book or send e-mail

Protecting E-Mail

Protecting Web Servers

 Apply the latest hotfixes

 Install the latest service pack

 Install the security roll-up packages

 Remove unnecessary IIS components

 Install UrlScan with the default rule set

Internet Information Service

Internet Information Service

Protecting File Servers

 Remove unnecessary file shares

 Use an AGDLP or AGUDLP Strategy

 Assign the minimum required permissions

 Enforce complex passwords

Microsoft Strategic Technology

Protection Program

 Two-phase program that integrates Microsoft

products, services, and support

• Phase 1: Get Secure

• Phase 2: Stay Secure

Phase 1: Get Secure

 The Microsoft Security Tool Kit

servers that are connected to the Internet

 Toll-free virus support

Phase 2: Stay Secure

 Worldwide security-readiness events

 Tools, updates, and patches

• Enterprise security tools

• Windows Update auto-update functionality

• Bimonthly product roll-up patches

 Consulting engagements

Part 2: Performing a Risk Assessment

Strategies to Manage Risk

4 Implement

Security Measures

Identifying the Resources to Protect

Identifying the Threats to Resources

Viruses, Trojan Horses, and Worms

Social Engineering

Automated Attacks

2 Identify

Threats

Threats

External Attacks Most Frequent

 Greater use of Internet

 Tools & techniques evolve to enable new opportunities for

attack

Source: 2000 CSI/FBI Computer Crime and Security Survey

Frequent Points of Attack

password guessing

self-replicating code

password cracking

exploiting known vulnerabilities

disabling audits

back doors

hijacking sessions

sniffer / sweepers

stealth diagnostics

packet forging / spoofing

GUI

Hacking Tools

Average Intruder

Hacking Tools

Kiddie Scripter 2001

Part 3: Hacker Technologies

The Threats

 These hacking tools could be easily

download from the Internet =>

your system

The Threats

 Your host does not need to be as famous as yahoo

or ebay to be targeted

sites

activities

The Threats

 The Trends

for RLAB segment) , our site has received the following

security warning

– Web page defacement– Unauthorized system access

– Port scanning– Ping broadcast scanning– Telnet probe scanning

Part 4: Buffer Overflow Exploits

• Identify the victim host vulnerability

• Attack the victim host via this vulnerability

• Establish backdoors for later access

How they Hack in?

Some hacking tools can automate the above steps into a single command

• After break-in, use this victim host to

activities

How they Hack in?

 Buffer Overflow Exploit

• stuffing more data into a buffer than it can handle

• it overwrites the return address of a function

• it switches the execution flow to the hacker code

How they Hack in?

 Buffer Overflow Exploit

Text Region(program code)Data Region(initialization/unintialization)

Stack Region

Low MemoryAddress

How they Hack in?

 Buffer Overflow Exploit

Function local variable buffer

Return addressSave Frame Pointer

How they Hack in?

 Real Case Study I

137.189 network

Daemon) buffer overflow vulnerability

of inetd daemon

How they Hack in?

 Real Case Study II

scanning

Demonstration: Buffer Overflow in

IIS IPP Protocol

Part 5: Firewalls

Fighting Back

 Get Your Security Profile

 Set Your Security Policy

 Build the Firewall

Get Your Security Profile

 Act as a hacker and try to break-in your host

applications are vulnerable

any monitoring or intrusion detection system)

built any firewall?)

Set Your Security Policy

minimum as possible

you can formulate your host access lists

Set Your Security Policy

• sudo

• restrict login shell

Build Your Firewall and IDS

 Control and monitor the traffic IN and OUT of your

network

 Block any unnecessary network connection from

non-trusted hosts and networks

 Define your access rules according to your security policy

 Use packet filtering and Application Proxy

 Build sniffer to monitor your internal network traffic

Firewall Architecture

Firewall Architecture

 Architecture using two routers

Firewall Architecture

Build Your Firewall

How it protects your network

detection

Firewall in IE Network

Set your own filter rules at your host

Here is the example how you use ipchains to block all non-IE network TCP and UDP connections to your host except 80 port

ipchains -A input -s 0.0.0.0./0.0.0.0 -d your_host_ip/255.255.255.255 80 -i eth0 -p 6 -j ACCEPT ipchains -A input -s ! 137.189.96.0/255.255.252.0 -d 0.0.0.0/0.0.0.0 -i eth0 -p 6 -j DENY -y

ipchains -A input -s ! 137.189.96.0/255.255.252.0 -d 0.0.0.0/0.0.0.0 -i eth0 -p 17 -j DENY

Firewall Protection Services

LAN

Firewall Internet

192.168.10.1

192.168.10.2 192.168.10.3

Network address translation

Source IP Source port Target IP Target port

192.168.10.1 207.46.197.100 1033 1998 Any 80

Protecting the Internal Network

Private Network

SMTP POP3 IMAP

Private Network

Client: UDP:5555 Public Network

Firewall

Stateful Inspection

Client: UDP 4444

Client

 Client sends a packet from UDP port 4444

Perimeter Networks

 A perimeter network:

the private network

 Perimeter networks are also known as:

• DMZs

Internet

Using a Mid-Ground Perimeter

Network

External Firewall

Internal Firewall

Perimeter Network

Internal Network

Firewall Weaknesses

for network security

target port

• Circuit-level and application filtering can provide

protection against these attacks

firewalls:

authentication of endpoint systems

Demonstration: Snort

Part 6: Denial of Service and Trojans

Today: Parasitic Attacks

 Internet exploits

 Take advantage of unwitting accomplices

 All Internet constituents adversely affected

End users

Loss of data

Downtime

Service providers Loss of revenue Bad publicity

Software and System Vendors

Bad publicity Increased support burden

Network Attack

Parasitic Hostile Code

Created to Steal

 CPU cycles

 Network bandwidth

 Identity

Many to One:

Stacheldraht & Trinoo DDoS

 Focused on web servers

• Ties up all ‘incoming lines’

 Uses multiple zombie hosts

 Controlled remotely with automated tool

Web Server Requests

Many to Many:

Smurf & Fraggle Denial of Service

 Affects all systems on a network segment

• Ties up all ‘incoming lines’

 Spoofed source packets

 Uses multiple routers as amplifiers

Victims

PC Workstation Email sever

DB Server

Melissa & PrettyPark:

Workstation Email Parasites

 Word Macro Viruses

 Cascading victims

• I attack 50

– Some of which are infected & attack another 50

One to Many:

Spam

 UBE depends upon unwitting relay hosts

 By default, Sendmail accepts relay requests

• No exploit tools required

 No postage required

Parasitic Attacks Need Access

 Provide ONLY the access needed in order to do the job

 Don’t open up too much

 Policy: Least Privilege

Not the possible, just the necessary.

Domain of accessible data and systems

POSSIBLE

Required

How do PCs get infected?

Manual insertion

Through shares Physical access

Demonstration: NuBus Trojan

Part 7: Security Policy

Top Challenge to Resolving Network Security Issues

How to Respond

 New attacks, but same old vulnerabilities

Written Security Policy

 Written security goals and priorities

 Prioritize information security requirements

 NOT implementation specific

 Develop policy before

technical requirements

 If policy isn’t explicit,

it’ll be implicit

Policy Priorities Vary

User Responsibility

 Evaluate security capabilities of suppliers

 Don’t become

‘Attractive Nuisance’

User Risks & Response

Prevent IP spoofing Disable Directed Broadcast Routers used as amplifiers

Control hostile code

Workstations used to mail

hostile code

Harden OS Server hijacked for zombie

Ask ISP for help Web DoS attack

Response Risk

ISP Responsibility

 Privileged Position

 Must provide incident response

 Must protect high-bandwidth hosts

 Jealously guard routing and DNS info

 Be prepared to crank-up router filtering

 Follow GRIP RFCs

• http://www.ietf.org/html.charters/grip-charter.html

ISP Risks and Response

Prevent source IP spoof Disable Directed Broadcast Routers used as amplifiers

No client shell accounts UNIX host used for zombie

Don’t allow IP Spoofing DDoS

Authenticate xfer requests SMTP Host used as relay

Response Risk

How ISPs can Protect Subscribers

 Information

 Router configuration

 Scan e-mail for hostile code

 Provide security software

 Support security standards

• E-mail client authentication

Vendor Responsibility

 Create products that resist compromise

 Provide better access control

 Anticipate security risks

We’re All in this Together

End users

Service Providers

Software and

Network Security

The Purpose of the Security Policy

A security policy:

• Defines an organization’s requirements for correct

computer and network usage

• Includes procedures to detect, prevent, and

respond to security incidents

• Provides a framework for implementing security

plans and procedures

Organization security goals reflect:

• The organization’s concerns

• How the organization values data

• How data is secured

Organization security goals reflect:

• The organization’s concerns

• How the organization values data

• How data is secured

Categorizing Data

Enforcing Security

Conflicting security goals

Banking

Server

Banking Clients Transfer to Savings

X&6y%43hJ3B@2

The Security Plan Process

Set the plan scope Create a project team Develop a plan based on the security policy Test and deploy the plan

Local Office

Defining the Scope of the Security

Plan

Security Plan

Remote Office

Remote User

Internet

Remote Office

Remote User

Internet

Scope

Creating the Project Team

Project Team

Creating the Security Plan

Obtain participant feedback

Test and implement security plan

Project timeline

- All tasks

- Release date

Update security plan

1

2

3 4

Testing and Deploying the Security Plan

Part 8: How to Handle an Attack

When an Attack Occurs

Identify the attack Inform personnel Contain the attack Identify defensive strategies

 Review event logs

 Review variations from the baseline performance

 Use Intrusion Detection Systems

Identifying the Type of Attack

 Research security resource to gather

Informing Organization Personnel

 Notify all personnel of the attack by:

Containing the Effects of the Attack

Shut down affected servers Remove affected computers from network

Remove network from the Internet

Prevents further exposure from the Internet Prevents your organization from infecting others

Remove network from the InternetPrevents further exposure from the Internet Prevents your organization from infecting others

Preserve the evidence

Identify Strategies to Defend Against Attacks

 External attacks

and the private network

 Internal attacks

clean backup

Implementing Preventative

Measures

Maintaining service pack versions

Test and install latest service packs and hotfixes

Maintaining service pack versions

Test and install latest service packs and hotfixes

Running intrusion detection systems

Network perimeter and local

Running intrusion detection systems

Network perimeter and local

Reviewing event logs regularly

For example, account logon events

Reviewing event logs regularly

For example, account logon events

Collect and record attack details Perform a postmortem meeting Develop an action plan for future attacks

Modify the security policy and security plan

Part 9: Educational Resources

Web Resources

 2600.com

• Hacker magazine that gives a good perspective of the hacker mindset.

 allhack.com

• This Web site features a library and download area Library features readmes on hacking and

learning computer basics for the beginner Download area contains everything from scanners to flooders to crackers to denial of service (DoS) attacks.

Thank You

 Feedback Survey