COEN 250 Security Threats Network Based Exploits Phases

COEN 250 Security Threats

Network Based Exploits Phases of an Attack Reconnaissance n Scanning n Gaining Access n Expanding Access n Covering Tracks n

Reconnaissance n Social Engineering ¨ “I cannot access my email. What do I do? ” ¨ Dumpster Diving (especially useful when people move) n Search the Web ¨ Sam Spade (www. samspade. org/ssw/), Cyber. Kit, Net. Scan. Tools, . . . ¨ Search Engine ¨ Usenet postings ¨ Whois

Reconnaissance Databases n To research. com , . net, and. org domain names: Inter. NIC whois feature: www. internic. net/whois. html allwhois, network soultions, . . . n ARIN: American Registry for Interent Numbers (www. arin. net/whoiis/arin-whois. html) n RIPE (Europe) www. ripe. net n APNIC (Asia Pacific) www. apnic. net

Reconnaissance: Scanning Once we have a target, we need to get to know it better. Methods: n War Dialing (to find out modem access) n Network Mapping n Vulnerability Scanning n War Driving

Scanning: War Dialing Purpose: Find a modem connection. n Many users in a company install remote PC software such as PCAnywhere without setting the software up correctly. n War Dialer finds these numbers by going through a range of phone numbers listening for a modem. n Demon Dialer tries a brute force password attack on a found connection. n Typically: war dialing will find an unsecured connection.

Scanning: Network Mapping Ping: n ping is implemented using the Internet Control Message Protocol (ICMP) Echo Request. n A receiving station answers back to the sender. n Used by system administrators to check status of machines and connections.

Scanning: Network Mapping Traceroute: n Pings a system with ICMP echo requests with varying life spans (= # of hops allowed). n A system that receives a package with expired numbers of hops sends an error message back to sender. n Traceroute uses this to find the route to a given system. n Useful for System Administration

Scanning: Network Mapping Cheops: Network Scanner (UNIX based) (Uses traceroute and other tools to map a network. ) Cheops et Co. are the reason that firewalls intercept pings.

Reconnaissance: Port Scans Applications on a system use ports to listen for network traffic or send it out. n 216 ports available, some for known services such as http (80), ftp, . . . n Port scans send various type of IP packages to target on different ports. n Reaction tells them whether the port is open (an application listens). n

Reconnaissance: Nmap Uses different types of packets to check for open ports. n Can tell from the reaction what OS is running, including patch levels. n Can run in stealth mode, in which it is not detected by many firewalls. n

Reconnaissance: Webserver Information Leakage n Most webservers leak information: ¨ HTTP n answers Identify webserver ¨ URLs n Have forms peculiar to certain webservers: ¨ Extensions: § ASP pages: Probably IIS § ¨ “http: //search. barnesandnoble. com/booksearch/results. asp? WRD=Oxford+history&z=y&cds 2 Pid=9481” § “htm”: Probably windows Format of query string ¨ Cookies

Reconnaissance: Webserver Information Leakage n Most webservers leak information: ¨ Error Messages Identify webserver technology by name and version number. n Sometimes send debug information to browser. n Can be provoked by changing query strings or asking for non-existing resources. n ¨ Sometimes, possible to get a message from the database engine.

Reconnaissance Prevention n Firewalls can make it very difficult to scan from the outside. ¨ Drop scan packets. Patched OS do not have idiosyncratic behavior that allows OS determination. n IDS can detect internal scans and warn against them. n

Gaining Access Gain access using application and OS attacks. n Gain access using network attack. n

Gaining Access through Apps and OS n Buffer Overflow Attacks ¨ Stack ¨ Heap n n n Dynamic Memory Attacks Format Vulnerabilities Integer Overflow … Password Attacks Web Application Attacks n Trends: ¨ Modularized super-tools ¨ The Metasploit Project n n n multiple attacks multiple payloads easily updated

Gaining Access: Web Application Attacks n The URL not only contains the web address of a site, but also input: http: //www. google. com/search? hl=en&ie=UTF-8&oe=UTF 8&q=web+application+attack n A poorly written webpage allows the viewer to input data in an uncontrolled fashion. If the webpage contains SQL, the user might execute SQL commands.

Gaining Access through Network Attacks: Sniffing Sniffer: Gathers traffic from a LAN. n Examples: Snort www. snort. org, Sniffit reptile. rug. ac. be/~coder/sniffit. html n To gain access to packages, use spoofed ARP (Address Resolution Protocol) to reroute traffic. n

Gaining Access: Session Hijacking IP Address Spoofing: Send out IP packages with false IP addresses. n If an attacker sits on a link through which traffic between two sites flows, the attacker can inject spoofed packages to “hijack the session”. n Attacker inserts commands into the connection. n Details omitted. n

Exploiting and Maintaining Access After successful intrusion, an attacker should: n Use other tools to gain root or administrator privileges. n Erase traces (e. g. change log entries). n Take measures to maintain access. n Erase security holes so that no-one else can gain illicit access and do something stupid to wake up the sys. ad.

Maintaining Access: Trojans n A program with an additional, evil payload. ¨ Running MS Word also reinstalls a backdoor. ¨ ps does not display the installed sniffer.

Maintaining Access: Backdoors Bypass normal security measures. Example: netcat n Install netcat on victim with the GAPING_SECURITY_HOLE option. C: nc -1 –p 12345 –e cmd. sh n In the future: connect to port 12345 and start typing commands. n

Maintaining Access: Backdoors BO 2 K (Back Orifice 2000) runs in stealth mode (you cannot discover it by looking at the processes tab in the TASK MANAGER. n Otherwise, it is a remote control program like pc. Any. Where, that allows accessing a computer over the net. n

Maintaining Access: Backdoors n Root. Kit: A backdoor built as a Trojan of system executables such as ipconfig. n Kernel-Level Root. Kit: Changes the OS, not only system executables.

Covering Tracks: Altering logs. n Create difficult to find files and directories. n Covert Channels through Networks: n ¨ Loki uses ICMP messages as the carrier. ¨ Use WWW traffic. ¨ Use unused fields in TCP/IP headers.

Hacker Damage n n Releasing Information Releasing Software ¨ By circumventing copying protection. ¨ Through IP theft n n Consuming Unused(? ) Resources Discover and Document Vulnerabilities Compromise Systems and Increase their Vulnerabilities Website Vandalism

Hacking Profile Shift to for-profit motiv n Shift to underground economy n