Once you've downloaded an ISO Image you can mount it as a loopback device. This will give you access to the files in the ISO without you having to burn it to a CDROM first. In order to do this you must have loopback compiled into your Linux Kernel. (Most newer distributions will have this enabled by default). For example if you wanted to mount filename.iso to /mnt/iso you would run the following command: mount -o loop -t iso9660 filename.iso /mnt/iso
Saturday, April 14, 2012
RainbowCrack
Introduction
RainbowCrack is a general propose implementation of Philippe Oechslin's faster time-memory trade-off technique. Function of this software is to crack hash.The straightforward way to crack hash is brute force. In brute force approach, all candidate plaintexts and corresponding hashes are computed one by one. The computed hashes are compared with the target hash. If one of them matches, the plaintext is found. Otherwise the process continues until finish searching all candidate plaintexts.
In time-memory tradeoff approach, the task of hash computing is done in advance with the results stored in files called "rainbow table". After that, hashes can be looked up from the rainbow tables whenever needed. The pre-computation process needs several times the effort of full key space brute force. But once the one time pre-computation is complete, the table lookup performance can be hundreds or thousands times faster than brute force.
This document explains the steps to make the RainbowCrack software working for first time user. Most contents in this document are implementation specific, while others are generic to time-memory tradeoff algorithm.
The RainbowCrack software includes three tools that must be used in sequence to make things working.
Step 1: Use rtgen program to generate rainbow tables.
Step 2: Use rtsort program to sort rainbow tables generated by rtgen.
Step 3: Use rcrack program to lookup rainbow tables sorted by rtsort.
The table lookup process in final step is equivalent to the hash cracking process.
The way to use these programs will be explained in this document. All of them are command line programs.
Step 1: Use rtgen program to generate rainbow tables
The rtgen program need several parameters to generate a rainbow table, the syntax of the command line is:rtgen hash_algorithm charset plaintext_len_min plaintext_len_max table_index chain_len chain_num part_index
Explanation of these parameters:
| parameter | meaning |
| hash_algorithm | The hash algorithm (lm, ntlm, md5 and so on) used in the rainbow table. |
| charset | The charset of all plaintexts in the rainbow table. All possible charset are defined in the charset.txt file. |
| plaintext_len_min plaintext_len_max | These two parameters define the possible length of all plaintexts in the rainbow table. If charset is numeric, plaintext_len_min is 1, and plaintext_len_max is 5. Then the plaintext "12345" is likely included in the table, but "123456" will not be included. |
| table_index chain_len chain_num part_index | These four parameters are really difficult to explain in simple words. To read and understand Philippe Oechslin's original paper can help to know the exact meaning. The table_index is related to the "reduce function" that is used in rainbow table. The chain_len is the length of each "rainbow chain" in the rainbow table. A "rainbow chain" sized 16 bytes is the smallest unit in a rainbow table. A rainbow table contains lots of rainbow chains. The chain_num is the number of rainbow chains in the rainbow table. The part_index parameter determines how the "start point" in each rainbow chain is generated. It must be a number (or begin with a number) in RainbowCrack 1.3 & 1.4. In RainbowCrack 1.2, this parameter can be any string because random "start point" is used, while 1.3 & 1.4 use the sequential "start point". |
The right values of all the parameters depend on what you need, to select good parameters require some understanding of the time-memory tradeoff algorithm.
One ready to work configuration is given below, as an example:
| hash_algorithm | lm, ntlm or md5 |
| charset | alpha-numeric = [ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789] or loweralpha-numeric = [abcdefghijklmnopqrstuvwxyz0123456789] |
| plaintext_len_min | 1 |
| plaintext_len_max | 7 |
| chain_len | 3800 |
| chain_num | 33554432 |
| key space | 36^1 + 36^2 + 36^3 + 36^4 + 36^5 + 36^6 + 36^7 = 80603140212 key space is the number of possible plaintexts for the charset, plaintext_len_min and plaintext_len_max selected. |
| table size | 3 GB |
| success rate | 0.999 The time-memory tradeoff algorithm is a probabilistic algorithm. Whatever the parameters are selected, there is always probability that the plaintext within the selected charset and plaintext length range is not covered. The success rate is 99.9% with the parameters used in this example. |
| table generation commands | The actual rtgen commands used to generate the rainbow tables are: rtgen md5 loweralpha-numeric 1 7 0 3800 33554432 0 rtgen md5 loweralpha-numeric 1 7 1 3800 33554432 0 rtgen md5 loweralpha-numeric 1 7 2 3800 33554432 0 rtgen md5 loweralpha-numeric 1 7 3 3800 33554432 0 rtgen md5 loweralpha-numeric 1 7 4 3800 33554432 0 rtgen md5 loweralpha-numeric 1 7 5 3800 33554432 0 If ntlm or lm table is desired, replace "md5" in commands above with "ntlm" or "lm". If alpha-numeric charset is desired, replace "loweralpha-numeric" in commands above with "alpha-numeric". If lm table is to be generated, please CONFIRM the charset is alpha-numeric instead of loweralpha-numeric. The lm algorithm NEVER uses lowercase letters as plaintext. |
Now it is time to generate rainbow table.
Change the current directory of your command prompt to RainbowCrack's directory, and execute following command:
| rtgen md5 loweralpha-numeric 1 7 0 3800 33554432 0 |
This command takes about 4 hours to complete on Core2 Duo E7300 processor. It is safe to stop the computation any time by pressing Ctrl+C. Next time if the rtgen program is executed with exactly same command line parameters, it will resume from where the computation is stopped and continue the table generation.
When the command is finished, a file named "md5_loweralpha-numeric#1-7_0_3800x33554432_0.rt" sized 512 MB will be in place. The file name is simply all the command line parameters connected, with the "rt" extension. The rcrack program to be explained later need this piece of information to know parameters of the rainbow table. So don't rename the file.
Remaining tables can be generated in same way with commands:
| rtgen md5 loweralpha-numeric 1 7 1 3800 33554432 0 rtgen md5 loweralpha-numeric 1 7 2 3800 33554432 0 rtgen md5 loweralpha-numeric 1 7 3 3800 33554432 0 rtgen md5 loweralpha-numeric 1 7 4 3800 33554432 0 rtgen md5 loweralpha-numeric 1 7 5 3800 33554432 0 |
Finally, these files are generated:
md5_loweralpha-numeric#1-7_0_3800x33554432_0.rt 512MB
md5_loweralpha-numeric#1-7_1_3800x33554432_0.rt 512MB
md5_loweralpha-numeric#1-7_2_3800x33554432_0.rt 512MB
md5_loweralpha-numeric#1-7_3_3800x33554432_0.rt 512MB
md5_loweralpha-numeric#1-7_4_3800x33554432_0.rt 512MB
md5_loweralpha-numeric#1-7_5_3800x33554432_0.rt 512MB
Now the rainbow table generation process complete.
Step 2: Use rtsort program to sort rainbow tables
The rainbow tables generated by rtgen program need some post processing to make table lookup easier. The rtsort program is used to sort the "end point" of all rainbow chains in a rainbow table.Use following commands:
| rtsort md5_loweralpha-numeric#1-7_0_3800x33554432_0.rt rtsort md5_loweralpha-numeric#1-7_1_3800x33554432_0.rt rtsort md5_loweralpha-numeric#1-7_2_3800x33554432_0.rt rtsort md5_loweralpha-numeric#1-7_3_3800x33554432_0.rt rtsort md5_loweralpha-numeric#1-7_4_3800x33554432_0.rt rtsort md5_loweralpha-numeric#1-7_5_3800x33554432_0.rt |
Each command above takes about 1 to 2 minutes to complete. The rtsort program will write the sorted rainbow table to the original file.
Don't interrupt the rtsort program; otherwise the rainbow table being sorted will be damaged.
If the free memory size of your system is smaller than the size of the rainbow table being sorted, temporary hard disk space as large as the rainbow table size will be needed to store intermediate data.
Now the rainbow table sorting process complete.
Step 3: Use rcrack program to lookup rainbow tables
The rcrack program is used to lookup the rainbow tables. It only accepts sorted rainbow tables.Assume the sorted rainbow tables are placed in c:\rt directory, to crack single hash the command line will be:
| rcrack c:\rt\*.rt -h your_hash_comes_here |
The first parameter specifies the path to the rainbow tables to lookup. The "*" and "?" character can be used to specify multiple files.
Normally it takes seconds or tens of seconds to finish, if the plaintext is within the selected charset and plaintext length range. Otherwise, it takes much longer time to search all the tables only to find nothing.
To crack multiple hashes, place all the hashes in a text file with each hash in a line. And then specify file name in rcrack command line:
| rcrack c:\rt\*.rt -l hash_list_file |
If the rainbow tables you generate use lm algorithm, the rcrack program has special support for it with the "-f" command switch. A hash dump file in pwdump format is required as input to rcrack program. The file will looks like this:
Administrator:500:1c3a2b6d939a1021aad3b435b51404ee:e24106942bf38bcf57a6a4b29016eff6:::
Guest:501:a296c9e4267e9ba9aad3b435b51404ee:9d978dda95e5185bbeda9b3ae00f84b4:::
The pwdump file is the output of pwdump2, pwdump3 or other utilities. It contains both the lm hash and the ntlm hash.
To crack lm hashes in pwdump file, use following command:
| rcrack c:\rt\*.rt -f pwdump_file |
The lm hash algorithm converts all lowercase letters in plaintext to uppercase; as a result all the plaintexts cracked via the lm hash never contain lowercase letters, while the actual plaintext may contain lowercase letters. The rcrack program will try to do case correction with the ntlm hashes stored in same file and output the original plaintext.
Defense against rainbow tables
A rainbow table is ineffective against one-way hashes that include salts. For example, consider a password hash that is generated using the following function (where "." is the concatenation operator):hash = MD5 (password . salt)
Or
hash = MD5 (MD5 (password) . salt)
The salt value is not secret and may be generated at random and stored with the password hash. A large salt value prevents precomputation attacks, including rainbow tables, by ensuring that each user's password is hashed uniquely. This means that two users with the same password will have different password hashes (assuming different salts are used). In order to succeed, an attacker needs to precompute tables for each possible salt value. Even for older Unix passwords, which used a 12-bit salt, this would be improbable. The MD5-crypt and bcrypt methods—used in Linux, BSD Unixes, and Solaris—have salts of 48 and 128 bits, respectively.[3] These larger salt values make precomputation attacks for almost any length of password infeasible against these systems for the foreseeable future.
Another technique that helps prevent precomputation attacks is key strengthening (also called key stretching). When stretching is used, the salt, password, and a number of intermediate hash values are run through the underlying hash function multiple times to increase the computation time required to hash each password[4]. For instance, MD5-Crypt uses a 1000 iteration loop that repeatedly feeds the salt, password, and current intermediate hash value back into the underlying MD5 hash function.[3] The user's password hash is the concatenation of the salt value (which is not secret) and the final hash. The extra time is not noticeable to a user because he only has to wait a fraction of a second each time he logs in. On the other hand, stretching greatly reduces the effectiveness of a brute-force or precomputation attacks because it reduces the number of computations an attacker can perform in a given time frame. This principle is applied in MD5-Crypt and in bcrypt.[5]
Also, rainbow tables and other precomputation attacks do not work against passwords that contain symbols outside the range presupposed, or that are longer than those precomputed by the attacker. Because of the sizable investment in computing processing, rainbow tables beyond fourteen places in length are not yet common. So, choosing a password that is longer than fourteen characters or that contains non-alphanumeric symbols may force an attacker to resort to brute-force methods.
Nearly all distributions and variations of Unix, Linux, and BSD use hashes with salts, though many applications use just a hash (typically MD5) with no salt. The Windows NT/2000 family uses the LAN Manager and NT LAN Manager hashing method and is also unsalted, which makes it one of the more popularly generated tables.
Virus Worms Trojans
What is a Virus ?
Recognized types of viruses
Boot Sector,Polymorphic(change form each time its executed),Stealth(uses techniques to avoid detection),Macro(infects MS office docs),
Program(infects executable files),Multipartite(hybrid of boot and Program)
Spyware
======
Undesirable code that comes with commercial software distributions.
A computer virus is a small program written to alter the way a computer operates, without the permission or knowledge of the user. A virus must meet two criteria:
|
Recognized types of viruses
Boot Sector,Polymorphic(change form each time its executed),Stealth(uses techniques to avoid detection),Macro(infects MS office docs),
Program(infects executable files),Multipartite(hybrid of boot and Program)
| File infector viruses | File infector viruses infect program files. These viruses normally infect executable code, such as .com and .exe files. The can infect other files when an infected program is run from floppy, hard drive, or from the network. Many of these viruses are memory resident. After memory becomes infected, any noninfected executable that runs becomes infected. Examples of known file infector viruses include Jerusalem and Cascade. |
| Boot sector viruses | Boot sector viruses infect the system area of a disk; that is, the boot record on floppy disks and hard disks. All floppy disks and hard disks (including disks containing only data) contain a small program in the boot record that is run when the computer starts up. Boot sector viruses attach themselves to this part of the disk and activate when the user attempts to start up from the infected disk. These viruses are always memory resident in nature. Most were written for DOS, but, all PCs, regardless of the operating system, are potential targets of this type of virus. All that is required to become infected is to attempt to start up your computer with an infected floppy disk Thereafter, while the virus remains in memory, all floppy disks that are not write protected will become infected when the floppy disk is accessed. Examples of boot sector viruses are Form, Disk Killer, Michelangelo, and Stoned. |
| Master boot record viruses | Master boot record viruses are memory-resident viruses that infect disks in the same manner as boot sector viruses. The difference between these two virus types is where the viral code is located. Master boot record infectors normally save a legitimate copy of the master boot record in an different location. Windows NT computers that become infected by either boot sector viruses or master boot sector viruses will not boot. This is due to the difference in how the operating system accesses its boot information, as compared to Windows 98/Me. If your Windows NT systems is formatted with FAT partitions you can usually remove the virus by booting to DOS and using antivirus software. If the boot partition is NTFS, the system must be recovered by using the three Windows NT Setup disks. Examples of master boot record infectors are NYB, AntiExe, and Unashamed. |
| Multipartite viruses | Multipartite (also known as polypartite) viruses infect both boot records and program files. These are particularly difficult to repair. If the boot area is cleaned, but the files are not, the boot area will be reinfected. The same holds true for cleaning infected files. If the virus is not removed from the boot area, any files that you have cleaned will be reinfected. Examples of multipartite viruses include One_Half, Emperor, Anthrax and Tequilla. |
| Macro viruses | These types of viruses infect data files. They are the most common and have cost corporations the most money and time trying to repair. With the advent of Visual Basic in Microsoft's Office 97, a macro virus can be written that not only infects data files, but also can infect other files as well. Macro viruses infect Microsoft Office Word, Excel, PowerPoint and Access files. Newer strains are now turning up in other programs as well. All of these viruses use another program's internal programming language, which was created to allow users to automate certain tasks within that program. Because of the ease with which these viruses can be created, there are now thousands of them in circulation. Examples of macro viruses include W97M.Melissa, WM.NiceDay and W97M.Groov. |
| What is a Trojan horse? | |||
| Trojan horses are impostors—files that claim to be something desirable but, in fact, are malicious. A very important distinction between Trojan horse programs and true viruses is that they do not replicate themselves. Trojan horses contain malicious code that when triggered cause loss, or even theft, of data. For a Trojan horse to spread, you must invite these programs onto your computers; for example, by opening an email attachment or downloading and running a file from the Internet. Trojan.Vundo is a Trojan horse. Its ability to spread depends on popularity of software and willingness of user to downaload and install it from internet. |
| What is a worm?-->Same as Virus except that it replicates by itself without user interaction. | |||
| Worms are programs that replicate themselves from system to system without the use of a host file. This is in contrast to viruses, which requires the spreading of an infected host file. Although worms generally exist inside of other files, often Word or Excel documents, there is a difference between how worms and viruses use the host file. Usually the worm will release a document that already has the "worm" macro inside the document. The entire document will travel from computer to computer, so the entire document should be considered the worm W32.Mydoom.AX@mm is an example of a worm. It takes advantage of security hole in applications/OS and then find other systems running similar applications/OS to replicate it.Its spreads by using email,file sharing(P2P),IM(Instant Messaging),IRC channels |
| What is a virus hoax? | |||
Virus hoaxes are messages, almost always sent by email, that amount to little more than chain letters. Following are some of the common phrases that are used in these hoaxes:
|
Spyware
======
Undesirable code that comes with commercial software distributions.
Denial of Service
DoS(Denial of Service) :
It is an attack through which a person can render a system unusable unusable, or significantly slow it down for legitimate users, by overloading its resources.
Attempt to flood a network, thereby preventing legitimate network traffic
Attempt to disrupt connections between two machines, thereby preventing access to a service
Attempt to prevent a particular individual/system from accessing a service.
Distributed Denial of Service (DDoS) :
one in which a multitude of compromised systems attack a single target.
The Impact: Disabled network,Disabled organization,Financial loss,Loss of goodwill.
The Modes: Consumption of Scarce, limited, or non-renewable resources such as Network bandwidth, memory, disk space,CPU time,data structures,certain environmental resources such as power, cool air, or even water ; Destruction or Alteration of Configuration Information ; Physical destruction or alteration of network components, resources such as power, cool air, or even water.
Smurf Attack : The attacker generates a large amount of ICMP echo (ping) traffic to a network broadcast address with a spoofed source IP set to a victim host.The result will be lots of ping replies (ICMP Echo Reply) flooding the spoofed host.
Buffer Overflow Attack : Buffer overflow occurs any time the program writes more information into the buffer than the space allocated in the memory.The attacker can overwrite the data that controls the program execution path and hijack the control of the program to execute the attacker’s code instead of the process code. Sending email messages that have attachments with 256-character file names can cause buffer overflow.
There are two main types of buffer overflow attacks: stack based and heap based. Heap-based attacks flood the memory space reserved for a program, but the difficulty involved with performing such an attack makes them rare. Stack-based buffer overflows are by far the most common.
In a stack-based buffer overrun, the program being exploited uses a memory object known as a stack to store user input. Normally, the stack is empty until the program requires user input. At that point, the program writes a return memory address to the stack and then the user's input is placed on top of it. When the stack is processed, the user's input gets sent to the return address specified by the program.
However, a stack does not have an infinite potential size. The programmer who develops the code must reserve a specific amount of space for the stack. If the user's input is longer than the amount of space reserved for it within the stack, then the stack will overflow. This in itself isn't a huge problem, but it becomes a huge security hole when combined with malicious input.
For example, suppose a program is waiting for a user to enter his or her name. Rather than enter the name, the hacker would enter an executable command that exceeds the stack size. The command is usually something short. In a Linux environment, for instance, the command is typically EXEC("sh"), which tells the system to open a command prompt window, known as a root shell in Linux circles.
Yet overflowing the buffer with an executable command doesn't mean that the command will be executed. The attacker must then specify a return address that points to the malicious command. The program partially crashes because the stack overflowed. It then tries to recover by going to the return address, but the return address has been changed to point to the command specified by the hacker. Of course this means that the hacker must know the address where the malicious command will reside. To get around needing the actual address, the malicious command is often padded on both sides by NOP instructions, a type of pointer. Padding on both sides is a technique used when the exact memory range is unknown. Therefore, if the address the hacker specifies falls anywhere within the padding, the malicious command will be executed.
The last part of the equation is the executable program's permissions. As you know, most modern operating systems have some sort of mechanism to control the access level of the user who's currently logged on and executable programs typically require a higher level of permissions. These programs therefore run either in kernel mode or with permissions inherited from a service account. When a stack-overflow attack runs the command found at the new return address, the program thinks it is still running. This means that the command prompt window that has been opened is running with the same set of permissions as the application that was compromised. Generally speaking, this often means that the attacker will gain full control of the operating system.
Ping of Death Attack : Fragmentation allows a single IP packet to be broken down into smaller segments.The fragments can add up to more than the allowed 65,536 bytes. The operating system, unable to handle oversized packets freezes, reboots, or simply crashes.
Teardrop Attack : IP requires that a packet that is too large for the next router to handle should be divided into fragments
The attacker's IP puts a confusing offset value in the second or later fragment.If the receiving operating system is not able to aggregate the packets accordingly, it can crash the system .It is a UDP attack, which uses overlapping offset fields to bring down hosts
The Unnamed Attack : Variation of the Teardrop attack .Fragments are not overlapping but gaps are incorporated
SYN Attack : The attacker sends bogus TCP SYN requests to a victim server. The host allocates resources (memory sockets) to
the connection.Prevents the server from responding to the legitimate requests.This attack exploits the three-way handshake.Malicious flooding by large volumes of TCP SYN packets to the victim’s system with spoofed source IP addresses can cause DoS
Initially, after receiving a connection request (a packet with SYN flag set), a victim host puts this half-open connection to the backlog queue and sends out the first response (a packet with SYN and ACK flags set). When the victim does not receive a response from a remote host, it tries to retransmit this SYN+ACK packet until it times out, and then finally removes this half-open connection from the backlog queue. In some operating systems this process for a single SYN request can take about 3 minutes!. The other important information you need to know is that the operating system can handle only a defined amount of half-open connections in the backlog queue. This amount is controlled by the size of the backlog queue. For instance, the default backlog size is 256 for RedHat 7.3 and 100 for Windows 2000 Professional. When this size is reached, the system will no longer accept incoming connection requests.
SYN Flooding : A malicious host can exploit the small size of the listen queue by sending multiple SYN requests to a host, but never replying to the SYN&ACK
DoS Attack Tools :
Jolt2 :denial of service attack against Windows-based machines,consume 100% of the CPU time on processing the illegal packets.Cisco routers
and other gateways may be vulnerable
Bubonic.c : against Windows 2000.It works by randomly sending TCP packets with random settings with the goal of increasing the load of the machine, so that it eventually crashes.
Land and LaTierra : IP spoofing in combination with the opening of a TCP connection.Both IP addresses, source, and destination, are modified to
be the same—the address of the destination host.This results in sending the packet back to itself, because the addresses are the same
Targa : eight different DoS attacks.It integrates bonk, jolt, land, nestea, netear, syndrop, teardrop, and winnuke into one multi-platform DoS attack
Blast : small, quick TCP service stress test tool that does a large amount of work quickly and can spot potential weaknesses in your network servers
Nemesy : generates random packets (protocol,port,etc)
Panther2 : UDP-based attack is designed for 28.8-56k connection.Comes under flooder ( overloads a connection by any mechanism, such as fast pinging, causing a DoS attack).
Crazy Pinger : send large packets of ICMP to a remote target network.
SomeTrouble :remote flooder.3 remote functions: Mail Bomb (Self Resolve for Smtp),Icq Bomb,Net Send Flood.
ICQ ( homophone for the phrase "I seek you") is a popular instant messaging computer program, which was first developed by the Israeli company Mirabilis, now owned by AOL.
Net send ,command in Windows Sends messages to other users, computers, or messaging names on the network.
UDP Flood : sends out UDP packets to the specified IP and port at a controllable rate.Packets can be made from a typed text string; a given number of random bytes or data from a file.
FSMax : A scriptable, server stress testing tool .It takes a text file as input and runs a server through a series of tests based on the input.The purpose of this tool is to find buffer overflows of DOS points in a server.
It is an attack through which a person can render a system unusable unusable, or significantly slow it down for legitimate users, by overloading its resources.
Attempt to flood a network, thereby preventing legitimate network traffic
Attempt to disrupt connections between two machines, thereby preventing access to a service
Attempt to prevent a particular individual/system from accessing a service.
Distributed Denial of Service (DDoS) :
one in which a multitude of compromised systems attack a single target.
The Impact: Disabled network,Disabled organization,Financial loss,Loss of goodwill.
The Modes: Consumption of Scarce, limited, or non-renewable resources such as Network bandwidth, memory, disk space,CPU time,data structures,certain environmental resources such as power, cool air, or even water ; Destruction or Alteration of Configuration Information ; Physical destruction or alteration of network components, resources such as power, cool air, or even water.
Smurf Attack : The attacker generates a large amount of ICMP echo (ping) traffic to a network broadcast address with a spoofed source IP set to a victim host.The result will be lots of ping replies (ICMP Echo Reply) flooding the spoofed host.
Buffer Overflow Attack : Buffer overflow occurs any time the program writes more information into the buffer than the space allocated in the memory.The attacker can overwrite the data that controls the program execution path and hijack the control of the program to execute the attacker’s code instead of the process code. Sending email messages that have attachments with 256-character file names can cause buffer overflow.
There are two main types of buffer overflow attacks: stack based and heap based. Heap-based attacks flood the memory space reserved for a program, but the difficulty involved with performing such an attack makes them rare. Stack-based buffer overflows are by far the most common.
In a stack-based buffer overrun, the program being exploited uses a memory object known as a stack to store user input. Normally, the stack is empty until the program requires user input. At that point, the program writes a return memory address to the stack and then the user's input is placed on top of it. When the stack is processed, the user's input gets sent to the return address specified by the program.
However, a stack does not have an infinite potential size. The programmer who develops the code must reserve a specific amount of space for the stack. If the user's input is longer than the amount of space reserved for it within the stack, then the stack will overflow. This in itself isn't a huge problem, but it becomes a huge security hole when combined with malicious input.
For example, suppose a program is waiting for a user to enter his or her name. Rather than enter the name, the hacker would enter an executable command that exceeds the stack size. The command is usually something short. In a Linux environment, for instance, the command is typically EXEC("sh"), which tells the system to open a command prompt window, known as a root shell in Linux circles.
Yet overflowing the buffer with an executable command doesn't mean that the command will be executed. The attacker must then specify a return address that points to the malicious command. The program partially crashes because the stack overflowed. It then tries to recover by going to the return address, but the return address has been changed to point to the command specified by the hacker. Of course this means that the hacker must know the address where the malicious command will reside. To get around needing the actual address, the malicious command is often padded on both sides by NOP instructions, a type of pointer. Padding on both sides is a technique used when the exact memory range is unknown. Therefore, if the address the hacker specifies falls anywhere within the padding, the malicious command will be executed.
The last part of the equation is the executable program's permissions. As you know, most modern operating systems have some sort of mechanism to control the access level of the user who's currently logged on and executable programs typically require a higher level of permissions. These programs therefore run either in kernel mode or with permissions inherited from a service account. When a stack-overflow attack runs the command found at the new return address, the program thinks it is still running. This means that the command prompt window that has been opened is running with the same set of permissions as the application that was compromised. Generally speaking, this often means that the attacker will gain full control of the operating system.
Ping of Death Attack : Fragmentation allows a single IP packet to be broken down into smaller segments.The fragments can add up to more than the allowed 65,536 bytes. The operating system, unable to handle oversized packets freezes, reboots, or simply crashes.
Teardrop Attack : IP requires that a packet that is too large for the next router to handle should be divided into fragments
The attacker's IP puts a confusing offset value in the second or later fragment.If the receiving operating system is not able to aggregate the packets accordingly, it can crash the system .It is a UDP attack, which uses overlapping offset fields to bring down hosts
The Unnamed Attack : Variation of the Teardrop attack .Fragments are not overlapping but gaps are incorporated
SYN Attack : The attacker sends bogus TCP SYN requests to a victim server. The host allocates resources (memory sockets) to
the connection.Prevents the server from responding to the legitimate requests.This attack exploits the three-way handshake.Malicious flooding by large volumes of TCP SYN packets to the victim’s system with spoofed source IP addresses can cause DoS
Initially, after receiving a connection request (a packet with SYN flag set), a victim host puts this half-open connection to the backlog queue and sends out the first response (a packet with SYN and ACK flags set). When the victim does not receive a response from a remote host, it tries to retransmit this SYN+ACK packet until it times out, and then finally removes this half-open connection from the backlog queue. In some operating systems this process for a single SYN request can take about 3 minutes!. The other important information you need to know is that the operating system can handle only a defined amount of half-open connections in the backlog queue. This amount is controlled by the size of the backlog queue. For instance, the default backlog size is 256 for RedHat 7.3 and 100 for Windows 2000 Professional. When this size is reached, the system will no longer accept incoming connection requests.
SYN Flooding : A malicious host can exploit the small size of the listen queue by sending multiple SYN requests to a host, but never replying to the SYN&ACK
DoS Attack Tools :
Jolt2 :denial of service attack against Windows-based machines,consume 100% of the CPU time on processing the illegal packets.Cisco routers
and other gateways may be vulnerable
Bubonic.c : against Windows 2000.It works by randomly sending TCP packets with random settings with the goal of increasing the load of the machine, so that it eventually crashes.
Land and LaTierra : IP spoofing in combination with the opening of a TCP connection.Both IP addresses, source, and destination, are modified to
be the same—the address of the destination host.This results in sending the packet back to itself, because the addresses are the same
Targa : eight different DoS attacks.It integrates bonk, jolt, land, nestea, netear, syndrop, teardrop, and winnuke into one multi-platform DoS attack
Blast : small, quick TCP service stress test tool that does a large amount of work quickly and can spot potential weaknesses in your network servers
Nemesy : generates random packets (protocol,port,etc)
Panther2 : UDP-based attack is designed for 28.8-56k connection.Comes under flooder ( overloads a connection by any mechanism, such as fast pinging, causing a DoS attack).
Crazy Pinger : send large packets of ICMP to a remote target network.
SomeTrouble :remote flooder.3 remote functions: Mail Bomb (Self Resolve for Smtp),Icq Bomb,Net Send Flood.
ICQ ( homophone for the phrase "I seek you") is a popular instant messaging computer program, which was first developed by the Israeli company Mirabilis, now owned by AOL.
Net send ,command in Windows Sends messages to other users, computers, or messaging names on the network.
UDP Flood : sends out UDP packets to the specified IP and port at a controllable rate.Packets can be made from a typed text string; a given number of random bytes or data from a file.
FSMax : A scriptable, server stress testing tool .It takes a text file as input and runs a server through a series of tests based on the input.The purpose of this tool is to find buffer overflows of DOS points in a server.
Proxy servers
Proxy servers : a server, which acts as an intermediary between internal users and external host
The proxy server takes requests from a user and then performs those requests on behalf of the user. To the external system, the request looks as if it originated from the proxy server, not from the user on the internal network.
To perform NAT functions : A proxy server can process and execute commands on behalf of clients that have private IP addresses. This enables an organization with only one registered IP address to provide Internet access to a large number of computers. This process is known as IP proxy.
To allow Internet access to be controlled : Having a centralized point of access allows for a great deal of control over the use of the Internet. By using the functionality of a proxy server application or by using an add-on feature, proxy servers can filter requests made by clients and either allow or disallow them. You can, for example, implement uniform resource locator (URL) filtering, which allows or denies users access to certain sites. More sophisticated products can also perform tests on retrieved material, to see if it fits acceptable criteria. Such measures are intended to prevent users from accessing inappropriate Internet web pages. As an "after the event" feature, proxy server applications also normally provide logging capabilities so that Internet usage can be monitored.
Caching Proxy Server : Caching enables the proxy server to store pages that it retrieves as files on disk. Consequently, if the same pages are requested again, they can be provided more quickly from the cache than if the proxy server had to continue going back to the Web server.
Increase performance where there is a great likelihood that more than one user might retrieve the same page.
To prevent issue of new page not been updated in the proxy server cache : Aging of cached information is implemented so that it is removed from the cache after a certain amount of time. Some proxy applications can also make sure that the page stored in the cache is the same as the page currently available on the Internet. If the page in the cache is the same as the one on the Internet, it is served to the client from the cache. If the page is not the same, the newer page is retrieved, cached, and supplied to the client.
Anonymizing Proxy Server : generally attempts to anonymize web surfing.
The socks : an IETF (Internet Engineering Task Force ) standard.It is like a proxy system which supports the proxy aware applications.
Internet Content Filtering Techniques
Internet filter is a software that blocks unwanted content such as pornography and group sites.
Filters use a list of keywords and well-known URLs to restrict access.More advanced filters can also block or filter chat rooms,
FilterGate : offers four main Internet filters : PopupFilter,AdFilter,PrivacyFilter,AdultFilter.
instant messages, file downloads, and forums.
Key Features of Internet Filters :
User profiles: Allow you to create a profile for each member of your family.
Reporting: Provides detailed information on what your children have been doing and saying online, including sites visited
Time Limits: You can set limits on when and how long a user may be online
Regular updates: download regular updates to keyword and URL lists.
Compatibility: with browser as well as your operating system used.
Pros and Cons of Internet Filters :
Pros : Prevents children from deliberately or inadvertently accessing pornography.Prevent predators from talking to your children online.Allows kids to surf online without constant parental presence
Cons : Can sometimes filter out “safe” sites, words, and people.May create a false sense of security for parents.Tech-savvy kids may find a way around filters, or may access inappropriate content elsewhere.
Internet Content Filtering Tools
iProtectYou :Block e-mails, chat sessions, instant messages, and P2P connections if they contain inappropriate words. Prevent your private information (credit card number for example) from being sent to the Internet.Set a schedule to specify days and times when on-line activity is allowed. Limit Internet Traffic to a specified amount of data that can be sent or received per user/per day. Control the list of programs that can have access to the Internet.Get notification e-mails with full description of blocked operations and an attached screen-shot of your kids' computer to control them remotely
Block Porn : is an Internet filtering software that can block access to pornographic material and adult web sites as well as any other web site as
needed.The program offers two modes: One that allows access to all web sites, except pornography. Restricted mode that blocks all web browsing, except for the sites that you specifically allow.It include the options such as blocking access to selected folders, restricting program access, locking the IE home page, custom warning messages,network synch, and more.
FilterGate : offers four main Internet filters : PopupFilter,AdFilter,PrivacyFilter,AdultFilter.
Adblock : content filtering plug-in for the Mozilla and Firebird browsers.It allows the user to specify filters, which remove unwanted content based on
the source-address.Adblock supports two types of filters: Simple Filter and Regular Expression.Adblock has no built-in concept of what an ad is. It doesn’t look for blinky gifs or anything like that. Rather, it has a big list of known bad servers. For example, if you’re on the website www.whatever.com and there is an image that comes from "http://www.doubleclick.com/advertisementImages/blinkyAd.gif", Adblock will decide that this is an advertisement and not render that image. It works equally well on images you can’t see, since it makes it decision of whether to show the graphic before Firefox even downloads it.This is why keeping Adblock’s list of known advertising URLs up-to-date is important to its usefulness. If there’s a particular website you visit very often or a particular ad that drives you crazy, it can definitely be worth your while to play with Adblock’s list of blocked URLs and filter rules.
AdSubtract : program that blocks every type of conceivable web advertisements.Pop-Ups and Pop-Unders are blocked.A pop-up window is a new browser window created (launched or opened), either by the user clicking a button/link, or automatically: when a webpage is first viewed (loaded) or is linked away from (unloaded).As pop-up ads became widespread, many users learned to immediately close the popup ads that appeared over a site without looking at them.Pop-under ads do not immediately impede a user's ability to view the site content, and thus usually remain unnoticed until the main browser window is closed, leaving the user's attention free for the advertisement.A pop-under is first opened, then moved behind the content window. The new window is then only visible if the user systematically closes content windows before quitting/closing their browser, or if the content windows do not fill the screen.
Stops multimedia ads.Stops windows messenger pop-up spam[Windows Messenger service listens for connections on port 1026 as well as the more widely-known port 135.Windows Messenger has been a target for spammers because it allows anonymous pop-up messages to be displayed on any Windows system running the messenger service].Distracting animations can be frozen; Web sounds can be silenced.GalaxySpy : GalaxySpy is a program that lets you retake control of your Internet experience.It allows you selectively block ads, adult-content sites, market research, profiling, and tracking.It detects and blocks adware, cookies, hackers, scripts, spyware,viruses, and worms.This program features an optional password for parental control.The Professional Edition lets you log Web sites visited, cookie contents and requested URLS
AdsGone : Blocks unwanted popup ads. Prevents messenger service and web page dialog ads. Blocks banner ads.Kills spyware and adware programs.Blocks ads and Pop-Ups when using Kazaa,Morpheus, Gator, or Chat programs like ICQ, MSN,AIM or Trillian.Blocks Macromedia "Flash" ads
Anti-AD Guard : program that filters and blocks commercial banners from being loaded by browsers.
Anti-PopUp for IE is a small program that automatically stops a sponsor's pop-ups.also has an Internet Eraser capabilities
Pop Up Police is a popup blocker that will keep your Internet surfing experience entertaining
Super Ad Blocker blocks all forms of advertising including Flash, Rich Media,fly-in, slide-in, pop-ups, pop-unders, spyware ads, and messenger ads.
Anti-AD Guard : program that filters and blocks commercial banners from being loaded by browsers.
Net Nanny : controls access to websites and other online content such as Internet-based games, blocks file sharing of music, images and videos, and monitors a user's Internet activity.
CyberSieve is a Internet filtering and parental control software program
BSafe Internet Filter : allows you to monitor your child’s use of Internet.
Stop-the-Pop-Up Lite : kills all pop ups from file sharing programs and the spyware/adware that are bundled with these peer-to-peer programs.It supports Kazaa, Kazaa Lite, Morpheus, Grokster, iMesh, Xolox, and Direct Connect.It kills the new breed of pop-ups called 'Messenger Service spam'.
WebCleaner : program that prevents annoying sponsors PopUp's when you visit some web sites.
AdCleaner : program that blocks floating ads and new form popups.
Adult Photo Blanker : blanks objectionable adult images and movies.It intercepts attempts to open files and checks them for objectionable content.
LiveMark Family enables you to block access to web sites that are inappropriate for children.You can choose from two filtering levels (under 12 or over 12 years old) and also select the topics that should be filtered (pornography, violence etc.).It also includes an option to limit Internet access to certain times of the day.
KDT Site Blocker is an easy to use tool to block access to certain websites.It automatically displays a generic ‘blocked’ page
whenever a blocked site is accessed.
Social Engineering
Social Engineering is the human side of breaking into a corporate network.
Social engineering is the tactic or trick of gaining sensitive information by exploiting the basic human nature such as:
• Trust
• Fear
• Desire to Help
Social engineers attempt to gather information such as:
• Sensitive information
• Authorization details
• Access details
extract sensitive data such as: Security policies,Sensitive documents,Office network infrastructure,Passwords
People are usually the weakest link in the security chain.A successful defense depends on having good policies and educating employees to follow them.Social Engineering is the hardest form of
attack to defend against because it cannot be defended with hardware or software alone.
Social Engineering can be divided into two categories:
•Human-based: Gathers sensitive information by interaction.Attacks of this category exploits trust, fear, and helping nature of humans
Posing as Legitimate End User : Gives identity and asks for the sensitive information.“Hi! This is John, from Department X. I have forgotten my password. Can I get it?”
Posing as an Important User : Posing as a VIP of a target company, valuable customer, etc.“Hi! This is Kevin, CFO Secretary. I’m working on an urgent project and lost system password. Can you help me out?”
Posing as Technical Support : Calls as a technical support staff, and requests id & passwords to retrieve data.‘Sir, this is Mathew, Technical support, X company. Last night we had a system
crash here, and we are checking for the lost data.Can u give me your ID and Password?’
Eavesdropping or unauthorized listening of conversations or reading of messages.Interception of any form such as audio, video, or written
Shoulder Surfing : Looking over your shoulder as you enter a password.Simply, they look over your shoulder--or even watch from a distance using binoculars,in order to get those pieces of information
Dumpster Diving : Search for sensitive information at target company’s: Trash-bins, Printer Trash bins, user desk for sticky notes etc. Collect: Phone Bills, Contact Information, Financial Information, Operations related Information etc
In person : Survey a target company to collect information on Current technologies, Contact information, and so on
Third-party Authorization : Refer to an important person in the organization and try to collect data. “Mr. George, our Finance Manager, asked that I pick up the audit reports. Will you please provide them to me?
Tailgating : An unauthorized person, wearing a fake ID badge, enters a secured area by closely following an authorized person through a door requiring key access
Piggybacking : “I forgot my ID badge at home. Please help me.”. An authorized person provides access to an unauthorized person by keeping the secured door open
Chain letters : Charity Hoaxes - These hoax messages ask you to forward them to all your friends for a good cause.Timothy Flyte (who doesn't exist) has ostriopliosis of the liver (the disease doesn't exist) and asks you to forward this message to all your friends. The National Diesese Society (which doesn't exist) will receive 7 cents for every person the message is forwarded to.Useless Petitions -These hoaxes take the form of petitions which try to get something done by collecting a lot of "signatures". Prayer Requests - These messages ask you to forward them to all your friends to get as many people as possible to pray for someone. Although these messages can't be called hoaxes, they do have the same flaws: They take up a lot of bandwidth and there's no way to stop them.
Insider Attack : If a competitor wants to cause damage to your organization,steal critical secrets, or put you out of business, they just have to
Netcraft Anti-Phishing Toolbar :
Behaviors Vulnerable to Attacks :
Countermeasures
Policies and Procedures
Impersonating on MySpace : effective marketing tool
Social engineering is the tactic or trick of gaining sensitive information by exploiting the basic human nature such as:
• Trust
• Fear
• Desire to Help
Social engineers attempt to gather information such as:
• Sensitive information
• Authorization details
• Access details
extract sensitive data such as: Security policies,Sensitive documents,Office network infrastructure,Passwords
People are usually the weakest link in the security chain.A successful defense depends on having good policies and educating employees to follow them.Social Engineering is the hardest form of
attack to defend against because it cannot be defended with hardware or software alone.
Social Engineering can be divided into two categories:
•Human-based: Gathers sensitive information by interaction.Attacks of this category exploits trust, fear, and helping nature of humans
Posing as Legitimate End User : Gives identity and asks for the sensitive information.“Hi! This is John, from Department X. I have forgotten my password. Can I get it?”
Posing as an Important User : Posing as a VIP of a target company, valuable customer, etc.“Hi! This is Kevin, CFO Secretary. I’m working on an urgent project and lost system password. Can you help me out?”
Posing as Technical Support : Calls as a technical support staff, and requests id & passwords to retrieve data.‘Sir, this is Mathew, Technical support, X company. Last night we had a system
crash here, and we are checking for the lost data.Can u give me your ID and Password?’
Eavesdropping or unauthorized listening of conversations or reading of messages.Interception of any form such as audio, video, or written
Shoulder Surfing : Looking over your shoulder as you enter a password.Simply, they look over your shoulder--or even watch from a distance using binoculars,in order to get those pieces of information
Dumpster Diving : Search for sensitive information at target company’s: Trash-bins, Printer Trash bins, user desk for sticky notes etc. Collect: Phone Bills, Contact Information, Financial Information, Operations related Information etc
In person : Survey a target company to collect information on Current technologies, Contact information, and so on
Third-party Authorization : Refer to an important person in the organization and try to collect data. “Mr. George, our Finance Manager, asked that I pick up the audit reports. Will you please provide them to me?
Tailgating : An unauthorized person, wearing a fake ID badge, enters a secured area by closely following an authorized person through a door requiring key access
Piggybacking : “I forgot my ID badge at home. Please help me.”. An authorized person provides access to an unauthorized person by keeping the secured door open
Reverse Social Engineering : This is when the hacker creates a persona that appears to be in a position of authority so that employees will ask him for information, rather than the other way around.Reverse Social Engineering attack involves: Sabotage,Marketing,Providing Support - The first step involves the sabotage of a targeted network by any means necessary. The second step involves advertising your services to the network owners you sabotaged in the first place. The last step involves actual assistance, which will allow you access to your victims' databases and corporate information.
Vishing : There's phishing, and then there's vishing. In simplified terms, vishing is the phone equivalent of a phishing attack.A visher basically uses the anonymity afforded by a phone call to pretend to be a representative of a target's financial institution. By manipulating a victim to enter his PIN, credit card number, and so on using the phone keypad, a visher can get instant access to another person's bank credentialsAlcohol: It's a scarily effective way to get the information you want out of a so-called security expert or corporate executive. It's not just the hard drinks that does people in, though; it's a combination of their lowered guards, their inebriation, and the ambiance of the bar that compels them to spill the beans and disclose information they normally wouldn't share.
• Computer Based: Social engineering is carried out with the aid of computers Sex: You really don't need fancy cracking programs, hacking devices, and whatnot to steal the information you need. Before the concept of firewalls was even formulated, sex (or at the very least, sex appeal) has been used to manipulate targets into divulging their personal secrets with you (pillow talk, if you will), which may include work-related data.
Techie talk enables you to use your victim's lack of technology knowledge against him so that you can literally trick him into doing anything with his computer by "walking" him through the entire "process".Mail / IM attachments
Pop-up Windows : Windows that suddenly pops up, while surfing the Internet and asks for users information to login or sign-in
Websites / Sweepstakes : The Internet is fertile ground for social engineers looking to harvest passwords. The primary weakness is that many users often repeat the use of one simple password on every account: Yahoo, Travelocity, Gap.com, whatever. So once the hacker has one password, he or she can probably get into multiple accounts. One way in which hackers have been known to obtain this kind of password is through an on-line form: they can send out some sort of sweepstakes information and ask the user to put in a name (including e-mail address – that way, she might even get that person’s corporate account password as well) and password. These forms can be sent by e-mail.
Spam mail : Email sent to many recipients without prior permission intended for commercial purposes.Irrelevant, unwanted, and unsolicited email to collect financial information, social security numbers, and network information.
Hoaxes and chain letters : Hoax letters are emails that issue warnings to user on new virus, Trojans or worms that may harm the user’s system.Chain letters are emails that offer free gifts such as money, and software on the condition that if the user forwards the mail to said number of persons
Virus hoaxes : There are a lot of viruses out there. But some aren't really out there at all. Virus hoaxes are more than mere annoyances, as they may lead some users to routinely ignore all virus warning messages, leaving them vulnerable to a genuine, destructive virus. Next time you receive an urgent virus warning message, be sure to check the list of known virus hoaxes.Remember: Never open an email attachment unless you know what it is—even if it's from someone you know and trust.Virus writers can use known hoaxes to their advantage. For example, AOL4FREE began as a hoax virus warning. Then somebody distributed a destructive Trojan horse attached to the original hoax virus warning! The lesson is clear: remain vigilant and never open a suspicious attachment.Chain letters : Charity Hoaxes - These hoax messages ask you to forward them to all your friends for a good cause.Timothy Flyte (who doesn't exist) has ostriopliosis of the liver (the disease doesn't exist) and asks you to forward this message to all your friends. The National Diesese Society (which doesn't exist) will receive 7 cents for every person the message is forwarded to.Useless Petitions -These hoaxes take the form of petitions which try to get something done by collecting a lot of "signatures". Prayer Requests - These messages ask you to forward them to all your friends to get as many people as possible to pray for someone. Although these messages can't be called hoaxes, they do have the same flaws: They take up a lot of bandwidth and there's no way to stop them.
Instant Chat Messenger: Gathering of personal information by chatting with a selected online user to attempt to get information such as birth dates and maiden names.Acquired data is later used for cracking the user’s accounts.
Phishing : An illegitimate email falsely claiming to be from a legitimate site attempts to acquire user’s personal or account information.Lures online users with statements such as : Verify your account,Update your information,Your account will be closed or suspended.Spam filters, anti-phishing tools integrated with web browsers can be used to protect from Phishers.
Insider Attack : If a competitor wants to cause damage to your organization,steal critical secrets, or put you out of business, they just have to
find a job opening, prepare someone to pass the interview, have that person hired, and they will be in the organization.It takes only one disgruntled person to take revenge and your company is compromised. 60% of attacks occur behind the firewall,An inside attack is easy to launch,Prevention is difficult,The inside attacker can easily succeed,Difficult to catch the perpetrator.Disgruntled Employee : Most cases of insider abuse can be traced to individuals who are introverted, incapable of dealing with stress or conflict, and frustrated with their job, office politics, no respect, no promotions etc.
Preventing Insider Threat : Some recommendations: Separation of duties, Rotation of duties, Least privilege, Controlled access, Logging and auditing, Legal policies, Archive critical data.Common Targets of Social Engineering : Receptionists and help desk personnel,Technical support executives,Vendors of target organization,
Telephone-Based Threats : It is a familiar medium, but it is also impersonal, because target cannot see the hacker.Communication options for most computer systems can also make Private Branch Exchange (PBX) an attractive target.Stealing either credit card or telephone card PINs at telephone booths is another kind of attack.There are three major goals for a hacker who attacks a PBX: Request information, usually through the imitation of a legitimate user, either to access the telephone system itself or to gain remote access to computer systems.Gain access to “free” telephone usage.Gain access to communications network.
Personal Approaches : Four main successful approaches for social engineers : Intimidation(through fear), Persuasion(Win approval or support for- The goal is not to force but to get voluntary action,Target believes they are making the decision), Ingratiation(power to induce action or belief -System administrators and users
Social Engineering Threats and Defenses : Major attack vectors that a social engineering hacker uses: Online, Telephone, Personal approaches, Reverse social engineering
Online Threats : In a connected business world, staff often use and respond to requests and information that come electronically.This connectivity enables hackers to make approaches to staff from the relative anonymity of Internet.Online attacks, such as e-mail, pop-up application, and instant message attacks; use Trojan horses, worms, or viruses(malware) to damage or subvert computer resources.Social engineering hacker persuades a staff member to provide information through a believable ruse, rather than infecting a computer with malware through a direct attack.An attack may provide information that enables hacker to make a subsequent malware attack.Telephone-Based Threats : It is a familiar medium, but it is also impersonal, because target cannot see the hacker.Communication options for most computer systems can also make Private Branch Exchange (PBX) an attractive target.Stealing either credit card or telephone card PINs at telephone booths is another kind of attack.There are three major goals for a hacker who attacks a PBX: Request information, usually through the imitation of a legitimate user, either to access the telephone system itself or to gain remote access to computer systems.Gain access to “free” telephone usage.Gain access to communications network.
The target is lead to believe that compliance with the request will enhance their chances of receiving benefit : Gaining advantage over a competitor,getting in good with management,Giving assistance to a sultry sounding female), Assistance
Defenses Against Social Engineering Threats :
Develop a security management framework
Undertake risk management assessments - Risk Assessment: You need to assess the level of risk that an attack possesses towards your
company for deploying suitable security measures.Risk categories include: Confidential information, Business credibility, Business availability, Resources, Money.
Implement social engineering defenses within your security policy
Factors that make Companies Vulnerable to Attacks :
Insufficient security training and awareness
Several organizational units
Lack of appropriate security policies
Easy access of information e.g. e-mail Ids and phone extension numbers of employees
Warning Signs of an Attack, An attacker may:
• Show inability to give valid callback number
• Make informal requests
• Claim of authority
• Show haste
• Unusually compliment or praise
• Show discomfort when questioned
• Drop the name inadvertently
• Threaten of dire consequences if information is not provided
Netcraft Anti-Phishing Toolbar :
An anti-phishing system consisting of a toolbar and a central server that has information about URLs provided by Toolbar community and Netcraft.
Blocks phishing websites that are recorded in Netcraft’s central server.Suspicious URLs can be reported to Netcraft by clicking Report a Phishing Site
in the toolbar menu.Shows all the attributes of each site such as host location, country, longevity, and popularity
Four phases of a Social Engineering Attack:
Research on target company : Dumpster diving, websites, employees, tour company and so on
Select Victim : Identify frustrated employees of the target company
Develop relationship : Developing relationship with the selected employees
Exploit the relationship to achieve the objective: Collect sensitive account information, Financial information, Current Technologies
Behaviors Vulnerable to Attacks :
Trust : Human nature of trust is the basis of any social engineering attack
Ignorance : Ignorance about social engineering and its effects among the workforce makes the organization an easy target
Fear : Social engineers might threaten severe losses in case of non- compliance with their requestGreed : Social engineers lure the targets to divulge information by promising something for nothing
Moral duty : Targets are asked for the help, and they comply out of a sense of moral obligation
Impact on the Organization
Economic losses,Damage of goodwill,Loss of privacy,Dangers of terrorism,Lawsuits and arbitrations,Temporary or permanent closure
Countermeasures
Training : An efficient training program should consist of all security policies and methods to increase awareness on social engineering.
Password policies : Periodic password change, Avoiding guessable passwords, Account blocking after failed attempts, Length and complexity of passwords, Minimum number of characters, use of special characters, and numbers etc. e.g. ar1f23#$g , Secrecy of passwords, Do not reveal if asked, or write on anything to remember them
Operational guidelines : Ensure security of sensitive information and authorized use of resources
Physical security policies : Identification of employees e.g. issuing of ID cards uniforms and so on. Escorting the visitors. Accessing area restrictions. Proper shredding of useless documents. Employing security personnel.
Classification of Information : Categorize the information as top secret, proprietary, for internal use only, for public use, and so on
Access privileges : Administrator, user, and guest accounts with proper authorization
Background check of employees and proper termination process : Insiders with a criminal background and terminated employees are easy
targets for procuring information
Proper incidence response system : There should be proper guidelines for reacting in case of a social engineering attempt
Policies and Procedures
Good policies and procedures are ineffective if they are not taught and reinforced by the employees.
After receiving training, the employee should sign a statement acknowledging that they understand the policies.
Security Policies - Checklist
Account setup
Password change policy
Help desk procedures
Access privileges
Violations
Employee identification
Privacy policy
Paper documents
Modems
Physical access restrictions
Virus control
Impersonating Orkut,Facebook, MySpace
Impersonating on Orkut : anyone can steal the personal and corporate information and create the account on others’ nameOn Orkut, accounts can be hacked by 2 main methods: Cookie Stealing and Phishing (Fake Page).When JavaScript is run by the victim, his cookie comes to the hacker, using which he can get into the victim’s account.Fake pages look like pages of Orkut; when user name and password is put into their respective fields, they are sent to the email ID of the hacker
MW.Orc worm steals users' banking details, usernames, and passwords by propagating through Orkut.This attack is triggered as the user launches an executable file disguised as a JPEG file.The initial executable file that causes the infection, installs two additional files on the user's computer
Impersonating on Facebook : use a nickname instead of the real name.Fake accounts are a violation of Terms of UseThese files then pass e-mail banking details and passwords to the worm's anonymous creator when the infected users click on “My Computer” icon.
Infection spreads automatically by posting a URL in another user's Orkut Scrapbook; a guestbook where visitors can leave comments visible on user's page.Apart from stealing personal information, this malware also enables a remote user to control PC and make it a part of botnet which is a network of infected PCs.
Impersonating on MySpace : effective marketing tool
Identity Theft
Identity theft occurs when someone steals your name and other personal information for fraudulent purposes
Securing personal information in the workplace and at home, and looking over credit card reports are just few of the ways to minimize the risk of the identity theft.
Hping
Getting started
===========
Log in as the root user (you need this to send and receive raw packets).
To enter the hping3 interactive shell, just type:
# hping3
without any argument. If hping was compiled with Tcl scripting capabilities you should see a prompt. The prompt will accept any Tcl command, it's actually a Tcl shell, what's special about it is that there is a new command calledhping, and support for big numbers using commands like +, -, and so on.
As first try, you can type a simple command and see the result: hping3.0.0-alpha-1> hping resolve www.google.com
66.102.9.104
66.102.9.104
The hping command should be called with a subcommand as a first argument (resolve in the example) and additional arguments according to the particular subcommand. The hping resolve command is used to convert a hostname to an IP address.
hping3.0.0-alpha-1> hping send {ip(daddr=192.168.1.8)+icmp(type=8,code=0)}This command means "send an ICMP echo request packet to 192.168.1.8". Many details of the packet can be omitted. For example we didn't specify our source address (that will default to the real source address of the sender, the one of the outgoing interface), nor the IP or ICMP checksum. hping will compute them for us.
Let's check what tcpdump running at 192.168.1.8 detected:
tcpdump: listening on eth0
19:09:16.556695 192.168.1.6 > 192.168.1.8: icmp: echo request [ttl 0]
19:09:16.556803 192.168.1.8 > 192.168.1.6: icmp: echo replyOur ICMP packet reached the destination, that kindly replied with an ICMP echo reply packet.
19:09:16.556695 192.168.1.6 > 192.168.1.8: icmp: echo request [ttl 0]
19:09:16.556803 192.168.1.8 > 192.168.1.6: icmp: echo replyOur ICMP packet reached the destination, that kindly replied with an ICMP echo reply packet.
It's better to recall for a second the previous command, to analyze it better:
hping3.0.0-alpha-1> hping send {ip(daddr=192.168.1.8)+icmp(type=8,code=0)}
As you can see, there are { and } surrounding the packet description. This is required by Tcl in order to quote the string so that special characters will not be interpreted. Quoting with {} in Tcl is just like to quote with "" in most other languages, with the difference that no escapes are recognized inside {} quoting. The second thing to note is the format we used to describe the packet. That's called APD, and was introduced with hping3 itself. The APD syntax is trivial, and there is a simple way to figure how to generate a given packet, because hping3 use this format to send packets, but also to receive packets as we will see in a moment.
We can use any of the Tcl abilities in hping scripts.The following hping script will send the same ICMP packet we already sent to 192.168.1.8, but using different TTL values, from 5 to 10.
foreach i [list 5 6 7 8 9 10] {
hping send "ip(daddr=192.168.1.8,ttl=$i)+icmp(type=8,code=0)"
}With scripts longer then one line it can be a good idea to write the script with a text editor, and then run it using hping:
hping send "ip(daddr=192.168.1.8,ttl=$i)+icmp(type=8,code=0)"
}With scripts longer then one line it can be a good idea to write the script with a text editor, and then run it using hping:
# hping exec foo.htcl
Packet reception
Another very important subcommand of hping is hping recv, that is used to capture packets from the specified interface. The simplest usage is the following:
hping3.0.0-alpha-1> hping recv eth0
ip(ihl=0x5,ver=0x4,tos=0x00,totlen=52,id=42833,fragoff=0,mf=0,df=1,rf=0,ttl=54,proto=6,cksum=0xd53a,saddr=192.106.224.132,daddr=192.168.1.6)+tcp(sport=6667,dport=52466,seq=2163829654,ack=3105171942,x2=0x0,off=8,flags=a,win=2848,cksum=0x99bd,urp=0)+tcp.nop()+tcp.nop()+tcp.timestamp(val=181365875,ecr=104872758)
hping recv returns a Tcl list, where every element is a packet.At every call, hping recv eth0 will return the packet(s) in queue. If there is no packet to receive the command will block until one is available.
ip(ihl=0x5,ver=0x4,tos=0x00,totlen=52,id=42833,fragoff=0,mf=0,df=1,rf=0,ttl=54,proto=6,cksum=0xd53a,saddr=192.106.224.132,daddr=192.168.1.6)+tcp(sport=6667,dport=52466,seq=2163829654,ack=3105171942,x2=0x0,off=8,flags=a,win=2848,cksum=0x99bd,urp=0)+tcp.nop()+tcp.nop()+tcp.timestamp(val=181365875,ecr=104872758)
hping recv returns a Tcl list, where every element is a packet.At every call, hping recv eth0 will return the packet(s) in queue. If there is no packet to receive the command will block until one is available.
If you don't want hping recv to block forever, you can specify an additional argument. One more argument will tell hping the max number of packets to return in a single call.
while 1 {
set p [lindex [hping recv eth0] 0]
puts "[hping getfield ip saddr $p] -> [hping getfield ip ttl $p]"
}The first line is just a while loop that will repeat the script provided as second argument forever. The second line,set p [lindex [hping recv eth0] 0] gets the next packet, the lindex command is used to extract the packet from the Tcl list (and the 0 argument tells lindex to get the first packet).
set p [lindex [hping recv eth0] 0]
puts "[hping getfield ip saddr $p] -> [hping getfield ip ttl $p]"
}The first line is just a while loop that will repeat the script provided as second argument forever. The second line,set p [lindex [hping recv eth0] 0] gets the next packet, the lindex command is used to extract the packet from the Tcl list (and the 0 argument tells lindex to get the first packet).
The second line of code, puts "...", print on the screen the source IP address and the TTL value of the packet. To extract fiels from packets there is the command hping getfield (see the specific page for more information as usually).
If you execute this script, you'll get an output similar to the following:
# ./hping3 exec /tmp/test.tcl
192.168.1.6 -> 128
192.168.1.20 -> 128
192.168.1.6 -> 128
192.168.1.20 -> 128
the script will dump the packets until you press ctrl+C.
To execute an hping script, call the hping program with "exec" as first argument followed by the name of the script and the arguments.
# hping exec hping.htcl www.hping.org
Port Forwarding
All TCP and UDP traffic on the Internet uses ports to identify the procotol being used, such as port 80 for HTTP (web) and port 25 for SMTP (email). To solve the firewall problem and let visitors into the network, the user instructs the router to allow traffic to pass through on a given port. This is known as port forwarding, as the router forwards (directs) all Internet requests on a specific port to the local machine. With port forwarding, external visitors are able to connect to the server while other internal devices remain protected.
There are three different kinds of port forwarding:
- Port Forwarding: Standard port forwarding is an "always on" tunnel through your router's firewall. Any visitor may connect to your network on the given port at any time. This is the correct choice for "always on" services such as webservers and mailservers.
- Port Triggering: This is a special kind of "temporary" port forwarding that requires an initial outgoing connection. Once the connection is established, the router begins forwarding all new incoming connections to the local machine; when the local machine closes the connection, the forwarding rule is turned off. This rule is most commonly used in gaming, video conferencing and other applications that receive incoming connections on a need-only basis.
- DMZ (DeMilitarized Zone): This feature effectively places the destination device outside of the router's protective firewall by forwarding all incoming connections on all ports to the single local machine. The DMZ is mostly used for troubleshooting purposes and advanced network configurations; as such, it is not recommended to use the DMZ for general hosting purposes.
- Application Name: The label for the forwarding rule.
- Start and End Port: The application's port(s), e.g. 80 for HTTP. Many routers will allow you to forward an array of ports with a single rule.
- Protocol: The protocol (TCP, UDP or Both) for the forwarding rule. The protocol depends on the type of service you are providing (e.g. webservers use TCP).
- IP Address: The internal IP address of the destination device in the LAN, usually beginning with 192.168.x. If your router dynamically assigns internal IPs with DHCP, you will need to configure the server device to use an internal static IP address.
Subscribe to:
Posts (Atom)