- Shopping Bag ( 0 items )
Barnaby Jack"Whether you're a struggling novice or a seasoned pro--Hacking Exposed, Third Edition is required reading."
--Win32 Buffer Overflow Expert
Ships from: Fort Worth, TX
Usually ships in 1-2 business days
Ships from: Chatham, NJ
Usually ships in 1-2 business days
Ships from: acton, MA
Usually ships in 1-2 business days
Ships from: acton, MA
Usually ships in 1-2 business days
Your operations team receives the new server at the data center and follows your instructions to replace the aging NT server with this new one. You exude confidence that your hardware vendor has configured the system with meticulous care, even setting the IP address for you. The switch-over succeeds without a hitch. This customization-by-order takes plug-and-play to a new level, you think. Unfortunately, this takes hacking to a new level as well.
Your super server is actually a leaking sieve of information waiting to be pillaged by any hacker who happens to direct his or her efforts in your direction. With ports like 139 and 445 open to the world, even a novice hacker doesn't have to ask for much more. A quick "anonymous" connection to your server will yield a wealth of information that can be used to determine what users have administrator rights, the last logon date for a user, hidden share information, the last time a password was changed, and if a password is required at all! All of this information can be gleaned-or as we call it, enumerated-via a null session and a few open ports that were determined from footprinting your environment. Scanning and enumerating systems are basic skills most attackers will use to determine if your systems are ripe for picking. Once your system gives up the goods, you are toast.
In our experience, this scenario is all too real and represents a major portion of time spent by determined attackers. The more information that can be gleaned by an attacker, the greater the chances of a successful security breach. While the media likes to sensationalize the "push button" hack, a skilled and determine attacker may take months to footprint and enumerate a target environment before ever executing an exploit. Many users exacerbate this situation by naively trusting hardware manufacturers to securely configure their systems. While some vendors may make token attempts to turn off a service here or there, most systems come out of the box begging to be hacked. Don't get lulled into a false sense of security just because the factory preconfigured your system. Most systems are designed out of the box to reduce support calls, not to keep a hacker out.
The techniques discussed in Chapters 1 through 3 will serve you well. Footprint your own systems before someone with less than honorable intentions does it for you!
The same requirement applies to successful attackers. They must harvest a wealth of information to execute a focused and surgical attack (one that won't be readily caught). As a result, attackers will gather as much information as possible about all aspects of an organization's security posture. Hackers end up with a unique footprint or profile of their Internet, remote access, and intranet/extranet presence. By following a structured methodology, attackers can systematically glean information from a multitude of sources to compile this critical footprint on any organization.
It is difficult to provide a step-by-step guide on footprinting because it is an activity that may lead you down several paths. However, this chapter delineates basic steps that should allow you to complete a thorough footprint analysis. Many of these techniques can be applied to the other technologies mentioned earlier.
As a starting point, peruse the target organization's web page if they have one. Many times an organization's web page provides a ridiculous amount of information that can aid attackers. We have actually seen organizations list security configuration options for their firewall system directly on their Internet web server. Other items of interest include
After studying web pages, you can perform open source searches for information relating to the target organization. News articles, press releases, and so on, may provide additional clues about the state of the organization and their security posture. Web sites such as finance.yahoo.com or http://www.companysleuth.com provide a plethora of information. If you are profiling a company that is mostly Internet based, you may find by searching for related news stories that they have had numerous security incidents. Using your web search engine of choice will suffice for this activity. However, there are more advanced searching tools and criteria you can use to uncover additional information....
|Commentary on the State of Network Security|
|Pt. I||Casing the Establishment|
|Pt. II||System Hacking|
|4||Hacking Windows 95/98, Me, and XP Home Edition||115|
|5||Hacking Windows NT||141|
|6||Hacking Windows 2000||219|
|7||Novell NetWare Hacking||275|
|Pt. III||Network Hacking|
|9||Dial-Up, PBX, Voicemail, and VPN Hacking||393|
|12||Denial of Service (DoS) Attacks||503|
|Pt. IV||Software Hacking|
|13||Remote Control Insecurities||529|
|16||Hacking the Internet User||635|
|B||Top 14 Security Vulnerabilities||701|
Since the dawn of time, we have turned to our elders for knowledge and experience; their direction and guidance has staved off innumerable ills and misfortunes thrust upon us. But in today's esoteric and ever-changing underworld of computer security, few wise sages walk the corporate hallowed halls. The digital soldiers of today don't posses even a vague security roadmap, much less a proven framework for combating these obscure and wily enemies.
To improve your security and fight the enemy, you must know them, befriend them, and learn from them. Hackers are too resourceful and committed to be ignored. Hackers by their very nature continually reinvent themselves and their techniques, often becoming ghosts on the cyberlandscape, next to impossible to follow. Like a virus, they morph and adapt to survive making them painfully difficult to study. The world today is a chaotic digital battlefield. At every turn technology and computers are taking over our everyday world, offering simplified and efficient living, all the while hiding the dark secret that threatens its very existence. The wires that hold the billions of electrons of the Internet hold an enormous secret, one that we have only begun to unravel and expose to the open air: the world of the blackhat hacker. By reading books like Hacking Exposed, and watching and learning from these hackers, you can begin to understand their attacks, how they work, what they do, and what motivates them. Nothing else out there today more empowers security professionals to fight this battle.
Little is known about this dark underworld and until recently few have had the know-how to discuss their tactics in a public forum such as this. The traditional means of battle require an enemy you can see and touch, one that abides by the laws of engagement and reason; qualities unknown in today's cyberanarchy. As security professionals, we are called to assess the scope of an attack, help companies recover from compromise, and provide concrete steps for hardening computer systems. But without knowledge of the enemy, how can we defend ourselves?
The following chapters are not fictional stories concocted by students of drama or horror. They are true techniques and stories about the reality of the digital battlefield in which we are forever immersed. The enemy is at the door, and they're all but invisible to but a few security experts. Within these pages is the advice of those experts. You are about to open yourself to the mind and motivation of the enemy, from which you will learn their motives, their techniques, but most important, you will learn how to defeat them.
New Content Abounds
Among the new items exposed in the third edition:
Whether we recognize it or not, when connected to the Internet in our home or office, we are all vulnerable. In fact, connecting to the Internet makes you a member (either willing or unwilling) of a community in which everyone becomes part of an enormous system-one much larger than any individual and where time and distance are almost eliminated. The interconnectivity of the Internet brings all participants in close proximity to each other. Your "neighbor next door" is now a hacker in a foreign country with intent to harm or a young talented kid searching out your vulnerabilities just for kicks.
As with every community, not all of its citizens are upstanding members. You can't open a newspaper these days without coming across another sleepy, quiet community that has been rocked by violence or scandal. The same is true for the cyber community of the Internet. In the high-speed, highly connected worldwide Internet community, it's easy to see why some of the most significant negative events happen there and happen with great speed. Even more distressing is the fact that within the Internet community live some very smart people with extraordinary talent and free time who insist on using that talent for evil instead of good.
You don't have to look back very far into Internet history to see incredible advances in computer exploitation. Actually, I believe the rate at which vulnerabilities are discovered and exploited far surpasses Moore's Law for computing power advances. Maybe the security community should develop our own law that says: "Attackers on the Internet will eventually find and exploit every vulnerability. The more interesting the target, the faster this will occur." Unfortunately, most people on the Internet believe that they are not interesting targets. This is simply not true. Anyone running a firewall on his or her home PC can see that. It's much faster for me to count the number of countries in the world that have not tried to attach to my home PC than count the ones that have. Every day there are at least a dozen individuals out there that want to know if my computer will talk to them using one of several well known Trojan Horses or vulnerable software applications. Why do these people keep coming back day after day? Simple, they often have success finding and compromising vulnerable computers.
Hacking and exploitation used to be the work of relatively few highly skilled experts. Today, ready-made point and click, load and run, compile and execute tools put destructive capability in the hands of almost anyone looking to cause trouble. It wasn't long ago that we were learning about basic p ping and SYN floods as the primary method for denial of service attacks. Soon after, denial of service took a great step forward with distributed attacks co-opting "innocent" UNIX computers. This technique was quickly morphed to work on another platform even more easily exploited, the Windows platforms used by thousands of cable and DSL customers. A great example of accelerated development is in the worm techniques that propagate Trojan Horses without human intervention. Fall 2000 through summer 2001 brought us the Bymer worm, Linux Ramen worm, Lion worm, SADMIND, the Leave worm, and Code Red. Code Red is possibly the most costly automated attack to date with current estimates of damage and clean up exceeding several billion dollars. This "hacking on autopilot" is a huge force multiplier and greatly leverages the attackers available time, increasing the chances of success. For all of the different techniques employed by worms, they all have one thing in common: closing the vulnerabilities that they exploit would have prevented all of the damage done. The vulnerabilities exploited by these worms, and countermeasures for them, are described in the book you are now reading.
Even the most security savvy companies will have vulnerabilities on their network and, because of this, must remain diligent to minimize risk. The first step is knowledge and with knowledge comes the opportunity to mature and improve. In your hands, you hold one of the most powerful tools available in the security business to help increase your knowledge. Read it, heed it, and use it. I hold great respect for the authors of this book. I have sought and received excellent advice from them over the years. In Hacking Exposed, they have written "The Book" on vulnerabilities and countermeasures. My hope is that you will use the information here to make your company a safer and more secure place. In the future, companies that have the fewest reputation issues from security problems will be the companies that invest in passionate and talented people, flexible technology to meet constantly changing security threats, and processes that ensure continuous improvement. The companies that don't will most likely make The Wall Street Journal headlines-and not in a positive way.
Pete Murphy, 8/4/2001
SVP, Vulnerability and Response Management
Bank of America
Peter F. Murphy is responsible for the Vulnerability and Response Management team at Bank of America. These responsibilities include the Bank of America Computer Incident Response Team (BACIRT), Intrusion Detection, Vulnerability Assessments, Threat Management, Forensic Investigations, Regional Workarea Recovery Centers, and Network Computing Group Contingency Planning and Testing.
Pete has seventeen years experience in systems development, technology auditing, and information security in the banking and finance industry. Pete is a member of the Information Systems Audit and Control Association, holds a Certified Information Systems Auditor certification, participates in the Vulnerability Assessment working group as part of the President's Commission on Critical Infrastructure Protection, and participates in the Network Security Information Exchange (NSIE) as part of the President's National Security Telecommunications Advisory Council (NSTAC).
Posted August 16, 2001