01 threat

Breezy

Download

Post to :

URL :

Related Presentations :

Add to Flag Embed

Uploaded from authorPOINTLite

Views: 1188

Category: Entertainment

Presentation Description

No description available.

Comments

Presentation Transcript

The threat we face:

The threat we face What is security? We want computers to Do what they are supposed to do When we want them to do it With restrictions on who can read/modify data/programs Schneier - "enforcing a policy that describes rules for accessing resources" Security can be measured by compliance with that policy

Computers and crime:

Computers and crime Computers are often involved in crime in one of two ways: They can be used as an "agent" of a crime They can be the "victim" of a crime

Computers used as an agent of the crime:

Computers used as an agent of the crime Communication about drug deals, murder Exchange of copyrighted material Sharing, storing child porn Identity theft Harassment, death threats Fraud

Computers as the victim of the crime:

Computers as the victim of the crime Destruction of data Programs subverted, replaced "Malware" installed Denial of service attacks To compromise other computers Share files Hide tracks

Who would do this?:

Who would do this? Someone who is out to get you Disgruntled employee Disgruntled patron Someone who is after something you have "Miscreants" "Random acts of violence" Might not be targetting you Most attacks are like muggings - wrong place and time

Who would do this?:

Who would do this? Activists (“hacktivists”) Espionage Terrorists Terrorists

Hackers/crackers?:

Hackers/crackers? Hackers traditionally were *not* crooks Originally meant someone who is skilled, clever "Taken over" by the popular press Some use "crackers" (myself included at times) This can be confusing Miscreant is a pretty descriptive term

Why do they do this?:

Why do they do this? Curiosity, “learning” Computer underground "economy" A means to an ends (file sharing, warez sites) Hacktivism (web defacements, denial of service attacks)

A little about the miscreants...:

A little about the miscreants... There's a small number of "clueful" people They write most of the exploit scripts, rootkits and backdoors These tools are "enabling technologies" There's a larger number of potential miscreants They couldn't commit these attacks w/o the tools The tools are *easy* to use

How do they do this?:

How do they do this? Scan for computers, services, vulnerabilities Gather information (accounts, operating system, software) Exploit vulnerabilities to gain access (or leverage access) Install back doors, possibly rootkits Use the computers for [fill in the blank]

Scanning:

Scanning Host There are typically many unused addresses Which ones have computers listening on them? Ports Determine which network services each computer runs May only be interested in specific services (e.g. IIS)

Information Gathering:

Information Gathering O/S Fingerprinting Typically done through TCP/IP stack "fingerprinting" Banner grabbing Helps determine software type, version Account enumeration Through null sessions, finger, whois, ldap, mailing lists, etc.

Exploits:

Exploits Typically automated May try multiple exploits Exploits take advantage of bugs, misconfigured systems, human error, design flaws to give the intruder access

Exploits:

Exploits Bugs (buffer overflows, race conditions) Misconfigured systems (no admin password) Human gullibility (many viruses) Design flaws (other viruses, attacks against weak passwords)

Exploits:

Exploits Most common exploits have patches (or workarounds) available Most people don't install patches 0-day exploits are new, unknown, typically no patches available

Exploits:

Exploits The exploit often installs a simple backdoor Root shell via inetd on TCP/1524 on Unix Dameware on Windows Intruder may scan for the backdoor to find successfully compromised systems In some cases (Netbus or Back Orifice installed via email) the intruder needs to search for the infected computers In other cases the backdoor “phones home” (Nethief)

Backdoors:

Backdoors On success, intruder will often use the simple backdoor to gain access to the system and: Install a better backdoor Install a rootkit Cleanup traces of their intrusion on the system Remove services or install patches to keep others from gaining access

Backdoors:

Backdoors These vary in sophistication Simple: Root shell on special TCP port Extra ssh on a special port Cmd.exe copied to a new location in the web tree

Backdoors:

Backdoors Complex: Back Orifice, Netbus DDOS agents Botnets Nethief Seteri

Case study: Nethief:

Case study: Nethief Attacker creates a special “agent” with the console, infects one or more victims with it. Console updates a web site with its current IP address (encrypted) Agents check the web site once a minute, send “here I am” traffic to console on udp/8102

Case study: Nethief:

Case study: Nethief Console displays list of agents Attacker picks an agent, console puts instructions for that agent on the web Agent gets instructions, contacts console on TCP/80 Console now has access to all files (read, write, delete, create, execute…) Greenstuffsoft.com (warning: Chinese)

Rootkits:

Rootkits Set of tools that the intruder installs on the system when it has been successfully compromised Typically includes backdoor, install scripts, tools for breaking into other systems, tools for hiding their tracks

Rootkits - Hiding:

Rootkits - Hiding Replacements for common applications ps modified to not show certain processes netstat modified to not show certain network connections ls, du, find modified to not show certain files etc. Kernel modules If the O/S doesn't report X, there's little that you can do except image the disk and analyze it

Normal Software Hierarchy:

Operating System (kernel) Kernel modules Dynamic Libraries Statically Linked Programs Dynamically Linked Progs Normal Software Hierarchy

Compromised Hierarchy:

Compromised Hierarchy Operating System (kernel) Kernel modules Dynamic Libraries Statically Linked Programs Dynamically Linked Progs Intruder replaces “good” programs with “bad” copies intended to hide their activity or provide a back door. E.g. ls, find, du might hide directories, ps might hide some processes, netstat might hide network activity, login might allow root access with a special password

Compromised Hierarchy:

Compromised Hierarchy Operating System (kernel) Kernel modules Dynamic Libraries Statically Linked Programs Dynamically Linked Progs Intruder installs a new kernel module that changes how the system behaves. This affects ALL programs running on the system.

Case study: Knark:

Case study: Knark Knark – a loadable kernel module rootkit for Linux Hides files, directories, net connections Hides processes – inherited Exec redirection – run sshd.bad when they ask for sshd Hides modules, execute programs as root And so on…

Response to kernel rootkits:

Response to kernel rootkits Good argument for prevention  Examine the disk contents (portable forensics) Log reconciliation Compare logs from host against external logs (e.g. network traffic logs), look for differences E.g. telnet connection, but no login session

Distributed Attack Tools:

Distributed Attack Tools Basic idea is to split phases of the attack, or pieces of a denial of service mechanism, across multiple hosts Harder to detect – easier to drop below intrusion detection threshold, hard to correlate seemingly pointless traffic from multiple sources.

Sample Distributed Attack:

Sample Distributed Attack Probe Sources Victims Attack Hosts Compromised Hosts D of S Sources Denial of Service Victims Probed Hosts 1 2 3 3

Viruses and Worms:

Viruses and Worms The terminology is often misused Virus Malicious software installed into another, otherwise "normal" program "Infection part" looks for other files/programs to infect "Payload part" does something (sends email, deletes files, etc.) Frequently requires human intervention to spread (e.g. execute attachment)

Viruses and Worms:

Viruses and Worms Worm Stand-alone program - not attached to another Typically spreads automatically

Case study: SQL/Slammer (Saphire) Worm:

Case study: SQL/Slammer (Saphire) Worm

How does SQL/Slammer Infect a Computer?:

How does SQL/Slammer Infect a Computer? Through the SQL Locater Service Microsoft SQL is a network database server SQL Locater Service is a network service for finding SQL databases Some versions of the SQL locater service have a bug SQL/Slammer was written to take advantage of this bug

More Specifically...:

More Specifically... The bug that SQL/Slammer used is a type of "buffer overflow" attack A buffer overflow attack is when the attack, um, overflows the buffer This can enable the attacker to insert their program into the program receiving the data and execute it If it works the good program is replaced with a copy of the worm

Slide36:

SQL Locater Service Buffer SQL/Slammer