1 / 33

Packet saga

Packet saga. Using Strategic Hacking To Terrorize Commercial And Governmental Entities On The Internet. By: Khaled M.A. Nassar Wael A. Ali. Agenda. Introduction. Methodology. Simple attack. Professional hacking. Strategic Hacking. Scenarios. DOS Scenario. Takeover scenario.

tuan
Download Presentation

Packet saga

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Packet saga Using Strategic Hacking To Terrorize Commercial And Governmental Entities On The Internet. By: Khaled M.A. Nassar Wael A. Ali

  2. Agenda • Introduction. • Methodology. • Simple attack. • Professional hacking. • Strategic Hacking. • Scenarios. • DOS Scenario. • Takeover scenario. • Conclusions. • Recommendations.

  3. Introduction motive motive attack motive attack motive motive attack Network motive attack motive attack

  4. Methodology • Simple attack. • Professional hacking. • Strategic Hacking.

  5. Simple attack Target host Exploit Vulnerable service DOS Login service Brute force

  6. Professional hacking Foot-printing Scanning Enumeration Gaining Access Pilfering Escalating Privileges Covering Tracks Creating Backdoors Misinformation Denial of service

  7. Strategic Hacking Information Gathering Information Analysis Reliability checks Locating Entities Locating Patterns Enumeration Footprinting Brute-force unmonitored services Stealth testing Scanning What-if analysis Name, Piece of information Planning Sequences & prerequisites Critical timing consideration Ending the attack Design Attack trees and Scenarios Hiding traces Installing backdoors Initiating attack DOS attacks Misinformation Attacks Accomplishing objectives Escalation loop Gaining access Denial of service Information Tampering Escalating privileges Pilfering Network takeover Information Stealing

  8. + + Firewall Web dev. DB admin Service Web admin Manager Secretary Service Service ………….. …….. …….. ……….. Administrator …….. …….. Switch Firewall switch Switch switch switch DB server Web server Operational db Non.op. DB Web srv. Scenarios 6 13 16 12 7 11 15 5 4 2 8 3 14 9 10 1

  9. Takeover scenario • The targeted network: • A governmental unit that provides computerized license renovation. • The online service is not yet running but is being developed. • The time: • Nothing specific. • Intruders: • Someone who has interest in making the electronic government project fail. So, he hired a professional team of intruders to do the job for him. • Motive: • He wants to take over the network so he could manipulate it anytime he wants to prove something. And if have to he would want todestroy all the data in the network.

  10. Manager Secretary Service Web dev. DB admin Web admin Service Service Takeover (targeted network) + Firewall Switch Switch Operational db Non.op. DB Web srv.

  11. Takeover (Footprinting) • The secretary e-mail from the website. • The IP addresses for the network xxx.xxx.xxx.0-31. All real IP’s. • A good idea about how the system works by going to the physical place and asking how to renovate a license. • The intruder notices that there is a room called “the server room”. • The developer is a professional in a different OS platform than administrators. This could mean non-standard Operating systems.

  12. Takeover (Scanning) • The firewall is badly configured to block only suspicious ports. • The attackers presume that the firewall also allows all outgoing traffic. • The Machines scanning results are as following: • Web server is listening on: 1- 80, static pages. 2- 8080, some dynamic pages the developer is developing for the forthcoming service. • Operational database server: apparently the SQL server port is filtered as it shows from the scan. • Non-operational DB server: SQL port is opened as well as terminal server port.

  13. Takeover ( Enumeration ) • Web server and operational database servers are updated with patches and have antivirus. • Non-operational database server is not. • Manager machine is sharing the printer and a writable folder. • All service machines have the names “service1-3” and username and password “service”. • All client machines are windows 2000.

  14. Takeover ( Analysis)Location of critical individuals, Groups and technologies • The secretary machine usually is less secured but has more information about the company than the whole company. • Web developer machine usually has more privileges than normal users but the developer most of time is not keen on security as administrator. • The technical group (web admin, database admin and developer) has access on the servers group. • The server group is in a separate room (maybe on a separate hub). • Only two users on the administrators’ machines. This implies that the two different administrators (DB, web) most probably know the system’s, web’s, and database’s password to be able to fill in for each others.

  15. Takeover ( Analysis)Pattern location • The service machine is a pattern. • Having terminal service on the non-operational database could be a pattern on other servers. • The password for the servers could be similar (a pattern). If we could sniff one, we would get the rest.

  16. Takeover ( Analysis)What-if analysis and Attack Scenarios • Send the secretary a Trojan horse. • They could find critical information about the manager, the company, and maybe even backup of the source codes and databases. • They could find old password or any other critical in mail boxes. • Attack the un-armored web server on the developer machine. • They will be able to get the source code and designs. • This goes for all client machines: they will sure gather new information and use it to sniff at least local password, brute force other machines, and make misinformation and DOS attacks. • Attack the SQL server on the non-operational server. • They maybe able to sniff passwords of the hub. • Download the data of the server. • Know the structure of the operational database and try to send queries.

  17. Manager Secretary Service Web dev. DB admin Web admin Service Service Takeover (Reliability checking)Stealth-testing the vulnerabilities + Firewall Switch Switch Operational db Non.op. DB Web srv.

  18. Manager Secretary Service Web dev. DB admin Web admin Service Service Takeover (Reliability checking)Brute forcing unmonitored services + Firewall Switch Switch Operational db Non.op. DB Web srv.

  19. Takeover (Planning for the attack)Sequence of attack and prerequisitesAttack trees and scenarios

  20. Manager Secretary Service Web dev. DB admin Web admin Service Service Takeover (Initiating the attack)Gaining access + Firewall Switch Switch Operational db Non.op. DB Web srv.

  21. Manager Secretary Service Web dev. DB admin Web admin Service Service Takeover (Escalation loop)Pilfering + Firewall Switch Switch Operational db Non.op. DB Web srv.

  22. Manager Secretary Service Web dev. DB admin Web admin Service Service Takeover (Escalation loop) Escalation + Firewall Switch Switch Operational db Non.op. DB Web srv.

  23. Manager Secretary Service Web dev. DB admin Web admin Service Service Takeover (Escalation loop) Escalation + Firewall Switch Switch Operational db Non.op. DB Web srv.

  24. Manager Secretary Service Web dev. DB admin Web admin Service Service Takeover (Escalation loop) Escalation + Firewall Switch Switch Operational db Non.op. DB Web srv.

  25. Manager Secretary Service Web dev. DB admin Web admin Service Service Takeover (Escalation loop) Escalation + Firewall Switch Switch Operational db Non.op. DB Web srv.

  26. Takeover Accomplishing the objectives • They are ready to do whatever their employer asks them to do.

  27. Takeover Ending the attack • Installing backdoors • The intruders install 2 instances of “netcat” on the server. The first one will act as a server. The other one will act as a client that tries to connect every week to a previously compromised server by the intrusion team. • Hiding traces. • The team executes a root-kit that erases the logs, hide the binaries and erase any users they may have added to some systems.

  28. Takeover Impact on the organization • Invading the privacy of at least thousands of citizens which could very much compromise the electronic government project in Egypt.

  29. Conclusions • Malicious hacking cause companies great deals of money, effort, and time. • Malicious hacking could be motivated by electronic terrorism. • Advanced or strategic hacking could be used to terrorize commercial as well as governmental organizations. • A well design attack may compromise the organization’s integrity. • Such attacks could also threaten national projects like electronic government. • Facing such threats is a must.

  30. Countermeasures • Intelligence. • IIDS. • Honey pots.

  31. Recommendation • Developing a research and development institution for cyber security that should provide solutions and consultation services for the governmental as well as the private organizations. • Increasing the awareness of people in the field of cyber security to increase the possibility of a new generation that could explore and develop this new space.

  32. Inspiration • Presentation artwork is inspired by: • Boris Vallejo. • Hackers (the movie). • TCP/IP packets’ headers. • Dr. Strangelove (the movie).

  33. Thanks Questions?

More Related