Open Source Security Tools

1. Open Source Security Tools alek rollyson

2. DISCLAIMER DON'T BE STUPID...SERIOUSLY USE OF THESE TOOLS ON MACHINES NOT LEGALLY OWNED BY YOU COULD END UP PUTTING A NASTY MARK ON YOUR CRIMINAL RECORD

3. please ask questions. in the interest of time i'm going to automatically assume you're keeping up if you don't say anything

4. Talk Overview • Protocol Analyzing, Sniffers, Interceptors, Port Scanning • Wireshark, Ettercap, Nmap • Vulnerability Assessment • OpenVAS (nessus replacement) • Pen Testing Tools • metasploit framework • Password Crackers • john the ripper, ophcrack • Wireless Security Tools • aircrack-ng, kismet • Honeypots • kippo • Security Focused Distributions • Notes on Hardening • Dispelling some bullshit

5. protocol analysis • capture and analyze network traffic • promiscuous mode • Wireshark is extremely popular and powerful • uses pcap to capture packets • capture ethernet, 802.11, PPP and loopback traffic • "knows" about different networking protocols and can display useful information about each • use filters to find relevant data • used to need special privileges, can run as normal user on most platforms now • CLI interface Tshark

6. Sniffing, Intercepting • MITM - man in the middle • Ettercap is highly regarded and very powerful • use in promiscuous mode • four modes (IP, MAC, ARP, PublicARP) • can sniff encrypted traffic (SSH, HTTPS) • Password collectors for tons of protocols • inject into an established connection • hijack dns • alter/drop packets • can detect other poisoners on the network

7. port scanning • self descriptive, designed to probe and scan for open ports • Nmap is THE port scanner. Just use it •  very comprehensive and smart • accounts for network conditions during the scan • turned into a swiss army knife due to excellent community • OS fingerprinting • names and versions of running services • estimated uptime • presence of firewall • type of device • new scripting engine (SoC project) • ZenWalk gui available (also SoC project)

8. Vulnerability Assessments • meant to be a one stop shop for discovering vulnerabilities in systems • port scanning, enumerator, web app scanner, exploit checks, default accounts and passwords, misconfigurations, DoS checks, etc • Nessus is huge in the industry (OpenVAS is the open source implementation) • exploits published regularly as a "feed" • attacks are written in NASL (nessus attack scripting language)

9. Penetration Testing Tools • often used in conjunction with vulnerability scans to actively attempt to penetrate a system • very broad term • Metasploit Framework is becoming the de facto standard for vulnerability development • largest ruby project in existence • often times new exploits will include a Metasploit module that includes full details of the exploit • choose exploit -> check if exploit applies -> configure payload -> configure encoding to evade IDS -> execute the exploit • includes an extensive shell code and opcode database with full source code

10. password crackers • two main modes • dictionary (rainbow tables) • brute force • John The Ripper probably most popular • can auto detect password type •  DES flavors, LM Hash (MD5), SHA, Blowfish, Kerberos AFS •  can be fed rainbow tables • pretty simple to use • Ophcrack • Cracks windows LM hash passwords via rainbow tables • some basic tables provided • livecd available

11. Honeypots • valuable recon tool • set up to look like a vulnerable machine, really used to divert attacks and possibly gather information • distraction tool • research attack methods • watch skiddies try and fail over and over • sometimes turn out to be pretty entertaining • Kippo is a simple open source honeypot with recording capabilities

12. security distros • backtrack linux  • includes most of the tools we'll talk about tonight • one of the best (most up to date) security live cd  • latest release is 4r2 • knoppix std •  used to be an excellent security live cd • now stagnant unfortunately • damn vulnerable linux • pretty much exactly what it sounds like • designed to be easy to break, good for learning about vulnerabilities • almost all of these tools are available in distribution repositories

13. notes on hardening • mandatory vs. discretionary access control • intrusion detection systems • reduce your attack surface • close unneeded ports (port knocking) • disable unneeded services • open source vs. proprietary • aka: security through obscurity = FAIL • intrusion detection systems • regular security auditing • always be aware of social engineering  • use key login for ssh, disable password login • use a password for you key and protect it! • disable root login via ssh • disable smtp open relays

14. dispelling some bullshit • upping password change frequency not really that helpful, false sense of security • good idea to write down passwords? • argument still going on about this • bruce schneier seems to think it's ok • changing default ports doesn't really do much • auto scanners are patient b/c they're, well, machines • hashing != encryption • not broadcasting SSID doesn't really do much • neither does MAC black/whitelisting • DON'T USE DICTIONARY WORDS IN PASSWORDS • use different passwords for sites! • physical access = root

15. dispelling more bullshit • beware of unencrypted access points • free public wifi • pay attention to those messages about server keys changing • phishing can get anyone, even smart people • Linux and OSX do have nasty attacks out there • just a matter of time people • don't assume you're automatically secure • DO NOT rely on tor for confidentiality • malicious nodes are not unheard of • Don't let anyone convince you that they are omniscient just because they have a CISSP • as mentioned before...security via obscurity == FAIL • don't connect LOIC via hivemind, regardless of what people on the anonops irc channel tell you