Information Security Threats and Vulnerabilities

These notes on information security vulnerabilities are based on the ISC2 Common Body of Knowledge [CBK].

“Danger, Will Robinson, Danger” —robot in movie "Lost In Space"
"Phew! All this computer hacking is making me thirsty!" —Homer Simpson in the Simpsons TV series

Topics this page:

Site Map  
About this site  

Definitions: Risk = Threat X Vulnerability

• Being “at risk" is being exposed to threats.
• Risks are subjective -- the potential to incur consequences of harm or loss of target assets.
• A Risk Factor is the likelihood of resources being attacked.
• Threats are dangerous actions that can cause harm. The degree of threat depends on the attacker's Skills, Knowledge, Resources, Authority, and Motives.
• Vulnerabilities are weaknesses in victims that allow a threat to become effective.

Who They Are

• A rogue user is an authorized user who, without permission, accessing restricted assets.
• A bogie is an unauthorized user who subverts security systems.
• A cracker breaks into others' computing facilities for their own personal gain - be it financial, revenge, or amusement.
• A hacktivist is a cracker with a cause. (Example of hactivism: Building Peekabooty to get around governments blocking websites)
• A terrorist uses fear to blackmail others into doing what they want.
• White Hats are also called “ethical" hackers, such as the Axent (now Symantec) Tiger Team
• Black Hats disregard generally accepted social conventions and laws.

• Script kiddie is a derogatory term for a wannabe cracker who lacks programming skills and thus relies on prewritten scripts and toolkits for their exploits.
• Journeyman is an experienced hacker: someone who has collected many tools and made many connections.
• A Puppet Master (wizard) produces exploits.
• Malware is a generic term for malicious software such as trojan horses, worms, and viruses.
• Warez is a nickname for pirated software (illegal copies of copyrighted software).
• Serialz are serial numbers illegally shared used to unlock software.

• Espionage
• steganography

Hackers congregate on the AntiCode site and Blackhat Conferences.

McAfee's virus and malicious code dictionary provides a concise yet thorough explanations of key terms.

Kevin Metnick,the world's most notorious hacker, is now out of jail and plays a CIA computer expert on the ABC spy drama, Alias.

Defenders of networks go to Defcon

The Hacker Crackdown from Bruce Sterling of MIT.

Target Assets (What's To Steal?)

Assets on machines and network servers.
• End Users' Information (trade secrets, customer data, personnel data, product plans, marketing plans, financial data, etc.).
• Application Services (ports, memory to infect)
• Registry settings (keys, values controlling
  service initiation and operation)
• Audit settings
• Group memberships and privileges
• Permissions stored in ACLs

Consequences

• Disclosure of trade secrets, customer data.
• Modification
• Destruction - Cost of cleanup (renentry of data if lost)
• Denial - Cost of litigation with affected customers, partners, shareholders, etc.
• Loss of reputation of customer trust.
• Loss of sales and customers to competitors.

• Repetition of errors
• Cascading of errors

Loss Expectancy

• Improper use of technology
• Inability to control technology
• Inability to react quickly enough
• Concentration of data
• Incorrect Data entry

The Customers of Hackers

• Current or past staff,
• Private Investigators
• Competitors, trade associations
• Rivals in a takeover
• Opposing litigants
• The press
• Criminals
• Regulatory agencies
• Foreign government intelligence agencies

Physical Facilities Security: Prevention, Detection, Suppression

Category	Threat	Preventive Measures	Detective Measures	Suppression (Stop Loss) Response & Recovery
Natural	Earth Movement (Earthquakes, Slides, Volcanos)	Tie downs
	Fire	Floor Slab flame spread rating <=25, 2 hr. rating on Walls/Ceilings, Positive pressure from AC	Smoke alarms, Inspect for elec. code violations	Sprinklers, Extinguishers
	Water (Falling rain, Rising Floods)			Shut-off valves
	Storms (Wind, Rain, Snow, Sleet, Ice)
Services	Telephone			Alternative: Cell phones
	Internet
	Electrical Power			UPS
	Gas/Heating
	Air
	Water
	Cooling
	Equipment Failure
	Personnel Illness	Health info library/classes, Health club, membership discounts	Health screenings, Medical exams	First aid kits, Wheelchairs, Guerneys
	Personnel Loss (Strikes, access, transport)
Loss	Petty Theft (Breaking & Entering), Vandalism	Fences, gates	Lighting, Guards, Escorts, CCTV, Motion detectors, Facial recognition	Turnstiles, Mantraps
	Seige (Armed robbery, Bombing)	Barriers, Bullet-proof glass	Detectors of metal and explosives	Armed guards with radios
	Human Error	Job Rotations	Access Logs, Change Logs, Audits
	Sabotage, Tampering	Restricted areas, Pre-employment background reference checks, Separation of Job Duties	Post-employment Security clearances, Credit checks, Supervisory Ratings, Employee Satisfaction Surveys, Sting operations,
	Toxic Hazmat (Hazardous materials) spills & Radiation	Label product, MSDS Signs, Safety Education	Carbon Monoxide detectors, Fire Dept. Inspections	FD Hazmat Team

Threats to Electronic Data

Intrusion & Attack Modality	Dimension of Involvement	Attack Type (examples)
Interference	Active	Spam with junk mail (such as chain letters) to inform or annoy. Denial of Service: Overwhelm (ala IP Syn flooding, mail bombing, or Smurf with ICMP Echo Requests); Take advantage of software bugs (ala Buffer overflow, Ping of death, LAND) Bacteria: corrupt live data or destroy boot sector; Make back up data unrecoverable
	Passive	Worms are self-propagating malicious code that executes unauthorized computer instructions. They can infect any component (boot record, registry, .exe & .com program files, macro scripts, etc.) They do not destroy data. Viruses are worms that harm data. Rabbits - runaway applications that consume all resources (memory on machines or bandwidth on networks).
Interception of message stream	Active	Connection/Session hijacking: Active Telnet session seized Spoofing: Altering DNS namespace to setup Web Page Redirection
	Passive	Eavesdropping with a wiretap: capture data in transit. Using a packet Sniffer (Protocol Analyzer) for network traffic analysis (see patterns in text flow, packet size, etc.). Compromised Key Disseminate sensitive information for illicit gain or to embarrass organizations and individuals. [Sircam]
Impersonation	Active	IP Address Spoofing -- when a rogue site intercepts authenticated communications between legitimate users and presents altered content as legitimate. Man-in-the-middle spoofing: captured packets are tampered and reinserted into an active session pipe Crack (decrypt passwords and cyphertext by brute force or other means) Replay reusing a captured authenticator DDoS (Distributed Denial of Service) attack DNS Name Server cache loading
	Passive	Trap doors (such as Sub7, NetBus patch, or Back Orafice) to bypass noraml security and allow unauthorized/undetected entry. Trojan horses inserted to reconfigure network settings or grant root access and permissions to an unauthorized person.



• A LAND DoS attack puts TCP into a loop by sending it a TCP SYN packet with the source IP address and port number spoofed to be the same as the destination IP address and port.
• A Smurf attack occurs by changing the return address of ICMP echo request message. They are amplified when they are broadcasted in the victim's IP network. This results in a flood of ICMP reply messages. ISPs are vulnerable if they do not set firewalls to drop ICMP messages and set external Cisco routers with no ip directed-broadcast.
• Others: invalid UDP Teardrop datagram attack
• Others: fraggle attacks

  The UC Davis Vulnerbilities Project

The Five Phases of Attack/Intrusion/Incursion

Corporate Security Policy typically define these activities as unacceptable:
1. Outside Reconnaissance Probing
2. Penetration - Inside Reconnaissance
3. Escalate Priviledge - Gain Foothold and Pillage
4. Expand Influence - Exploit and Cleanup to cover tracks
5. Profit




Outside Reconnaissance

Like a burglar casing the joint, obtain publicly available information as a normal anonymous user or potential customer.

Network Reconnaissance of the footprint of the target system:

• traceroute to present potential access paths and vulnerable entry points through the target network.
• Look for Web server version information using. Grinder to scan a series of IP addresses.

Network enumeration - listing domain names and networks related to an organization from:

• search of news articles, press releases, and newsgroup postings.
• keyword search in Whois database which may contain administrator contact and IP addresses
• nslookup to walk though DNS tables.
• NMAP(Network Mapper) open source utility developed by Fyodor reports the operating systems of OSs and firewalls. Some of its techniques:
  • Reverse ARP
  • Bogus flag probe
  • TCP ISN sampling
  • FIN probes
• WhatsUp from Ipswitch.com performs a tracert.

Telecom devices (such as PhoneSweep) programmatically dial large banks of phone numbers, log valid data connections, attempt to identify the system on the other end of the phone, and optionally attempt logon by guessing common usernames and passphrases.

DNS Interrogation - If zone transfers are enabled over a network, a hacker can intercept it.

OS and Service Detection - Use NMAP from Phrack to determine what OS and services are active on a subnet.

IP stack signatures reveal the vendors, each with their own vulnerabilities (exploitable bugs).

The LSA secrets hack exploits reg key HKLM\Security\policy\secrets which stores cached credentials, web/ftp passwords, and the machine account password as well as service accts. References include http://razor.bindview.com/tools/desc/lsadump2_readme.html and HEW2K Stealing Passwords from Microsoft Operating Systems by Marcus H. Sachs March 14, 2001

Inside Reconnaissance

eTrust from Computer Associates can capture the packets of all protocols on a network and save (non SSL) pages viewed on desktops. Scary.

Use techniques which do not harm target machines.

Identify which machine names are alive with a ping sweep.

Identify which services are available on each machine using a UDP/TCP port scan/strobe.

Look for CGI scripts by walking through and capturing web pages.

DNS zone transfer

Identify which machines have NetBIOS vulnerabilities. Traditionally, attacks against Windows 2000 have been against the SMB service. More recently, is through IIS web service, installed by default.

List Folder Contents

Exploit

Take advantage of vulnerabilities to break into target systems:
• Crack logon passwords using dictionary or brute-force attempts using
  • L0pht - pronounced “Loft" - for NT4 and LC3 for Win2000 from AtStake.com is based on pwdump
  • Locksmith works with Remote Recover or NTRecover from Winternals
  • Elcomsoft's tools to crack passwords in PDF files, etc.
  • Distributed.net
  • access data crak and Password crackers, Inc boast a library of software, techniques, and resources for a price
  • benchmarks of password cracking software .
  • lostpassword.com

• Obtain elevated privileges (root) by taking advantage of buffer-overrun holes or determine NIDS thresholds by sending large amounts of data.

• Modifying cookies to access other accounts.
• Sending shell commands in input fields.
• Modifying SQL query strings in GET commands.
• Initiate emails infected with worms and Trojan horse viruses

Foot hold (Got Root!)

Once elevated privilege is obtained:
1. Hide evidence of intrusion in log files. Security Log Event ID
   • 612 - The audit policy has changed, perhaps maliciously.
   • 640 - A change has been made to the SAM database. (Was it you?)
   • 531 - An attempt was made to log on using a disabled account. (Why would anyone want to do this?)
   • 539 - A logon attempt was made and rejected because the account was locked out. (Why would anyone want to do this?)
   • 529 - An attempt was made to log on using an unknown user account or using a valid user account but with an invalid password. (An unexpected increase in the number of these audits might indicate an attempt to guess passwords.)
   • 517 - The audit log has been cleared. (Is an attacker attempting to cover her tracks?)
   • 624 - A user account has been created. (Was it created by a trusted person?)
   • 628 - A user account's password has been set. (Was this done by a trusted person?)

2. Reduce detection during future incursions:
   • Replace services with backdoor trojan horses such as “Back Orafice” Example: the Melissa virus installed a program named “Explore".
   • Create accounts with full Privileges
   • Install a rootkit

3. Provide services to other hackers, such as storing files on the compromised machine for others to obtain files. This is done by announcing availabiilty on IRC (Internet Relay Chat).

4. Use infected system to launch Distributed Denial of Service attacks on another target. This is done by installing zombies (evilbots) such as sub7 which enable infected machines to inflect other machines - achieving a “snowball effect" chain reaction.

   Note: A DDoS attack can be made more lethal by coding the attack to strike at a single time (such as April 1st) and/or address (such as whitehouse.gov).

5. To reduce the chance of being filtered and to make it more likely that intermediate targets get themselves infected, a virus may be coded to
   • Masquerade as the actual user and send emails from the address books of infected hosts. This is because most email filters do not filter out email specifically address to the recipient.
   • Use enticing subjects (such as "naked wife", celebrity names, or - in the case of Sircam - words extracted from the intermediate host's personal files.
   • Generate a list of 100 random IP addresses to scan for new servers to infect.

Profit from Attack

1. Steal information (such as credit card numbers and passwords). On Windows client machines, sensitive files are typically stored in the default “My Documents” folder.

2. Run up charges by using the modem to dial and reach a 900 number at a remote country such as Trinidad

3. On client browsers, point the default website to a malicious site.

4. Deface web pages served on web servers (such as IIS). Examples:
   • The first “Code Red" virus added “hacked by Chinese!" on websites.
   • The SunOS/Poisonbox.worm uses a Unicode buffer overflow vulnerability in the ssinc.dll on Microsoft IIS5 SP6a servers to replace index.htm/asp pages with one which displays “** CHINA Government" AND drop a renamed copy of cmd.exe (root.exe) to provide a trap door.

vulnerability Advisories

CERT from the Software Engineering Institute at the Carnegie Mellon University.
NIST Security Guidelines
BugNet and BugTraq report bugs and fixes.
Securityfocus
Neophsis
Packetstorm
NIPC (National Infrastructure Protection Center) setup mid 1998 by the FBI, publisher of
Cybernotes
CIAO

Penetration Test Tools

Talisker's Network Security Tools is a very complete list. OpenSource security tools eg. nmap, snort

Articles

SecurityFocus
ZDNet article: Denial-of-Service Attacks

Books

Computer Security Basics (O'Reilly) by by Deborah Russell and G. T. Gangemi is a good introduction.

Top Five Security Tools from Insecure.org


Book: Hacking Exposed offers detailed how-to's. Make sure to ask for the 2nd Edition. Authors Joel Scambray, Stuart McClure (editor of Security Watch Newsletter) and George Kurtz co-founded FoundStone, purveyors of “Ultimate Hacking" 3-day workshops and fport.exe which reports the process using specific ports, just as TDIMon from SysInternals.

John D. Howard's dissertation for Carnegie Mellon Univ. on the extent of hacking over the Internet

Computer Security Instituate surveys about Internet intrusions

Mitre's academic concordance of names for Common Vulnerabilities and Exposures (CVE)

Windows 2000 Security Little Black Book by Ian McLean Coriolis ISBN 1576103870

Subscribe to the free Information Security magazine bi-weekly eletter.

Network Magazine offers occassional articles about infosec.

Cerberus WebScan from AtStake

WebWasher is a local proxy to IE filters webbugs.

Book recommendation: The Blue Nowhere, a fast-paced cat-and-mouse detective novel that combines the tactics of crackers and homicide detectives against a wizard cracker turned murder. Lots of twists and turns. It's more believable than previous hacker video movies: War Games, Hackers, Sneakers.

searchsecurity.techtarget.com

hackademia.com

Figleaf offers security classes on Cold Fusion

Cryptography and Network Security by William Stallings.

Secret access code to the computer controls of the U.S. nuclear-tipped missile arsenal between 1968 and 1976 : 00000000 [Center for Defense Information (Washington)] — Harpers Index