HACK PROOFING YOUR NETWORK: INTERNET TRADECRAFT
CONTENTS PART I: THEORY AND IDEALS CHAPTER 1: POLITICS INTRODUCTION DEFINITIONS OF THE WORD HACKER HACKER CRACKER SCRIPT KIDDIE PHREAK WHITE HAT/BLACK HAT GREY HAT HACKTIVISM THE ROLE OF THE HACKER CRIMINAL MAGICIAN SECURITY PROFESSIONAL CONSUMER ADVOCATE CIVIL RIGHTS ACTIVIST CYBER WARRIOR MOTIVATION RECOGNITION ADMIRATION CURIOSITY POWER & GAIN REVENGE LEGAL/MORAL ISSUES WHAT’S ILLEGAL REASONABLY SAFE WHAT’S RIGHT? EXCEPTIONS? THE HACKER CODE WHY THIS BOOK? PUBLIC VS PRIVATE RESEARCH WHO IS AFFECTED WHEN AN EXPLOIT IS RELEASED? SUMMARY FAQS CONTENTS CHAPTER 2 LAWS OF SECURITY WHAT ARE THE LAWS OF SECURITY? CLIENT-SIDE SECURITY DOESN'T WORK APPLYING THE LAW EXCEPTIONS DEFENSE YOU CAN'T EXCHANGE ENCRYPTION KEYS WITHOUT A SHARED PIECE OF INFORMATION VIRUSES AND TROJANS CANNOT BE 100 PERCENT PROTECTED AGAINST FIREWALLS CANNOT PROTECT YOU 100 PERCENT FROM ATTACK SOCIAL ENGINEERING ATTACKING EXPOSED SERVERS ATTACKING THE FIREWALL DIRECTLY CLIENT-SIDE HOLES SECRET CRYPTOGRAPHIC ALGORITHMS ARE NOT SECURE IF A KEY ISN'T REQUIRED, YOU DON'T HAVE ENCRYPTION; YOU HAVE ENCODING PASSWORDS CANNOT BE SECURELY STORED ON THE CLIENT UNLESS THERE IS ANOTHER PASSWORD TO PROTECT THEM IN ORDER FOR A SYSTEM TO BEGIN TO BE CONSIDERED SECURE, IT MUST UNDERGO AN INDEPENDENT SECURITY AUDIT SECURITY THROUGH OBSCURITY DOESN'T WORK CONTENTS DEFENSE PEOPLE BELIEVE THAT SOMETHING IS MORE SECURE SIMPLY BECAUSE IT'S NEW WHAT CAN GO WRONG WILL GO WRONG CHAPTER 3: CLASSES OF ATTACK WHAT ARE THE CLASSES OF ATTACK? DENIAL-OF-SERVICE INFORMATION LEAKAGE FILE CREATION, READING, MODIFICATION, REMOVAL MISINFORMATION SPECIAL FILE/DATABASE ACCESS ELEVATION OF PRIVILEGES PROBLEMS HOW DO YOU TEST FOR VULNERABILITY WITHOUT EXERCISING THE EXPLOIT? HOW TO SECURE AGAINST THESE CLASSES OF ATTACK CHAPTER 4: METHODOLOGY TYPES OF PROBLEMS BLACK BOX CHIPS UNKNOWN REMOTE HOST TRANSLUCENT BOX TOOLS SYSTEM MONITORING TOOLS PACKET SNIFFING DEBUGGERS, DECOMPILERS, AND RELATED TOOLS CRYSTAL BOX CONTENTS PROBLEMS COST/AVAILABILITY OF TOOLS OBTAINING/CREATING A DUPLICATE ENVIRONMENT HOW TO SECURE AGAINST THESE METHODOLOGIES LIMIT INFORMATION GIVEN AWAY ADDITIONAL RESOURCES PART II: THEORY AND IDEALS CHAPTER 5: DIFFING WHAT IS DIFFING? FILES FILE COMPARISON TOOLS HEX EDITORS FILE SYSTEM MONITORING TOOLS OTHER TOOLS CHECKSUMS/HASHES COMPRESSION/ENCRYPTION HOW TO SECURE AGAINST DIFFING CHAPTER 6: CRYPTOGRAPHY AN OVERVIEW OF CRYPTOGRAPHY AND SOME OF ITS ALGORITHMS (CRYPTO 101) HISTORY ENCRYPTION KEY TYPES ALGORITHMS SYMMETRIC ALGORITHMS ASYMMETRIC ALGORITHMS PROBLEMS WITH CRYPTOGRAPHY SECRET STORAGE UNIVERSAL SECRET ENTROPY AND CRYPTOGRAPHY BRUTE FORCE L0PHTCRACK CRACK JOHN THE RIPPER OTHER WAYS BRUTE FORCE ATTACKS ARE BEING USED DISTRIBUTEDNET DEEP CRACK CONTENTS REAL CRYPTANALYSIS DIFFERENTIAL CRYPTANALYSIS SIDE-CHANNEL ATTACKS CHAPTER 7: UNEXPECTED INPUT WHY UNEXPECTED DATA IS DANGEROUS SITUATIONS INVOLVING UNEXPECTED DATA HTTP/HTML UNEXPECTED DATA IN SQL QUERIES DISGUISING THE OBVIOUS FINDING VULNERABILITIES BLACK-BOXING USE THE SOURCE (LUKE) APPLICATION AUTHENTICATION PROTECTION: FILTERING BAD DATA ESCAPING CHARACTERS IS NOT ALWAYS ENOUGH PERL COLD FUSION/COLD FUSION MARKUP LANGUAGE (CFML) ASP PHP PROTECTING YOUR SQL QUERIES SILENTLY REMOVING VS ALERTING ON BAD DATA INVALID INPUT FUNCTION TOKEN SUBSTITUTION AVAILABLE SAFETY FEATURES COLD FUSION/COLD FUSION MARKUP LANGUAGE MYSQL CHAPTER 8: BUFFER OVERFLOW WHAT IS A BUFFER OVERFLOW? SMASHING THE STACK HELLO BUFFER WHAT HAPPENS WHEN I OVERFLOW A BUFFER? METHODS TO EXECUTE PAYLOAD DIRECT JUMP (GUESSING OFFSETS) BLIND RETURN POP RETURN CONTENTS CALL REGISTER PUSH RETURN WHAT IS AN OFFSET? NO OPERATION (NOP) SLED OFF-BY-ONE STRUCT POINTER DEREFERENCING—SMASHING THE HEAP CORRUPTING A FUNCTION POINTER TRESPASSING THE HEAP DESIGNING PAYLOAD CODING THE PAYLOAD INJECTION VECTOR LOCATION OF PAYLOAD THE PAYLOAD CONSTRUCTION KIT GETTING BEARINGS FINDING THE DATA SECTION, USING A CANARY ENCODING DATA XOR PROTECTION USING WHAT YOU HAVE—PRELOADED FUNCTIONS HASHING LOADER LOADING NEW LIBRARIES AND FUNCTIONS WININETDLL CONFINED SET DECODING NYBBLE-TO-BYTE COMPRESSION BUILDING A BACKWARD BRIDGE BUILDING A COMMAND SHELL “THE SHINY RED BUTTON”—INJECTING A DEVICE DRIVER INTO KERNEL MODE WORMS FINDING NEW BUFFER OVERFLOW EXPLOITS PART III: REMOTE ATTACKS CHAPTER 9: SNIFFING WHAT IS “SNIFFING?” HOW IS SNIFFING USEFUL TO AN ATTACKER? HOW DOES IT WORK? WHAT TO SNIFF? AUTHENTICATION INFORMATION TELNET (PORT 23) FTP (PORT 21) POP (PORT 110) IMAP (PORT 143) NNTP (PORT 119) REXEC (PORT 512) RLOGIN (PORT 513) X11 (PORT 6000+) CONTENTS NFS FILE HANDLES WINDOWS NT AUTHENTICATION OTHER NETWORK TRAFFIC SMTP (PORT 25) HTTP (PORT 80) COMMON IMPLEMENTATIONS NETWORK ASSOCIATES SNIFFER PRO NT NETWORK MONITOR TCPDUMP DSNIFF ESNIFFC SNIFFIT ADVANCED SNIFFING TECHNIQUES SWITCH TRICKS ARP SPOOFING ARP FLOODING ROUTING GAMES OPERATING SYSTEM INTERFACES LINUX BSD LIBPCAP WINDOWS PROTECTION ENCRYPTION SECURE SHELL (SSH) SWITCHING DETECTION LOCAL DETECTION NETWORK DETECTION DNS LOOKUPS LATENCY DRIVER BUGS ANTISNIFF NETWORK MONITOR CHAPTER 10: SESSION HIJACKING WHAT IS SESSION HIJACKING? TCP SESSION HIJACKING TCP SESSION HIJACKING WITH PACKET BLOCKING ROUTE TABLE MODIFICATION ARP ATTACKS TCP SESSION HIJACKING TOOLS JUGGERNAUT HUNT CONTENTS UDP HIJACKING OTHER HIJACKING HOW TO PROTECT AGAINST SESSION HIJACKING STORM WATCHERS CHAPTER 11: SPOOFING: ATTACKS ON TRUSTED IDENTITY WHAT IT MEANS TO SPOOF SPOOFING IS IDENTITY FORGERY SPOOFING IS AN ACTIVE ATTACK AGAINST IDENTITY CHECKING PROCEDURES SPOOFING IS POSSIBLE AT ALL LAYERS OF COMMUNICATION SPOOFING IS ALWAYS INTENTIONAL SPOOFING MAY BE BLIND OR INFORMED, BUT USUALLY INVOLVES ONLY PARTIAL CREDENTIALS SPOOFING IS NOT THE SAME THING AS BETRAYAL SPOOFING IS NOT ALWAYS MALICIOUS SPOOFING IS NOTHING NEW BACKGROUND THEORY THE IMPORTANCE OF IDENTITY THE EVOLUTION OF TRUST ASYMMETRIC SIGNATURES BETWEEN HUMAN BEINGS ESTABLISHING IDENTITY WITHIN COMPUTER NETWORKS RETURN TO SENDER IN THE BEGINNING, THERE WAS…A TRANSMISSION CAPABILITY CHALLENGES ABILITY TO TRANSMIT: “CAN IT TALK TO ME?” ABILITY TO RESPOND: “CAN IT RESPOND TO ME?” ABILITY TO ENCODE: “CAN IT SPEAK MY LANGUAGE?” ABILITY TO PROVE A SHARED SECRET: “DOES IT SHARE A SECRET WITH ME?” ABILITY TO PROVE A PRIVATE KEYPAIR: “CAN I RECOGNIZE YOUR VOICE?” ABILITY TO PROVE AN IDENTITY KEYPAIR: “IS ITS IDENTITY INDEPENDENTLY REPRESENTED IN MY KEYPAIR?” CONFIGURATION METHODOLOGIES: BUILDING A TRUSTED CAPABILITY INDEX LOCAL CONFIGURATIONS VS CENTRAL CONFIGURATIONS DESKTOP SPOOFS THE PLAGUE OF AUTO-UPDATING APPLICATIONS IMPACTS OF SPOOFS SUBTLE SPOOFS AND ECONOMIC SABOTAGE SUBTLETY WILL GET YOU EVERYWHERE CONTENTS SELECTIVE FAILURE FOR SELECTING RECOVERY ATTACKING SSL THROUGH INTERMITTENT FAILURES CHAPTER: 12 SERVER HOLES WHAT ARE SERVER HOLES? DENIAL OF SERVICE DAEMON/SERVICE VULNERABILITIES PROGRAM INTERACTION VULNERABILITIES COMPROMISING THE SERVER GOALS STEPS TO REACH OUR GOAL HAZARDS TO KEEP IN MIND PLANNING NETWORK/MACHINE RECON RESEARCH/DEVELOP EXECUTE THE ATTACK CLEANUP CHAPTER 13: CLIENT HOLES THREAT SOURCE MALICIOUS SERVER MASS VS TARGETED ATTACK LOCATION OF EXPLOIT DROP POINT MALICIOUS PEER E-MAILED THREAT EASY TARGETS SESSION HIJACKING AND CLIENT HOLES HOW TO SECURE AGAINST CLIENT HOLES MINIMIZE USE ANTI-VIRUS SOFTWARE LIMITING TRUST CLIENT CONFIGURATION CHAPTER 14: VIRUSES, TROJAN HORSES, AND WORMS HOW DO VIRUSES, TROJANS HORSES, AND WORMS DIFFER? VIRUSES CONTENTS MACRO VIRUS TROJAN HORSES HOAXES ANATOMY OF A VIRUS PROPAGATION PAYLOAD OTHER TRICKS OF THE TRADE DEALING WITH CROSS-PLATFORM ISSUES JAVA MACRO VIRUSES RECOMPILATION PROOF THAT WE NEED TO WORRY MORRIS WORM ADMW0RM MELISSA AND I LOVE YOU CREATING YOUR OWN MALWARE NEW DELIVERY METHODS OTHER THOUGHTS ON CREATING NEW MALWARE HOW TO SECURE AGAINST MALICIOUS SOFTWARE WEB BROWSER SECURITY ANTI-VIRUS RESEARCH PART IV: REPORTING CHAPTER 15 REPORTING SECURITY PROBLEMS SHOULD YOU REPORT SECURITY PROBLEMS? WHO TO REPORT SECURITY PROBLEMS TO? FULL DISCLOSURE REPORTING SECURITY PROBLEMS TO VENDORS REPORTING SECURITY PROBLEMS TO THE PUBLIC PUBLISHING EXPLOIT CODE REPERCUSSIONS FROM VENDORS RISK TO THE PUBLIC HOW TO SECURE AGAINST PROBLEM REPORTING MONITORING LISTS VULNERABILITY DATABASES PATCHES RESPONSE PROCEDURE