HACKERS BEWARE
CHAPTER 1 INTRODUCTION 1 CHAPTER 2 HOW AND WHY HACKERS DO IT 23 CHAPTER 3 INFORMATION GATHERING 70 CHAPTER 4 SPOOFING 115 CHAPTER 5 SESSION HIJACKING 159 CHAPTER 6 DENIAL OF SERVICE ATTACKS 198 CHAPTER 7 BUFFER OVERFLOW ATTACKS 270 CHAPTER 8 PASSWORD SECURITY 315 CHAPTER 9 MICROSOFT NT PASSWORD CRACKERS 349 CHAPTER 10 UNIX PASSWORD CRACKERS 386 CHAPTER 11 FUNDAMENTALS OF MICROSOFT NT 427 CHAPTER 12 SPECIFIC EXPLOITS FOR NT 458 CHAPTER 13 FUNDAMENTALS OF UNIX 531 CONTENTS CHAPTER 1 INTRODUCTION NO MATTER WHAT FIELD YOU WORK IN YOU CANNOT HELP BUT NOTICE THE IMPACT THAT THE INTERNET HAS HAD ON SOCIETY IT HAS OPENED UP OPPORTUNITIES AND MARKETS THAT PEOPLE ONLY DREAMED OF BEFORE AS WITH ANY NEW TECHNOLOGY THERE IS ALWAYS A POSITIVE AND NEGATIVE ASPECT THE POSITIVE SIDE IS THE TREMENDOUS BUSINESS OPPORTUNITIES THE NEGATIVE SIDE IS THE HUGE SECURITY RISK THAT IS NOW POSED TO SO MANY COMPANIES YET FEW COMPANIES ARE TRULY AWARE OF THE POTENTIAL DANGER IT S LIKE GETTING IN A BRAND NEW CAR AND DRIVING DOWN THE ROAD AT 80MPH ONLY TO REALIZE THAT THE ENGINEERS DID NOT EQUIP THE CAR WITH BREAKS IF THIS DID OCCUR AND A LARGE NUMBER OF PEOPLE BOUGHT THE CAR THE NET RESULT WOULD BE A HIGH NUMBER OF FATALITIES BECAUSE THE PROPER BREAKING WAS NOT BUILT INTO THE CAR THE SAME THING IS OCCURRING WITH THE INTERNET NOW THAT COMPANIES HAVE INVESTED MILLIONS OF DOLLARS IN THIS NEW INFRASTRUCTURE THEY REALIZE THAT SECURITY WAS NOT PROPERLY BUILT IN AND NOW THEIR ENTIRE COMPANIES ARE VULNERABLE THE POINT OF THIS BOOK IS THAT THERE IS NO WAY TO PROPERLY PROTECT A COMPANY S NETWORK UNLESS YOU KNOW WHAT YOU RE UP AGAINST ONLY BY UNDERSTANDING HOW ATTACKS WORK AND WHAT AN ATTACKER DOES TO COMPROMISE A MACHINE CAN A COMPANY POSITION ITSELF SO THAT IT CAN BE PROPERLY PROTECTED IF SOMEONE TELLS YOU TO PROTECT A SITE AGAINST A CERTAIN THREAT AND YOU DON T UNDERSTAND WHAT THE THREAT IS OR HOW IT WORKS YOU CANNOT PROTECT AGAINST IT KNOWING WHAT AN ATTACKER CAN DO TO COMPROMISE YOUR SYSTEM AND WHAT THAT COMPROMISE LOOKS LIKE ON A NETWORK ALLOWS YOU TO BUILD A SECURE SYSTEM ALTHOUGH THIS BOOK GOES INTO TECHNIQUES USED TO HACK A MACHINE AND PERFORM COMMON EXPLOITS IT IS NOT MEANT TO BE A HANDBOOK ON HOW TO HACK IT IS MEANT TO HELP A COMPANY PROPERLY CLOSE UP ITS VULNERABILITIES AND PROTECT ITS COMPUTERS I WANT TO MAKE YOU AWARE OF THE TOOLS THAT ARE AVAILABLE AND HOW EASY THEY ARE TO USE AND I WANT TO SHOW YOU WHAT A COMPANY MUST DO TO HAVE A SECURE NETWORK THE GOLDEN AGE OF HACKING BASED ON EVERYTHING WE KNOW THIS TRULY SEEMS TO BE THE GOLDEN AGE OF HACKING TO SUM THINGS UP IT IS A GREAT TIME TO BE A HACKER BECAUSE THERE ARE SO MANY POSSIBLE SYSTEMS TO BREAK INTO AND MOST OF THEM HAVE SUCH WEAK SECURITY ATTACKERS CAN PICK AND CHOOSE WHICH MACHINES TO GO AFTER TO MAKE MATTERS WORSE MOST COMPANIES HAVE INSUFFICIENT INFORMATION OR RESOURCES TO TRACK THESE ATTACKERS SO EVEN IF THEY ARE DETECTED THEIR CHANCES OF GETTING CAUGHT ARE SLIM NO ONE POLICES THE INTERNET AND IN TERMS OF KNOWLEDGE AND EXPERIENCE ATTACKERS HAVE THE UPPER HAND NOT ONLY IS IT A GOOD TIME TO 1 BE A HACKER BUT IT IS A GOOD TIME TO BE A SECURITY PROFESSIONAL THERE IS PLENTY OF WORK AND A WHOLE LOT OF CHALLENGES AHEAD A RECENT AND WELL KNOWN EXAMPLE OF HACKING ATTACKS HAPPENED IN FEBRUARY OF 2000 SEVERAL LARGE SITES ON THE INTERNET WERE ATTACKED WITHIN IN A SHORT PERIOD OF TIME THE TYPE OF ATTACK WAS A DISTRIBUTED DENIAL OF SERVICE ATTACK IN WHICH COMPANY WEB SITES BECAME UNREACHABLE TO LEGITIMATE USERS THESE ATTACKS WILL BE DISCUSSED IN DETAIL IN CHAPTER 6 DENIAL OF SERVICE ATTACKS FROM A BUSINESS PERSPECTIVE THIS HAD A LARGE IMPACT ON THE VICTIM COMPANIES FOR ONE COMPANY AN ONLINE BOOKSTORE THE ATTACK RESULTED IN LOST REVENUE NOT ONLY DID THE COMPANY LOSE SALES BUT IT LOST CUSTOMERS LET S LOOK AT AN EXAMPLE IF A CUSTOMER INTENDING TO BUY SOMETHING ONLINE TRIES TO CONNECT TO A COMPANY S WEB SITE AT 10 00 P M AND THE WEB BROWSER DISPLAYS THE MESSAGE WEB SITE UNAVAILABLE HE MIGHT TRY BACK AT 10 45 P M WHEN THE CUSTOMER TRIES AGAIN AT 11 30 P M AND STILL RECEIVES THE SAME MESSAGE MORE THAN LIKELY THE CUSTOMER WILL GO TO A COMPETITOR TO BUY THE PRODUCT WITH THE AMOUNT OF COMPETITION ON THE INTERNET IF A CUSTOMER CANNOT ACCESS A SITE IN A MATTER OF SECONDS HE WILL QUICKLY GIVE UP AND GO TO A DIFFERENT SITE IRONICALLY COMPANIES WERE SO AFRAID OF THE Y2K PROBLEM THAT THEY DUMPED LARGE SUMS OF MONEY INTO FIXING IT IN SEVERAL CASES IT SEEMED LIKE A WASTE BECAUSE THE PROBLEM WAS OVERESTIMATED AND HYPED BY THE MEDIA NOW THERE IS A PROBLEM FAR WORSE BUT COMPANIES ARE LOOKING THE OTHER WAY THEY DO NOT WANT TO INVEST THE MONEY THERE ARE SEVERAL REASONS WHY SO MANY COMPANIES ARE VULNERABLE BUT ONE OF THE MAIN REASONS IS LACK OF AWARENESS COMPANIES HAVE NOT REALIZED AND STILL DO NOT REALIZE THE THREAT ONE OF MY GOALS IN WRITING THIS BOOK IS TO MAKE PEOPLE AWARE OF THE THREAT AND THE TOOLS THAT EXIST TO PROTECT THEIR SITES IGNORANCE IS DEADLY BUT KNOWLEDGE IS POWER IF AN ATTACKER BREAKS INTO YOUR HOUSE WITH AN ARSENAL OF GUNS AND YOU HAVE NO WEAPONS YOU CANNOT DEFEND YOURSELF ON THE OTHER HAND IF YOU ARE PROPERLY TRAINED ON WEAPONS AND KNOW THE LIMITATIONS OF THE WEAPONS THE INTRUDER IS USING YOU HAVE AN UPPER HAND THIS IS THE EXACT PURPOSE OF THIS BOOK GIVING IT PROFESSIONALS THE TOOLS AND TECHNIQUES ATTACKERS USE TO BREAK INTO SITES EQUIPS THEM WITH THE PROPER DEFENSES HOW BAD IS THE PROBLEM TO LIST ALL THE SITES THAT HAVE BEEN HACKED WOULD TAKE UP SEVERAL PAGES IF NOT AN ENTIRE BOOK THIS SECTION IS MEANT TO GIVE A SAMPLE OF SOME OF THE SITES THAT HAVE BEEN HACKED TO ILLUSTRATE HOW BAD THE PROBLEM IS THE EXAMPLES THAT FOLLOW WHICH WERE TAKEN DIRECTLY OFF THE INTERNET RANGE FROM COMMERCIAL TO GOVERNMENT SITES NATIONAL TO INTERNATIONAL AND ENTERTAINMENT TO NOT FOR PROFIT SITES NO ONE IS SAFE NO MARKET HAS BEEN SPARED FROM HACKING ANY COMPANY CAN BE HACKED IF IT IS CONNECTED TO THE INTERNET NO MATTER WHERE IT IS OR WHAT IT DOES THE FOLLOWING IS A LIST OF SOME SITES THAT HAVE BEEN HACKED U S DEPARTMENT OF COMMERCE CHURCH OF CHRIST UNICEF VALUJET NASA 2 UNITED STATES AIR FORCE CIA MALAYSIAN GOVERNMENT GREENPEACE TUCOWS PHILIPPINE S IRS STAR WARS SIX FLAGS CARTOON NETWORK UNIVERSITY OF TEXAS NY TIMES DOMINOS COMDEX MOTOROLA FOX MOST OF THESE WERE WEB SITE ATTACKS WHERE AN ATTACKER WENT IN AND CHANGED THE CONTENT ALSO KNOWN AS WEB GRAFFITI ATTACKS BECAUSE THESE WERE WEB GRAFFITI ATTACKS IT WAS FAIRLY OBVIOUS THAT THE SITES WERE COMPROMISED WITH ATTACKS WHERE INFORMATION IS ACQUIRED IN A LESS OBVIOUS WAY THERE IS A GOOD CHANCE THAT YOU WOULD NOT KNOW ABOUT IT IF YOU SEARCH ON THE WEB FOR HACKED SITES OR SIMILAR TERMS YOU CAN SEE A WIDE RANGE OF GRAFFITI ATTACKS JUST BE WARNED THAT SEVERAL OF THEM COULD BE OFFENSIVE TO JUST ABOUT ANYONE THE FOLLOWING IS AN EXAMPLE OF A WEB SITE HACK OF A MAJOR SEARCH ENGINE WHEN USERS CONNECTED TO THE SEARCH ENGINE S URL INSTEAD OF RECEIVING THE NORMAL WEB SITE THEY RECEIVED THE FOLLOWING P4NTZ H4GIS W0RLD D0M1N4T10N 97 FOR THE PAST MONTH ANYONE WHO HAS VIEWED THIS PAGE USED THEIR SEARCH ENGINE NOW HAS A LOGIC BOMB WORM IMPLANTED DEEP WITHIN THEIR COMPUTER THE WORM PART OF THIS VIRUS IN LAYMAN S TERMS SPREADS ITSELF ACROSS INTERNAL NETWORKS THAT THE INFECTED MACHINE IS ON BINARY PROGRAMS ARE ALSO INFECTED ON CHRISTMAS DAY 1997 THE LOGIC BOMB PART OF THIS VIRUS WILL BECOME ACTIVE WREAKING HAVOC UPON THE ENTIRE PLANET S NETWORKS THE VIRUS CAN BE STOPPED 3