Terminology The opponent Attack demonstration Mitigation Hacking Demystified Johnny Vestergaard – 4 / 57 The views and opinions expressed in this presentation are the personal views of the speaker and do not necessarily reflect the views, policies or procedures of present or past employers. All information tactics techniques and procedures used or mentioned during this presentation are based solely on open and public accessable sources.
purpose • Terminology The opponent Attack demonstration Mitigation Hacking Demystified Johnny Vestergaard – 5 / 57 «So it is said that if you know your enemies and know yourself, you can win a hundred battles without a single loss. If you only know yourself, but not your opponent, you may win or may lose. If you know neither yourself nor your enemy, you will always endanger yourself.» -Sun Tzu
Vulnerability ◦ A weakness in a piece of software which can compromise the security of the computer system involved. • Exploit ◦ A piece of code or a technique which allows an attacker to exploit a vulnerability. • Zero day exploit / vulnerability ◦ Exploiting or having knowledge of a vulnerability before it is publicly announced.
• Terminology The opponent • Opponent types • The hacktivist • Attack timeline • Plain old (digital) criminal • State actors Attack demonstration Mitigation Hacking Demystified Johnny Vestergaard – 8 / 57 This presentation will have focus on the following types of opponents: • The hacktivist • Plain old (digital) criminal • State and state-sponsored actors
• Promote a political message or agenda. • Loosly organized, a few lone wolves. • Terrorism or activism? Depends on the observer... • Defacement, Doxing, DoS, Data dumps, etc • Tend to use old and well-proven techniques • Anonymous, The Jester, Cyber Hezbollah.
and purpose • Terminology The opponent Attack demonstration • Tools of the trade • Case information • Penetrate through VPN • Password hashing • Jump to classified side • Summary Mitigation Hacking Demystified Johnny Vestergaard – 10 / 57
and purpose • Terminology The opponent Attack demonstration Mitigation • SQL Injection • Secure storage of passwords • ARP Poisioning • Client-side angreb • The End Hacking Demystified Johnny Vestergaard – 29 / 57 Værktøjer brugt under angrebet: • Backtrack (http://www.backtrack-linux.org) • Arpspoof (http://arpspoof.sourceforge.net) • John the ripper (http://www.openwall.com/john/) • Metasploit (http://metasploit.com/)
• Terminology The opponent Attack demonstration Mitigation • SQL Injection • Secure storage of passwords • ARP Poisioning • Client-side angreb • The End Hacking Demystified Johnny Vestergaard – 30 / 57 Target: A small privately held research company on the verge of a breakthrough within development of an effective HIV vaccine. Goal: Collect scientific information in such a degree that our customer will be able to recreate ACME’s new vaccine.
and purpose • Terminology The opponent Attack demonstration Mitigation • SQL Injection • Secure storage of passwords • ARP Poisioning • Client-side angreb • The End Hacking Demystified Johnny Vestergaard – 31 / 57
Ethics and purpose • Terminology The opponent Attack demonstration Mitigation • SQL Injection • Secure storage of passwords • ARP Poisioning • Client-side angreb • The End Hacking Demystified Johnny Vestergaard – 37 / 57 SELECT ∗ FROM a r t i c l e WHERE content LIKE ’%ELVIS%’ OR 1=convert ( int , ’ H i l l b i l l y ’ )
Ethics and purpose • Terminology The opponent Attack demonstration Mitigation • SQL Injection • Secure storage of passwords • ARP Poisioning • Client-side angreb • The End Hacking Demystified Johnny Vestergaard – 37 / 57 SELECT ∗ FROM a r t i c l e WHERE content LIKE ’%ELVIS%’ OR 1=convert ( int , ’ H i l l b i l l y ’ ) Conversion failed when converting the varchar value ’Hillbilly’ to data type int.
Pseudo code to identify the cleartext which goes with the digest above: possibleWords = [ " Horse " , " Cat " , " Closet " , " Automobile " . . . ] for word in possibleWords i f (md5( word ) == " d910eb044a857f9ee . . . " ) return word
• Ethics and purpose • Terminology The opponent Attack demonstration Mitigation • SQL Injection • Secure storage of passwords • ARP Poisioning • Client-side angreb • The End Hacking Demystified Johnny Vestergaard – 41 / 57 • HBGary Federal, Feb 2011 ◦ SQL Injection • http://www.hbgaryfederal.com/pages.php?pageNav=2&page=27 ◦ Extract of login, emails and hashes. ◦ Used for intrusion on HBGary’s servers, twitter account, etc. ◦ Publication of internal data. • Barracuda Networks, April 2011 ◦ During maintenance of the application firewall a hacker conducted his attack. • How did he know the firewall was down at this exact time? ◦ Extract of login, emails og hashes. ◦ Used for? • A1 on OWASP Top 10 Application Security Risks.
and purpose • Terminology The opponent Attack demonstration Mitigation • SQL Injection • Secure storage of passwords • ARP Poisioning • Client-side angreb • The End Hacking Demystified Johnny Vestergaard – 42 / 57
and purpose • Terminology The opponent Attack demonstration Mitigation • SQL Injection • Secure storage of passwords • ARP Poisioning • Client-side angreb • The End Hacking Demystified Johnny Vestergaard – 43 / 57
• Ethics and purpose • Terminology The opponent Attack demonstration Mitigation • SQL Injection • Secure storage of passwords • ARP Poisioning • Client-side angreb • The End Hacking Demystified Johnny Vestergaard – 49 / 57 • RSA, March 2011 ◦ Pretty simple mail attack to create bridgehead into RSA’s network. Attached to the mail was a excel document with an embedded zero-day Flash exploit, payload used was Poison Ivy. ◦ Purpose of the hack was to collect classified information on secureID (!!).
• Terminology The opponent Attack demonstration Mitigation Hacking Demystified Johnny Vestergaard – 52 / 57 • Input validation (Server-side!) • Separation of code and data ◦ C#: SQLParameter. SqlCommand cmd = new SqlCommand ( "SELECT ∗ FROM a r t i c l e s WHERE content LIKE %@searchString%" , connection ) ; cmd . Parameters .Add(new SqlParameter { ParameterName = " @searchString " , Value=searchString } ) ; • Værktøjer ◦ SQLMap (http://sqlmap.sourceforge.net/) ◦ Skipfish (http://code.google.com/p/skipfish/)
and purpose • Terminology The opponent Attack demonstration Mitigation Hacking Demystified Johnny Vestergaard – 54 / 57 • Do not store plaintext passwords - store a hash of the password! • Hashing != encryption • Goal: Maximise the time a opponent must use (waste) to crack our passwords. ◦ SALTing. ◦ Password length and complexitity. • ...dont use passwords?
• Terminology The opponent Attack demonstration Mitigation Hacking Demystified Johnny Vestergaard – 55 / 57 • Static arp tables on each and every host. • Restrict switch ports to specific MAC addresses. • Detection of suspect ARP traffic (arpwatch). • 802.1X.
johnnykv
otanet
cdataj
yutaokafuji
miyatakoji
line_developers_tw
junki
uhyo
ymatsuwitter
tomoyks
moepy_stats
kumaiu
_kensh
katarinadahlin
sferik
stephaniewalter
aleyda
madoxten
techseoconnect
.jpg){kind=avatar}
cargoodrich
inesmontani
rasagy
cassininazir
rabernat
