1 / 11

Fundamentals of Computer Security

Fundamentals of Computer Security. Hacks & Counterhacks. Anatomy of a Hack. Gaining Access. Footprinting. Escalating Privilege. Scanning. Denial of Service. Pilfering. Enumeration. Covering Tracks. Creating Backdoors. Footprinting. Goals: Determine the address range of targets.

ian-stanley
Download Presentation

Fundamentals of Computer Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Fundamentals of Computer Security Hacks & Counterhacks CSCI 379 Fundamentals of Computer Security

  2. Anatomy of a Hack Gaining Access Footprinting Escalating Privilege Scanning Denial of Service Pilfering Enumeration Covering Tracks Creating Backdoors CSCI 379 Fundamentals of Computer Security

  3. Footprinting Goals: • Determine the address range of targets. • Namespace acquisition. • Information gathering. Tools: • dig, nslookup, search engines, USENet, Sam Spade. CSCI 379 Fundamentals of Computer Security

  4. DNS Zone Transfer This is really easy to carry out and needs only nslookup. > nslookup Default Server: ns1.example.net Address: 10.10.20.2 > 216.182.1.1 Server: ns1.example.net Address: 10.10.20.2 Name: gate.tellurian.net Address: 216.182.1.1 > set type=any > ls –d tellurian.net. >> /tmp/zone_out CSCI 379 Fundamentals of Computer Security

  5. DNS Security Goal: Reduce the amount of information DNS about your system that DNS can put on the Internet. Countermeasures: • Restrict zone transfers to authorized servers. • Use the allow-transfer directive in named.conf. • Firewall configuration: lookup requests are UDP, zone transfers are TCP => deny all TCP connections on port 53. • Note that these measures only slow down target acquisition, they do not make it impossible. CSCI 379 Fundamentals of Computer Security

  6. Scanning Goal: Identify entry points for the intrusion (UDP and TCP services running); identify the operating system. Techniques: • Ping sweeps. • Port scans. Tools: • icmpquery, http://packetstormsecurity.org/UNIX/scanners/ • nmap, http://www.insecure.org/nmap CSCI 379 Fundamentals of Computer Security

  7. Ping Sweep Countermeasure • Detection: Log incoming ICMP traffic; use a NIDS tool like snort (http://www.snort.org). • Prevention: Filter incoming ICMP traffic at a firewall. CSCI 379 Fundamentals of Computer Security

  8. Port Scanning Goal: Determine what UDP and TCP ports are actively listening for requests. This allows one to determine what operating system and applications are running. A future attack can use this information to match the system specs against known exploits. Tools: • nmap • netcat (http://rpmfind.net) CSCI 379 Fundamentals of Computer Security

  9. Port Scanning Countermeasures Detection: Port scans can cause activity to be recorded in system logs. Reading logs periodically may reveal scanning activity. NIDS like snort can issue warnings regarding port scans. Prevention: Carefully study the list of running services on a host and disable all services that are not necessary. CSCI 379 Fundamentals of Computer Security

  10. Automated Discovery Tools • Cheops, http://www.marko.net/cheops/ • Tkined, http://wwwhome.cs.utwente.nl/~schoenw/scotty CSCI 379 Fundamentals of Computer Security

  11. Enumeration Goal: Probe the identified services for fully known weaknesses. This involves active connections to systems and directed queries, which will probably be logged. Techniques: • Banner grabbing (uses telnet and netcat to specific ports). CSCI 379 Fundamentals of Computer Security

More Related