MIT Network & Security Group (MNSG)

1. MIT Network & Security Group (MNSG) SESSION I

2. General Information • 8 Sessions planned for this semester • Forum at www.mnsg.aceboard.com • Detailed schedule given at the forum • Linux is a must • Practical oriented, with live demos • Please use the material responsibly

3. What is Security? • Measures and controls that ensure • Confidentiality (Not disclosing sensitive Info) • Integrity (Authentication, Authorization) • Availability (Eliminating Denial of Service) of hardware, software, firmware and data being processed, stored or communicated.

4. Hacking Hall of Fame • Some retro hackers • Denis Ritchie • Kevin Poulsen • Kevin Mitnick • Tsutomu Simomura The earliest ‘hackers’ were young teenage boys, employed by Bell Telephone Co. who were often up to some mischief. Later female operators were hired for at least 100 years!

5. Some Key terms… • VULNERABILITY Weaknesses in network infrastructure, Operating Systems or Applications that allows someone to disrupt or compromise a computerized system. • THREAT Someone who exploits a vulnerability in s system, often maliciously • RISK = VULNERABILITIES x THREATS • RISK MANAGEMENT (FOR ETHICAL HACKERS) The techniques that involve discovering the holes in a system and fixing them before the bad guys find them

6. Vulnerability Life Cycle Vulnerability Discovered Crude Exploit Is Released GUI Tools Automate Process Novice Command Line Tool Made Finally, Advisories, patches released!

7. What are our goals? • Fix things before hackers find them • Think like hackers • Secure our systems, so that attackers look elsewhere

8. Types of tests… • VULNERABILITY ASSESSMENT • Just find the vulnerabilities, don’t fix anything • High Level, not in-depth • Done from time to time • PENETRATION-TESTING (PEN-TESTS) • Find holes + exploit them safely • Compromise one system and use it to hack others • Takes longer time, requires more skills • Often conducted by red-team (specialized ethical hackers)

9. Legalities… • White-box • Done in full cooperation of the Organization • The Organization helps, no discovery needed • Least time consuming • GOAL: Find out where core security issues lie • Black-box • The Organization Management should know, but not IT staff • Ethical Hackers need to discover topologies etc themselves • Takes longer time, money • GOAL: Track the response of unprepared IT staff

10. SQL Injection, an example attack • PHP, Apache, mySQL – the drivers of modern • day servers, amongst others • Often in haste, good ‘secure’ code is not written • Leads to vulnerabilities in systems • SQL Injection is the technique in which an • attacker exploits a coding bug which can be used • to trigger actions of great consequence. (For example, • deleting the complete database of a website, in • extreme cases) • A simple example is gaining un-authorized access to a • website

11. Time For a DEMO!!!

12. ?

13. Next Week… • Distributed Denial of Service Attacks Can we control computers from Chat channels? • Coding Computer Viruses How difficult is to code one? Can I do it?

14. THANK YOU!