View
222
Download
0
Category
Tags:
Preview:
Citation preview
111
100% Security100% Security100% Security100% Security
“
”
The only system which is truly secure is one which is switched off and
unplugged, locked in a titanium lined safe, buried in a concrete bunker, and is surrounded by nerve gas and very
highly paid armed guards. Even then, I wouldn’t stake my life on it ….
Gene Spafford—Director, Computer Operations, Audit, and Security Technology (COAST), Purdue University
222
Supply ChainManagement
Customer Care
E-Commerce
E-Learning
Workforce Optimization
The Internet Challenge
Expanded Access Heightened Network Security Risks
Internet AccessInternet Access
CorporateIntranet
CorporateIntranet
InternetPresenceInternet
Presence
InternetBusinessValue
Expansion of E-Business!!Expansion of E-Business!!
333
Threat Capabilities:More Dangerous & Easier To Use
Sophistication of Hacker Tools
Packet Forging/ Spoofing
19901980
Password Guessing
Self Replicating Code
Password Cracking
Exploiting Known Vulnerabilities
Disabling Audits
Back Doors
Sweepers
Sniffers
Stealth Diagnostics
Technical Knowledge Required
High
Low 2000
DDOS
Internet Worms
444
Examples
555
Distributed Denial of Service (DDoS)
•Stacheldraht - “barbed wire”
•Trinoo
•Tribe Flood Network (TFN) and TFN2000
•Shaft
666
Attacks Keep Getting Easier
Connected to www.test.com
www.test.com
777
l0PHT Crack l0PHT Crack Dumps All Passwords Dumps All Passwords from the NT Registryfrom the NT Registry
Specify a Specify a Computer:Computer:
888
l0PHT Crack Dumps the Password Filesl0PHT Crack Dumps the Password Files
999
The Intruder Opens a Word DictionaryThe Intruder Opens a Word Dictionary
101010
and Runs the Crackand Runs the Crack
111111
12© 2001, Cisco Systems, Inc. All rights reserved.
A new generation of attacks:The Internet Worms
131313
The Code Red & NIMDA WormsWhat Happened??
Code Red- July 19-20/2001- 359,104 Hosts in 13 hours- $2.6 Billion in Damages!
Estimates from Computer Economics (Carlsbad, CA)
NIMDA- September 18, 2001- Fastest spreading virus - 300K+ Hosts, 2.2M devices
Damage still being assessed
141414
Code Red Spreads
July 19, Midnight – 159 hosts infected
151515
July 19, 11:40 am – 4,920 hosts infected
Code Red Spreads
161616
July 20, Midnight – 341,015 hosts infected
Code Red Spreads
171717
The Code Red WormHow It Works
• Conceals itself in HTTP Packets. Firewalls alone cannot safeguard against the virus
• The worm exploits vulnerabilities found in Microsoft’s Internet Information Server (IIS) v4&5 via a buffer overflow attack
• It then exploits arbitrary code and installs a copy of itself into the infected computer’s memory – which infects other hosts.
181818
The NIMDA WormHow It Works
• Hybrid of Worm & Virus
• Spread by:
- E-mail attachment (virus)- Network Shares (worm)- Javascript by browsing compromised web site (virus)- Infected hosts scanning for exploitable hosts (worm)- Infected hosts scanning for backdoors created by Code-Red and sadmind/IIS worms (worm)
191919
Anatomy Of A Worm
3 - Payload
2 - Propagation Mechanism
1 - The Enabling Vulnerability
202020
The Enabling Vulnerability
Using the Index Server buffer overflow attack, the worm attempts to install itself on IIS Web servers.
1Internet
IIS
IIS
IIS
IISIIS
212121
Propagation
After gaining access to the servers, the worm replicates itself and selects new targets for infection.
GO
2 IIS
IIS
IIS
222222
Payload
3
When the server is infected with a worm, the attacker has administrator-level access to the server. Not only can the attacker deface Web pages, but they also have the power to reformat the hard drive, install a rootkit, steal credit card numbers, etc.
STEALDEFACEBACK DOORROOTKIT
232323
Additional Information
• Compulsory Reading
"Hacking Exposed".
• Security Links (vulnerabilities, tips, exploits, tools)
http://www.securityfocus.com
http://packetstorm.securify.org
http://www.insecure.org
Recommended