1. Remote Control and Advanced Techniques

2. Remote Control Software What do they do? Connect through dial-in and/or TCP/IP. Replicate remote screen on local machine (graphical)graphical Allow running graphical, text-based application in remote machine, displaying the results in the local machine. A variety of applications, most with free download as demo.download pcAnywherepcAnywhere is one of the pioneers and very popular. VNCVNC is also very popular because it is cross-platform and free. Discovering and connecting to remote control software Use Nmap or Superscan to search for ports 22, 799, 800, 1494, 2000, 2001, 5631, 5632, 5800, 5801, 5900, 5901, 43188, 65301 Once software is identified download free demo and try brute force. Major weakness: only password is encrypted, traffic is compressed, only. Countermeasures: strong password (again), encrypt traffic (SSL, SSN, etc.), limit and log login attempts, change default listening port. In dial-in use: logoff user with call completion.

3. Advanced Techniques Adding to what we have seen before: TrojansTrojans: we have seen that BO, NetBus and SubSeven are the most common Trojan, backdoor hacker tools. TCP/IP ports: official, Internet services. Different from protocol ports.officialInternet servicesprotocol ports Trojan ports: list, more details, and resources.listmore detailsresources Port listening software: netstat, Active Ports (example), BackOfficer Friendly (example).netstatActive PortsexampleBackOfficer Friendly example Checking and removing Trojans: Symantec on-line check (example), Moosoft Cleaner shareware.on-line checkexampleMoosoft Cleaner Weeding out rogue processes: Windows Task Manager, Linux ps – auxTask Managerps – aux Be aware of traps: Whack-A-Mole (pseudo game), BoSniffer (BO in disguise), eLiTeWrap (packs Trojans as exe). Generic: download, scan for virus, then execute, do not run from Internet. Rootkits: Difficult to detectDifficult to detect keep a record of your files using Tripwire,Tripwire create image of your hard-drive: hardware and software solutions (Norton Ghost, Drive Image).hardwareNorton GhostDrive Image

4. Other Techniques TCP hijacking JuggernautJuggernaut: spy on a TCP connection and issue commands as the logged user. HuntHunt: spy on a TCP connection (works with shared and switched nets). Countermeasures: encrypted protocols such as IPSec, SSH. TFTPTFTP: Trivial File Transfer Protocol. Used by routers, and there are free servers for Windows.free servers Standard client in Windows 2000: tftp.exe protected by Windows File Protection so it can't be removed. See use here.clienthere Prevent its use by Nimda :Nimda 1) Edit the services file: %systemroot%/system32/drivers/etc/services 2) Find this line: tftp 69/udp 3) Replace it with: tftp 0/udp Social Engineering Help desk information: on the Web, e-mail, voice User information: on the Web, e-mail, voice