Hacking Linux Based on Hacking Linux Exposed Hatch, Lee, and Kurtz ISBN

Looking into Linux Linux security overview Proactive measures and recovering

Stages of hacking – again Mapping your machine and network Social Engineering, Trojans, and other tricks Physical attacks Attacking over the network Abusing the network itself Elevating user privilege Password cracking Maintaining access

Server issues and vulnerabilities Mail and ftp Web servers and dynamic content Access control and firewalls

Linux security overview Porque You are easy You can be used as anonymous access You are Linux and thus open source The OS source is available But the developers are self-policing – developer culture and Bugtraq Access control methods Password security Controls on users Privileged ports Virtual memory gets reclaimed

Proactive measures and recovering Proactive measures Insecurity scanners – finding your own weakness Scan detectors – is someone eyeballing you? Hardening your system Log file analysis File system integrity checks Recovering from being hacked Detecting if you have been hacked What to do after a breakin

Mapping your machine and network Public domain looking Online searches Whois databases Ping sweeps DNS issues Traceroutes Port scanning OS detection Active stack fingerprinting Passive stack fingerprinting

Mapping, continued Enumerating RPC services What authentication level is used What services – NFS, NIS, other PRC NFS file sharing What is exportable – and to what users SNMP possibilities Network insecurity scanners Canned stuff that combines all these approaches

Social Engineering, Trojans, and other tricks Social engineering Trojan horses Viruses and worms IRC backdoors

Physical attacks Attacking the office Sneaky pete installs something Boot access is root access Boot passwords are in the flash ROM Setup helps a little bit Encrypted filesystems

Attacking over the network Using the network itself TCP/IP The public phone system Default or bad configurations NFS mounts Netscape defaults Squid X-Windows system

TCP/IP Structure (header and function) TCP Flag bits (Urgent, Ack, Push, Reset, Syn, Fin) UDP – less structure and functionality ICMP – Control messages – many hacking possibilities IP – Underlies these three protocols – host-to-host

The public phone system Modem attacks Wardialing – mechanized dialing used to find modems Attacks on modem internal protocols – Hayes not-so-smart Modem Idea was to shut off sound, store a new number, disconnect and redial Moldavia Countermeasures One-time-pad login modules Passwording Biometrics

More network attacks Default passwords and password guessing Sniffers How they work Common versions Vulnerabilities Buffer overflows Vulnerable services Vulnerable scripts Unnecessary services and detecting them Using netstat, lsof, nmap How to turn them off – inetd.conf

Abusing the network itself DNS Exploits Routing issues Advanced sniffing and session hijacking Hunt Dsniff Man-in-the-middle attacks Denial of service (DoS) attacks Floods TCP/IP attacks

More abuse and countermeasures Abusing trust relationships Implementing egress filtering

Elevating user privilege Users and privileges Elevation of privilege Trusted paths and trojan horses Password storage and use Special purpose groups and device access Sudo Suid programs Hacker suids on mounted file systems Countering poor programming

Password cracking How they work More advanced algorithms Cracking programs Shadow passwords Pluggable modules, etc.

Maintaining access Using the r commands, rsh, rexe, etc. Passwordless access using ssh Network accessible root shells Trojaned system programs Back doors Trail hiding Kernel hacks

Remote access methods - Unix Primary methods Exploiting a listening service (TCP/IP) System must be running services listening on some port First enumerate, then specific exploit for that service Using source routing to cross firewall or router Router must have source routing disabled, or at least protected User-triggered traps Example: browsing as root and encountering malicious code Exploiting system with network interface in promiscuous mode Sniffer can sniff a malicious packet that was put there to catch any victim

Brute force attacks Password attacks These can use any service that uses a logname/password for access Many utilities exist for automating Countermeasures are improved password analyzers, delay in login on incorrect passwords, detecting repeated login attempts User password education – don’t use same password everywhere Data driven attacks Buffer and stack overflows work because of weak C libraries Basic idea is to send an “egg” with code that goes on stack (used for local variables and return address)