Maximum Security: A Hacker's Guide to Protecting Your Internet Site and Network

IV Platforms and Security......Page 1
VIII Appendixes......Page 2
About the Author......Page 3
Introduction......Page 4
Copyright......Page 10
  1 Why Did I Write This Book?......Page 11
Misconfiguration of the Victim Host......Page 12
The Active State......Page 13
System Flaws or Deficiency of Vendor Response......Page 15
Why Education in Security Is Important......Page 17
The Corporate Sector......Page 18
Operating Systems......Page 19
How Will This Book Affect the Internet Community?......Page 20
Summary......Page 21
Using This Book Effectively: Who Are You?......Page 23
What This Book Offers the System Administrator......Page 24
Business Person......Page 25
What This Book Offers the Casual User......Page 26
The Good, the Bad, and the Ugly......Page 27
Part III: Tools......Page 28
Part V: Beginning at Ground Zero......Page 29
Timeliness......Page 30
Summary......Page 31
Mens Rea......Page 33
Computer Languages......Page 34
Randal Schwartz......Page 35
Where Did This All Start?......Page 37
Table 3.1. Boxes and their uses.......Page 38
The Situation Today: A Network at War......Page 40
The Hackers......Page 41
The Crackers......Page 42
Summary......Page 43
The Request For Comments (RFC) System......Page 44
A Holiday Message......Page 45
Government......Page 46
SATAN and Other Tools......Page 47
Education and Awareness About Security......Page 50
High-Profile Cases......Page 51
Can the United States Protect the National Information Infrastructure?......Page 53
Who Holds the Cards?......Page 54
The Public Sector......Page 55
Panix.com......Page 56
Crack dot Com......Page 57
Kevin Mitnik......Page 58
Summary......Page 61
Security Through Obscurity......Page 62
Lack of Education......Page 63
The Genesis of an Advisory......Page 64
The Dissemination of Information......Page 66
The Problems with PC-Based Operating Systems......Page 67
The Internet\'s Design......Page 68
Anonymity on the Net......Page 70
ActiveX......Page 72
Table 5.1. Some major security sites for information and tools.......Page 74
Human Nature......Page 75
Does the Internet Really Need to Be Secure?......Page 76
Summary......Page 77
What Is TCP/IP?......Page 78
The History of TCP/IP......Page 79
Table 6.1. Platforms and their support for TCP/IP.......Page 80
How Does TCP/IP Work?......Page 81
Network-Level Protocols......Page 82
The Internet Control Message Protocol......Page 83
The Internet Protocol......Page 84
The Transmission Control Protocol......Page 85
The Ports......Page 86
Telnet......Page 87
File Transfer Protocol......Page 88
Table 6.5. FTP servers for various operating systems.......Page 89
Gopher......Page 90
Hypertext Transfer Protocol......Page 91
Network News Transfer Protocol......Page 92
TCP/IP Is the Internet......Page 93
Summary......Page 94
  7 Birth of a Network: The Internet......Page 95
What Is C?......Page 97
Interpreted Programming Languages......Page 98
Compiled Languages......Page 99
Modern C: The All-Purpose Language......Page 100
Advantages of C......Page 101
UNIX......Page 102
Table 7.2. Commercial versions of UNIX and their manufacturers.......Page 104
Say, What About a Windowing System?......Page 105
Table 7.4. Common windowing systems in UNIX.......Page 106
UNIX in Relation to Internet Security......Page 107
The Internet: How Big Is It?......Page 109
The Future......Page 110
Summary......Page 111
  8 Internet Warfare......Page 112
The E-Mail Bomb......Page 114
List Linking......Page 116
Internet Relay Chat Utilities......Page 118
Virus Infections and Trojan Horses......Page 120
Cracking......Page 122
Table 8.2. Newsreaders by platform.......Page 123
Internet Service Providers......Page 126
Table 8.3. Various logging and snooping utilities of interest.......Page 128
The Government......Page 130
Summary......Page 131
Scanners......Page 132
What System Requirements Are Necessary to Run a Scanner?......Page 133
Are Scanners Legal?......Page 134
Historical Background......Page 135
Table 9.1. Online mailing lists of security holes.......Page 136
Locating a Potential Target......Page 138
Looking for WebForce Models......Page 139
Using Scanners to Uncover WebForce Models......Page 140
host......Page 142
Traceroute......Page 144
rusers and finger......Page 145
Showmount......Page 146
On Macintosh......Page 147
NSS (Network Security Scanner)......Page 148
Strobe......Page 150
Pointers......Page 151
SATAN (Security Administrator\'s Tool for Analyzing Networks)......Page 152
Jakal......Page 153
IdentTCPscan......Page 154
XSCAN......Page 155
From ISS to SAFEsuite......Page 156
Notes on the Server Configuration......Page 157
Table 9.3. Installation requirements for SAFEsuite.......Page 158
Configuration......Page 159
The rlogin Bug......Page 160
The Other Side of the Fence......Page 162
Other Platforms......Page 163
Network Toolbox......Page 164
Summary......Page 165
What Is a Password Cracker?......Page 167
ROT-13......Page 170
DES and Crypt......Page 172
The Password-Cracking Process......Page 174
The Mechanics of Password Cracking......Page 175
Crack by Alec Muffett......Page 176
CrackerJack by Jackal......Page 178
Qcrack by the Crypt Keeper......Page 179
John the Ripper by Solar Designer......Page 180
Hades by Remote and Zabkar (?)......Page 181
Killer Cracker by Doctor Dissector......Page 182
XIT by Roche\'Crypt......Page 183
Claymore by the Grenadier......Page 184
Merlin by Computer Incident Advisory Capability (CIAC) DOE......Page 185
ZipCrack by Michael A. Quinlan......Page 186
AMI Decode (Author Unknown)......Page 187
PGPCrack by Mark Miller......Page 188
Password NT by Midwestern Commerce, Inc.......Page 189
About UNIX Password Security......Page 190
Other Sources and Documents......Page 194
Summary......Page 195
What Is a Trojan?......Page 196
Where Do Trojans Come From?......Page 197
Where Might One Find a Trojan?......Page 199
C\'mon! How Often Are Trojans Really Discovered?......Page 200
How Does One Detect a Trojan?......Page 202
MD5......Page 205
TripWire......Page 206
TAMU......Page 207
ATP (The Anti-Tampering Program)......Page 208
On Other Platforms......Page 209
Resources......Page 210
About Ethernet......Page 213
The Composition of an Ethernet Network......Page 214
What Level of Risk Do Sniffers Represent?......Page 217
Has Anyone Actually Seen a Sniffer Attack?......Page 218
What Information Is Most Commonly Gotten from a Sniffer?......Page 219
Gobbler (Tirza van Rijn)......Page 220
ETHLOAD (Vyncke, Vyncke, Blondiau, Ghys, Timmermans, Hotterbeex, Khronis, and Keunen)......Page 221
Netman (Schulze, Benko, and Farrell)......Page 222
Sunsniff (Author Unknown)......Page 223
How Do I Detect a Sniffer on My Network?......Page 224
What Can I Do to Foil a Sniffer?......Page 225
What Are Some Other Ways to Defeat Sniffer Attacks?......Page 226
Summary......Page 228
13 Techniques to Hide One\'s Identity......Page 230
finger......Page 231
Table 13.1. Finger clients for non-UNIX, non-NT users.......Page 233
The Plan File (.plan)......Page 235
MasterPlan......Page 236
A Few Words About Cookies......Page 239
Public Postings......Page 243
The WHOIS Service......Page 245
Resources......Page 253
Articles and Papers......Page 255
14 Destructive Devices......Page 256
KaBoom......Page 257
Unabomber......Page 258
The UNIX MailBomb......Page 259
General Information About E-Mail Bombs......Page 260
IRC: Flash Bombs and War Scripts......Page 262
ACME......Page 263
The 7th Sphere......Page 264
Syn_Flooder......Page 265
win95ping.c......Page 266
Viruses......Page 267
Sweep for Windows 95 and Windows NT......Page 276
The Simtel.Net MS-DOS Collection at the OAK Repository......Page 277
Resources......Page 278
The Concept of the Hole......Page 281
Holes That Allow Denial of Service......Page 282
sendmail......Page 284
Other Class B Holes......Page 285
Holes That Allow Remote Users Unauthorized Access (Class A)......Page 287
Other Holes......Page 290
Is This Hole Problem As Bad As They Say?......Page 291
Table 15.1. Operating system holes that allowed root access.......Page 292
CERT......Page 293
The National Institute of Standards and Technology Computer Security Resource Clearinghouse......Page 294
The ISS NT Security Mailing List......Page 295
The Bugtraq Archives......Page 296
Mailing Lists......Page 297
Summary......Page 298
16 Microsoft......Page 299
A Friendly Platform That\'s a Bit Too Friendly......Page 300
CMOS Password......Page 301
Playback 1.9......Page 303
Keytrap......Page 304
LCK2......Page 305
Sentry......Page 306
The Repository at Oakland.edu......Page 307
Windows and Windows for Workgroups......Page 308
Glide......Page 309
Windows 95......Page 310
WP WinSafe......Page 312
Fortres 101......Page 313
The Microsoft Word Macro Viruses......Page 314
The Microsoft FrontPage Web Server Hole......Page 315
The Microsoft Internet Security Framework......Page 316
Microsoft Windows NT......Page 317
DAC......Page 318
NT RegFind......Page 320
Microsoft\'s Systems Management Server......Page 321
Denial-of-Service Attacks......Page 322
The SMB Problem......Page 324
Resources......Page 325
The UNIX Platform Generally......Page 327
Table 17.1. Trusted, secure UNIX products.......Page 328
Console Security......Page 332
Where Is the Box Located?......Page 333
Securing Your Installation Media......Page 334
Out-of-the-Box Defaults......Page 335
Getting Down to Business: Password Security......Page 336
Installing Password Shadowing......Page 337
Installing a Proactive Password Checking Program......Page 338
The r Services......Page 339
Snooping Utilities: The finger Service......Page 341
Table 17.2. Alternative finger daemons.......Page 342
Telnet......Page 343
FTP......Page 345
About wu_ftpd......Page 346
About TFTPD......Page 348
Gopher......Page 349
Network File System......Page 350
HTTP......Page 351
Secure Hypertext Transfer Protocol......Page 353
After Backup: Installing TCP_WRAPPERS, TCP_Dump, and Tripwire......Page 354
TCP_Dump......Page 355
Other Tools......Page 356
About X......Page 357
Publications......Page 359
Connecting the Machine to the Internet: Last Steps......Page 360
Publications......Page 361
The Next Step......Page 362
Summary......Page 363
Background......Page 364
Default Passwords......Page 367
Spoofing......Page 368
Sniffers and Novell......Page 369
Burglar......Page 370
IPXCntrl......Page 371
Novelbfh.exe......Page 372
Login Protocol of NetWare 3.12 Flawed......Page 373
WSetPass 1.55......Page 374
GETEQUIV.EXE......Page 375
Publications......Page 376
Usenet Newsgroups......Page 377
19 VAX/VMS......Page 378
VMS......Page 380
Table 19.1. Common VMS commands.......Page 381
Security in VMS......Page 382
The Mountd Hole......Page 383
Historical Problems: The Wank Worm Incident......Page 384
Audits and Monitoring......Page 385
Stealth......Page 386
Crypt......Page 387
Changing Times......Page 388
Summary......Page 389
Resources......Page 390
20 Macintosh......Page 391
Password Crackers and Related Utilities......Page 392
FMProPeeker 1.1......Page 393
MacKrack......Page 394
RemoveIt......Page 395
AOL4FREE2.6v4.sit......Page 396
The WebStar Controversy......Page 397
Super Save......Page 401
Sesame......Page 402
Books and Reports......Page 403
Sites with Tools and Munitions......Page 404
Zines and Electronic Online Magazines......Page 406
The Basics......Page 408
What Plan 9 Is Not......Page 409
Some Concepts......Page 410
SAM......Page 413
Plan 9\'s Window System......Page 414
Programming in Plan 9......Page 415
The Machine Targeted for Installation......Page 417
The Installation Process......Page 418
Partitioning the Disk......Page 419
Installing the Remaining Diskette Files......Page 420
Starting Plan 9......Page 421
Plan 9 on the WWW......Page 422
Articles and Such......Page 423
The General Idea......Page 424
About Access Control......Page 426
About Gaining Root......Page 427
Cracking Root......Page 428
Root Might Be a Thing of the Past......Page 429
The Cracker Who Is Root......Page 430
Beware of Root......Page 431
Summary......Page 432
23 An Introduction to Breaching a Server Internally......Page 433
Anatomy of a Local Crack......Page 436
Gathering Information......Page 437
Extremely Local Users: Hardware Considerations......Page 439
Remote Local Users......Page 442
The Process......Page 443
inftp.pl......Page 444
Summary......Page 445
Resources......Page 446
How Security Concepts Can Influence Your Choices......Page 448
About Remote Security Consults......Page 450
Security Through Obscurity......Page 451
Choosing a Consultant......Page 452
Criminal Record......Page 453
Cost......Page 454
The Heterogeneous Network......Page 455
The General Process......Page 456
Degrees of Security......Page 457
Local Saves......Page 458
Remote Saves via CGI......Page 460
The Overall Picture of Net Commerce......Page 461
Summary......Page 463
The First Steps......Page 464
About Finger Queries......Page 467
The Operating System......Page 468
Doing a Test Run......Page 471
Tools: About Holes and Other Important Features......Page 475
Developing an Attack Strategy......Page 476
After the Scan......Page 477
Summary......Page 478
When Can an Attack Occur?......Page 480
What Operating Systems Do Crackers Use?......Page 481
Microsoft......Page 482
What Is the Typical Cracker Like?......Page 483
What Is the Typical Target Like?......Page 484
Why Do They Want to Attack?......Page 485
About Attacks......Page 486
The Sams Crack Level Index......Page 489
Level One......Page 490
Levels Two and Three......Page 492
Responding to Level-Two Attacks......Page 495
Resources......Page 496
Intrusion Detection......Page 498
What Is a Firewall?......Page 500
What Are the Components of a Firewall?......Page 501
Types of Firewalls......Page 502
Packet Filtering Tools......Page 503
Audit and Logging Tools......Page 504
NOCOL/NetConsole v4.0......Page 505
Application-Proxy Firewalls/Application Gateways......Page 506
TIS FWTK......Page 507
Firewalls Generally......Page 508
Building a Firewall: What You Need to Know......Page 509
Identifying Topology and Protocol Needs......Page 510
Are Firewalls Foolproof?......Page 511
Commercial Firewalls......Page 512
Summary......Page 514
Resources......Page 515
What Is a Spoofing Attack?......Page 519
Who Can Be Spoofed?......Page 520
How Spoofing Attacks Work......Page 521
Trust Relationships and Spoofing Generally......Page 522
Step One: Putting Nexus 3 to Sleep......Page 523
Step Two: Discovering Nexus 2\'s Sequence Number......Page 524
How Common Are Spoofing Attacks?......Page 525
What Can Be Done to Prevent IP Spoofing Attacks?......Page 527
Other Strange and Offbeat Spoofing Attacks......Page 528
Summary......Page 530
Virtual Terminal......Page 531
Telnet Security History......Page 532
Changing the Environment......Page 535
Terminal Emulation......Page 536
Telnet as a Weapon......Page 540
Resources......Page 543
Language......Page 546
HTML......Page 547
Password Protection for Web Sites: htpasswd......Page 549
HTML Security Extensions......Page 552
Java and JavaScript......Page 556
Java......Page 557
What Was All the Fuss About?......Page 558
Java Books, Articles, Papers, and Other Resources......Page 563
Perl......Page 564
Perl and CGI......Page 565
The System Call......Page 567
Server-Side Includes......Page 569
Microsoft Internet Explorer......Page 571
ActiveX......Page 574
So, What Is the Problem with ActiveX?......Page 576
Summary......Page 578
Phreaks......Page 579
United States of America v. Robert Tappan Morris......Page 580
California......Page 583
Texas......Page 584
Table 31.1. Interesting United States computer crime provisions.......Page 585
The Law in Action......Page 586
China......Page 587
Russia and the CIS......Page 588
The EEC (European Economic Community)......Page 589
The United Kingdom......Page 590
Finland......Page 591
Free Speech......Page 592
Resources......Page 593
Sources for General Information......Page 595
Sites on the WWW......Page 596
Books, Reports, and Publications......Page 600
Windows NT......Page 602
General......Page 603
Java......Page 604
Databases and Security......Page 606
Articles......Page 608
Password Crackers......Page 610
Sniffers......Page 611
Scanners and Related Utilities......Page 612
Finger Clients......Page 613
Technical Reports and Publications......Page 614
Intrusion Detection......Page 622
Mailing Lists......Page 623
Underground Resources......Page 624
The Listings......Page 626
AS Stallion Ltd.......Page 627
Cambridge Technology Partners, Inc.......Page 628
Comet & Company......Page 629
Electronic Communications Consultants Inc.......Page 630
Eric Murray, Independent Consultant......Page 631
Gemini Computers Inc.......Page 632
Grand Designs, Ltd./ConfluX.net......Page 633
I.T. NetworX Ltd.......Page 634
InterNet Guide Service Inc.......Page 635
Interpact, Inc./Infowar.Com......Page 636
Jerboa, Inc.......Page 637
Lawrence J. Kilgallen......Page 638
Livermore Software Labs......Page 639
Metamor Technologies, Ltd.......Page 640
Milvets System Technology, Inc......Page 641
Myxa Corporation......Page 642
Network Evolutions, Incorporated......Page 643
NH&A......Page 644
Omnes......Page 645
R.C. Consulting, Inc.......Page 646
Realogic, Inc.......Page 647
SecTek, Inc.......Page 648
SecureNet Engineering, Inc.......Page 649
Sequent Computer Systems BV......Page 650
Strategic Data Command Inc.......Page 651
Technologic, Inc.......Page 652
Visionary Corporate Computing Concepts......Page 653
Zot Consulting......Page 654
C  A Hidden Message About the Internet......Page 656
File Lock Series......Page 657
EtherBoy (Of the NetMan Suite)......Page 658
WebBoy......Page 659
Point \'n Crypt World 1.5......Page 660
NetScanTools 32 Bit v2.42......Page 661
PrivaSuite......Page 662
WebSENSE......Page 663
Cetus StormWindows......Page 664
Windows Enforcer......Page 665
SATAN (Security Administrator\'s Tool for Analyzing Networks)......Page 666
SAFEsuite......Page 667
SecureConsole......Page 668
RadLast......Page 669
About the Software......Page 670