Introduction to Ethical Hacking

Hello headaches: Barbie of the Internet age has even more security flaws (reported on 12/4/2015 by c/net)…

www.cnet.com/news/hello-headaches-barbie-of-the-internet-age-has-even-more-security-flaws/?ftag=CAD090e536&bhid=24556750370481986524809036644946

Intro-to-Ethical-Hacking-Week-13

You have been invited to attend a Mediasite presentation.

Presentation Details:
Title: =MIS 5211.001_11/18/2015
Date: Wednesday, November 18, 2015
Time: 5:30 PM (UTC-05:00) Eastern Time (US & Canada)
Duration: 2:30:00
Link: http://tucapture.fox.temple.edu/Mediasite/Play/1e041ea03f994540b211b10077157a231d

Description:

Intrusion Prevention System (IPS) are network security appliances which inspect data and flow of network traffic.   This appliances is configured to detect or prevent malicious activity targeting systems. The assigned reading lists various methods used to circumvent or bypass the different types of intrusion presention systems in the marketplace. The following are very effective methods; Obfuscation, Encryption and tunneling,  Fragmentation and Protocol Violations.  Quite often several of these methods are combined or requeired to circumvent the intrusion presevention system of a target.

In the NEWS:Why Banks Need to Prepare for More Chase-Like Breaches

http://www.databreachtoday.com/interviews/banks-need-to-prepare-for-more-chase-like-breaches-i-2980

Intrusion Prevention System examines data and flow of network traffic to detect or prevent vulnerabilities or exploits. The reading for this week discusses different ways and methods to bypass different flavors of IPS from various vendors.  The mentioned methods in the reading are Obfuscation (making something unreadable), Encryption and tunneling (sending attack through SSH),  Fragmentation (splitting malicious packets into fragments; reassembly is tricky; delaying packets) and Protocol Violations.  In some cases, a combination of the methods were required to get through the IPS.  Decoy trees and big-endian evasion techniques were also shown to help with making the attack successful. IPS are not meant to be the be-all and end-all in protection and also need to be configured or tailored to your environment.

In the news:

Self-encrypting drives are little better than software-based encryption

If a laptop using a self-encrypted drive is stolen or lost while in sleep mode, the security of its data can’t be guaranteed. Companies relying on self-encrypting drives (SEDs) to secure data stored on their employees’ laptops should be aware that this technology is not immune to attack and should carefully consider whether they want to use this rather than software-based approaches.

Reading: Dyrmose, M. (2013). Beating the IPS. SANS Institute InfoSec Reading Room.  The paper: describes how to build an intrusion protection system research laboratory, introduces four evasion techniques, and illustrates how to use three of them in various combinations to avoid detection by 1 open source and 5 commercial intrusion protection systems (IPSs) to execute a successful web-based information security exploit.  The techniques include: Obfuscation, Fragmentation (including overlapping, reassembly order, and timeout variants), and Protocol violations.  The article demonstrated that the simple one-exploit attacks were detected by most of the IPSs, but particular combinations could be formulated to bypass any one of them.

Question for the Class:  Did you know that: “99% of all successful attacks/breaches involve a vulnerability that is at least 1 year old”, and “ 90% of all breaches involve a vulnerability from 7 years or older”?  (From: http://www.coresecurity.com/videos/what-your-scanner-isnt-telling-you)

InTheNews: Shackelford, S.J. (2015-10-30) Another ‘Back to the Future’ Moment – 27 Years After the World’s First Cyber Attack.  Twenty-seven years ago (1988) a Cornell University grad student (Robert Morris) launched the first “Internet worm” from MIT. Meant to measure the size of the Internet, the worm morphed into a denial of service exploit copying itself onto many of the 60,000 computers connected to the Internet. The worm caused between $100,000 to $10 million in damages. Morris received 3 years of probation and a $10,050 fine,  and note as “the world’s first cyber attacker” prosecuted under the Computer Fraud and Abuse Act. He is now a tenured MIT professor and dot-com millionaire. Today, there are > 9 billion devices and >3 billion people online.  Positive outcomes traceable to Morris’ exploit include: Carnegie Mellon University’s Cyber Emergency Response Team (CERT), proactive cybersecurity best practices, and the NIST Cybersecurity Framework. The government of Australia reports success in preventing 85% of cyberattacks based on following 3 common sense techniques: (1) Only permitting pre-approved programs to operate on networks (i.e. application whitelisting), (2) regular patching of operating systems and applications, and (3) minimizing the number of people on the network with admin privileges.

http://www.huffingtonpost.com/scott-j-shackelford/another-back-to-the-future-moment_b_8428352.html?utm_hp_ref=cybersecurity

Evasion Techniques

Here’s what I’ve used in the past for evasion techniques; very slow and steady scanning, scanning for only one or two ports at a time, spoofing an IP addresses, encryption to avoid IDS’s, clearing traffic logs, fragmenting payloads and packets, pivoting and using another machine to do the scanning for you. You could also try ARP poisoning and MAC spoofing.

In the news:
The Army wants to put cyber Soldiers in the mud with the Infantry. For what practical purpose? Not too sure.
http://breakingdefense.com/2015/11/army-puts-cyber-soldiers-in-the-mud/

Evasion Techniques – Reading

Even though IPS systems provide means to prevent malicious attacks from entering the network systems beyond secured perimeter, it is still possible to evade detection through bypass of IPS/IDS and perform an attack. IPS performs deep packet filtering to reveal abnormal content or traffic behavior based on various threshold values that trigger an alert/detection and then executes prevention mechanism if configured right. Possible evasion ways are done via obfuscation, encryption and tunneling, packet fragmentation, protocol violation. One of evasion tools is Evader and others. When data is captured, an analysis of payload is performed to reveal services, sources, destination, etc.. Various IPS are used for protection, such as Palo Alto, Cisco ASA and others. It is critical to constantly review configuration design for threshold values as well as always review all logs to find out of anything might be vulnerable.

Question for the Class: What IPS is greatest in all terms in the market today?

In the News:

The reading discussed techniques that penetration testers can use to evade IPS. Examples are fragmenting packets, obfuscation, using decoy trees, using open ports .etc. The main lesson is that an IPS and other systems by themselves won’t protect your client. You have to make sure unwanted services are turned off, activities are logged & monitored in combination with other measures. There is no panacea for vulnerabilities because there is always a way into an enterprise. Security professionals should make the best use of available resources to make it as difficult as possible to breach the enterprise.

Articles I found interesting for discussion are:

https://threatpost.com/one-badbarcode-spoils-whole-bunch/115362/

https://answers.microsoft.com/en-us/windows/forum/windows_10-security/windows-10-and-hipaa-compliance/037e3f2e-8262-42eb-8909-05832e856645?auth=1

https://www.linkedin.com/pulse/does-windows-10-violate-hipaa-steve-hoffenberg

Regardless of how many security products and procedures you put in place there will still be ways to get around them and cover the tracks. Evasion techniques are used to accomplish these goals. Our reading is an introductory piece to evasion techniques and lists obfuscation, encryption and tunneling, fragmentation, and protocol violations as evasion techniques.

Evasion is incredibly dangerous because it is an attack that you’re unable to trace. It would be like the IT version of a stealth bomber flying into your airspace without you being able to track it on radar. Since these techniques are so dangerous it’s important to test your ability to launch one of these attacks on your systems. The suggested method in the reading was to set up a test network that simulates the real environment and is off the grid.

Article for the week: Anonymous declares cyber war on ISIS http://fortune.com/2015/11/16/anonymous-cyber-war-isis/?xid=soc_socialflow_twitter_FORTUNE

I thought this was of note because as we shift to more and more cyber risk in society there is a chance that individuals can play unsolicited roles in military type actions that used to be exclusive to the government.