Cracking Passwords

• On unix systems, passwords are stored in encrypted form in the /etc/passwd file (or more recently in /etc/shadow)
• The stored password is the result of encrypting a constant string repeatedly using an encryption key derived from the typed password
• Since the raw password is not stored, to find a password you need to try encoding many passwords and comparing against the stored passwords
• Use a dictionary or word list and try simple variations such as adding numbers. Other systems have used generators of `pronounceable' strings
• The standard crypt program on unix has a built in delay to make bulk checking slow but a cracker can remove this and check thousands of words very quickly

Getting Root

• Once a cracker has user access to a machine they can log in as usual
• Now a whole new range of security exploits are possible, involving non-server programs
• The ultimate goal of the cracker is to get root access to the machine

Network Packet Sniffing

• If a cracker has root access to the machine, a next step might be to look for more access on the local network
• The cracker may try the passwords gained on other machines on the local network: abusing the trust between local machines
• Another option is to listen on the Ethernet for user traffic. The goal is to see a users login/password going past on the network to gain access to other machines
• To do this the cracker needs to put the ethernet interface into promiscuous mode. This (normally) requires root access
• Packet sniffing can happen anywhere on the route between client and server -- eg. on a ISP router machine

Automated Cracking: Script Kiddies

• Some exploits are so well known that the procedure for carrying them out is encoded in so called root kits
• These are scripts and programs that can be run to break into a vulnerable system, install a backdoor or trojan and then conceal the intrusion
• The availability of these root kits leads to a group of crackers (script kiddies) who are just in it for the thrill. It also enables widespread cracking of systems by automated agents
• Programs like chkrootkit check system binaries for rootkit modification
• Read Rootkits (WikiPedia)

Trojan Horses

• Named after the Trojan Horse used by the Greeks to sack Troy (Brad Pitt)
• Programs that look harmless or useful but contain hidden features
• The user may not know that the program hides information
  • E.g. a trojaned ps command may not display running processes initiated by the intruder
  • The user may believe that the system is safe
• The program may produce specific behaviour
  • E.g. a trojaned passwd that grants root shell if rootkit password is entered as current password

Denial of Service Attacks

• DOS attacks seek to harm a user or a site by making them unuseable in some way
• A DOS attack on a web server can come from outside, it doesn't require access to the machine
• A common DOS attack is carried out by flooding a host with network traffic or by sending special TCP packets to the host
• Recently we have seen Distributed DOS attacks where many machines are cracked into and used as sources in the DOS attack against one host, (eg. Trin00)
• DOS attacks can also be carried out by triggering a system bug, eg. the Microsoft Windows 95 TCP/IP Address out-of-band bug

Notes and References

• The WWW Security FAQ
• The Unofficial Web Hack FAQ provides more `underground' info but might be getting dated now
• There is an excellent analysis of a DDOS attack at grc.com, a site which also has a number of other security related stories and tools
• More white hat info from securityfocus.com which has current information on system vulnerabilities
• The Jargon File, otherwise known as the Hacker's Dictionary, defines many terms like hack, crack and warez d00dz

Building Secure Servers

• The primary means of avoiding intrusion is to keep up to date with security patches for your OS
• Secondly, your server should only activate the minimum IP ports to fulfill its function. All others should be disabled
• Check the system regularly for unusual files or system activity, some tools can automate this (eg. tripwire)
• Put valuable data on another system, connected with a secure link and protected by a firewall
• Encrypt valuable data and encrypt traffic over the network to avoid network sniffers

Firewalls

• A firewall is a means of restricting the traffic between the internet and a local area network
• The firewall server is connected directly to the internet and routes packets from the internet to local machines on a separate network
• The firewall doesn't allow direct access to any local machine and can block or filter traffic on most IP ports

Encryption

• Encryption is a means of hiding the message being transmitted or stored
• Key based encryption uses a key of a given size (number of bits) to encrypt the message. More bits means more possible keys and therefore more security There are 3.4 x 10^38 128 bit keys
• Symmetric or secret key encryption uses the same key to encrypt and decrypt a message
  • But how do we exchange the key securely?
• Asymmetric or public key encryption uses different keys to encrypt and decrypt. The public key can be published for use by anyone to send me a secret message

Using Public Key Cryptography

• In public key cryptography, each key is used to perform a one-way transformation on the message which only the other key can reverse
• To exchange a secret message: encrypt with receiver's public key, decrypt with private key
• To verify senders identity: encrypt with senders private key, if public key decrypts then it's authentic
• To digitally sign a message: generate a string from the message (use a hashing function) and encrypt this string with your private key
• To verify the signature we decode the string and verify that it matches the string produced by hashing the message
  • Verifies the sender and the message

SSL: Secure Socket Layer

• To avoid sending sensitive data in clear text over the internet, the SSL standard defines a way of establishing an encrypted IP connection
• Designed by Netscape Communications Corporation
• URLs that begin with https indicate an SSL connection
• SSL is based in public key encryption
• SSL can be used to forward traffic on any internet port, it can secure telnet, pop, ftp or www traffic
• SSL is an open standard, implemented in web browsers and for various operating system services

Who Needs Secure Services

• Any e-commerce site where sensitive information is being transferred: credit card numbers, names, addresses, etc
• Service providers such as Hotmail which store personal data for users
• Repositories of commercial or restricted materials
• Requirements range from verifying the identity of users to protecting server side storage and encrypting messages between client and server

Verifying Identity

• We've seen how to use CGI scripts and cookies to check a user's password against a stored database
• While this is adequate for low level security it is prone to abuse
• One solution is to use SSL to transmit the CGI request: the https protocol. This is implemented by the major browsers and connects to the server using SSL
• To be more sure of your client's identity you can issue them with a digital certificate based on public key cryptography. This can be sent instead of a cookie by supporting browsers

Secure Data Transmission

• Transmission of sensitive data must use some kind of encryption: SSL via https

  <form action="https://sourceforge.net/account/login.php" method="post">
  <INPUT TYPE="HIDDEN" NAME="return_to" VALUE="">
  Login Name: <input type="text" name="form_loginname" VALUE="">
  Password: <input type="password" name="form_pw">
  <input type="submit">
  </form>
            
  

• The client might also want some way of verifying your identity: you could send your digital certificate to them

Digital Certificates

• If you want to convince your clients that you are who you say you are then you need to give them something that only you can have
• A digital certificate is just such a thing. This contains:
  • Your name and contact details
  • Your public key
  • Details of a certifying authority
• This information is then digitally signed with the public key of the certifying authority
• The user can check the validity of the message and then use your public key to communicate with you
• This implies that the certifying authority can be trusted!

An Example Digital Certificate

Certificate:
    Data:
        Version: 0 (0x0)
        Serial Number: 0 (0x0)
        Signature Algorithm: md5withRSAEncryption
        Issuer: C=ZA, SP=Western Cape, L=Cape Town, O=Thawte Consulting cc, 
                OU=Certification Services, CN=www.thawte.com, 
                Email=webmaster@thawte.com
        Validity
            Not Before: Nov 14 17:15:25 1996 GMT
            Not After : Dec 14 17:15:25 1996 GMT
        Subject: C=ZA, SP=Western Cape, L=Cape Town, O=Thawte Consulting cc,
                 OU=Certification Services, CN=www.thawte.com,
                 Email=webmaster@thawte.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Modulus:
                    00:9a:92:25:ed:a4:77:69:23:d4:53:05:2b:1f:3a:
                    55:32:bb:26:de:0a:48:d8:fc:c8:c0:c8:77:f6:5d:
                    61:fd:1b:33:23:4f:f4:a8:2d:96:44:c9:5f:c2:6e:
                    45:6a:9a:21:a3:28:d3:27:a6:72:19:45:1e:9c:80:
                    a5:94:ac:8a:67
                Exponent: 65537 (0x10001)
    Signature Algorithm: md5withRSAEncryption
        7c:8e:7b:58:b9:0e:28:4c:90:ab:20:83:61:9e:ab:78:2b:a4:
        54:39:80:7b:b9:d9:49:b3:b2:2a:fe:8a:52:f4:c2:89:0e:5c:
        7b:92:f8:cb:77:3f:56:22:9d:96:8b:b9:05:c4:18:01:bc:40:
        ee:bc:0e:fe:fc:f8:9b:9d:70:e3
      

Notes and References

• Verisign and Thawte are companies that issue digital certificates -- trusted sources
• Netscape (who invented it) have some papers describing SSL and the associated public key infrastructure