SystemsSec 2016W Lecture 11 - Revision history

Willforrest at 00:27, 22 February 2016

2016-02-22T00:27:37Z

← Older revision		Revision as of 00:27, 22 February 2016
Line 13:		Line 13:
	*This exam will be closed book. Email Anil if writing this midterm via computer is important to you.		*This exam will be closed book. Email Anil if writing this midterm via computer is important to you.

	~~==Under construction==~~

	==Model of a standard attack==		==Model of a standard attack==

Daniaghazal: /* Countermeasures */

2016-02-13T20:45:40Z

Countermeasures

← Older revision		Revision as of 20:45, 13 February 2016
Line 75:		Line 75:

	*One problem. We can't make a perfect reference monitor.		*One problem. We can't make a perfect reference monitor.
			**The rest of the semester, we'll talk about the failure of reference monitor.

	==Tools==		==Tools==

	*NMAP: A tool designed to identify system and their versions, by analyzing the responses. Each system implements networks slightly differently, and this tool has a small database to compare to.		*NMAP: A tool designed to identify system and their versions, by analyzing the responses. Each system implements networks slightly differently, and this tool has a small database to compare to.

Daniaghazal: /* Example attack */

2016-02-13T20:41:05Z

Example attack

← Older revision		Revision as of 20:41, 13 February 2016
Line 59:		Line 59:
	**Targets become very broad: Anyone with windows, anyone with an RBC account etc.		**Targets become very broad: Anyone with windows, anyone with an RBC account etc.
	**Surveillance becomes less needed if you infect a trusted system.		**Surveillance becomes less needed if you infect a trusted system.

			Recently, some attackers stop at surveillance. They develop the exploits and keep them; in order to sell the vulnerability (not the exploit) or blackmail. Governments now keep exploit stacks.

	==Countermeasures==		==Countermeasures==

Daniaghazal: /* Example attack */

2016-02-13T20:25:03Z

Example attack

← Older revision		Revision as of 20:25, 13 February 2016
Line 44:		Line 44:
	==Example attack==		==Example attack==

	Let's say ~~we know someone~~ is running ~~wordpress~~ (wahoo, ~~many exploits~~), and we know the exact version. ~~We can get an exploit to use online~~.		There's a tool called '''nmap''' which can figure out what operating system you're running. Let's say it is running WordPress (wahoo, it has known vulnerabilities), and we know the exact version. There are packaged tools like '''metaexploit''' which easily help you make the attack.

	The next step? Set up the same ~~wordpress~~ version, and test the exploit on our own systems. We don't want to be caught on a failed attempt. We can engineer the exploit to do it's intended goal, and test it's success, without fear of detection.		The next step? Set up the same WordPress version, and test the exploit on our own systems. We don't want to be caught on a failed attempt. We can engineer the exploit to do it's intended goal, and test it's success, without fear of detection.

	If we are not detected, this brings us to another type of attack:		If we are not detected, this brings us to another type of attack:

	*Advanced Persistent ~~threats~~: Breaking in, and modifying the system to infiltrate as needed.		*Advanced Persistent Threats: Breaking in, and modifying the system to infiltrate as needed.

	As we can see it takes a fair bit of work to infiltrate a target. So why do we protection? The end result is if someone doesn't want to be caught, they need another machine. Or ~~manay~~.		As we can see it takes a fair bit of work to infiltrate a target. So why do we protection? The end result is if someone doesn't want to be caught, they need another machine. Or many.

	*The most common threat scenario:		*The most common threat scenario:
Line 58:		Line 58:
	**Being attacked, but you are not the target!		**Being attacked, but you are not the target!
	**Targets become very broad: Anyone with windows, anyone with an RBC account etc.		**Targets become very broad: Anyone with windows, anyone with an RBC account etc.
	**~~Surveillence~~ becomes less needed if you infect a trusted system.		**Surveillance becomes less needed if you infect a trusted system.

	==Countermeasures==		==Countermeasures==

Daniaghazal: /* Example attack Surveillance */

2016-02-13T20:08:30Z

Example attack Surveillance

← Older revision		Revision as of 20:08, 13 February 2016
Line 30:		Line 30:
	How do we monitor what's happening?		How do we monitor what's happening?

	*Ip addresses, Port checking, etc.: These are very noisy approaches, and will alert a system. an attacker will not do this more then absolutely necessary		*IP addresses, Port checking, etc.: These are very noisy approaches, and will alert a system. An attacker will not do this more then absolutely necessary

	*~~Webserver status:~~		*Monitoring the network: Is it possible to monitor this network from another machine?, An attacker may need to compromise another machine first!
	**What code is running on the server?
	**What version?
	**Webserver will usually hand this out

	*monitoring the network: Is it possible to monitor this network from another machine?, An attacker may need to compromise another machine first!
	**This can be done by Wireshark		**This can be done by Wireshark

	*Physical Surveillance:		*Physical Surveillance:
	~~Personel~~, Administrators: Do they have social media that can be accessed, and guess the password from info? Set up account on another site: Can they convince an employee to make an account, they may use same password.		Personnel, Administrators: Do they have social media that can be accessed, and guess the password from info? Set up account on another site: Can they convince an employee to make an account, they may use same password.
	**Forums: Have they posted about bugs or net problems?		**Forums: Have they posted about bugs or net problems?
	**Wireless network: can they eavesdrop on a signal?		**Wireless network: can they eavesdrop on a signal?

			What we really want to know in Surveillance step: What code is running on the server.

	==Example attack==		==Example attack==

Daniaghazal: /* Example attack Surveillance */

2016-02-13T20:03:58Z

Example attack Surveillance

← Older revision		Revision as of 20:03, 13 February 2016
Line 28:		Line 28:
	Let's say we are attacking an Ubuntu machine.		Let's say we are attacking an Ubuntu machine.

	~~What can~~ we ~~gather intelligence wise~~?		How do we monitor what's happening?

	*Ip addresses, Port checking, etc.: These are very noisy approaches, and will alert a system. an attacker will not do this more then absolutely ~~neccessary~~		*Ip addresses, Port checking, etc.: These are very noisy approaches, and will alert a system. an attacker will not do this more then absolutely necessary

	*Webserver status:		*Webserver status:
Line 38:		Line 38:

	*monitoring the network: Is it possible to monitor this network from another machine?, An attacker may need to compromise another machine first!		*monitoring the network: Is it possible to monitor this network from another machine?, An attacker may need to compromise another machine first!
			**This can be done by Wireshark

	*Physical Surveillance:		*Physical Surveillance:

Daniaghazal: /* Example attack Surveillence */

2016-02-13T19:56:53Z

Example attack Surveillence

← Older revision		Revision as of 19:56, 13 February 2016
Line 24:		Line 24:
	*Cover his tracks: An attacker will not want to be identified. They will try to destroy system logs, and any evidence that could point to the attack ever happening. In this sense, the news only reports failed attacks, as the intrusion was detected.		*Cover his tracks: An attacker will not want to be identified. They will try to destroy system logs, and any evidence that could point to the attack ever happening. In this sense, the news only reports failed attacks, as the intrusion was detected.

	==Example attack ~~Surveillence~~==		==Example attack Surveillance==

	Let's say we are attacking an Ubuntu machine.		Let's say we are attacking an Ubuntu machine.
Line 39:		Line 39:
	*monitoring the network: Is it possible to monitor this network from another machine?, An attacker may need to compromise another machine first!		*monitoring the network: Is it possible to monitor this network from another machine?, An attacker may need to compromise another machine first!

	*Physical ~~Surveillence~~:		*Physical Surveillance:
	Personel, Administrators: Do they have social media that can be accessed, and guess the password from info? Set up account on another site: Can they convince an employee to make an account, they may use same password.		Personel, Administrators: Do they have social media that can be accessed, and guess the password from info? Set up account on another site: Can they convince an employee to make an account, they may use same password.
	**Forums: Have they posted about bugs or net problems?		**Forums: Have they posted about bugs or net problems?

Daniaghazal: /* Model of a standard attack */

2016-02-13T19:47:40Z

Model of a standard attack

← Older revision		Revision as of 19:47, 13 February 2016
Line 19:		Line 19:
	Let us look at a standard attack. An attacker will do the following:		Let us look at a standard attack. An attacker will do the following:
	*Identify a target: An attacker will select a system or individual to attack		*Identify a target: An attacker will select a system or individual to attack
	*~~Surveillence~~: An attacker will study the target.		*Surveillance: An attacker will study the target.
	*Get access ("The Attack"): An attacker at some point will access or breach the system.		*Get access ("The Attack"): An attacker at some point will access or breach the system.
	*Accomplish his goal: An attacker will gather what he came for (credit cards, passwords, bank transfer etc)		*Accomplish his goal: An attacker will gather what he came for (credit cards, passwords, bank transfer etc)

Willforrest at 19:03, 12 February 2016

2016-02-12T19:03:32Z

@@ Line 48: / Line 48: @@
 Let's say we know someone is running wordpress (wahoo, many exploits), and we know the exact version. We can get an exploit to use online.
-The next step? Set up the same wordpress version, and test the exploit on our own systems. We don't want to be caught on a failed attempt.
+The next step? Set up the same wordpress version, and test the exploit on our own systems. We don't want to be caught on a failed attempt. We can engineer the exploit to do it's intended goal, and test it's success, without fear of detection.
 ==Tools==
 *NMAP: A tool designed to identify system and their versions, by analyzing the responses. Each system implements networks slightly differently, and this tool has a small database to compare to.

Willforrest at 18:52, 12 February 2016

2016-02-12T18:52:40Z

← Older revision		Revision as of 18:52, 12 February 2016
Line 12:		Line 12:
	*Expect 3-5 questions on the midterm.		*Expect 3-5 questions on the midterm.
	*This exam will be closed book. Email Anil if writing this midterm via computer is important to you.		*This exam will be closed book. Email Anil if writing this midterm via computer is important to you.

			==Under construction==

			==Model of a standard attack==

			Let us look at a standard attack. An attacker will do the following:
			*Identify a target: An attacker will select a system or individual to attack
			*Surveillence: An attacker will study the target.
			*Get access ("The Attack"): An attacker at some point will access or breach the system.
			*Accomplish his goal: An attacker will gather what he came for (credit cards, passwords, bank transfer etc)
			*Cover his tracks: An attacker will not want to be identified. They will try to destroy system logs, and any evidence that could point to the attack ever happening. In this sense, the news only reports failed attacks, as the intrusion was detected.

			==Example attack Surveillence==

			Let's say we are attacking an Ubuntu machine.

			What can we gather intelligence wise?

			*Ip addresses, Port checking, etc.: These are very noisy approaches, and will alert a system. an attacker will not do this more then absolutely neccessary

			*Webserver status:
			**What code is running on the server?
			**What version?
			**Webserver will usually hand this out

			*monitoring the network: Is it possible to monitor this network from another machine?, An attacker may need to compromise another machine first!

			*Physical Surveillence:
			Personel, Administrators: Do they have social media that can be accessed, and guess the password from info? Set up account on another site: Can they convince an employee to make an account, they may use same password.
			**Forums: Have they posted about bugs or net problems?
			**Wireless network: can they eavesdrop on a signal?

			==Example attack==

			Let's say we know someone is running wordpress (wahoo, many exploits), and we know the exact version. We can get an exploit to use online.

			The next step? Set up the same wordpress version, and test the exploit on our own systems. We don't want to be caught on a failed attempt.




			==Tools==

			*NMAP: A tool designed to identify system and their versions, by analyzing the responses. Each system implements networks slightly differently, and this tool has a small database to compare to.