Security - Hack In Progress
Just how easy is it to break into your company's networks? Hire a hacker, then sit tight.
story link
The SetUp
Ryan Breed is a hacker. He's honed his skills since his undergraduate days at the University of Rochester, where a cryptography course piqued his interest in network security. Breed, 28, enjoys the analysis of computer systems and "decomposing systems and figuring out how they work."
As a security consultant for Unisys, hacker Breed tests his mettle against company security systems, pointing out weak spots.
Photo of Ryan Breed by Ken Schles
 | 
|
As a security consultant for Unisys, hacker Breed tests his mettle against company security systems, pointing out weak spots.
Photo of Ryan Breed by Ken Schles |
|
He's gearing up to do his thing. But this evening's hack is sanctioned, commissioned, and paid for by the targeted company. Breed is an ethical hacker, a security consultant for Unisys, and tonight he's conducting a penetration test on an international business-consulting firm with 10 servers and more than 150 desktops. The name of the company and information that would disclose its identity have been withheld at the company's request.
The scene is the third-floor conference room of a building in a suburban office park. It's a hot and humid July night. Seated around the wood-grained conference table, opposite Breed, are three people: the financial officer of the company, a director, and the company's IT manager. Breed's black Dell notebook is hooked up to a projector that displays what's happening on his screen on the wall.
The Hack
Breed likes his work. You can see it in his eyes as he readies his PC on the table. The notebook holds a few hints of his personality, such as a copy of the shoot-'em-up game Quake III, as well as the tools of his trade, such as a network-protocol analyzer named Ethereal and a tool called NetStumbler, an app that's used to find wireless networks. "That's standard issue," he says. "It's a must-have." You get the impression Breed carries around plenty of these "standard-issue" tools.
Surprisingly, the first tool Breed employs is Google.com. "Google is great for researching a company," he explains. "You can often catch information about the corporate domains and find interesting things that reference other sites that the company may be connected to."
Another of Breed's favorite places for preattack recon, he says, is a company's help-wanted ads for IT jobs. "You'll find out what kind of software and systems they run from the skills and experience they're seeking in their IT job listings," he says. Another tactic is scanning Internet message boards on financial sites such as Yahoo and seeking out sites set up by ex-employees. "There's lots of information about any corporation; it's all over and easily found if you just go and look for it."
The hacker-for-hire doesn't find much of interest in his Google search. He then looks up the company's domain name to see what he can find at Whois.net. "I'm looking for targets," he says. The Whois search reveals a contact name and a pair of domain servers.
"Why is that information available?" asks the company's director, surprised that domain-server information is so easily accessible. The IT manager explains that such information is commonly available on the Net.
As Breed clicks away on his notebook, he lets an occasional grin surface, lifts his eyebrows, and crinkles his forehead. After jotting down the domain addresses, he takes an educated guess at what may be the block of network addresses on the company's system. He launches Nmap, or Network Mapper, and begins sweeping to see what his guess may turn over. Nmap uses IP packets to see what operating systems the network is running, what servers are connected to it, what services and ports are available, even whether packet filters and firewalls are in place.
Breed sees something interesting. He points to lines and lists of numbers that may as well be written in Urdu as far as most everyone else in the room is concerned. "This usually means someone is outsourcing or has a different server range somewhere," he says, looking at the IT manager, who confirms that a good portion of the company's systems are outsourced.
Breed avoids scanning the hosted domains--no sense making their intrusion-detection systems light up. He finds a local server with an open port. Breed uses Netcat, a network-analysis tool, to figure out what type of Web server he's looking at. It's a Lotus Domino Server.
The IT manager has been toying with a white bottle-cap, and now his right leg breaks out in nervous thumping. Breed says he's found a mail server, two Web servers, and the Domino Notes server. "We're looking for services that are open. Anything that is open on port 80 [Web port] is worth looking for," he says.
The next program he runs is Nikto, a free tool for scanning Web servers for vulnerabilities. Breed studies the lists and takes more notes. "We found a new host name, another potential target," he says.
"He hasn't broken into anything," the IT manager tells the director.
Breed is looking through files in the Domino database. Now he's looking at Lotus MTA routing tables. "MTA tables show how the system routes mail. It may or may not tell us something, but it's always worth looking at."
Breed pauses for a moment. He's accessed a file called names.nsf. Suddenly, the company's directory splashes on the screen. Breed is scrolling up and down, reading what appear to be the addresses and contact information for everyone in the company.
"That's my home address!" says the director.
Then Breed discovers he's able to download user IDs in Lotus Notes. These are files used to log on to the company's E-mail system. It's a long list, and includes the entire management team. "I could have total E-mail access in a matter of hours or days," Breed says. "Since they can be copied, you can do an offline attack on them all day until you crack one."
"Why don't we just close that up and pretend it didn't happen," jokes the IT manager.
Now Breed fires up another free security tool called Nessus, from the Nessus Project, which develops open-source toolsets and security scanners that look for potential ways crackers could break in or misuse applications. Lists of potential vulnerabilities, generated by Nessus, scroll across the screen. Breed asks the IT manager how often the company updates its servers. The IT manager says systems are patched regularly--a good step toward secure systems.
Breed didn't find much worth looking at with the Nessus scan, so he turns back to information he collected earlier. This time it's a server that, when he surfs with Internet Explorer, prompts him with a digital certificate. And the certificate is invalid. "This is something that a hacker could attempt to use against you," he says. Breed explains that if users get used to clicking "yes" to the invalid certificate, they could do so when a hacker has taken control of the machine. A hacker could exploit this, Breed says, by setting up what's called a "man-in-the-middle attack"--crafting his or her own digital certificate that would closely resemble the certificate users are used to signing. When a user clicks "yes" to trust it, portions of what they do on the Internet will be guided through a system under the control of the hacker. "It's an interesting way to collect passwords and other interesting things," he says.
After exposing and explaining that vulnerability, Breed focuses on another available server he found. It appears to be a system used by IT administrators for remote access. After he types a few commands, a logon screen for a remote terminal appears: It's Real VNC 3.3.7.
"What is that, and why can he access it?" asks the company director. The IT manager explains that it's a remote-system-administration tool, something their IT people use to make system changes without having to actually sit at the terminal. The IT manager then looks at Breed and says, "You'll never guess that password."
TOOLS OF THE TRADE
What the ethical hacker has on hand:
Ethereal: Free network-protocol analyzer that runs on Unix and Windows. It can analyze network traffic in real time or from a saved file.
NetStumbler: Free tool that can find wireless networks.
Nmap: Network Mapper, a tool to analyze a network for the operating systems, servers, types of services and ports, and packet filters and firewalls in place.
Netcat: Free network-analysis tool.
Nikto: Web-server scanner that tests servers for potential vulnerabilities that could allow a hacker easy entry.
Nessus: Free remote security scanner. It attempts to examine a network for vulnerabilities that could let bad guys in.
Data: InformationWeek
|
|
|
After several failed attempts Breed agrees, but explains that these systems often don't record failed logon attempts. "You can grind against this forever, and you wouldn't know. Again, it's just a matter of time," he says. And once inside, it's like "walking into the data center and physically sitting at the server."
By the end of the evening, the company's director is surprised at how far Breed was able to intrude into the network--and what could have happened, given more time. The IT manager is resolute, knowing the work that's ahead. "I thought I was going to be off this weekend," he says.
Breed explains that reaching the internal systems he did over the Internet was made possible by a router misconfiguration--the reason behind the flaw couldn't be determined--that enabled traffic from the Internet to flow into the internal systems of the company's network. "This dispels one of the popular security myths: that a company can focus only on securing its perimeter and remain secure."
Afterward
A few days after the assessment, the company's director says the first thing she did was change her password. "If someone was intent on cracking that password, they probably could have. It was the initials of my kids," she says. "I take password security seriously, and I'll use stronger passwords and change them more frequently from now on." She had most of the company's VPs do the same thing.
Password security isn't the only thing that will change. "We're a growing company, and it's clear we have to get better security policies in place," she says. "You may think something is set up one way, but without looking, you just don't know." Breed may have gotten closer to the company's main systems than he thought. "That one server he got into, that one is connected to our main server," the director says. "That's been changed." And the misconfigured router that allowed the unauthorized access? "That still remains a mystery. We don't know who made that change," she says. The company has since patched that opening.
Now, change controls and regular security assessments will be part of the company routine. Says the IT manager: "Thank God we did this."
Posted by Craig at November 5, 2003 04:11 PM