Hacking For Dummies

Chapter 1

Introduction to Ethical Hacking

In This Chapter

arrow Differentiating between ethical hackers and malicious attackers

arrow Understanding hackers’ and malicious users’ objectives

arrow Examining how the ethical hacking process came about

arrow Understanding the dangers that your computer systems face

arrow Starting to use the ethical hacking process

This book is about hacking ethically — the methodology of testing your computers and networks for security vulnerabilities and plugging the holes you find before the bad guys get a chance to exploit them.

Although ethical is an often overused and misunderstood word, Webster’s New World Dictionary defines ethical perfectly for the context of this book and the professional security testing techniques that I cover — that is, conforming to the standards of conduct of a given profession or group. IT and information security practitioners are obligated to perform the tests covered in this book aboveboard and only after permission has been obtained by the owner(s) of the systems. That’s why, in this book’s Introduction, you find a disclaimer. Use your power of choice wisely.

Straightening Out the Terminology

Most people have heard of hackers and malicious users. Many have even suffered the consequences of hackers’ criminal actions. So who are these people? And why do you need to know about them? The next few sections give you the lowdown on these attackers.

remember.eps In this book, I use the following terminology:

check.png Hackers (or external attackers) try to compromise computers and sensitive information for ill-gotten gains — usually from the outside — as unauthorized users. Hackers go for almost any system they think they can compromise. Some prefer prestigious, well-protected systems, but hacking into anyone’s system increases an attacker’s status in hacker circles.

check.png Malicious users (or internal attackers) try to compromise computers and sensitive information from the inside as authorized and trusted users. Malicious users go for systems they believe they can compromise for ill-gotten gains or revenge.

Malicious attackers are, generally speaking, both hackers and malicious users. For the sake of simplicity, I refer to both as hackers and specify hacker or malicious user only when I need to drill down further into their tools, techniques, and ways of thinking.

check.png Ethical hackers (or good guys) hack systems to discover vulnerabilities to protect against unauthorized access, abuse, and misuse. Information security researchers typically fall into this category.

Defining hacker

Hacker has two meanings:

check.png Traditionally, hackers like to tinker with software or electronic systems. Hackers enjoy exploring and learning how computer systems operate. They love discovering new ways to work — both mechanically and electronically.

check.png In recent years, hacker has taken on a new meaning — someone who maliciously breaks into systems for personal gain. Technically, these criminals are crackers (criminal hackers). Crackers break into, or crack, systems with malicious intent. The personal gain they seek could be fame, profit, and even revenge. They modify, delete, and steal critical information, often making other people miserable.

The good-guy (white hat) hackers don’t like being lumped in the same category as the bad-guy (black hat) hackers. (In case you’re curious, the white hat and black hat terms come from old Western TV shows in which the good guys wore white cowboy hats and the bad guys wore black cowboy hats.) Gray hat hackers are a little bit of both. Whatever the case, most people have a negative connotation for the word hacker.

Many malicious hackers claim that they don’t cause damage but instead help others for the greater good of society. Yeah, right. Malicious hackers are electronic miscreants and deserve the consequences of their actions. However, be careful not to confuse criminal hackers with security researchers. Researchers not only hack aboveboard and develop the amazing tools that you get to use in your work, but they also take responsible steps to disclose their findings and publish their code.

Defining malicious user

A malicious user — meaning a rogue employee, contractor, intern, or other user who abuses his or her privileges — is a common term in security circles and in headlines about information breaches. A long-standing statistic states that insiders carry out 80 percent of all security breaches. Whether this number is accurate is still questionable, but based on what I’ve seen and numerous annual surveys, undoubtedly an insider problem makes up a large part of security breaches.

The issue isn’t necessarily users hacking internal systems, but rather users who abuse the computer access privileges they’ve been given. Users ferret through critical database systems to glean sensitive information, e-mail confidential client information to the competition or other third parties, or delete sensitive files from servers that they probably didn’t need to have access to in the first place. There’s also the occasional ignorant insider whose intent is not malicious but who still causes security problems by moving, deleting, or corrupting sensitive information. Even an innocent fat-finger on the keyboard can have dire consequences in the business world.

Malicious users are often the worst enemies of IT and information security professionals because they know exactly where to go to get the goods and don’t need to be computer savvy to compromise sensitive information. These users have the access they need and the management trusts them — often without question.

Recognizing How Malicious Attackers Beget Ethical Hackers

You need protection from hacker shenanigans; you need (or need to become) an ethical hacker. An ethical hacker possesses the skills, mindset, and tools of a hacker but is also trustworthy. Ethical hackers perform the hacks as security tests for their systems based on how hackers might work.

remember.eps Ethical hacking — which encompasses formal and methodical penetration testing, white hat hacking, and vulnerability testing — involves the same tools, tricks, and techniques that criminal hackers use, but with one major difference: Ethical hacking is performed with the target’s permission in a professional setting. The intent of ethical hacking is to discover vulnerabilities from a malicious attacker’s viewpoint to better secure systems. Ethical hacking is part of an overall information risk management program that allows for ongoing security improvements. Ethical hacking can also ensure that vendors’ claims about the security of their products are legitimate.

tip.eps If you perform ethical hacking tests and want to add another certification to your credentials, you might want to consider becoming a Certified Ethical Hacker (C|EH), through a certification program sponsored by EC-Council. See www.eccouncil.org for more information. Like the Certified Information Systems Security Professional (CISSP), the C|EH certification has become a well-known and respected certification in the industry. It’s even accredited by the American National Standards Institute (ANSI 17024).

Ethical hacking versus auditing

Many people confuse ethical hacking with security auditing, but there are big differences. Security auditing involves comparing a company’s security policies (or compliance requirements) to what’s actually taking place. The intent of security auditing is to validate that security controls exist — typically using a risk-based approach. Auditing often involves reviewing business processes and, in many cases, might not be very technical. I often refer to security audits as security checklists because they’re usually based on (you guessed it) checklists. Not all audits are this high-level, but the majority of the ones I’ve seen are quite simplistic.

Conversely, ethical hacking focuses on vulnerabilities that can be exploited. It validates that security controls do not exist or are ineffectual at best. Ethical hacking can be both highly technical and nontechnical, and although you do use a formal methodology, it tends to be a bit less structured than formal auditing. If auditing continues to take place in your organization, you might consider integrating the ethical hacking techniques I outline in this book into your IT audit program. They complement one another really well.

Policy considerations

If you choose to make ethical hacking an important part of your business’s risk management program, you really need to have a documented security testing policy. Such a policy outlines the type of ethical hacking that is done, which systems (such as servers, web applications, laptops, and so on) are tested, and how often the testing is performed. Specific procedures for carrying out your security tests could outline the ethical hacking methodology I cover in this book. You might also consider creating a security standards document that outlines the specific security testing tools that are used and specific dates your systems are tested each year. You might list standard testing dates, such as once per quarter for external systems and biannual tests for internal systems — whatever works for your business.

Compliance and regulatory concerns

Your own internal policies might dictate how management views security testing, but you also need to consider the state, federal, and global laws and regulations that affect your business. Many of the federal laws and regulations in the U.S. — such as the Health Insurance Portability and Accountability Act (HIPAA), Health Information Technology for Economic and Clinical Health (HITECH) Act, Gramm-Leach-Bliley Act (GLBA), North American Electric Reliability Corporation (NERC) CIP requirements, and Payment Card Industry Data Security Standard (PCI DSS) — require strong security controls and consistent security evaluations. Related international laws such as the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), the European Union Data Protection Directive, and Japan’s Personal Information Protection Act (JPIPA) are no different. Incorporating your ethical hacking tests into these compliance requirements is a great way to meet the state and federal regulations and beef up your overall privacy and security program.

Understanding the Need to Hack Your Own Systems

To catch a thief, you must think like a thief. That’s the basis for ethical hacking. Knowing your enemy is absolutely critical. See Chapter 2 for details about how malicious attackers work.

The law of averages works against security. With the increased number of hackers and their expanding knowledge, and the growing number of system vulnerabilities and other unknowns, eventually, all computer systems and applications will be hacked or compromised in some way. Protecting your systems from the bad guys — and not just the generic vulnerabilities that everyone knows about — is absolutely critical. When you know hacker tricks, you find out how vulnerable your systems really are.

Hacking preys on weak security practices and undisclosed vulnerabilities. Firewalls, encryption, and passwords can create a false feeling of safety. These security systems often focus on high-level vulnerabilities, such as basic access control, without affecting how the bad guys work. Attacking your own systems to discover vulnerabilities helps make them more secure. Ethical hacking is a proven method of greatly hardening your systems from attack. If you don’t identify weaknesses, it’s only a matter of time before the vulnerabilities are exploited.

As hackers expand their knowledge, so should you. You must think like them and work like them to protect your systems from them. As the ethical hacker, you must know the activities that hackers carry out and how to stop their efforts. Knowing what to look for and how to use that information helps you to thwart hackers’ efforts.

tip.eps You don’t have to protect your systems from everything. You can’t. The only protection against everything is to unplug your computer systems and lock them away so no one can touch them — not even you. But doing so is not the best approach to information security, and it’s certainly not good for business. What’s important is to protect your systems from known vulnerabilities and common attacks, which happen to be some of the most overlooked weaknesses in many organizations.

Anticipating all the possible vulnerabilities you’ll have in your systems and business processes is impossible. You certainly can’t plan for all possible attacks — especially the unknown ones. However, the more combinations you try and the more you test whole systems instead of individual units, the better your chances are of discovering vulnerabilities that affect your information systems in their entirety.

Don’t take ethical hacking too far, though; hardening your systems from unlikely attacks makes little sense. For instance, if you don’t have a lot of foot traffic in your office and no internal web server running, you might not have as much to worry about as an Internet- hosting provider might have.

remember.eps Your overall goals as an ethical hacker are to

check.png Prioritize your systems so you can focus your efforts on what matters.

check.png Hack your systems in a nondestructive fashion.

check.png Enumerate vulnerabilities and, if necessary, prove to management that vulnerabilities exist and can be exploited.

check.png Apply results to remove the vulnerabilities and better secure your systems.

Understanding the Dangers Your Systems Face

It’s one thing to know generally that your systems are under fire from hackers around the world and malicious users around the office; it’s another to understand the specific attacks against your systems that are possible. This section offers some well-known attacks but is by no means a comprehensive listing.

Many information security vulnerabilities aren’t critical by themselves. However, exploiting several vulnerabilities at the same time can take its toll on a system. For example, a default Windows OS configuration, a weak SQL Server administrator password, or a server hosted on a wireless network might not be major security concerns separately — but a hacker exploiting all three of these vulnerabilities at the same time could lead to sensitive information disclosure and more.

remember.eps Complexity is the enemy of security.

The possible vulnerabilities and attacks have grown enormously in recent years because of social media and cloud computing. These two things alone have added immeasurable complexity to your IT environment.

Nontechnical attacks

Exploits that involve manipulating people — end users and even yourself — are the greatest vulnerability within any computer or network infrastructure. Humans are trusting by nature, which can lead to social engineering exploits. Social engineering is the exploitation of the trusting nature of human beings to gain information for malicious purposes. Check out Chapter 5 for more information about social engineering and how to guard your systems against it.

Other common and effective attacks against information systems are physical. Hackers break into buildings, computer rooms, or other areas containing critical information or property to steal computers, servers, and other valuable equipment. Physical attacks can also include dumpster diving — rummaging through trash cans and dumpsters for intellectual property, passwords, network diagrams, and other information.

Network infrastructure attacks

Hacker attacks against network infrastructures can be easy to accomplish because many networks can be reached from anywhere in the world via the Internet. Some examples of network infrastructure attacks include the following:

check.png Connecting to a network through an unsecured wireless access point attached behind a firewall

check.png Exploiting weaknesses in network protocols, such as TCP/IP and NetBIOS

check.png Flooding a network with too many requests, creating a denial of service (DoS) for legitimate requests

check.png Installing a network analyzer on a network segment and capturing every packet that travels across it, revealing confidential information in clear text

Operating system attacks

Hacking an operating system (OS) is a preferred method of the bad guys. OS attacks make up a large portion of hacker attacks simply because every computer has an operating system and OSes are susceptible to many well-known exploits.

Occasionally, some operating systems that tend to be more secure out of the box — such as the old-but-still-out-there Novell NetWare and OpenBSD — are attacked, and vulnerabilities turn up. But hackers often prefer attacking Windows and Linux because they’re widely used and better known for their weaknesses.

Here are some examples of attacks on operating systems:

check.png Exploiting missing patches

check.png Attacking built-in authentication systems

check.png Breaking file system security

check.png Cracking passwords and weak encryption implementations

Application and other specialized attacks

Applications take a lot of hits by hackers. Programs (such as e-mail server software and web applications) are often beaten down:

check.png Hypertext Transfer Protocol (HTTP) and Simple Mail Transfer Protocol (SMTP) applications are frequently attacked because most firewalls and other security mechanisms are configured to allow full access to these services to and from the Internet.

check.png Voice over Internet Protocol (VoIP) faces increasing attacks as it finds its way into more and more businesses.

check.png Unsecured files containing sensitive information are scattered throughout workstation and server shares. Database systems also contain numerous vulnerabilities that malicious users can exploit.

Obeying the Ethical Hacking Commandments

Ethical hackers carry out the same attacks against computer systems, physical controls, and people that malicious hackers do. (I introduce those attacks in the preceding section.) An ethical hacker’s intent, however, is to highlight any associated weaknesses. Parts II through V of this book cover how ethical hackers might proceed with these attacks in detail, along with specific countermeasures you can implement against attacks against your business.

To ensure his or her hacking is truly ethical, every ethical hacker must abide by a few basic commandments. The following sections introduce the commandments you need to follow.

warning_bomb.eps If you don’t heed the following commandments, bad things can happen. I’ve seen these commandments ignored or forgotten when planning or executing ethical hacking tests. The results weren’t positive — trust me.

Working ethically

The word ethical in this context means working with high professional morals and principles. Whether you’re performing ethical hacking tests against your own systems or for someone who has hired you, everything you do as an ethical hacker must be aboveboard and must support the company’s goals. No hidden agendas allowed! This also includes reporting all your findings regardless of whether or not it will create politic backlash.

Trustworthiness is the ultimate tenet. The misuse of information is absolutely forbidden. That’s what the bad guys do. Let them receive a fine or go to prison because of their poor choices.

Respecting privacy

Treat the information you gather with the utmost respect. All information you obtain during your testing — from web application flaws to clear text e-mail passwords to personally identifiable information and beyond — must be kept private. Don’t snoop into confidential corporate information or employees’ private lives. Nothing good can come of it.

tip.eps Involve others in your process. Employ a watch-the-watcher system that can help build trust and support for your ethical hacking projects.

Not crashing your systems

One of the biggest mistakes I’ve seen people make when trying to hack their own systems is inadvertently crashing the systems they’re trying to keep running. Poor planning is the main cause of this mistake. These testers often misunderstand the use and power of the security tools and techniques at their disposal.

Although it’s not likely, you can create DoS conditions on your systems when testing. Running too many tests too quickly can cause system lockups, data corruption, reboots, and more. This is especially true when testing websites and applications. I should know: I’ve done it! Don’t rush and assume that a network or specific host can handle the beating that network tools and vulnerability scanners can dish out.

You can even accidentally create an account lockout or a system lockout condition by using vulnerability scanners or by socially engineering someone into changing a password, not realizing the consequences of your actions. Proceed with caution and common sense. It’s still better that you discover DoS weaknesses than someone else!

tip.eps Many vulnerability scanners can control how many tests are performed on a system at the same time. These settings are especially handy when you need to run the tests on production systems during regular business hours. Don’t be afraid to throttle back your scans. It will take longer to complete your testing, but it can save you a lot of grief.

Using the Ethical Hacking Process

Like practically any IT or security project, you need to plan your ethical hacking. It’s been said that action without planning is at the root of every failure. Strategic and tactical issues in the ethical hacking process need to be determined and agreed upon. To ensure the success of your efforts, spend time up front planning for any amount of testing — from a simple OS password-cracking test to an all-out vulnerability assessment of a web application.

warning_bomb.eps If you choose to hire a reformed hacker to work with you during your testing or to obtain an independent perspective, be careful. I cover the pros and cons, and the do’s and don’ts associated with hiring trusted and no-so-trusted ethical hacking resources in Chapter 18.

Formulating your plan

Getting approval for ethical hacking is essential. Make sure that what you’re doing is known and visible — at least to the decision makers. Obtaining sponsorship of the project is the first step. Sponsorship could come from your manager, an executive, your client, or even yourself if you’re the boss. You need someone to back you up and sign off on your plan. Otherwise, your testing might be called off unexpectedly if someone claims you were never authorized to perform the tests.

The authorization can be as simple as an internal memo or an e-mail from your boss when you perform these tests on your own systems. If you’re testing for a client, have a signed contract stating the client’s support and authorization. Get written approval on this sponsorship as soon as possible to ensure that none of your time or effort is wasted. This documentation is your Get Out of Jail Free card if anyone such as your Internet Service Provider (ISP), cloud service provider, or related vendor questions what you’re doing, or worse, if the authorities come calling. Don’t laugh — it wouldn’t be the first time it happened.

One slip can crash your systems — not necessarily what anyone wants. You need a detailed plan, but that doesn’t mean you need volumes of testing procedures to make things overly complex. A well-defined scope includes the following information:

check.png Specific systems to be tested: When selecting systems to test, start with the most critical systems and processes or the ones you suspect are the most vulnerable. For instance, you can test server OS passwords, test an Internet-facing web application, or attempt social engineering attacks before drilling down into all your systems.

check.png Risks involved: Have a contingency plan for your ethical hacking process in case something goes awry. What if you’re assessing your firewall or web application and you take it down? This can cause system unavailability, which can reduce system performance or employee productivity. Even worse, it might cause loss of data integrity, loss of data itself, and even bad publicity. It’ll most certainly tick off a person or two and make you look bad.

Handle social engineering and DoS attacks carefully. Determine how they affect the people and systems you test.

check.png Dates the tests will be performed and your overall timeline: Determining when the tests are performed is something that you must think long and hard about. Do you perform tests during normal business hours? How about late at night or early in the morning so that production systems aren’t affected? Involve others to make sure they approve of your timing.

You may get pushback and suffer DoS-related consequences, but the best approach is an unlimited attack, where any type of test is possible at any time of day. The bad guys aren’t breaking into your systems within a limited scope, so why should you? Some exceptions to this approach are performing DoS attacks, social engineering, and physical security tests.

tip.eps check.png Whether or not you intend to be detected: One of your goals might be to perform the tests without being detected. For example, you might perform your tests on remote systems or on a remote office, and you might not want the users to be aware of what you’re doing. Otherwise, the users might catch on to you and be on their best behavior — instead of their normal behavior.

check.png Knowledge of the systems you have before you start testing: You don’t need extensive knowledge of the systems you’re testing — just a basic understanding. This basic understanding helps protect you and the tested systems.

Understanding the systems you’re testing shouldn’t be difficult if you’re hacking your own in-house systems. If you’re testing a client’s systems, you may have to dig deeper. In fact, I’ve only had one or two clients ask for a fully blind assessment. Most IT managers and others responsible for security are scared of these assessments — and they can take more time, cost more, and be less effective. Base the type of test you perform on your organization’s or client’s needs.

check.png Actions you will take when a major vulnerability is discovered: Don’t stop after you find one or two security holes. Keep going to see what else you can discover. I’m not saying to keep hacking until the end of time or until you crash all your systems; simply pursue the path you’re going down until you just can’t hack it any longer (pun intended). If you haven’t found any vulnerabilities, you haven’t looked hard enough. They’re there. If you uncover something big, you need to share that information with the key players (developers, DBAs, IT managers, and so on) as soon as possible to plug the hole before it’s exploited.

check.png The specific deliverables: This includes vulnerability scanner reports and your own distilled report outlining the important vulnerabilities to address, along with countermeasures to implement.

Selecting tools

As with any project, if you don’t have the right tools for ethical hacking, you might have difficulty accomplishing the task effectively. Having said that, just because you use the right tools doesn’t mean that you’ll discover all the right vulnerabilities. Experience counts.

tip.eps Know the personal and technical limitations. Many vulnerability scanners generate false positives and negatives (incorrectly identifying vulnerabilities). Others just skip right over vulnerabilities altogether. In certain situations, like when testing web applications, you might need to run multiple vulnerability scanners to find the most vulnerabilities.

Many tools focus on specific tests, and no tool can test for everything. For the same reason that you wouldn’t drive a nail with a screwdriver, don’t use a port scanner to uncover specific network vulnerabilities. This is why you need a set of specific tools for the task. The more (and better) tools you have, the easier your ethical hacking efforts are.

Make sure you’re using the right tool for the task:

check.png To crack passwords, you need cracking tools, such as ophcrack and Proactive Password Auditor.

check.png For an in-depth analysis of a web application, a web vulnerability scanner (such as Acunetix Web Vulnerability Scanner or NTOSpider) is more appropriate than a network analyzer (such as Wireshark).

tip.eps When selecting the right security tool for the task, ask around. Get advice from your colleagues and from other people online via Google, LinkedIn (www.linkedin.com), and Twitter (http://twitter.com). Hundreds, if not thousands, of tools can be used for ethical hacking. The following list runs down some of my favorite commercial, freeware, and open source security tools:

check.png Cain & Abel

check.png OmniPeek

check.png QualysGuard

check.png WebInspect

check.png ophcrack

check.png Metasploit

check.png GFI LanGuard

check.png CommView for WiFi

I discuss these tools and many others in Parts II through V when I go into the specific hack attacks. The Appendix contains a more comprehensive listing of these tools for your reference.

The capabilities of many security and hacking tools are often misunderstood. This misunderstanding has cast a negative light on otherwise excellent and legitimate tools. Part of this misunderstanding is due to the complexity of many security testing tools. Whichever tools you use, familiarize yourself with them before you start using them. That way, you’re prepared to use the tools in the ways they’re intended to be used. Here are ways to do that:

check.png Read the readme and/or online Help files and FAQs.

check.png Study the user guides.

check.png Use the tools in a lab or test environment.

check.png Consider formal classroom training from the security tool vendor or another third-party training provider, if available.

Look for these characteristics in tools for ethical hacking:

check.png Adequate documentation

check.png Detailed reports on the discovered vulnerabilities, including how they might be exploited and fixed

check.png General industry acceptance

check.png Availability of updates and support

check.png High-level reports that can be presented to managers or nontechnical types (This is especially important in today’s audit- and compliance-driven world!)

These features can save you a ton of time and effort when you’re performing your tests and writing your final reports.

Executing the plan

Good ethical hacking takes persistence. Time and patience are important. Also, be careful when you’re performing your ethical hacking tests. A criminal on your network or a seemingly benign employee looking over your shoulder might watch what’s going on and use this information against you or your business.

Making sure that no hackers are on your systems before you start isn’t practical. Be sure you keep everything as quiet and private as possible. This is especially critical when transmitting and storing your test results. If possible, encrypt any e-mails and files containing sensitive test information with Pretty Good Privacy (PGP) (www.symantec.com/products-solutions/families/?fid=encryption), an encrypted Zip file, or a similar technology.

You’re now on a reconnaissance mission. Harness as much information as possible about your organization and systems, much like malicious hackers do. Start with a broad view and narrow your focus:

1. Search the Internet for your organization’s name, your computer and network system names, and your IP addresses.

Google is a great place to start.

2. Narrow your scope, targeting the specific systems you’re testing.

Whether you’re assessing physical security structures or web applications, a casual assessment can turn up a lot of information about your systems.

3. Further narrow your focus with a more critical eye. Perform actual scans and other detailed tests to uncover vulnerabilities on your systems.

4. Perform the attacks and exploit any vulnerabilities you find if that’s what you choose to do.

Check out Chapter 4 to find out more information and tips on using this process.

Evaluating results

Assess your results to see what you’ve uncovered, assuming that the vulnerabilities haven’t been made obvious before now. This is where knowledge counts. Your skill at evaluating the results and correlating the specific vulnerabilities discovered will get better with practice. You’ll end up knowing your systems much better than anyone else. This makes the evaluation process much simpler moving forward.

tip.eps Submit a formal report to management or to your client, outlining your results and any recommendations you