Security Auditing - Agenda

Why hack yourself

Network auditing

Web application auditing

Product auditing

Password auditing

Why Hack Yourself?

The Situation:

The security problems are known

The solutions are out there

So what's the problem?

Too many problems

Too many solutions

You never know how much you're really vulnerable...

Why Hack Yourself?

The I-know-it-all equation:

Confident => Cocky => Vulnerable

Unsure => Paranoid => Safe

You never know how much you're really vulnerable...

Isn't it difficult?

You don't (necessarily) need to be an expert

'script kiddie' tools available

The best vulnerability scanners are open-source

Closing the 'obvious' holes will protect you from casual attacks

=> That's usually all you need

Great Political Conflicts of Our Time

Israeli/Palestinian conflict

Iraq war

Abortion

Gun Ownership

Full disclosure

Full Disclosure - Disadvantages

The bad guys learn about the security holes they can exploit (and create worms, Trojans, etc)

Publishing proof of concept code makes exploitation more likely

Full Disclosure - Advantages

Full disclosure of a security hole will force a software company to create and release a patch for the vulnerability in a timely manner

Users can test for this vulnerability and ensure the patch fixes the problem

Keeping the problem secret has not solved the problem in many cases

More Benefits

Users can provide their own fixes:

I Love you Virus had dozens of different 'home made' solutions

SQL Slammer worm had different solution paths

Developers can learn from other people's mistakes

Security experts can look for similar problems in other products

What we do

Give the vendor time to release a patch

Don't publish exploit code until users had enough time to patch

Offer plenty of work-arounds

Make the proof-of-concept harmless

Network Auditing

Step 1: Port Scanning

Nmap

SYN Scan (-sS)

Decoy scan

Ping sweep (-sP)

Zombie scan (-sI)

Firewall ruleset mapper (-sA)

OS Fingerprinting (-O)

Timing:

Paranoid

Sneaky

Polite

Aggressive

Insane

Host A

Host B

SYN

SYN/ACK

Data

ACK

FIN

Data

ACK

Who is blocking the port?

Firewalking: hping

www.hping.org

Step 2: Vulnerability Scanning

SecuriTeam.com has over 7,000 (!) known security holes in products

Most cannot be exploited remotely

Nessus (www.nessus.org) will check for over 1,200 remote security holes

Exploiting Network Vulnerabilities

www.securiteam.com/exploits Has many 'off-the-shelf' codes

Ptrace:
http://www.securiteam.com/exploits/5WP0V009FC.html'This code exploits a race condition in kernel/kmod.c, which creates kernel thread in insecure manner'

Exploiting Network Vulnerabilities

File: http://www.securiteam.com/exploits/5SP011P9FQ.html

$ gcc -o 85deadelf 85deadelf.c

$ ./85deadelf deadelf

[+] Creating a evil file deadelf!

[+] Using address of shellcode = 0xbfffbd40

$ file deadelf

File: ASCII text

$ telnet localhost 2003

Trying 127.0.0.1...

Connected to blacksand (127.0.0.1).

Escape character is '^]'.

id;

uid=500(crz) gid=500(crz) groups=500(crz)

: command not found

exit;

Connection closed by foreign host.

Exploiting Network Vulnerabilities

Try your own:

Stunnel

WebDAV

And many many more...

Can this really be done remotely?

Yes. See 'How to Remotely and Automatically Exploit a Format Bug':
http://www.securiteam.com/securitynews/5HP050U75C.html

How to audit for Network Vulns?

Step 1: Check for open services

Either Close, Bind or Restrict Access

Step 2: Get service version
This will usually appear in the banner

Telnet or netcat to the port and see what answers

e.g. For HTTP: GET / HTTP/1.0

After checking, you may want to remove the banners. Search SecuriTeam.com for 'banner removal'

Step 3: See if the versions you are using are vulnerable

Even better: Use nessus to check that for you

Web Application Hacking

SQL Injection

Cross Site Scripting

SQL Injection

How that works:

You enter a value through a web form

Search form

Feedback CGI

Login page

The value goes into an SQL statement for interaction with the database

Classic example:
SELECT ID FROM Users WHERE Username='$Username' AND Password='$Password'

SQL Injection - Example

Generic login: ' or ''='

Manipulate the statement for UPDATE, SELECT, DELETE,...

How to Audit SQL Injection

Enter ' into any web form you see

Try the 'generic login' in login pages

Almost any database error means SQL execution

Make sure all input is filtered

Use only stored procedures

For more information: search for 'sql injection walkthrough' on SecuriTeam.com

Warning Bells - SQL Error

=>

http://www.example.com/dir/show_item?item_id=1234'

<=

SEARCH: Error while evaluating SQL:

SELECT i.name , i.id, t.desc , t.child_count ,

t. path, t.pri, t. permissions

FROM i, t

WHERE t.id = 1234'

AND i.id = t.id

Database error: [SERVERERROR] Unclosed quote before the character string '

Cross Site Scripting

Some web mechanisms trust the server:

Cookies are domain based

Referrers

SSL

You will usually trust what you see on a trusted server

CSS manipulates what the server returns to you

Via error pages (404)

Via error messages (see example)

Latest example: Macromedia flash ads

Aren't CSS URLs evident?

Hex encoding is trivial

IFRAME to another site location is possible

Users tend to trust SSL sites

How to Audit CSS

There is no easy way :-(

Convert all < and > to &lt; and &gt;

Convert ( and ) to &#40; and &#41;

Convert # and & to &#35 (#) and &#38 (&)

Filter and sanitize every user input!

Search SecuriTeam.com for Cross Site Scripting FAQ

Product Audits

Can you produce secure software?

Qmail is version 1.03

Qmail is unchanged (no patches, no updates) since who-knows-when

No vulnerability has ever been discovered on qmail since the first release

There's a prize for the first hacker that finds the hole :-)

How?

Simple code

Safe usage of dangerous functions

So what's the big deal?

Sendmail is version 8.12.9

This version released 2 weeks ago fixes a critical security issue

SecuriTeam.com has 86 matches for 'sendmail'

Why?

-	while (isascii(*--p) && isspace(*p))

+	while (p > addr &&

+	isascii(*--p) && isspace(*p))

Main Product Security Holes

Buffer overflow

Format string vulnerabilities

Off-by-one

How to Audit

strcpy

strcat

sprintf

memcpy

memset

gets

sscanf

read

strstr

strrev

Indicate a possible Buffer Overflow:

Tools to Help

Qaudit.pl

RATS

ITS4

FlawFinder

How to Audit

fprintf

printf

sprintf

snprintf

vfprintf

vprintf

vsprintf

vsnprintf

syslog

err*

warn*

vwarn*

Indicate a possible Format String:

More security Auditing

Password Cracking

John the Ripper

Brutus

Xavior - Customizable remote password cracker

Wwwhack - Web Passwords

Cisilia - Parallel cracking for Windows Passwords

KerbCrack - Sniffs kerberos logins

MySQL brute force cracker

SQL Server Password Auditing Tool

MacOS password encryption cracker - Retrieves passwords from memory

Special crackers

PalmCrack - Crack Cisco/NT/UNIX passwords on your palm

Airsnort - Cracks WEP encryption.

AirSnort requires approximately 100M-1GB of data to be gathered. Once enough packets have been gathered, AirSnort can guess the encryption password in under a second(!)

Omen - SSL Encryption cracking

More attacks

Look up:

tmp race condition

Directory traversal

Form modification

Login bypassing

Session ID in the URL

Cookie poisoning

Thank you

Questions?

support@securiteam.com

2003-04-10T09:25:30