Lecture1 - Introduction to Hacker Exploits and Techniques

8/6/2019 Lecture1 - Introduction to Hacker Exploits and Techniques

1/12

1

Advanced Network Security

Lecture 1

Introduction to Hacker

Exploits and Techniques

Objectives

Introduction to Security

What Malicious Hackers do

Introduction to Ethical Hacking

Various phases of hacking

Legal Perspective


2/12

2

Why security?

Most organizations are networked and exchange information

Routine tasks rely on computers

Increased network environment and network based

applications

Decreasing skill required for exploits

Increasing complexity of computer infrastructure, administration

and management.

Elements of Security

Secure network -A state of well-being of information and infrastructure

in which the possibility of successful yet undetected theft, tampering

and disruption of information and services is kept low.

Four components of security

Confidentiality concealment of information or resources

Authenticity identification and assurance of the origin of information

Integrity trustworthiness of data in terms of preventing improper and

unauthorized changes

Availability ability to use the information desired


3/12

3

Security, Functionality and Easy of Use - Triangle

Security

Ease of UseFunctionality

Essential terms

Threat

Situation wherein human or natural occurrences can cause undesirable outcome

Vulnerability

Presence of fault in the design or implementation of the system that lead to an

unanticipated compromise of security Exploit

A defined way to breach the security of an IT through vulnerabilities

Target of Evaluation

IT system or product or component requiring security evaluation

Attack

An action that violates security

Exposure

Loss due to an exploit


4/12

4

Attack

Attack

Active Passive ExternalInternal

Active modify the target system e.g DOSPassive violate confidentiality without affecting the state of the system e.gelectronic eavesdroppingInternal - initiated from within the physical boundary of a network by anauthorized personExternal by an intruder who does not have the privilege to access theenterprise network

Hacker

External entity or an intruder who attacks the

system or the network.

Malicious Hacker, Ethical Hacker


5/12

5

Phases of Hacking

Phase1 - Reconnaissance

Phase2 - Scanning

Phase3 Gaining access

Phase4 Maintaining access

Phase5 Covering tracks

Phase1 - Reconnaissance

gather information about a potential target without targeted

individual or companys knowledge.

Passive

Web search

Social engineering

Dumpster diving

Sniffing

Active

Probing the network

ping

whois

Phone calls


6/12

6

Phase2 - Scanning

Attacker probe the target for vulnerabilities that can be exploited

Use the information from the reconnaissance phase and use it

examine the network

Tools:

port scanners, network mappers, vulnerability scanners

Information gained:

computer names, IP addresses, user accounts

Phase3 - Gaining access

Phase where the real hacking takes place

Attacker exploits the vulnerability discovered during Reconnaissance and

scanning phase and gain access to the system

Method of connection:

LAN

Local access to a PC

Internet

Examples:

DOS

Buffer overflows

Session hijacking

Hacker term: Owningthe target


7/12

7

Phase4 - Maintaining access

Maintains the access to fulfill the purpose of entry

used as a base to launch additional attacks

Owned system -> Zombie system

Secure exclusive access

Trojans

Backdoors

rootkits

Phase5 Covering tracks

Destroys all the evidence of the attack

Need:

To continue to use the owned system

To remove evidence of hacking

To avoid legal actions

Example:

Remove/alter log files


8/12

8

Types of Hacker attacks

Operating system attacks

Os has many services, ports and processes running. Attacker tries

to exploit these for vulnerabilities

Application-level attacks

from applictaions. They are not completely tested.

Shrink Wrap code attacks

from the installation scripts of applications.. Not fine tuned to

individual

Mis-configuration attacks

systems that are not configured properly.

Hacker classes

Black Hats

White Hats

Gray Hats

Suicide Hackers


9/12

9

Ethical Hackers

Information security professionals engaged in evaluating threats from

attackers.

Use their hacking skills for defensive and protective purposes

Test the network and systems security for vulnerabilities using the

same tools that a hacker might use to compromise the network

Three categories

Former black hats

White hats

Consulting firms

Ethical Hacker skill profile

A computer expert

In-depth knowledge of target platforms such as Unix

& Linux

Extensive knowledge of networking and related

hardware and software

Knowledge about security areas and related issues


10/12

10

Steps to conduct ethical hacking

Talk to the client and discuss the needs to be addressed during the

testing

Prepare and sign the nondisclosure agreement

Organize an ethical hacking team and prepare a schedule for testing

Conduct the test Analyze the results of the testing and prepare a report

Present the report to the client

Testing Types

Black box

performing a security evaluation and testing without any prior knowledge of

the infrastructure or the system

Simulates an attack by a malicious attacker outside the network

White box

performing a security evaluation and testing with complete knowledge of

the infrastructure or the system such as a network administrator

Grey box

performing a security evaluation and testing internally

Examines the extent of access by insiders within the network.


11/12

11

Ethical Hacking Report

The result of the network penetration test or security audit

Information

Results of hacking activity

Types of tests performed

Hacking methods used

countermeasures proposed

Vulnerabilities

Security risks

Confidential

Legal Implications

Aware of the penalties of unauthorized hacking into the system

Security audit should not begin until the legal document

granting permissions is signed

Singapore cyber law.

Chapter 50A: computer misuse Act

http://www.mosstingrett.no/info/legal.html#29


12/12

12

Summary

Components of Security

Hacking

Terms

Phases

Types

Steps to conduct ethical hacking in an organization

Legal Implications

Documents

Lecture1 - Introduction to Hacker Exploits and Techniques