Upload
reynaldo-vipond
View
219
Download
3
Tags:
Embed Size (px)
Citation preview
Friendly hacking
Penetration testing vs. hacking
Kamil Golombek
[email protected] Tel. +420 241 046 279
Personal experiences
Definitions and dividing
Similarities and differences
Skills and mentality
Methodology and tools
Agenda
Definitions Penetration testing
– tries to replicate a real attack– goes as deep as possible– it’s not comprehensive (doesn’t enumerate all
vulnerabilities– it’s usually but not always done from outside– it’s not “just” a combinations of several vulnerabilities
scan tools reports – maybe not so strong, but very intelligent
Vulnerability scanning– doesn’t go as far as pentesting– but enumerate all possible known bugs and holes– not very intelligent but strong
Types of security tests
NIST Computer Security Division :– network mapping (survey and scanning)– vulnerability scanning (network and host scanners)– penetration testing (blue / red team, “manual work”)– security tests & evaluation (finding mistakes in design ...) – password cracking (e.g. can be used during pentests)– log review (system works as intended)– integrity checkers (implementation at start)– virus detection (old is none)– war dialing (rogue modems etc.)
Pros and cons of security tests
Type Pros Cons
Network mapping Very quick and easy Doesn’t find vulnerabilities, more often it’s the first phase of other tests.
Vulnerability scanning Quite quick, many good automated tools, wide range
Only known bugs, many “false positives”, doesn’t go under cover
Penetration testing Hacker tools and methods, shows real danger, goes deeply.
Very exhausting in time, skills and knowledge. Quite expensive.
ComparisonHacker vs. pen-tester
• Is pentesting a kind of “black art”?
• Who is the real hacker / pentester?
• “Wanna be” hackers / pentesters?
• Who is more dangerous?
• How can you find the real one?
Who is the real one?First – tier hackers
Best programmers and experts. They have a deep understanding of IP protocols and used OS and programming languages. They are able to find new holes or vulnerabilities and to create their own code. They usually don’t seek publicity, but they are known because many others use their hacking utilities.
Second - tier hackersHave a technical skill level equivalent to system or network administrators. They usually know several OS, know how to use some exploits and have some knowledge of programming language. They are much more common than first – tier hackers and they often rely on them.
Third –tier hacker (also script kiddies or “lamers”)Most populated but also the least respected group. The main principle they use is “download and try”. They usually don’t understand consequences and because they often use untested scripts against real networks, they can cause big problems. Their knowledge about IT is usually quite low, but what they lack (or lose) in skills they gain in motivation, free time etc. If they are successful, they think they are “elite”.
Usual (or minimal?) level of pentester?
• Skills, knowledge and experience should be at least similar to the second tier hackers.
• If he (she?) is better, that’s good but it’s more an exception than a rule.
• Plus– good reputation and no criminal record– patience and methodology (to find all holes, to
document ongoing tests, etc.)– presentation skills (?) and ability to close discovered
holes (if required)
Skills and mentality
Good skills and knowledge are necessary but not sufficient conditions!
You have to think like hacker but behave like professional!
Go beyond limits and use of your knowledge in different way is an attitude!
Methodology and tools
• Before you begin ...
• Classical phases of tests (hacks?)
• Obligations in execution of tests
• Basic categories of tools
Classical phases of tests
• General methodology (from outside)– Reconnaissance (get know as much as possible)– Vulnerability analysis (“low hanging fruit”, other ways)– Gaining access (trying of concrete attacks and methods,
escalation of privileges)
• Basic phases of “attack”– Reconnaissance (IP, DNS, mail servers, organization info, etc)– Scanning (ports, services, SW, known vulnerabilities)– Gaining access (exploits, scripts, hacker tools ...)– Maintaining access (Trojan horses – application, traditional,
kernel)– Covering tracks (hiding in OS, cover channels, wiping audit
logs)
Obligations in execution of tests
• Hacker– doesn’t have to follow our “test order”– needs to find and use only one hole– can have some trouble with covering tracks
• Pen-tester– must have methodology to test as much as
possible– except of having it he has to follow it too – tries to find theoretically all holes but can have
problems to prove it
Basic categories of tools
• Reconnaissance• War dialing• OS and Application
identification• Network services testing• Port scanning• Vulnerability scanning• NULL session tools• Session manipulation• FW, Router, ACL testing
• Forensic analysis• Password cracking• DoS• Log review• Packet forgery• Sniffing• IDS testing• WWW testing• ..... some more.
Personal experiences
• Relatively low level of security awareness– 95% of blue tests
• Impossible requirements on pentesters– „within one afternoon “– if you won’t finish as a “root”, your test were bad
• “Smart” handling with test results– final report is just “dust collector”– „it’s just a potential hole, you “can’t” prove it “– “it’s not a complete manual how to do from my messy IS a COSMIC
TOP SECRET system”
• Bad inner communication in organization– security officer or manager makes an order of pentests, but sometimes
forgets to announce it to the IT stuff of organization (diversion actions and aggressive attitude follow up very quickly)
ConclusionDo you need penetration tests?
– Penetration testing is for organizations with a strong security program.
– Don’t waste your money with pentests if you even don’t do regular vulnerability testing alone.
Do we need pentesters?– Vulnerability scanning IS NOT a penetration testing– To be up-to-date with an underground is a full time job – No vulnerability scanner does hack you system!
• Is it important to know basics of security testing?
Hack’em all!