All your bases belong to us

Alessio L.R. [email protected]: mayhemsppFaceBook: alessio.pennasilico

Roma, 7 Aprile 2011

All your bases belong to us!

mailto:[email protected]


All your bases belong to us! [email protected]

$ whois mayhem

Board of Directors:CLUSIT, Associazione Informatici Professionisti (AIP/OPSI),

Associazione Italiana Professionisti Sicurezza Informatica (AIPSI), Italian Linux Society (ILS), OpenBSD Italian User Group,

Hacker’s Profiling Project

2

Security Evangelist @



http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/

http://www.alba.st/


Hacker?

The Tech Model Railroad club is an MIT student activity founded during the 1946-1947 school year, making

this our 60th year, and making TMRC one of the oldest clubs at MIT.

The Tech Model Railroad Club (TMRC) caters to model railroaders, railfans, and hackers alike. Our activities involve all aspects of model railroading, including the

application of computer technology and timetable passenger and card-order freight operation.

3



http://tmrc.mit.edu/hackers-ref.html

http://tmrc.mit.edu/hackers-ref.html

Hacking?


Lockpicking

Quanto è facile aprire una serratura?

5




Quanto ci vuole?

http://www.youtube.com/watch?v=pgE1YJWQzTA

6






Come funziona?

http://www.youtube.com/watch?v=_sQ9gcjtLQM7



http://www.youtube.com/watch?v=_sQ9gcjtLQM

http://www.youtube.com/watch?v=_sQ9gcjtLQM


Per tutte le serrature?

http://www.youtube.com/watch?v=g0Zw4JI4cxs&feature=related

8






Dove sono le serrature?

9




Biometria

Uso cosciente?

“Qualcosa che si possiede”

Change Password

10




Social Engineering

è più facile decriptare

una password

o chiederla?

11




Facebook Hacking

“The social reconnaissance enabled us to identify 1402 employees 906 of which used facebook.”

[…]“We also populated the profile with information about our experiences at work by using combined

stories that we collected from real employee facebook profiles.”

http://snosoft.blogspot.com/2009/02/facebook-from-hackers-perspective.html

12






Fiducia

“Upon completion we joined our customer's facebook group. Joining wasn't an issue and

our request was approved in a matter of hours. Within twenty minutes of being

accepted as group members, legitimate customer employees began requesting our

friendship. […] Our friends list grew very quickly and included managers, executives, secretaries, interns, and even contractors.”

13




Risultati

“We used those credentials to access the web-vpn which in turn gave us access to the

network. As it turns out those credentials also allowed us to access the majority of systems on the network including the Active Directory server, the mainframe, pump control systems,

the checkpoint firewall console, etc.”

14




Come mi proteggo?

(Pen)Test

Analisi (efficacia? deterrente?)

Formazione

15



Conclusioni


Conclusioni

Non fidarci di misure di sicurezza

il cui scopo è farci sentire sicuri

non quello di proteggerci

17




Conclusioni

Dobbiamo rifuggire la pigrizia mentale

Chi vuole i nostri dati lo farà per certo

18



Alessio L.R. [email protected]: mayhemsppFaceBook: alessio.pennasilico

Roma, 7 Aprile 2011

Domande?

These slides are written by Alessio L.R. Pennasilico aka mayhem. They are subjected to Creative Commons Attribution-ShareAlike 2.5 version; you can copy, modify or sell them. “Please” cite your source and use the same licence :)

Grazie per l’attenzione!



Technology

All your bases belong to us