Hálózatbiztonság a gyakorlatban

Átírás

1 Hálózatbiztonság a gyakorlatban Mixed;Assassment május 22. Budapest Dr. Bencsáth Boldizsár adjunktus BME Híradástechnikai Tanszék bencsath@crysys.hit.bme.hu

2 News (11 days since last 0-day for java) Pwn2own / Everything cracked, but chromeos Sam.gov hacked Sudo vulnerability (in 2013!) TeamSpy 2

3 Stri.pe CTF 6 levels to crack You can begin Stripe's CTF challenge by running ssh level01@ctf.stri.pe from your shell and entering the password e9gx26yeb2. We will cover the challenges week-by-week Description and hints on 1 st challenge 3

4 Stri.pe how it works ls la /levels total 96 drwxr-xr-x 2 root root :44. drwxr-xr-x 15 root root :44.. -r-sr-x--- 1 level02 level :44 level01 -r--r level01 level :44 level01.c -r-sr-x--- 1 level03 level :44 level02 -r--r level02 level :44 level02.c -r-sr-x--- 1 level04 level :44 level03 -r--r level03 level :44 level03.c -r-sr-x--- 1 level05 level :44 level04 -r--r level04 level :44 level04.c -r--r level05 level :44 level05 -r-sr-x--- 1 the-flag level :44 level06 -r--r level06 level :44 level06.c As You can see, most level has a script that can be executed from a lower level and gets rights by setuid to the next level 4

5 Stri.pe ctf 12 L01 #include <stdio.h> #include <stdlib.h> int main(int argc, char **argv) { printf("current time: "); fflush(stdout); system("date"); return 0; } The CTF games are a bit misleading as it is much easier to find errors, if You exactly know that the exists And You exactly know where they reside This is an easy one 5

6 Related topic Security is not just about a program. It s about a system Security problems arise not just from programming errors inside one component But there can reside nasty things between the program and the environment (envrionment variables: badly formatted parameters, $PATH, ld_preload etc.; DLL injection from the current directory (windows); security features and parameters: -PIE (position independent executable), executable stack, stack protectors) Between multiple programs or programs and OS (memory limits, open file limits, error handling, inter-process communications, race conditions) 6

7 Web page with links to lot of hackable OS live CDs Holynix Similar to the de-ice Cd s and pwnos, holynix is an ubuntu server vmware image that was deliberately built to have security holes for the purposes of penetration testing. More of an obstacle course than a real world example. WackoPicko WackoPicko is a website that contains known vulnerabilities. It was first used for the paper Why Johnny Can t Pentest: An Analysis of Black-box Web Vulnerability Scanners found: De-ICE PenTest LiveCDs The PenTest LiveCDs are the creation of Thomas Wilhelm, who was transferred to a penetration test team at the company he worked for. Needing to learn as much about penetration testing as quickly as possible, Thomas began looking for both tools and targets. He found a number of tools, but no usable targets to practice against. Eventually, in an attempt to narrow the learning gap, Thomas created PenTest scenarios using LiveCDs. Thanks to Tamas Paulik 7

8 How many fixes can be combine to a single patch? = How many problems have we survived without attention?! ====================================================== ===== Ubuntu Security Notice USN March 03, 2011 linux-ltsbackport-maverick vulnerabilities CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE , CVE ====================================================== ===== A security issue affects the following Ubuntu releases: Ubuntu LTS Ubuntu LTS: linux-image generic ~lucid1 linux-image generic-pae ~lucid1 linux-image server ~lucid1 linux-image virtual ~lucid1 8

9 A n O n Y m O u S a real story 9

10 The Anonymous group case 12/2010 Julian Assange s arrest Operation:Payback by a previously unknown group called Anonymous 08/12 IT'S DOWN! KEEP FIRING!!! #DDOS #PAYBACK #WIKILEAKS 09/21/2010 BBC NEWS: Anonymous hacktivists say Wikileaks war to continue Earlier the BBC was contacted by a payment firm linked to Mastercard [mastercard.com] that said its customers had "a complete loss of service". 10

11 (Anonymous to scientology) (local) Fox11 news Westboro on-show crack link 11

12 HBGary Federal is a private company selling security tools etc. to private customers and to government CEO Aaron Barr tried to figure out who-is-who in Anonymous He used novel techniques, such as digging correlation between timestamps of twitter, facebook comments and IRC messages. He might have (not precisely) figured out real names of Anonymous participants He wanted to prove that Anonymous has a leader (vs. no leader) and that it consits of only some (4-5) members. He tried to modify the source code of the Low-Orbit Ion Cannon (DoS tool) to identify members -> questionable by law and ethics. Fake persons were used to get into Anonymous (IRC) Once some member even tried to hire him up for an attack against his own company. 12

13 13

14 14

15 HBGary kept a stockpile of 0-day exploits. A slide from one of the company's internal presentations showed that the company had 0-day exploits for which no patch yet existed but these 0-day exploits had not yet even been published. No one knew about them. The company had exploits "on the shelf" for Windows 2000, Flash, Java, and more; because they were 0-day attacks, any computer around the world running these pieces of software could be infiltrated. One of the unpublished Windows 2000 exploits, for instance, can deliver a "payload" of any size onto the target machine using a heap exploit. "The payload has virtually no restrictions" on what it can do, a document notes, because the exploit secures SYSTEM level access to the operating system, "the highest user-mode operating system defined level" available. These exploits were sold to customers. One , with the subject "Juicy Fruit," contains the following list of software: VMware ESX and ESXi * Win2K3 Terminal Services Win2K3 MSRPC Solaris 10 RPC Adobe Flash * Sun Java * Win2k Professional & Server XRK Rootkit and Keylogger * Rootkit 2009 * 15

16 16

17 anonymous Anonymous hacked the company called HBGary The group submitted the full archive of the CEO as a torrent archive ( s) Info about this company made rootkits for private companies for $ (nasty) They tried to modify the Low-Orbit Ion Cannon to identify attackers Fake identities Tried to tell FBI real names of members One owner of the company (HBGary) had to talk with the group through IRC step down the CEO and we re happy Some s seem to be proof for criminal activity of the company (with others) For HBGARY, Had to withdraw from security conferences (e.g. RSA Conference) 17

18 Anonymous logos / Huge media attention Note: some persons were taken into custodity with probable connections to group Anonymous. 18

19 28/02/2011 HBGary Federal CEO Aaron Barr Steps Down Summary: Don t attack hackers. ( see ) You don t have to be a hacker or bad guy to be famous. To be on the right side will worth to do so. There is no GOOD, as there is no BAD in most cases. No ultimate truth. Who knows when it will end A bunch of hackers sometimes are harder than a bunch of lawyers Ethics and law should be a control of activities Check too. 19

20

21 Information sources on target systems Many public sources tell information on Network topology Used software/hardware elements Configuration settings Other systems/elements related to the target systems Some examples: DNS (name server) information Whois information Named version information SSH protocol header 21

22 Security through obscurity Security through obscurity (!!! There s a long-long debate about that!!!) = we don t even tell how the system/configuration/software looks like, someone thinks that hiding information makes the system secure. Harder to find bugs Insider information -> higher risk to find flaws as the system is not yet known for most of the experts Obscurity is just a tool to have more time to solve problems Time is crucial for the system administrator but not on the global level E.g traditional locks are all about time not about absolute protection However, Obscurity might hide problems that ought to be solved Audits can help to find out problems even if security-through-obscurity mechanisms are in use Hiding unnecessary information is a general tool of protection, but in fact, it is security through obscurity 22

23 DNS as information source 1 basic query [2010-noDNSSec] boldi@hbgyak:~$ dig crysys.hu ; <<>> DiG P3 <<>> crysys.hu ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6960 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;crysys.hu. IN A ;; ANSWER SECTION: crysys.hu IN A ;; Query time: 33 msec ;; SERVER: #53( ) ;; WHEN: Tue Feb 23 14:04: ;; MSG SIZE rcvd: 43 23

24 DNS get the MX record for mails dig crysys.hu in mx ; <<>> DiG P3 <<>> crysys.hu in mx ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;crysys.hu. IN MX ;; ANSWER SECTION: crysys.hu IN MX 50 eternal.datacontact.hu. crysys.hu IN MX 10 shamir.crysys.hu. ;; Query time: 32 msec ;; SERVER: #53( ) ;; WHEN: Tue Feb 23 14:04: ;; MSG SIZE rcvd: 86 24

25 Getting list of DNS servers dig crysys.hu in ns ; <<>> DiG P3 <<>> crysys.hu in ns ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;crysys.hu. IN NS ;; ANSWER SECTION: crysys.hu IN NS ns1.crysys.dc.hu. crysys.hu IN NS ns2.crysys.dc.hu. ;; Query time: 42 msec ;; SERVER: #53( ) ;; WHEN: Tue Feb 23 14:09: ;; MSG SIZE rcvd: 73 25

26 So?? DNS servers give the basic information about what servers are we connecting to The attacker will do these firsts steps as well Of course, sometimes this is not interesting But the attacker can learn which hosts are in duty for specific means (MX,NS,WEB, etc.) Multiple adresses might be used for a service (round-robin hosts for Web, multiple DNS servers (round-robin), MX records (priority based list + RR) Not to much to gain, but much to loose if You avoid to check this. 26

27 Finding out bind version information dig txt ch ; <<>> DiG P3 <<>> txt ch ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;version.bind. CH TXT ;; ANSWER SECTION: version.bind. 0 CH TXT "4.9.3-P1-plus-CA patches" 27

28 The named version of BME DNS server dig txt ch ; <<>> DiG P3 <<>> txt ch ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0 ;; WARNING: recursion requested but not available ;; QUESTION SECTION: ;version.bind. CH TXT ;; ANSWER SECTION: version.bind. 0 CH TXT "9.5.1-P3" ;; AUTHORITY SECTION: version.bind. 0 CH NS version.bind. 28

29 Version.bind So You can check the version of bind But You cannot be sure it is not faked As sysadmin, You might want to set this to something fake That will be security-through-obscurity But If You are lazy to upgrade whenever it is needed- at least, fake the version info 29

30 Zone transfer if allowed dig in axfr ; <<>> DiG P3 <<>> in axfr ;; global options: printcmd crysys.hu IN SOA ns1.crysys.dc.hu. netadmin.ns1.crysys.dc.hu crysys.hu IN NS ns1.crysys.dc.hu. crysys.hu IN NS ns2.crysys.dc.hu. crysys.hu IN A crysys.hu IN MX 10 shamir.crysys.hu. crysys.hu IN MX 50 eternal.datacontact.hu. crysys.hu IN TXT "Datacontact - your nameserver..." aggregator.crysys.hu IN A albifrons.crysys.hu IN A clamav.crysys.hu IN A cypio.crysys.hu IN A db.crysys.hu IN A deserecprj.crysys.hu IN A deserecvclt1.crysys.hu IN A deserecvclt2.crysys.hu IN A deserecvhost1.crysys.hu IN A deserecvirtclt1.crysys.hu IN A deserecvirtclt2.crysys.hu IN A

31 Zone transfer authorization dig in axfr ; <<>> DiG P1 <<>> in axfr ;; global options: printcmd ; Transfer failed. Limiting zone transfer in named.conf: allow-transfer { ; ; ) 31

32 Setting fake bind version in named.conf more $ more /etc/bind/named.conf /* sample configuration file for BIND 8.1 or later * should be installed as /etc/named.conf * * Author: Florian La Roche */ # # overall options of the server # options { version "4.9.3-P1-plus-CA patches"; 32

33 whois OrgName: RIPE Network Coordination Centre OrgID: RIPE Address: P.O. Box City: Amsterdam StateProv: PostalCode: 1001EB Country: NL ReferralServer: whois://whois.ripe.net:43 NetRange: CIDR: /16 NetName: RIPE-ERX NetHandle: NET Parent: NET NetType: Early Registrations, Transferred to RIPE NCC Comment: These addresses have been further assigned to users in Comment: the RIPE NCC region. Contact information can be found in Comment: the RIPE database at RegDate: Updated:

34 inetnum: netname: BMENET descr: Budapest University of Technology and Economics descr: Budapesti Muszaki es Gazdasagtudomanyi Egyetem country: HU org: ORG-BME1-RIPE admin-c: GR1029-RIPE tech-c: IOS2-RIPE tech-c: GOYA-RIPE tech-c: THU-RIPE remarks: rev-srv: nic.bme.hu remarks: rev-srv: ns.bme.hu status: ASSIGNED PI mnt-by: AS2547-MNT source: RIPE # Filtered remarks: rev-srv attribute deprecated by RIPE NCC on 02/09/

35 DNS AXFR AXFR is a zone transfer, that means, a DNS server copies all available data in a specific zone to another DNS server (the secondary downloads all data to be served). Anyone, who can download zone transfer data knows all the hosts, or subdomains that are defined in the zone E.g. all.ca domain entries could be downloaded by AXFR Why is it a problem? E.g. info@domain.hu type spams. Spammer can easily collect a list Is it a problem? Hard to answer see above S.b.Obscurity. 35

36 Whois Whois is a general internet-wide database protocol It is typically used for IP address look, DNS owner look At many places it is no longer used directly for.hu it is redirected to web-based service (who know how ethical it is) TEST THIS: whois -h asn.shadowserver.org origin

37 37

38 38

39 2011 domain: bme.hu domain-használó: Budapest University of Technology and Economics domain-használó: Budapesti Muszaki és Gazdaságtudományi Egyetem cím: Pf 91 cím: H-1521 Budapest cím: HU telefon: telefax: hun-id: admin-kontakt: tech-kontakt: zone-kontakt: névszerver: nic.bme.hu[ ] névszerver: ns2.pantel.net névszerver: ns.bme.hu[ ] regisztrálva: :24:46 módosítva: :28:56 regisztrátor: admin-kontakt: Remzső Gábor cím: Pf 91 cím: H-1521 Budapest cím: HU telefon: telefax: hun-id:

40 tech-kontakt: BMENET hostmaster cím: Pf 91 cím: H-1521 Budapest cím: HU telefon: telefax: hostmaster@bme.hu hun-id: zone-kontakt: DNS Admin HUNGARNET cím: Pf. 498 cím: 1396 Budapest 62 cím: HU telefon: dns-admin@hungarnet.hu telefax: hun-id: regisztrátor: HUNGARNET Association regisztrátor: HUNGARNET Egyesület (Registrar) cím: Victor Hugo u cím: H-1132 Budapest cím: HU telefon: telefax: hun-id:

41 2010 record (archive) person: Gabor Remzso address: Budapest University of Technology and Economics address: Center of Information Systems address: Muegyetem rkp. 9. R310 address: H-1111 Budapest address: Hungary phone: fax-no: nic-hdl: GR1029-RIPE org: ORG-BME1-RIPE mnt-by: AS2547-MNT source: RIPE # Filtered person: Istvan Ostrosits address: Invitel address: Puskas Tivadar u address: H-2040 Budaors address: Hungary phone: nic-hdl: IOS2-RIPE source: RIPE # Filtered 41

42 2010 record /2 person: Andras Jako address: Budapest University of Technology and Economics address: Center of Information Systems address: Muegyetem rkp. 9. R310 address: H-1111 Budapest address: Hungary phone: fax-no: nic-hdl: GOYA-RIPE org: ORG-BME1-RIPE source: RIPE # Filtered person: Imre Simon address: Budapest University of Technology and Economics address: Center of Information Systems address: Muegyetem rkp. 9. R310 address: H-1111 Budapest address: Hungary phone: fax-no: nic-hdl: THU-RIPE source: RIPE # Filtered 42

43 2010 record /3 % Information related to ' /16AS2547' route: /16 descr: BMENET org: ORG-BME1-RIPE origin: AS2547 mnt-by: AS2547-MNT source: RIPE # Filtered organisation: ORG-BME1-RIPE org-name: BME remarks: Budapest University of Technology and Economics remarks: Budapesti Muszaki es Gazdasagtudomanyi Egyetem org-type: OTHER address: Muegyetem rkp. 9. H-1111 Budapest Hungary phone: fax-no: remarks: ========================================================= abus box: abuse@bme.hu remarks: remarks: Reporting guidelines can be found at Reports not conforming to these guidelines may be discarded silently. Thanks for your cooperation. remarks:

44 2010 record /4 remarks: Bejelentest kerjuk az alabbiak szerint tegyen: Az itt leirtaknak meg nem felelo bejelentesekkel nem all modunkban foglalkozni. Koszonjuk szives egyuttmukodeset! remarks: ========================================================= mnt-ref: AS2547-MNT mnt-by: AS2547-MNT source: RIPE # Filtered 44

45 Some practical examples, tools 1. SSH protocol header modification VIDEO ssh_debian_header_removal-1.avi 05:30 45