Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Hacking And Its Prevention


Published on

Hacking is good and bad depending on who you are. Prevention tips to safeguard against hacking.

20090320, Ver 2.0

Published in: Business
  • Good points

    My thoughts
    Are you sure you want to  Yes  No
    Your message goes here
  • Free Download :

    Hey Guyz and girls, Today I am gonna show you perfact tool, Remember This video is old, But the download link with hack is brand new. Its very simple to using this tool and here are some instructions in video. Please REDOWNLOAD. Don't Forget to Comment Subscribe & Rate My Video :)

    Virus Scan :- This file has been scanned with avast! Antivirus. -- Status: FILE IS CLEANN.

    Copyright © 2014. All Rights Reserved
    Are you sure you want to  Yes  No
    Your message goes here

Hacking And Its Prevention

  1. 1. HACKING & IT’S PREVENTION PUNE POLICE Workshop on Cyber Crime (March 19 – 20, 2009) March 20, 2009
  2. 2. Introduction Dinesh Bareja CISA, CISM, ITIL, BS: 7799 (Imp & LA) Email: [email_address] Information Security professional, having more than 11 years of experience in technology in commercial, operational, functional and project management roles on multiple large and small projects in global and domestic markets.   Experienced in establishing ISMS (Information Security Management System), planning and implementation of large scale CobiT® implementation, ISO: 27001, ERM, BCP/DR, BIA, Asset Management, Incident Mgt, Governance and Compliance, VA/PT, AppSec etc   He is also member of ISACA, OCEG, iTSMF and co-founder of Indian Honeynet Project and Open Security Alliance. You can find him on Linked In as the owner of the India – Information Security Community group.
  3. 3. Summary <ul><li>It is a connected world with all types of individuals, organizations and countries having malicious intent….. constantly trying to attack, rob, destroy or paralyze our systems </li></ul><ul><li>Law Enforcement departments have a big challenge on hand </li></ul><ul><ul><li>… climb a steep learning curve </li></ul></ul><ul><ul><li>… . establish a higher level of competency to counter the threats of hacking </li></ul></ul><ul><ul><li>Necessary to protect assets 24x7x365 to ensure Continuity, Confidentiality, Integrity and Availability of business of the country, it’s citizens and institutions </li></ul></ul><ul><li>We shall look at Hacking --- how easy it is to start --- freely available tools --- easy motivation. </li></ul><ul><li>Against this what makes it difficult for the law is that the criminal is unseen, may be anywhere in the world and may not have any previous record ! </li></ul>
  4. 4. The hacker / cracker has TIME ANONYMITY INTELLIGENCE (hopefully not) TOOLS AND INFORMATION MALICIOUS INTENT Hack Hacker Hacking Hack:   // to write computer programs for enjoyment  //to gain access to a computer illegally —  hack it Hacker: //  an expert at programming and solving problems with a computer //  a person who illegally gains access to and sometimes tampers with information in a computer system Crack Cracker Crack:   //  to puzzle out and expose, solve, or reveal the mystery of <crack a code>  //to break into <crack a safe> Cracker: // Hacker // braggart; boaster.
  5. 5. Hacker to Cracker <ul><li>During the 1960s, the word &quot;hacker&quot; grew to prominence describing a person with strong computer skills, an extensive understanding of how computer programs worked, and a driving curiosity about computer systems. </li></ul><ul><li>True hackers are computer programming enthusiasts who pushed computer systems to their limits without malicious intent and followed a hacker code of ethics. </li></ul><ul><li>They believed technical information should be freely available to any person, and they abided by a code of ethics that looked down upon destroying, moving, or altering information in a way could cause injury or expense. </li></ul><ul><li>Hacking, however, soon became nearly synonymous with illegal activity. Negative publicity surrounding hackers continued to grow. </li></ul>
  6. 6. Hacker to Cracker <ul><li>While the first incidents of hacking dealt with breaking into phone systems, hackers also began diving into computer systems as technology advanced. </li></ul><ul><li>Hacking became increasingly problematic during the 1980s and as a result, in the US the Computer Fraud and Abuse Act was created, imposing more severe punishments for those caught abusing computer systems. In the early 1980s, the FBI made one of its first arrests related to hacking. </li></ul><ul><li>As a result, several hacker groups coined the term 'cracker' in 1985 to define a person who broke into computer systems and ignored hacker ethics; however, the media continued to use the word hacker. </li></ul>
  7. 7. Profiling … <ul><li>You are intelligent. </li></ul><ul><li>You have strong computing skills… you are an expert ! </li></ul><ul><li>You know how computers work and you can make them do things others cannot…. It is second nature for you. </li></ul><ul><li>You are interested in the internals of the computer and in pushing them to their limit for performance. </li></ul><ul><li>You want to learn and stay ahead in the race …. What’s new; how to get into databases; what are the techniques to access; how to bring down networks; what tools are free; where do criminals meet and transact business; how to crack applications… etc etc </li></ul>So … Are You A Hacker ! If you are legally in the profession then you are an Ethical Hacker If you engage in illegal hacking you are a Hacker or a Cracker. Welcome to the world of Hacking !
  8. 8. Profiling …. the color of your hat ! White Hat Also known as friendly hackers are always using their knowledge for good reasons Black Hat Also known as crackers these are the ones to watch out for, they send and make viruses, destroy data, and deface websites along with other illegal activity and break into peoples machines. This type of hacker has a bad reputation. Grey Hat … Are borderline white/black hats. They sometimes prank unsuspecting users and cause general mayhem. While they think this kind of activity is harmless, they may face long periods of jail time if they ever get found out. Not to forget the hatless….. - Script Kiddies - The Hobbyist - Insider - Countries
  9. 9. Identified by the color of his Hat ! <ul><li>Stephen Wozniak : &quot;Woz&quot; is co-founder Apple Computer . Was inducted into the National Inventors Hall of Fame in September 2000. </li></ul><ul><li>Tim Berners-Lee : The inventor of the World Wide Web . </li></ul><ul><li>Linus Torvalds : He fathered the Linux operating system . Calls himself &quot;an engineer,&quot; has simple aspirations , &quot;I just want to have fun making the best damn operating system I can.“ </li></ul><ul><li>Richard Stallman : He's known as the father of free software . </li></ul>Jonathan James: &quot;c0mrade,” The first juvenile to be sent to prison (16 years) for hacking. &quot;I was just looking around, playing around. What was fun for me was a challenge to see what I could pull off.“ Installed a backdoor into a Defense Threat Reduction Agency server. Cracked into NASA computers. Kevin Mitnick : Exploiting the LA bus punch card system to get free rides; broke into DEC network . He hacked into computers, stole corporate secrets, scrambled phone networks and broke into the national defense warning system. Robert Tappan Morris : Creator of the Morris Worm , the first computer worm to be unleashed on the Internet. The first person prosecuted under the 1986 Computer Fraud and Abuse Act. He wrote the code for the worm while he was a student at Cornell and “ intended to use it to see how large the Internet was ”.
  10. 10. Are these Black or White ? Kevin Poulsen : “Dark Dante” recognized for his hack of LA radio's KIIS-FM phone lines. Authorities began to pursue him after he hacked into a federal investigation database and during this pursuit, he further drew the ire of the FBI by hacking into federal computers for wiretap information. He served a sentence of five years and since serving time, he has worked as a journalist. As senior editor for Wired News his most prominent article details his work on identifying 744 sex offenders with MySpace profiles. Tsutomu Shimomura : son of Osamu Shimomura, winner of the 2008 Nobel Prize in Chemistry. He was hacked by Kevin Mitnick. Following this personal attack, he helped the FBI capture him by out-hacking Mitnick and had his own dark side These were the Black Hats Robert Tappan Morris :   now a tenured professor at the MIT Computer Science and Artificial Intelligence Laboratory. He principally researches computer network architectures including distributed hash tables such as Chord and wireless mesh networks such as Roofnet. Kevin Mitnick : now a productive member of society after five years in jail, about 8 months of it in solitary confinement. Now he is a computer security consultant, author and speaker Adrian Lamo: was breaking into NY Times, Microsoft, Yahoo etc …. currently working as an award-winning journalist and public speaker.
  11. 11. Takeaway Question <ul><li>Is a Hacker a criminal ? </li></ul><ul><li>Can we use Hackers to our advantage ? </li></ul><ul><li>Are we Hackers ?? </li></ul>
  12. 12. Hacking targets and types …. A short list <ul><li>Social Networking Sites </li></ul><ul><li>Online Databases </li></ul><ul><li>Network Infrastructure </li></ul><ul><li>Critical Infrastructure </li></ul><ul><li>Government Sites </li></ul><ul><li>Web Applications (XSS, CSRF…) </li></ul><ul><li>Phishing, Spear Phishing </li></ul><ul><li>Trojans / Virus / Logic Bombs </li></ul><ul><li>Denial Of Service (DoS) </li></ul><ul><li>Heart Pacemakers ( ) </li></ul>
  13. 13. Motivation Greed Revenge Curiosity Criminal Intent Coercion Show Off Attack
  14. 14. Web Hacking Incident Database Report .. Motivation Attack Goal % Defacement 24% Stealing Sensitive Information 19% Planting Malware 16% Monetary Loss 13% Downtime 8% Phishing 5% Deceit 2% Worm 1% Link Spam 13% Information Warfare 1% Web Hacking Incidents Database Report 2008
  15. 15. Tools <ul><li>A Google search will bring 1000’s of links for all types of Hacker Tools. </li></ul><ul><li>Cracks and pirated downloads of commercial tools are available freely. </li></ul><ul><li>E-books, self help guides, forums, chatrooms, networks….. </li></ul><ul><li>Tool # 1 : Social Engineering </li></ul>
  16. 16. Tools… a brief listing Trojan Horses - Yuri RAT v1.2 - MofoTro v1.7 BETA - Charon - Beast v2.0.7 - Omerta v1.3 - Theef v2.10 - Combined Forces R.A.T - MoSucker v3.0 - ProRat v1.9 Fix2 Keyloggers - Elite Keylogger v1.0 - SKL v0.1 - KeySpy v2.0 - A++++- Curiosity - Keylogger - KeyCopy Viruses - Hippi virus - Sasser- W32. Blaster .Worm - Midnight Massacre - 00001 - Nimda - Loveletter virus - Happy ‘99 - MXZ Binders - Daemon Crypt Public v- NT Packer v2.1 - EES binder v1.0 - File Injector v3 - Bytes Adder - FreshBind v2.01 - YAB v2.01 - NakedBind v1.0 - Amok Joiner WebHacks/WordLists Brute Forcers - Munga Bunga ’s Official - Brutus - Authentication Engine Test 2 - wwwHack v1.946 - FTP Brute Hacker - FTP Brute Forcer.tar.gz - Unix- Wbrute.tar.gz - Unix- Shadow Scanner - Brute Forcer - Hackers Utility v1.5 - POP3 brute forcer.tar.gz - Unix CGI-Bug Scanners - NStealth HTTP Security Scanner v5.8 - Attack Toolkit v4.1 - Scanarator- Legion NetBios Scanner v2.1 - NetView v1.0 - CGI Vulnerability Scan - CGI Scanner v4.0 - VoidEye CGI scanner Virus Builders - DR VBS - VBSwg 2 beta - Virus builder - p0ke’s WormGen 2.0 - RESIDUO - DoS Virus MSN Hacks & Bots - HoaX Toolbox 1.1 - MSN Extreme 3.0 - MessenPass v1.06 - Advanced Blood Scroller - Nudge Madness - Advanced IM  Password Recovery - Contact Spy - Msn Explosion - Encrypted Messenger Port & IP Scanners - Blues Port Scanner - ProPort v2.2 - SuperScan v3.0 - Net Scan Tools v4.2 - LanSpy v2.0 - ~censored~ Threads v3.1 - Trojan Hunter v1.5 - SuperScan v4.0 - Neotrace PRO v3.25 Nukers And Flooders - Rocket v1.0 - RPCNuke v1.0 - Panther Mode1 - 56k - Panther Mode2 - ISDN + - Final Fortune v2.4 - Battle Pong - Technophoria - Assault v1.0 - ICMP Nuker - CLICK v2.2
  17. 17. Incident Statistics (India) <ul><li>Statistics of defaced Indian Websites (Jan 2009) </li></ul><ul><li>CERT-In </li></ul>
  18. 18. Source:
  19. 19. Web Hacking Incidents Database Report 2008
  20. 20. Prevention and Mitigation <ul><li>Firewalls, IDS/IPS </li></ul><ul><li>Honeynet </li></ul><ul><li>Encryption </li></ul><ul><li>Patches </li></ul><ul><li>Anti Virus </li></ul><ul><li>Disable un-necessary services </li></ul><ul><li>Control on Mobile Devices </li></ul><ul><li>Restrict software installation </li></ul><ul><li>Monitor network traffic </li></ul><ul><li>Change default passwords on systems and devices </li></ul><ul><li>Role Based Access Control </li></ul><ul><li>Restrict Privileged Access / follow principle of Least Privilege </li></ul><ul><li>Internet facing infrastructure must be periodically assessed using Vulnerability and Penetration Testing methods for systems and applications </li></ul><ul><li>Conduct internal VA/PT </li></ul><ul><li>Identify assets and make sure you know what is valuable and you know where it is stored </li></ul>
  21. 21. Prevention and Mitigation <ul><li>Keep your identity safe </li></ul><ul><li>Do not using public Email systems like Gmail, Yahoo!... For official work </li></ul><ul><li>Do not use official email ID to subscribe to public groups </li></ul><ul><li>Sharing and posting professional information on Social networks </li></ul><ul><li>Professional Information on emails to public mailing lists and groups </li></ul><ul><li>Not using professional credentials online </li></ul><ul><li>Regularly conduct awareness trainings </li></ul><ul><li>Employee background checks </li></ul><ul><li>Continuous training and learning new technologies and methods </li></ul>
  22. 22. Police Dept : Prevention / Protection <ul><li>Intelligence Gathering through monitoring and participation in Social Networks, Chat Rooms, Warez sites, Adult Sites Internet Underground </li></ul><ul><li>Investigation of crimes following usual law enforcement practices </li></ul><ul><li>Fingerprinting / mapping and analysis of network traffic </li></ul><ul><li>Engage in public – private partnerships for research and studies </li></ul><ul><li>Undergo regular training to keep up with latest technology developments </li></ul><ul><li>Participate in public forums to share findings and actively enlist help from professionals, students, hobbyists, academia – this will provide sense of positive contribution from public and police can get information about crackers / kiddies who may seek to break the law for fun or profit </li></ul>
  23. 23. Police Dept : Prevention / Protection <ul><li>Attending conferences and events by professional industry groups in hacking, open source etc (ISACA,OWASP, LUG etc) </li></ul><ul><li>Build national database of incidents to help profile crimes and investigative procedures </li></ul><ul><li>Organize citizen trainings in schools, colleges, internet cafes and housing colonies to spread awareness about the risks / threats of computer crime </li></ul>The ongoing recession is only increasing the security risk for corporations, respondents said, with 42 percent reporting that displaced workers were the biggest threat to sensitive information on the network. - “Unsecured Economies: Protecting Vital Information” (McAfee)
  24. 24. FBI Undercover Operation <ul><li>DarkMarket was a &quot;carder&quot; site - like an eBay for criminals to buy and sell stolen credit card numbers, online identities and the tools to make fake credit cards.  </li></ul><ul><li>The Admin was ‘Master Splynter’ and he is like a “Don” who can make or break upcoming criminals in the business </li></ul><ul><li>‘ Iceman’ ran a competing website and accused ‘Master Splynter’ and of being an FBI agent </li></ul>Master Splynter’ Real name : J. Keith Mularski Designation : FBI Supervisory Special Agent Employer : FBI Division : Cyber Initiative and Resource Fusion Unit (under the National Cyber-Forensics & Training Alliance in Pittsburgh, Pennsylvania) The unit works with industry and international law enforcement agencies and does the deep research required to penetrate the world of online criminals.
  25. 25. FBI Undercover Operation <ul><li>‘ Iceman’ did not have conclusive proof </li></ul><ul><li>He had credibility problems since every Admin would be accused of being a Fed agent </li></ul><ul><li>And he had tried to take over three card markets and gain monopoly of the trade </li></ul><ul><li>‘ Master Splynter’ played “bluff “ when he got a lot of accusations about being a Fed agent </li></ul><ul><ul><li>He said that he was going to quit ! </li></ul></ul><ul><li>People allowed him to continue since they thought </li></ul><ul><ul><li>&quot;What law enforcement agency would, after they were monitoring the site, want to give it back to the bad guys?” </li></ul></ul><ul><li>Operation DarkMarket ws closed on Oct. 4, 2008. </li></ul><ul><li>FBI and police agencies in Germany, the U.K., Turkey and other countries, the investigation made </li></ul><ul><li>59 arrests </li></ul><ul><li>prevented an estimated US$70 million in bank fraud </li></ul>,0
  26. 26. Social Networking Case Study : Facebook Hack <ul><li>The threat from social networks comes from social engineering — employees post company information… the attackers collects during reconnaissance … then infiltrates the social network that exists between the employees … then uses that trust to phish for VPN passwords or any other information…. </li></ul>The Facebook hack case study is for an assignment carried out by SnoSoft and presents a unique insight into the threats and risks exposed on such sites
  27. 27. Facebook Hack Step 1 : Reconnaissance <ul><li>Conduct Social and Technical Reconnaissance </li></ul><ul><li>Social </li></ul><ul><ul><li>1400 employees identified through the internet of which 900 used social networking sites like Facebook, Orkut, LinkedIn, MySpace etc. </li></ul></ul><ul><ul><li>Studied about 200 profiles and created a false identity </li></ul></ul><ul><li>Technical </li></ul><ul><ul><li>Probed the corporate website and identified Cross Side Scripting vulnerabilities (which the researchers expected and hoped to find) </li></ul></ul>Cross-site scripting (&quot;XSS&quot;) vulnerability is most frequently discovered in websites that do not have sufficient input validation or data validation capabilities. XSS vulnerabilities allow an attacker to inject code into a website that is viewed by other users. This injection can be done sever side by saving the injected code on the server (in a forum, blog, etc) or it can be done client side by injecting the code into a specially crafted URL that can be delivered to a victim.
  28. 28. Facebook Hack Step 2: Setup <ul><li>Used a client side attack as opposed to a server side attack because it enabled the select ion of only those users that we are interested in attacking. Server side attacks are not as surgical and usually affect any user who views the compromised server page. </li></ul><ul><li>A payload is created and was designed to render a legitimate looking https secured web page that appeared to be a component of the customer's web site. </li></ul><ul><li>When a victim clicks on the specially crafted link the payload is executed and the fake web page is rendered. </li></ul><ul><li>In this case our fake web page was an alert that warned users that their accounts may have been compromised and that they should verify their credentials by entering them into the form provided. </li></ul><ul><li>When the users credentials are entered the form submitted them to and were extracted by an automated tool that had been created. </li></ul>
  29. 29. Facebook Hack Step 3: Create Profile <ul><li>After the payload was created and tested we started the process of building an easy to trust facebook profile. </li></ul><ul><li>Because most of the targeted employees were male between the ages of 20 and 40 we decided that it would be best to become a very attractive 28 year old female. </li></ul><ul><li>A fitting photograph was found by searching google images and used for the fake Facebook profile. </li></ul><ul><li>The profile was populated with information about our experiences at work by using combined stories that were collected from real employee facebook profiles. </li></ul>
  30. 30. Facebook Hack Step 3: Create Profile <ul><li>After the payload was created and tested we started the process of building an easy to trust facebook profile. </li></ul><ul><li>Because most of the targeted employees were male between the ages of 20 and 40 we decided that it would be best to become a very attractive 28 year old female. </li></ul><ul><li>A fitting photograph was found by searching google images and used for the fake Facebook profile. </li></ul><ul><li>The profile was populated with information about our experiences at work by using combined stories that were collected from real employee facebook profiles. </li></ul>
  31. 31. Facebook Hack Step 4: Attack Launch <ul><li>Upon completion we joined the company facebook group. </li></ul><ul><li>Joining request was approved in a matter of hours and within twenty minutes of accepted as group members, legitimate customer employees began sending friendship requests. </li></ul><ul><li>In addition we made hundreds of outbound requests. </li></ul><ul><li>The friends list grew very quickly and included managers, executives, secretaries, interns, and even contractors. </li></ul><ul><li>Having collected a few hundred friends, we began chatting. </li></ul>
  32. 32. Facebook Hack Step 5: Attack On <ul><li>Conversations were based on work related issues that we were able to collect from legitimate employee profiles. </li></ul><ul><li>After a period of three days of conversing and sharing links, we posted our specially crafted link to our facebook profile. </li></ul>The title of the link was &quot;Omigawd have you seen this I think we got hacked!” … . and people started clicking on the link and verifying their credentials. <ul><li>Ironically, the first set of credentials that we got belonged to the hiring manager. </li></ul>
  33. 33. Facebook Hack Step 6: Success <ul><li>Using those credentials one had access to the web-vpn which in turn gave access to the network . </li></ul><ul><li>Those credentials also allowed access to a majority of systems on the network including the Active Directory server , the mainframe , pump control systems , the checkpoint firewall console , etc. </li></ul>The Facebook hack has worked yet again.
  34. 34. Protecting against such attacks <ul><li>Awareness training </li></ul><ul><li>Regular vulnerability scans and tests </li></ul><ul><li>Monitoring of networks for suspicious activity </li></ul><ul><li>Organizations should implement best practices </li></ul>MID-DAY Pune Several armed force officials who have put sensitive details like their area of posting on Orkut are at risk of getting tapped by enemies Akin to numerous Puneities, even officials from the armed forces are besotted with social networking sites. This is evident from the fact that several officials have put up their personal details, including sensitive details like their area of posting, on Orkut or other network sites. RISK !
  35. 35. References <ul><li>Hacking History </li></ul><ul><li>Top 10 most Famous Hackers of All Time </li></ul><ul><li>How to Become a Hacker </li></ul><ul><li>Facebook Hack Case Study </li></ul><ul><li>CERT-In </li></ul><ul><li>Web Hacking Incidents Database Report 2008 </li></ul><ul><li>Policemag </li></ul><ul><li>Three years undercover with the identity thieves,0 </li></ul><ul><li>How Sky Reporter Broke Cash Card Scam </li></ul><ul><li>Computer Crime & Intellectual Property Section (US Department of Justice) </li></ul>
  36. 36. Discussions Q & A
  37. 37. <ul><li>A small group of professionals working in Information Security got together to discuss life beyond technical stuff which non-geeks find difficult to understand. </li></ul><ul><li>As a result of not being able to understand this technical security stuff and how it permeates into the organization DNA, these guys found that the non-geek person a.k.a. the Business Owner / Manager did not consider it necessary to provide adequate budgetary allocation ! </li></ul><ul><li>So these guys got together and want to work under OSA to present the risks, threats and vulnerabilities in an easy and understandable language. Just to make sure the non-geek understands the problems as well and gets as scared as the IS guy. </li></ul><ul><li>OSA - an open community of individuals who are committed to providing the benefit of their knowledge and expertise to community. </li></ul><ul><li>OSA - individual initiatives to undertake research and studies in Information Security (India centric) then provide learning to community. </li></ul><ul><li>… . The underlying thought is to Be The Change. </li></ul>
  38. 38. Thank You Dinesh Bareja Email: / Phone: 9769890505
  39. 39. Join OSA and leverage your knowledge and expertise to provide guidance and direction to community. Help in removing the FUD and misinformation and contribute to practical and usable studies and research that is India centric. This document is created by Open Security Alliance and is released in the public domain under Creative Commons License (Attribution-Noncommercial 2.5 India) Sponsored by Secure Matrix India Pvt Ltd. Title:Hacking and it’s Prevention Version: 1.0 / March 20, 2009