NTXISSACSC3 - How I hacked the Government and Got Away with It by Seven Hatfield
•
0 likes•89 views
How I hacked the Government and Got Away with It
Recommended
Recommended
More Related Content
What's hot
What's hot (19)
Similar to NTXISSACSC3 - How I hacked the Government and Got Away with It by Seven Hatfield
Similar to NTXISSACSC3 - How I hacked the Government and Got Away with It by Seven Hatfield (13)
More from North Texas Chapter of the ISSA
More from North Texas Chapter of the ISSA (20)
Recently uploaded
Recently uploaded (20)
NTXISSACSC3 - How I hacked the Government and Got Away with It by Seven Hatfield
- 1. @NTXISSA #NTXISSACSC3 How I Hacked The Government And Got Away With It Steven Hatfield II @drb0n3z Security System Senior Advisor Dell 10/03/2015
- 2. @NTXISSA #NTXISSACSC3 Topics • Legal Disclaimer • Explanation • Walkthrough • Ways to Improve • In Summary NTX ISSA Cyber Security Conference – October 2-3, 2015 2
- 3. @NTXISSA #NTXISSACSC3 3 Legal Disclaimer
- 5. @NTXISSA #NTXISSACSC3 5 Walkthrough • Certified Ethical Hacker (CEHv7) Course Description This Advanced Network Assessment prep course is a self-study resource designed to help students prepare to sit for the Certified Ethical Hacker CEHv7 exam. Specialty Area(s): Systems Security Analysis, Computer Network Defense, Vulnerability Assessment and Management Training Proficiency Level: Level 3 – Advanced Certified Ethical Hacker CEHv7 Overview CEHv7 Overview Download Ethical Hacking Introduction Download Ethical Hacking Terminology Download Hacking Phases and Vul Research Download
- 6. @NTXISSA #NTXISSACSC3 6 Walkthrough Let’s look closer at the PDF’s and “Downloads” by viewing page source */launcher.php?course=20&group=1 *'courses/CEHv7/course/videos/pdf/CEHv7_D01_S01_T01_STEP.pdf‘ *'courses/CEHv7/course/videos/pdf/CEHv7_D01_S01_T02_STEP.pdf‘ *'courses/CEHv7/course/videos/pdf/CEHv7_D01_S01_T03_STEP.pdf‘ *'courses/CEHv7/course/videos/pdf/CEHv7_D01_S01_T04_STEP.pdf‘ … *'courses/CEHv7/course/videos/pdf/CEHv7_D05_S03_T04_STEP.pdf‘ … *'courses/CEHv7/course/videos/pdf/CEHv7_Demo 3 - SQL Injection_STEP.pdf'
- 7. @NTXISSA #NTXISSACSC3 7 Walkthrough Now the videos…
- 8. @NTXISSA #NTXISSACSC3 8 Walkthrough Can you download that too? Let’s look at the PAGE source… */courses/CEHv7/index01.htm
- 9. @NTXISSA #NTXISSACSC3 9 Walkthrough Well that was jibberish. Let’s look at the FRAME source… */courses/CEHv7/course/container_01.htm
- 10. @NTXISSA #NTXISSACSC3 10 Walkthrough Familiarity among the urls….what happens if we try the video url in a page?
- 13. @NTXISSA #NTXISSACSC3 13 Walkthrough Now let’s get scary… Can I download from the command line?
- 14. @NTXISSA #NTXISSACSC3 14 Walkthrough And there you have an UNAUTHENTICATED WGET to the website pulling a copy of the video. Can you guess how stupid this is? So, now that we have a vulnerability….how do we report it?
- 15. @NTXISSA #NTXISSACSC3 15 Walkthrough Email is one way… That didn’t get ANY responses of course. How about Twitter? All the three letters are on Twitter!
- 17. @NTXISSA #NTXISSACSC3 17 Walkthrough Attempt 1……ok REALLY attempt 1….
- 19. @NTXISSA #NTXISSACSC3 19 Walkthrough Attempt 3 & 4 & 5…
- 25. @NTXISSA #NTXISSACSC3 25 Ways to Improve • Bug Bounties - Provides responsible disclosure - Allows for “hackers” to earn cash responsibly - Has proven to be responsive - (Google)Rewards for qualifying bugs typically range from $500 to $50,000. • BugCrowd (https://bugcrowd.com/list-of-bug-bounty-programs)
- 26. @NTXISSA #NTXISSACSC3 26 Ways to Improve • Even if they don’t/won’t provide a bug bounty program… - A central email/Twitter/Anonymous submission program to report vulnerabilities • Doing Code Audit… • Running a real Vulnerability Management Program…
- 27. @NTXISSA #NTXISSACSC3 27 In Summary • The Government SUCKS at security. Look at OPM… • With the right people in place, there is tons of room for improvement. • Current means of connecting and reporting is going on deaf ears. • Even current Government employees are wanting this to improve, but when they bring this up, it also falls on deaf ears or falls through budget cracks.
- 29. @NTXISSA #NTXISSACSC3@NTXISSA #NTXISSACSC3 The Collin College Engineering Department Collin College Student Chapter of the North Texas ISSA North Texas ISSA (Information Systems Security Association) NTX ISSA Cyber Security Conference – October 2-3, 2015 29 Thank you