The document summarizes common methods used to attack Windows NT operating systems and gain unauthorized access. It describes exploits like the "getadmin" hack that allows gaining administrator privileges by taking advantage of flaws in how the system handles memory addresses and permissions. Other attacks aim to crack encrypted passwords stored in the registry or conduct denial-of-service attacks by overwhelming systems with fragmented packets or network loops. The document stresses the importance of maintaining up-to-date security patches, implementing intrusion detection, and having policies and tools to constantly monitor for the latest threats.

1. Anatomy of an Operating System Attack
Drew Williams
Product Manager, Intruder Alert HIDS / Co-founder, Information Security SWAT Team
AXENT Technologies
April 9, 1998
More organizations move to the Internet as
their primary means of business communications
every day. As technology expands the way we do
business, that same technology is being turned to
misuse. A clear leader in advanced technology is
Microsoft’s NT operating system. Conversely, as more
businesses turn to Windows NT, it has become a
favorite target for computer hackers to exploit.
The two primary reasons for attacking a
system are ultimately to gain access to the system
with administrator privileges and to disrupt computer
operations and services.
With administrator privileges, an attacker has free reign of the system that’s being
compromised. Hackers can copy, change or delete information, reconfigure systems operations—
even execute other programs to gain access to the rest of the systems on the network.
The getadmin hack allowed an unprivileged user to gain administrator privileges.
Last year, while Americans were celebrating Independence Day, a fellow named “Konstantin
Sobolev” reported that Microsoft’s NT system service (NtAddAtom), does not check the memory
address of its output, if the NtGlobalFlag is set to “DEBUG.” This event results in the possibility of
writing to any space of kernel memory.
GetAdmin takes advantage of this first by setting the NtGlobalFlag, and injecting a .dll
into the winlogon process (which possesses SYSTEM privileges). With these privileges the
winlogon process now adds the user to the Administrator group.—This "hole" can allow almost
any type of program to be run, resulting in the attacker having complete access to an
organization’s network.
Four days after this flaw was first reported, Microsoft released the getadmin “hotfix.”
However, within a few hours a new version of the getadmin attack was released, which worked
around Microsoft's hotfix. (The hotfix patched the kernel to not allow the NtGlobalFlag to be
changed unless the user already had Administrator privileges.)—The new getadmin used another
area of memory (which allowed instructions to be executed at ring 0 privilege and
changed the NtGlobalFlag to DEBUG). The result: Administrator privileges, again!
Another method of gaining access to a system is to access a users id and password. User
information, including passwords, are stored in the system’s registry. A cadre of engineers with a

2. knack for hackgin, called “L0pht Heavy Industries,” revealed a method to dump the registry and
crack Microsoft's Lanman password encryption. With the latest version of L0phtcrack (available at
L0pht’s home page), an attacker can also "sniff" the network to gather user id's and passwords.
Microsoft uses a very weak hash algorithm as part of the NT Lanman. L0phtcrack 2.0 can
de-crypt paswords with only A-Z characters in less than 5 hours and passwords with A-Z,0-9 in
under 62 hours—Although Microsoft released the LM-Hash fix, this is rendered useless when
running Windows 95 or Windows 3.11 (both still utilize the original hash).
Another favorite hacker target is the NT Registry. For example, when sharing any system
resources with Windows 95, the hacker program called “CracksSharePW” takes advantage of the
share password entries stored in the registry at SOFTWAREMicrosoftWindows
CurrentVersionNetworkLanMan. These are also encrypted with an extremely weak cipher, and
the password hash is a simple XOR.
In the previously mentioned situations, attacks could have been thrawted by enforcing
strict password policys, utilizing security software that monitors systems file changes, and by
protecting direct access to an organization’s sytems with a properly secured firewall—and a
methodology for continual intrusion detection.
In another set of common hacker scenarios, an attacker disrupts computer operations
with a DoS (Denial-of-Service) attack, which is usually a deliberate attack, which includes allowing
another system on the network to impersonate the downed system. Following are a couple of
real-life example. . .
In early November 1997, a group of hackers found a serious bug in the fragmented packet
assembly routines in the TCP/IP code. When a fragmented packet is sent that overlaps the
previous packet the attacked system will slow down dramatically or completely crash. The
program code to this was immediately made public, and called the “Teardrop attack.”
Microsoft’s original fix was again quicky circumvented with the release of new teardrop
version, which worked by including false size information—This has since been fixed by
Microsoft’s “newest” tear fix.
In another example of a Dos technique, the “Land Attack” compromises another bug in
the Microsoft TCP/IP software. IP packets travel to a system, where the source address and port
are the same as the destination. This process obviously confuses the system into re-sending
packets back to itself in an endless loop, which ultimately renders a network completely useless.
The only real “prevention” from these type of attacks are to verify the latest fixes are
installed throughout the system by continuously auditing the system.
Currently, more than 100 Windows NT exploits are available via the Internet. To best
protect a system, security administrators should implement security software that keeps track of
the latest security information, monitors the entire network—not just selected segments—and
when necessary, encrypt all critical data.

3. To protect from external attack, administrators should ensure their networks are
protected with a properly configured firewall and install intrusion detection software to maintain
a flexible level of awareness (one that takes into consideration new attacks without requiring new
coded versions).
Many resources are available to keep abreast of current threats, a few web sites available
are:
http://www.axent.com/
http://www.icsa.org/
http://www.l0pht.com/
http://www.rootshell.com/
http://www.ntshop.org
. . . Security problems will continue as long as Organization “A” wants to keep information
or resources hidden from Organization “B”—or as long as curiosity or self interest continue to
provide the adequate motivation to lead people where they’re not supposed to go. The tools that
hackers use are easily accessible, and the targets flourish. So the situation begs the question for
security administrators to ask themselves, “How secure are we?”
Measuring acceptable risk against cost to productivity is not a single-point decision-
making
process. Administrators need to be constantly made aware of new threats and system
vulnerabilities. Today’s attack strategies—like today’s news events—do not necessarily reflect
tomorrow’s technological advances or new hacks. So what’s the best way to protect the
organization? Here are a few suggestions:
1. Establish a solid security policy, organization-wide, which effectively addresses all security
“points of interest” throughout the enterprise.
2. Maintain a constant effort of making sure the organization stays within compliance of its
respective policy. There are a handful of vendors who provide top-notch, multi-platform
security management tools (like AXENT’s Enterprise Security Manager).
3. Ensure that some mechanism for monitoring in real-time, the entire network, and a
means to
4. send immediate notification upon detecting an intrusion is in place and working 24x7. The
ideal intrusion detection model would provide a single point for monitoring and
management purposes, while directly involving all devices, nodes and segments of the
network in the intrusion detection process.
5. Keep the security structure flexible enough to move with the security “trends,” and don’t
rely on hard-coded solutions that are outdated almost as soon as they’re released.
Conclusion: Don’t wait until you lose
Like having auto insurance, nobody really “benefits” from security precautions until an
“accident” occurs. However, with the price-conscious solutions readily available from the world’s
leading vendors in network security, coupled with scores of security advisory groups,
administrators and executives can take the upper hand in protecting their organizations from

4. unnecessary security risks. So the question isn’t just, “How secure are you?” It’s more, “How
responsible for security are you willing to be?”.
Drew Williams manages AXENT Technologies’ Information Security SWAT team, which researches
and publishes information on how to protect networks from security attacks. SWAT’s research can
be accessed freely at www.axent.com.
# # # # #