Peter Wood is the CEO of First Base Technologies, one of the first ethical hacking firms. He discusses how unpatched systems leave organizations vulnerable to attacks from both external and internal actors. Exploits of unpatched systems can result in information theft, malware infection, and unauthorized control of systems, leading to consequences like reputational loss, loss of competitive advantage, and remediation costs. The document provides examples of exploits against unpatched FTP servers, sendmail servers, and routers.

1. Unpatched Systems
An Ethical Hacker’s View
Peter Wood
Chief Executive Officer
First•Base Technologies

2. Who is Peter Wood?
Worked in computers & electronics since 1969
Founded First Base in 1989 (one of the first ethical hacking firms)
CEO First Base Technologies LLP
Social engineer & penetration tester
Conference speaker and security „expert‟
Member of ISACA Security Advisory Group
Vice Chair of BCS Information Risk Management and Audit Group
UK Chair, Corporate Executive Programme
FBCS, CITP, CISSP, MIEEE, M.Inst.ISP
Registered BCS Security Consultant
Member of ACM, ISACA, ISSA, Mensa
Slide 2 © First Base Technologies 2013

3. Hacker thinking
• How does this work?
• What research is there out there?
• What‟s happening under the covers?
• What happens if I do this?
• What happens if I ignore the instructions?
• What if I‟m a “legitimate” user?
• Where are the weak points?
• Is there another way in?
Slide 3 © First Base Technologies 2013

4. Missing Patches – Where?
• Internet facing systems
- Operating systems, web servers, applications
• Internal servers
- Operating systems, databases, applications
• Workstations & Laptops
- Operating systems, browsers, applications
• Smartphones, iPads, etc.
- Operating systems, browsers, apps
Slide 4 © First Base Technologies 2013

5. Slide 5 © First Base Technologies 2013

6. The Attackers
• Attacks may be external or internal
• Attacks are not limited to „hackers‟
• Attacks can be manual or automated
Slide 6 © First Base Technologies 2013

7. Slide 7 © First Base Technologies 2013

8. Unpatched FTP
Slide 8 © First Base Technologies 2013

9. Unpatched Sendmail
Slide 9 © First Base Technologies 2013

10. Unpatched Router
SNMP Read-Write
strings revealed.
Now we have full
control of this
device
Slide 10 © First Base Technologies 2013

11. „Root‟ on a UNIX Host
Now we have
„root‟ and
control the file
system
Drag and drop
an exploit on
the target host
Slide 11 © First Base Technologies 2013

12. „System‟ on a Windows Host
Now we have
„system‟ and
control the file
system
Drag and drop
an exploit on
the target host
Slide 12 © First Base Technologies 2013

13. Consequences of Missing Patches
• Information theft
- Reputational loss
- Loss of competitive advantage
- Legal action
• Malware infection
- Remediation costs
- Participation in botnet
• Unauthorised control of systems
- Corporate espionage
- Corruption of information
• Denial of service
- Loss of revenue
- Remediation costs
Slide 13 © First Base Technologies 2013

14. Need more information?
Peter Wood
Chief Executive Officer
First Base Technologies LLP
peterw@firstbase.co.uk
http://firstbase.co.uk
http://white-hats.co.uk
http://peterwood.com
Twitter: peterwoodx
Slide 14 © First Base Technologies 2013