External servers security

KTH Technology and Health External Servers Security Master Thesis Computer Network 15 ECTS KTH STH Campus Haninge Author: David Romero Barrero Supervisor: Magnus Brenning Date: 24 August 2010 Page intentionally left blank. ABSTRACT In a world where the most of the people has at least one computer connected to the Internet for access to the huge variety of online services offered nowadays, it is really important the security of this services. Services in which the people trust giving personal and confidential information such as bank account to buy by Internet, credentials to access to the online-bank, can not be vulnerable to attacks from “hackers” looking for this valuable information. But this task of protect these services ensuring that the private information of the users is not going to be filtered, is not an easy task, because, due to the importance of this relevant information, sophisticated and powerful attacks has greatly increased. By this, the security of business IT systems has never been so important. Having the correct information at the right time can make the difference between success and failure in this task to secure the online services protecting the private information from unauthorized disclosure and from malicious changes and deletions. In this aspect of the computer security is focused this thesis, where tools wich purpose is to capture and study new attacks (honeypots) and tools to detect in real time attacks suffered against the systems (IDS) are explained. Page intentionally left blank. Table of Contents 1 Introduction.............................................................................................................................1 1.1 Thesis purpose.................................................................................................................1 1.2 Outline of thesis...............................................................................................................2 2 Computer Security..................................................................................................................3 2.1 Computer security threats................................................................................................7 2.1.1 Viruses.....................................................................................................................8 2.1.2 Worms......................................................................................................................9 2.1.3 Rootkits and backdoors............................................................................................9 2.1.4 Bots and zombies.....................................................................................................9 2.1.5 Trojan horses..........................................................................................................10 2.2 Background on server-side security..............................................................................10 3 Intrusion Detection System...................................................................................................13 3.1 History...........................................................................................................................13 3.2 Intruders.........................................................................................................................14 3.2.1 Intruder Behavior...................................................................................................15 3.2.1.1 Hackers..........................................................................................................15 3.2.1.2 Criminals........................................................................................................16 3.2.1.3 Insider Attacks...............................................................................................16 3.3 IDS overview.................................................................................................................17 3.4 IDS classification..........................................................................................................18 3.4.1 Analysis type..........................................................................................................18 3.4.1.1 Signature-Based System................................................................................18 3.4.1.2 Anomaly-Based System.................................................................................19 3.4.2 Information sources...............................................................................................19 3.4.2.1 Network-Based Intrusion Detection Systems (NIDSs)..................................19 3.4.2.2 Host-Based Intrusion Detection Systems (HIDSs)........................................23 3.4.3 Type of response....................................................................................................23 3.4.3.1 Passive response.............................................................................................24 3.4.3.2 Active response..............................................................................................24 3.4.4 Detection time........................................................................................................24 3.5 IDS architecture.............................................................................................................25 3.6 Why use an IDS?...........................................................................................................26 3.7 IDS limitations..............................................................................................................26 4 Honeypot...............................................................................................................................29 4.1 Types of honeypots........................................................................................................29 4.2 Levels of interaction......................................................................................................30 4.2.1 Low-interaction honeypots....................................................................................30 4.2.2 Medium-interaction honeypots..............................................................................31 4.2.3 High-interaction honeypots...................................................................................31 4.3 Where to place a honeypot............................................................................................32 4.4 Honeynets......................................................................................................................33 5 Penetration testing.................................................................................................................37 5.1 Penetration testing phases.............................................................................................38 5.2 Penetration testing tools................................................................................................40 5.2.1 Reconnaissance tools.............................................................................................40 5.2.1.1 Nmap..............................................................................................................40 5.2.1.2 Hping..............................................................................................................40 5.2.1.3 Netcat.............................................................................................................40 i 5.2.1.4 Wireshark.......................................................................................................40 5.2.1.5 Firewalk.........................................................................................................41 5.2.2 Vulnerability detection...........................................................................................41 5.2.2.1 Nessus............................................................................................................41 5.2.2.2 SARA.............................................................................................................41 5.2.2.3 Strobe.............................................................................................................41 5.2.3 Penetration tools....................................................................................................42 5.2.3.1 Password cracker...........................................................................................42 5.2.3.2 Injection attacks.............................................................................................42 5.2.3.3 Exploitation tools...........................................................................................42 6 Experimental part..................................................................................................................43 6.1 Purpose..........................................................................................................................43 6.2 Scenario.........................................................................................................................43 6.3 Snort..............................................................................................................................45 6.3.1 Installation and Configuration...............................................................................45 6.3.2 Report analyzers....................................................................................................50 6.4 Nessus............................................................................................................................54 6.4.1 Installation and Configuration...............................................................................55 6.5 Tests...............................................................................................................................58 6.5.1 Port scan................................................................................................................58 6.5.2 Windows Client.....................................................................................................60 6.5.2.1 Test 1: Reverse shell embed in a PDF file.....................................................60 6.5.2.2 Test 2: EasyFTP.............................................................................................63 6.5.2.3 Test 3: LNK Shortcut File code execution.....................................................65 6.5.3 Test conclusions.....................................................................................................66 7 Limitations............................................................................................................................67 8 Future work...........................................................................................................................69 9 Conclusions...........................................................................................................................71 References.................................................................................................................................73 Figures Index.............................................................................................................................79 Appendix I – Netcraft...............................................................................................................81 Appendix II – Creation of a PDF with a reverse shell embed..................................................83 Appendix III – Attack against EasyFtp.....................................................................................87 Appendix IV – LNK attack.......................................................................................................91 Acronyms..................................................................................................................................95 ii Master Thesis External Servers Security 1 Introduction Nowadays it is impossible to imagine a world without all the information needed at the distance of one click. This dependence to the Internet convert all the computer that are connected to it in a target for continuous attacks. But this is not new, since the beginning of the cyberspace have been people finding some vulnerability in the computer in order to exploit them to get some benefit. The techniques used by these people, now knowing incorrectly as “hackers”, have evolved together with the expansion of the Internet. At the beginning, the efforts of the attackers were focused on servers with some vulnerable services running, but actually the security of these machines has increase considerably doing really difficult execute successfully some attack against them with only one computer. By this reason, with the time the effort of attackers have been focused in the client computers in order to get botnets from where carry out another plans of attack. Internet is plenty of malicious traffic like virus, worms, constantly targeting random computer with the purpose to get the control of these machines. The major part of this vulnerable machines belong to particular clients: a computer recently re-installed connected to the Internet without the correspondent updates, a router with incorrect configuration, firewalls with fails in the iptables. Although this problems damage directly to the networks administrator who can suffer some attack from this zombies machines, for the administartors is very hard do something to prevent thes problems, this concern to the formation of the particular clients. Focusing in the administrator side, what can do and administrator to try to prevent, detect, and act against the attacks that the machines could suffer? Throughout the thesis this question is answered by means of the explanation of some applications which help to detect and prevent attempts of intrusion on the system (Intrusion Detection Systems, Intrusion Prevention System1), and application which purpose is focus the attention of the attackers to get more time to counteract and analyze the attacks (honeypots). The topic of this thesis is focused in the study of some of these applications trying to analyze how reliable are and trying to show that the use of this help is part but not the complete measures that a network administrator must to carry out in his system. All these things has been treated emphasizing on the importance of the user education, because, like the hacker Mitnick one time said: “Technology is critical but we have to look at people and processes. Social engineering is a form of hacking that uses influence tactics”.[1] 1.1 Thesis purpose The thesis purpose is to give a review of some measures that can help the network administrators in the labor of maintain the network the most secure possible, trying to detect when the system is in rick to suffer an attack and, if this occur, detect it as soon as possible. Protection tools like IDS and honeypots are going to be analyzed in order to let know to the readers the benefits and inconvenient of them. The practical part will show how to install, configure and how these protections tools work and which kind of results show. To show this result, some attacks will be carried out 1 Due to time limitations, Intrusion Prevention System measures only are mentioned. 1 Master Thesis External Servers Security using the Penetration Testing and Security Auditing Linux Distribution Backtrack. Finally, in the conclusion is exposed an analysis about the functionality of the IDS and honeypots in the task of improve the security of the system. 1.2 Outline of thesis Chapter 2: Computer Security:.This part is an introduction into the computer security world with a point focus briefly on the server side security. Chapter 3: Intrusion Detection System: This part explain what is an intrusion and how to detect them with use IDSs. An explanation and classification of the IDS is explained too. Chapter 4: Honeypot: This part explain and classify the different kinds of honeypots and it use to detect and understand attacks. Chapter 5: Penetration testing: This part explain briefly the purpose of the penetration testing and list some of the application used in a test of intrusion. Chapter 6: Experimental part: This part explain the installation and configuration of two important security tools like are Snort and Nessus. Furthermore, some attacks has been performed in a virtual environment to show how Snort reacts. Chapter 7: Limitations: This part show the limitations to do this thesis. Chapter 8: Future work: This part show a possible way to continue the work started in this thesis. Chapter 9: Conclusions and suggestion: This section concludes the thesis and contain some suggestions to do the network more secure. 2 Master Thesis External Servers Security 2 Computer Security Nowadays computer and network technologies are present in whatever aspects of the human live doing the daily work easier. This dependence to computer and network system has introduced new risks in the daily work, “cyber security risks”. In order to do more secure this coexistence emerged the concept of Computer Security: “The protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability, and confidentiality of information system resources (includes hardware, software, firmware, information/data, and telecommunication)”.[2] This definition introduce the three most important objectives of the computer security: maintain the confidentiality, integrity, and availability (C.I.A.) in the computer and network system which may be compromised by cyber attacks(Figure 1). •Confidentiality: Ensure the access to data only to authorized users using methods like login with username and password. •Integrity: Related with the credibility of the information resources. It ensure that data has not been modify inappropriately and that the data come from the person that is said. Auditing the system can insure the integrity of the information. •Availability: The information system is available when someone needs it. This can be carried out with data backups, redundant systems, etc. The main objective of an intrusion is compromise some of this aspect in a system breaking it security causing that the system enter in an insecure state. Typically this kind of actions leave traces detectable by an IDS. This intrusions are divided in two basics kinds[3]: •Inbound: Originated from outside of the internal network (attacks with the purpose of penetrate the perimeter defenses of the network) like worms, virus, hacking, DDoS, spyware, back doors. •Outbound: Originated intentional or unintentional from within the internal network (e.g. employ device that propagate a worm or virus, user who respond to a phishing, 3 Figure 1: The security requirement triad[9] Master Thesis External Servers Security A bot is a program which purpose is to launch attacks against another machines. Typically the first objective of the bots is to be installed in hundreds or thousands of computers. When enough computers have been affected by the bot, from them is launched a simultaneous attack against some objectives with different purposes. Some of these purposes are: •Distributed Denial-of-Service attacks (DDoS). •Spamming. •Sniffing traffic. •Spreading new malware. •Attacking IRC chat networks. 2.1.5 Trojan horses As is defined in the book Hacking Exposed 6[8], trojan horses are: “Software that does something other than, or in addition to, its purported functionality. Usually, this means installing a rootkit or back door”.[8] Trojan horses are programs which purpose is to install hacking software on a system in order to grant access to a hacker to that system, for example, installing a backdoor. The way to spread this malware is by means of files attached in mails, physical installation, IRC chat, infected websites, etc. When a user sing on in a computer and goes online, the Trojan is activated doing its purpose. Usually, the purpose of a trojan horse is give access to the hacker into the system (RATs) but, furthermore, trojan horse can be purely destructive or denying programs, install an FTP, keyloggers or password sending, etc. 2.2 Background on server-side security A server is a host which main function is to provide one or more services to other hosts (clients) through a connection established over a network from the clients to the server. There are a lot of kinds of servers with different purpose. Some examples are, database server which provides database services for another host or applications like web serves, web applications. The web serves provide web content services. Another example is a file server that provides a location for shared disk access. It is possible to find much more types of servers such as authentication, application, email, DNS, print servers. It is common that a server provides some of this services simultaneously. Hackers are constantly attacking the servers with the objective to steal the valuable information stored on them or to stop some important service that these are offering. These attacks can be externals, such as an attacker situated outside from the company attacked, or locals, such as a discontent employee. To be able to mitigate this attacks and secure properly a server, first of all, it is needed to know which threats must be mitigated from a server. These threats can be originated from many reason, since a bug in the operating system installed on the server or some server application, to errors in the end users or administrators, all of them have in common than generate a vulnerability in the system. The efforts dedicated to enhance the security of a server must be proportional to the importance of the information stored in that system. For example, it is more important enhance the security of a server that has personal information about companies, employee, clients, than a system that is used to share public information. This do not means that some 10 Master Thesis External Servers Security system do not need to be protected because a weak system is the origin of a weak network, like a link in a chain. All the system need a level of security which depend of the relevance of the information stored on it. FIPS PUB 199[12] defines 3 levels of security (low, moderate, and high) based on the impact caused on a system by the loss of confidentiality, integrity, or availability. •“The potential impact is LOW if the loss of confidentiality, integrity, or availability could be expected to have a limited adverse effect on organizational operations, organizational assets, or individuals. A limited adverse effect means that, for example, the loss of confidentiality, integrity, or availability might: (i) cause a degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is noticeably reduced; (ii) result in minor damage to organizational assets; (iii) result in minor financial loss; or (iv) result in minor harm to individuals. •The potential impact is MODERATE if the loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals. A serious adverse effect means that, for example, the loss of confidentiality, integrity, or availability might: (i) cause a significant degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is significantly reduced; (ii) result in significant damage to organizational assets; (iii) result in significant financial loss; or (iv) result in significant harm to individuals that does not involve loss of life or serious life threatening injuries. •The potential impact is HIGH if the loss of confidentiality, integrity, or availability could be expected to have a severe or catastrophic adverse effect on organizational operations, organizational assets, or individuals. AMPLIFICATION: A severe or catastrophic adverse effect means that, for example, the loss of confidentiality, integrity, or availability might: (i) cause a severe degradation in or loss of mission capability to an extent and duration that the organization is not able to perform one or more of its primary functions; (ii) result in major damage to organizational assets; (iii) result in major financial loss; or (iv) result in severe or catastrophic harm to individuals involving loss of life or serious life threatening injuries. ” To get a server the most secure possible, an administrator must focus its efforts basically in two actions. The first one is to solve security weaknesses, like know vulnerabilities, installing the needed parches. The second action is restrict the functionality of the system, offering only the services needed. NIST has provided some basic server security steps to ensure the security of a server which are listed below[13]: •Plan the installation of the operation system (OS) and other components needed for the server before it deployment. •Install, configure, and secure the OS. •Install, configure, and secure the server software. •Ensure that the content of the server is properly secured. •Deploy appropriate network protection mechanisms in function of the particular situations of the server, such as location of the server's clients, location of the server in the network, types of services offered. The description and deploy of some of this mechanisms are the purpose of this thesis and will be discussed in the next sections. 11 Master Thesis External Servers Security •Once the system with all it functionalities is deploy, it is necessary than an administrator give support to it upgrading the system, monitoring the logs, executing backups, etc. 12 Master Thesis External Servers Security 3 Intrusion Detection System RFC 2828[31] defined: “Security Intrusion: A security event, or a combination of multiple security events, that constitutes a security incident in which an intruder gains, or attempts to gain, access to a system (or system resource) without having authorization to do so. Intrusion detection: A security service that monitors and analyzes system events for the purpose of finding, and providing real-time or near real-time warning of, attempts to access system resources in an unauthorized manner”.[31] An Intrusion Detection System (IDS) is software that automates the intrusion detection process. 3.1 History Since the beginning of the computer science, intrusion detection techniques have been used by the administrators. With the time, these techniques have evolved. At the beginning, systems administrators were sitting in front of a console monitoring the user activities trying to detect some intrusion like users logged locally in holidays. The next step was in the late '70s and early '80s. In this period, system administrators typically printed audit logs on fan-folded paper generating huge stack of paper. Obviously, search manually between all that papers was very time consuming, by this, the administrators mainly used that audit logs as a forensic tool to try to find the cause of a particular security incident. With the time, the storage became cheaper and the audit logs were moved. With the audit logs stored in computers, appeared programs to analyze the data. However, analysis was slow and computationally intense by this reason the analysis take place when the system's user load was low. Therefore, the intrusions detected were after occurred. By that time, on 26th February 1980, James P. Anderson wrote “Computer Security Threat: Monitoring and Surveillance”, the first paper about IDSs. In this paper, Anderson wrote about the importance of analyze the audit trail and how to do it. Anderson was focused on the collection of logs that showed abnormal use of the system, such as use outside of time, abnormal frequency of use, abnormal behavior of the users. Anderson explained that: •Security logs must be obtained from different resources of the system. •The detections of unusual behavior of users is necessary to avoid internal attacks. •Security administrators, in order to find the problem, must get enough data. •The security audit trail should be able to recognize the attacker strategy. At the beginning of the '90s, appeared the firsts real-time intrusion detection systems. This allowed the detection of attacks and attempts of attacks instantaneously giving the opportunity to the system administrators to take some measure. At the beginning of this decade appeared one of the first IDS for network traffic, the Network System Monitor (NSM).[32] It was developed in the California University and it worked on an UNIX station of Sun. NSM had a similar process to work than IDS of today: •All network traffic was captured. 13 Master Thesis External Servers Security •Network packets were obtained. •The protocol was identified. •Data was inspected and compared with statistics and rules. 3.2 Intruders Together with the viruses, the intruder is one of the most publicized threats to security, generally referred as a hacker or cracker. An important study of intrusion[33] identified three classes of intruders. The following list shows the different kind of intrudes. This list is shorted from less to more on a scale of difficult to detect the activity carried by the intruder: •The Masquerader: Could be either an external penetrator who has penetrated physically in the installation of the company, or an employee with or without full access to a computer who has obtained the username and password of another legitimate user. In this case it is really difficult to distinguish the legitimate user from the masquerader who have the proper username and password. The next audit trail could help the administrator to identify this kind of intruders: ◦Use of the legitimate user credentials outside of normal time. ◦Abnormal frequency of use of the account of the legitimate user. ◦Abnormal volume of data generated in the account of the legitimate user. ◦Abnormal patterns of references to programs or data. To be able to detect this “abnormal” use of an user account, have to be some notions of which is a “normal” behavior of the user supplanted. •The legitimate user (misfeasor): An authorized user who abuses of its privileges to access to data, programs, or resources such access is not authorized. Since the user is authorized to use the system, in the audit trail records do not appear any abnormal patterns of reference, login times, etc. By this reason it is more difficult to detect this kind of users that masqueraders users. The trail to search in the logs, in order to detect this kind of intruders, is access to certain information which access is not authorized in the conduct of it job. •The clandestine user: This is possibly the most difficult intruder to detect by normal audit trail methods. This user is a person who have access to supervisory control of the system and uses this control to evade auditing and access controls or to suppress audit collection. There is nothing to do to detect this type of user because is able to alter the operating system to suppress audit recording unless that this user activates his clandestine operations in a masquerader or legitimate user or if the operating system is continuously being compared with some reference version. It is clear that to be able to suppress the audit logs in a network, the attacker must traverse a number of security points that with an experimented administrator is virtually impossible. The intruder attacks can be ranged from the benign to the serious. Benign attacks are carried out by people who only want to explore Internet and see what there are. Serious attacks are carried out by people who are attempting to stole private information, modify this information, disrupt the system, etc. Some example of intrusions are[34]: 14 Master Thesis External Servers Security •Performing a remote root compromise of an email server . •Defacing a web server . •Guessing or cracking passwords. •Viewing or copying sensitive data, such as payroll records, medical information, and credit card numbers, without authorization . •Running a packet sniffer on a workstation to capture usernames and passwords. •Using a permission error on an anonymous FTP server to distribute pirated software and music files . •Dialing into an unsecured modem and gaining internal network access . •Posing as an executive, calling the help desk, resetting the executive’s email password, and learning the new password . •Using an unattended, logged-in workstation without permission. 3.2.1 Intruder Behavior With the evolution of the security measures, the techniques and behavior of the intruders are constantly changing to evade the new detection systems and exploit new weaknesses that have not been solved yet. Despite this changes, intruders typically follow some recognizable behavior pattern which differ from those of ordinary users. In the following, some examples of intruder behavior patterns are explained.[35] 3.2.1.1 Hackers Typically, hackers break into a system for one reason: Status. Between the hackers, this status is determined by the level of competence. By this reason, the hackers attacks are destined to companies indiscriminately, searching it weakness point. When hackers break in a company, they share the results obtained with other hackers to prove their success. Some typical hacker behavior patterns are: •Select the target using IP lookup tools such as NSLookup, Dig, and others. •Map network for accessible services using tools such as NMAP. •Identify potentially vulnerable services. •Brute force password. •Install remote administration tool (DameWare). •Wait for administrator to log on and capture his password. •Use that password to access remainder of network. Some counter measures are: •Restrict remote logons to specific IP addresses and/or use VPN technology. •Monitor logs daily for anomalous behavior, such as a single user logged on locally and remotely at the same time. 15 Master Thesis External Servers Security 3.2.1.2 Criminals Criminals are groups of hackers which have specific targets or classes of targets in mind. All the targets of the criminals are selected with the purpose to steal money, a common target is an e-commerce server, with the purpose to get credit card information. Once a site is penetrated, the attack is quick, getting as much valuable information as possible and exiting. The typical behavior patterns of criminals are: •Act quickly and precisely to make their activities harder to detect. •Exploit perimeter through vulnerable ports, services and buffer overflows. •Use Trojan horses to leave back doors for reentry. •Use sniffers to capture passwords. •Make few or no mistakes. Counter measures: •Spend resources protecting that which are most valuable. •Encrypt credit cards in databases. •Use a dedicated server. •Purchase extra security options. 3.2.1.3 Insider Attacks Usually, this kind of attacks are discontent employees with revenge sentiment. This intruders are the most difficult to detect and prevent. Insider attackers have access and knowledge about the structure and content of corporate databases. Some behavior patterns of these intruders are: •Create network accounts for themselves and their friends. •Access accounts and applications that this users wouldn’t normally use for their daily jobs. •Conduct furtive instant messaging chats. •Perform large downloads and file copying. •Access the network during off-hours. Some counter measures are: •Enforce least privilege, only allowing access to the resources employees need to do their job. •Set logs to see what users access and what commands this users are typing. •Protect those resources that are most important with strong authentication. •Upon termination, delete all computer and network access. •When employees leave the company, make a mirror image of the hard drive that has been using before reissuing it. That evidence might be needed if the company information turns up at a competitor. 16 Master Thesis External Servers Security 3.3 IDS overview Authentication system, access control, firewalls are some of the security measures which main purpose is to prevent than the intruders get access to the system. But this measures sometimes are not enough, and it is when another line of defense is needed. This line of defense are the IDS which important role to secured a network is motivated by the next considerations: •If an intrusion is detected quickly enough, the intruder can be throw out of the system before any damage is done or any data are compromised. Even if the detection is not enough quickly to prevent the actions of the intruder, the sooner that the intrusion is detected, the less amount of damage in the system will be done. •An effective IDS can dissuade intruders, acting to prevent intrusions. •New intrusion techniques detected by IDS are used to increase the intrusion prevention measures. IDS works based on the assumption that the behavior of an intruder differs from that of an authorized user. But, like shows Figure 5, there is not an exact distinction between an attack by an intruder and the use of resources by an authorized user. Figure 5 shows an overlap between both behavior. That's why there is a risk of a false positive (authorized users identified as intruders) or a false negative (intruders not identified as intruders) in the results show by the IDS. The detection of false positives is not so dangerous as false negatives, because are not attacks against the system so the system is not compromised, but it is right that a big amount 17 Figure 5: Profiles of Behavior of Intruders and Authorized Users[76] Master Thesis External Servers Security of false positives can drown out correct IDS alerts. A rule could generates false positives alerts each 5 minutes. Reviewing one alert each fives minutes generates a huge quantity of data and could be possible than an administrator loose a true alert between that numerous quantity of false positives. The art of IDS management is learning how to minimize false positives without affect the detection of relevant alerts. Some of the most important desirables characteristics for IDS are[36]: •It must run continually with minimal human supervision. •It must be fault tolerant. It must be able to recover from system crashes, either accidental or caused by malicious activity. •It must resist subversion. The IDS must be able to monitor itself and detect if it has been modified by an attacker. •It must impose a minimal overhead on the system where it is running. •It must be able to be configured according to the security policies of the system that is being monitored. •It must be able to adapt to changes in system and user behavior over time (new applications installed, users changing from one activity to another). •It must be able to scale to monitor a large number of hosts. •It must provide graceful degradation of service. Is some components of the IDS stop working for any reason, the rest of them should be affected as little as possible. •It must allow dynamic reconfiguration. The IDS must be able to be reconfigured without having to restart it. 3.4 IDS classification There are different criteria to classify IDSs. Some of the most common are: •Analysis type: How the information captured is analyzed. •Information sources: Where the information is captured. •Type of response: How react the IDS after an attack has been detected. •Detection time: When the data is analyzed. 3.4.1 Analysis type The analysis type refers to how the information captured is analyzed in order to detect attacks. It is possible to difference two types: •Signature detection: Used by most of the commercial systems. •Anomalies detection: Looks for unusual patterns of activity. 3.4.1.1 Signature-Based System A Signature-based IDS(SBS) is based on pattern matching techniques. It works similar to an anti-virus. The IDS has a database of know-attacks signatures which is used to compare the signatures of the activities analyzed from a system. When a match is found, an alert is thrown. 18 Master Thesis External Servers Security This technique, usually has a few false positives, but has the inconvenient that new attacks (zero day) or polymorphic attacks, are not detected until a signature for this attacks is created and the database of the IDS is updated with it. For that reason, attackers have a window of time to gain control of the system or application under attacks without be detected. The advantages of this IDS is that requires a few work to be set up. The users only have to select the signatures needed depending of the application installed on the systems deactivating unneeded signatures to avoid possible false negatives. Another advantage is that the IDS signature-based can classified the alerts generated, which lend the administrators analyze this alerts quickly prioritizing the most important alerts. 3.4.1.2 Anomaly-Based System Anomaly-Based System (ABS) were developed to overcome the limitations of the SBS which are not able to detect zero-day or polymorphic attacks. ABS works assuming that the attacks are different from the normal activity. In order to detect these attacks, a statical model which describes the normal behavior of the monitored system/network is built. ABS works by training itself, by means of historical data collected during normal operations, to recognize acceptable behavior sending an alert when the monitored activity deviates from normal activity. The main advantage of this kind of IDS is the detection of zero-days and polymorphic attacks. But the negative side is that it has a high number of false positives, it installation requires expert personal because several parameters need to be configured, such as the duration of the training. Another inconvenient are that usually works as a black-box and does not classify the alerts that throw. In despite of the possibility of the ABS to detect unknown attacks, its disadvantages and it complex use provoke that the IDSs most used today are signature-based, mainly by it simplicity to be implemented, configured and maintained. However, with the apparition, each time more frequent, of new attacks, the interest by the ABS is increasing. 3.4.2 Information sources Information source is one of the first issues to define when the structure of the IDS is being designed. In function of this aspect, the IDSs are classified depending of where the packages are captured or the scope of the IDS. The main types are: •Network-Based Intrusion Detection System (NIDS): Acquire data from the network. •Host-Based Intrusion Detection System (HIDS): Acquire data from inside a computer. 3.4.2.1 Network-Based Intrusion Detection Systems (NIDSs) Most of the Intrusion Detection Systems are Network-Based (NIDS). The NIDSs, like a network analyzer, captures all the traffic destined to the network and, in real time or close to real time, examine network-level, transport-level and/or application-level protocol activity packet by packet. Once the information of the packet has been read into memory, the signature of this is analyzed in order to check if it has an acceptable signature or not. If the signature is not acceptable, depending on the particular configuration of the NIDS, different measures will be done, such as: •An alert will be send out, for example an e-mail. 19 Master Thesis External Servers Security 3.6 Why use an IDS? Think in a thief that is trying to enter in a house. The thief tries to enter by the front door but it is looked. Then the thief tries to enter by the windows, but it is looked too. The house seem to be secure, so, why to install an alarm?. The answer is simple, because one day it is possible that someone forget to lock properly all the entries to the house, or one entry is leaved unlocked deliberately. The same question could be asked by a network administrator. Why to install an IDS if the system have firewalls, all the operating systems are patched, the passwords are checked looking for weakness? Apparently the system is secure but, like in the example of the house, what happen if the administrator forget to update a rule of the firewall or do it incorrectly, or what happen if a discontent employee leave some backdoor, or unconsciously an user open a mail with a malware? Even with the best protection systems, the houses and the computers are not 100 percent secure. In the case of the computer science, most security experts ensure that with the fact of give to the users features like network connectivity, a system will never be completely secure. So, only by the fact that the systems are used by humans, and humans are not perfects, the network administrator must keep in mind than sooner or later, intentionally or not, someone will done a fail and probably an attacker will be aware of that an will try to attack the system. At this moment, the only important thing is to detect it as soon as possible. The main purpose of the IDS is detect this fails or attacks, alert the administrators and sometime take its own measures. 3.7 IDS limitations There is no an IDS model that is able to offer 100% intrusion detection. Some of the limitations of the IDS are the following[41]: •The fact that the IDSs operate comparing the actual behavior of a network with a predefined normal behavior, provoke a huge number of false alarms, False positives or False negatives. This is because the users have an unpredictable behavior and someday can do some action different from the habitual acts causing an alert in the IDS by the detection of this unusual behavior. In fact, an Anomaly-Based IDS with a rate of 20 false alarms to 1 real intrusion detection is considered good. •Anomaly-Based IDS require of an extensive training set of network or system event logs in order to characterize normal behavior. In recent companies or companies that usually do not save the logs of the system, it is needed certain time to recollect enough data in order to train the IDS. •New attacks or polymorphic attacks are not detectable until a signature of it has been generated and the IDS has been updated with it. Anomaly-Based IDS with a good training could solve this problem. •The IDS are really exigent with the resources requirements of the system where are implemented. This is because IDSs have to process in real time huge quantities of data. This is specially true in high networks. •In a state of overload, the IDS are not able to analyze in real-time all the traffic of the network, discarding some packets which could contain an attack. 26 Master Thesis External Servers Security •IDS are not able to detect sophisticated attacks such as packet fragmentation techniques. •Although usually is difficult to detect the position of the IDS, experimental attackers could find it and instantaneously will launch a direct attack against it. This direct attack can not be blocked by the IDS and will disable it. •Each system where the IDS are implemented has its own characteristics, the IDS must be configured and adapted to the particularities of each system. •Network-Based IDS are not able to analyze encrypted communication. •Depending of the position of the IDS, this one could cause that a trusted packet do not arrive to the network. For example, when a packet with TTL one arrive to the IDS this packet will be accepted by the IDS but the router of the organization will discard it. •Since the switches only send the traffic to the devices where it is addressed, for an IDS situated after a switch it is hard to monitor the global network traffic. 27 Master Thesis External Servers Security Page intentionally left blank. 28 Master Thesis External Servers Security 4 Honeypot One of the original honeypot stories comes from “The cuckoo's Egg”, a book by Clifford Stoll. In 1980's, a cracker has been traced to Germany, but all attempts to pinpoint him further were frustrated by the German phone system, which is based on analog circuits and tracing a connection takes time. To keep the cracker on the line, Clifford builds a series of fake computer files that purport to detail a new secret plane in development by the U.S. Military. The efforts of Clifford pays off: the cracker was so fascinated by the drawings and fake information that stayed connected long enough for his phone call to be traced. One important thing to be able to enhance the security of the systems is to know the last techniques used by the attackers. One way to get this valuable information for the system administrators is to install trap applications in the machines, like did Clifford Stoll, in order to register suspicious activities without attackers notice that are being examined. This is the basic functionality of the honeypots. Honeypots are a relatively recent innovation in intrusion detection technology. Honeypots are applications, more or less interactive, that emulate some application or service of a system and register the suspicious activity than attacker could launch against them. Obviously, the information served by this emulated applications are apparently important information about the company in order to distract the attackers for the real systems and give some extra time to the administrator to take some temporal measure. This kind of application will never have sensible information about the company and must always be properly isolated from the real systems to prevent attacks from these to the internal systems. Are designed to: •Divert an attacker from accessing critical systems. •Collect information about the attacker's activity. •Encourage the attacker to stay on the system enough time to lend the administrators to respond. 4.1 Types of honeypots Marty Roesch, developer of Snort, classified the honeypots in two general categories: production honeypots and research honeypots. Production honeypots protect an organization, while research honeypots are used to learn.[14] Production honeypots: have the purpose of enhance the security of a system alerting when some attacks is being launched against them. This kind of honeypots are easier to implement than research honeypots because need less functionality. However, production honeypots give to the users less information about the attacks and the attackers. With these honeypots, it is possible to know what exploits the attackers are launching against the system and from where are attacking. Research honeypots: have the objective of learn as much information as possible. That is why is not enough only with emulate some services or application and it is necessary to offer to the attackers a real computer system and application which interact with them. With these kind of honeypots, is possible to learn much more, such as how the tools of the attacker are developed. The disadvantages are that this kind of honeypots are more complex and have more risk than the production honeypots if an attackers get a complete control about the system because it could be used to launch attacks and other fraudulent activities. 29 Master Thesis External Servers Security Not always the implementation of each kind of honeypot is really different. At the end, the easiest way to know the type of a honeypot it will depend of the functionality and purpose of it. For example, a production honeypot capture all the activity of an attacker and after detect the activity of an attacker, block the attack and alert the administrators. The same honeypot as a research system try to know the tools that the attacker is using, the origin of the attack, and the activity of the attacker after the honeypot has been compromised. 4.2 Levels of interaction Honeypots can be categorized in function of the level of interaction that are offering to attackers. This level of interaction is related with what it is wanted to do with the honeypots: detect unauthorized activities, catch the attackers in action and learn about the tools, tactics that are using. Addison Wesley classified the honeypots in three different levels of interaction[14]: lowinteraction honeypots, medium-interaction honeypots, and high-interaction honeypots. 4.2.1 Low-interaction honeypots The honeypot emulate a service, application or a vulnerable system. This basic functionality make this kind of honeypots the easiest to deploy and maintain, usually is enough with execute a program. The administrator after install the program, only have to maintain it with possible patches and monitor any alert from it. This simplicity make that this kind of honeypots have the lowest level of risk. The purpose of low-interaction honeypot is only detect unauthorized scans or unauthorized connection attempts giving information about the date and moment of the attack, the source and destination IP and port of the attacker. Some examples are: •Honeyd[15]: Maybe one of the easiest and popular honeypots. It is a daemon that creates virtual hosts on a network. This virtual host can be configured to run arbitrary services, and can be configured to simulate to be running certain operating system. •HoneyC[16]: The purpose of this honeypot is to find malicious servers on a network. To do this, it is formed by three components:Queuer, Visitor, and Analysis Engine. The Queuer generate a server queue for interact with the Visitor. The request of the visitor are enqueued to be processes and answered. Finally, after the interaction between the Visitor and a server, the Analysis Engine evaluate if some security policy have been violated. •Glastopf[17]: Glastopf emulates thousand of vulnerabilities to collect data from attacks against web application such as remote file inclusion, SQL injection, local file inclusion. It functionality is simple, it scan the incoming request searching string like "=http://" or "=ftp://". When some request is recognized like dangerous, Glastopf try to download and analyze the file and respond to the expectations of the attackers. If the attackers send a bot, shell, spreader, the honeypot will get information with the purpose to avoid a successful attack against the real systems with the same technique. Once this kind of honeypot has been indexed by search engines, thousand of attacks could be launched against it. •Honeytrap[18]: This honeypot is destined for observing attacks against network. In 30 Master Thesis External Servers Security order to do this, it monitors the network stream for incoming sessions and starts appropriate listeners just in time. Each listener can handle multiple connections and terminates itself after some idle time. services. It is focus in catching the initial exploit. 4.2.2 Medium-interaction honeypots Situated in the middle of a complexity and functionality honeypots scale, mediuminteraction honeypots can expect certain activity and are designed to give certain response beyond than a low-interaction honeypot. For example, in a emulation of a web server, while a low-interaction honeypot simply present an HTTP banner, a medium-interaction honeypot could be customized to present whatever specific functionality or behavior. This possibility to customize the honeypot, make possible to get information more interesting like the payload launched by a worm, than only detect unauthorized scans or unauthorized connection attempts. Since the services offered by this kind of honeypots are emulated too, the risk of these compared with the low-interaction honeypots is not much more greater. The main inconvenient to implement these honeypots is the huge complexity and big difficulties to configure them properly increasing the risk that something could go wrong and an attacker get advantage of this mistake. A great amount of work is needed to configure a honeypot that emulate an specific functionality of an application. The main advantage is that, with less risk than with high-interaction honeypots, it is possible to get interesting information such as payloads launched against an specific system, how the attacker elevate privilege, the tools of an attacker. Some examples are: •Nephentes[19]: It is used to emulate vulnerabilities used by the worms to spread. Once a worm is trying to use some of the vulnerabilities emulated by Nephentes, this honeypot will capture it to study it behavior. •mwcollectd[20]: It is a malware collection daemon. It is based in the best features of Nephentes and honeytrap. •Multipot[21]: It is a honeypot for Windows. It emulate weak point under Windows with the purpose to collect worms. 4.2.3 High-interaction honeypots High-interaction honeypots are the extreme of honeypot technologies and are able to track all the actions of the attackers, giving really relevant information about the new techniques of the attackers. This information is very important to protect the real systems of the organization. The only thing that difference this kind of honeypots from a normal systems is that these honeypost have not production value. By this fact, this security tools have an immense level of risk because when attackers have control of one of this honeypots, the attackers have a fully operation system to interact with being able to attack other system or capture production activity. To mitigate this risk, high-interaction honeypots usually are placed within a controlled environment, in many cases behind a firewall. This firewall must be properly configured to allow the attacker full interaction with the system but it does not let the attacker 31 Master Thesis External Servers Security uses the honeypot to launch attacks to other system situated outside of a controlled infrastructure. This level of interaction with the attackers make this kind of honeypots extremely difficult to install and configure. A variety of technologies are involved such as firewall and IDS. This complex system have an high level of risk. Some examples are: •HIHAT[22]: The High Interaction Honeypot Analysis Toolkit (HIHAT) allows to transform arbitrary PHP applications into web-based high-interaction Honeypots. Some of this PHP applications are PHPNuke[23], PHPMyAdmin[24], OSCommerce[25]. Furthermore a graphical user interface is provided which supports the process of monitoring the Honeypot and analysing the acquired data. Some of the features of HIHAT are automatic scans for know attacks, detects SQLInjections, detects File-Inclusions, provides a geographical IP-based mapping about the attack sources, saves copies of malicious tools for later studies. •HoneyBow[26]: It is a malware collection toolkit and can be integrated with Nephentes to build a collection tool much more complete. •Sebek[27]: It works like a Host-based Intrusion Detection System (HIDS). It is designed to capture attacker's activities on a honeypot. It is formed by two components. The first is a client that runs on the honeypots which purpose is to capture the attacker's activities (for example: keystroke, file upload, passwords). The second component is the server that collects the data from the honeypot. •Capture-HPC[28]: Like HoneyC, is a honeyclient with the purpose to find malicious servers on a network. When it founds a malicious server, by means of a dedicated virtual machine, this server is observed searching some change in it system state. An organization interested on implement some honeypot, must be conscious of the risk that this security tools will add to the systems. First of all must define the use that is going to give to the honeypot and after that, in function of the experience of the administration, implement the correspondent honeypot. If the administrator has no experience with this systems, it is recommended to start with low-interaction honeypots and with the time try to implement a honeypot with greater level of interaction but, always knowing what is being done because the more interaction allowed to the attacker, the more that can go wrong converting a security tool in an attacker tool. 4.3 Where to place a honeypot There are different possibilities to deploy a honeypot. Figure 9 shows some of this possibilities. The location depend of different factors such as the type of information that the honeypot has to track, the level of risk tolerable. A honeypot situated on the option 1, outside the external firewall, does not increase the risk for the internal network, and reduce the alerts of the firewalls and internal IDS. In this position, the honeypot is useful to track attempts of connection and study the new vectors of the attackers. The second option, situated in the DMZ, has the disadvantages that the other system of this segment of the network, can be harm if do not have the properly security. Another disadvantages is that the external firewall has to open certain traffic that typically is blocked. 32 Master Thesis External Servers Security The third option, represent a fully internal honeypot. The most important advantage is that it can catch internal attacks and detect a bad configuration on firewalls, for example, if the firewall allow unnecessary traffic from the Internet to the internal system. The most serious disadvantages is that if the honeypot is compromised the internal system can be attacked. 4.4 Honeynets The extreme of high-interaction honeypot are the honeynets. Honeynet is a network of honeypots. The complexity of the honeynets lies on the design of a controlled network that control and captures all the activity in all the honeypots. The advantage of honeynets is that are able to capture the greatest level of information on any platform that exist. Figure 10 shows a possible topology for a honeynet. 33 Figure 9: Example of Honeypot Deployment Master Thesis External Servers Security Following are explained the different part of a honeynet: •The honeywall operates in mode bridge and offer mechanisms to capture, analyze and control data. •Data control: When attackers get the control of a honeynet will try to use all the systems to attack and harm another systems. The purpose of the data control is to mitigate this risk. To do this, it is necessary to get a balance between the freedom allowed to the attackers to act in the honeynet and how much the hacker activity is restricted. The use of a firewall properly configured is one of the solution to this problem. •Data capture: It is the monitoring and logging of all the activities within the honeynet with the purpose to analyze and learn the tools, tactics, and motives of attackers. It is recommended to capture data in different levels of the networks. Some of these levels are: ◦The register of the Firewall: It is really important to have a log of all the traffic controlled by the Firewall. It is the critical point and where is possible get the greater amount of information about the attackers. ◦The network traffic: All the packets content (payloads) generated outside or inside of the network must be captured. The most indicated tool to do this is an IDS (is explained in the next section). ◦Activity in the system: More important information can be extracted from the activity in the honeypot. One option to do this could be the use of a high34 Figure 10: Honeynet Topology[75] Master Thesis External Servers Security interaction honeypot like Sebek which capture all the keystroke. •System monitoring: As important as track all the data of the network is monitoring that all the components of the system are working properly. A server put down, an excess in the network traffic, an overload of the CPU are sign that the system can be suffering an attack. To detect this as soon as possible, it is recommended the use of monitoring tools like Nagios[29]. •Data analysis: The entire purpose of a honeynet is to get information about attacks and attackers. The easiest way to do this, is to centralized the log generated by all the honeypots and all the tools used in the honeynet. By means of log analyzer like Prelude[30] it is possible to do this. 35 Master Thesis External Servers Security 5.2.3 Penetration tools This tools are used in the phase “Penetration attempt” of a penetration test with the purpose to verify if the vulnerabilities of the systems can be exploited. Some kind of this tools are briefly explained in the next points with some examples. 5.2.3.1 Password cracker Passwords cracker are applications which by mean of brute-force, cryptanalysis attacks, using dictionary, etc. are able to recovery passwords sniffed on the network or get with some fraudulent system. Some examples are: Cain & Abel, John the Ripper, TCH-Hydra, aircrack. 5.2.3.2 Injection attacks Injection flaws, such as SQL, OS, LDAP injections, occurs when the data sends to the systems is not correctly filtered which allow an attacker the execution of unintended commands or the access to unauthorized data. 5.2.3.3 Exploitation tools One of the most famous application to launch exploits against some vulnerability is the Metasploit Framework. The framework includes hundreds of working remote exploits for a variety of platforms. Payload, encoders, etc. can be launched with an exploit with the purpose to get control of a machine. 42 Master Thesis External Servers Security 6 Experimental part 6.1 Purpose The purpose of the practical part is to check how a signature detection NIDS reacts when the system is being attacked. Different kinds of attacks will be performed to check the complexity of the attacks than an IDS is able to detect. A secondary objective, is to establish the bases for a possible assignment in which an IDS will be installed, configured and tested. 6.2 Scenario All this practical part, has been carried out in a virtual working environment using VirtualBox[52] running in a machine with the following characteristics: •OS: Ubuntu 10.04 Desktop Edition of 64 bits. •RAM: 4 GB •Processor: Intel Core 2 Duo CPU [email protected] VirtualBox has been selected to develop the virtual scenario because it has the required characteristic to build the virtual environment and it is freely available as Open Source Software under the terms of the GNU Generic Public License(GPL). The virtual network used in the test is formed by the next system: •Linux Server, where the IDS (Snort) and Nessus have been installed, which has the next characteristics: ◦Version: Ubuntu 10.04 Server Edition of 32 bits ◦RAM: 512 MB ◦Hostname: ThesisLabUbuntuSever ◦Full name user: Thesis UServer ◦Username: tuserver ◦Password: tus2010MCN ◦IP: 10.0.0.5 ◦MySQL root password: tus2010mySQL ◦MySQL snort password: tus2010mySQLsnort ◦Nessus username: nessus_user ◦Nessus user pasword: tus2010NessuS •Windows Client, some vulnerable application have been installed in it to be attacked and check if the IDS is able to detect such attacks. It has the following characteristics: ◦Version: Windows XP SP3 ◦RAM: 192 MB ◦Username: twclient 43 Master Thesis External Servers Security ◦Password: twc2010MCN ◦IP: 10.0.0.15 •Linux Client, from where all the attacks have been carried out, with the next characteristics: ◦Version: The penetration testing distribution Backtrack 4 R1[53] ◦RAM: 512 MB ◦Username: root ◦Password: tb2010MCN ◦IP: 10.0.0.2 The penetration testing distribution Backtrack has been selected to carried out the actions of an attacker because have installed a really good set of security tools which avoid the installation of all the necessary application, making easier the execution of the tests. One very famous tool installed is the Metasploit framework which provides a suit of tools destined for penetration testing, security researchers, and IDS signature developers. Figure 11 shows a diagram of the virtual network. As is explained in the point 6.3.1 , has been necessary to build a network in which the systems are connected through a virtual hub. 44 Figure 11: Diagram virtual network Master Thesis External Servers Security 6.3 Snort Snort is the IDS selected to do all the test. An analysis of how to install, a basic configuration, and its results are explained in this section. Snort was created by Martin Roesch in 1998. Actually, it is one of the most popular open source network detection system. It is able to analyze the TCP/IP datagram traffic on a network in real time. Snort can be configured to run in different modes. These modes are: •Sniffer mode: read and display in a console the packets of the network. •Packet logger mode: logs the packets to disk. •Intrusion Detection System mode: analyze network traffic looking for some possible attack against the system. This is the mode used in the tests. Some of the characteristics that have done snort so popular are: •The possibility to connect it with the most important databases such as PostgreSQL, MySql, Oracle. •A huge variety of complements to make easier the analysis of the results such as BASE[54] (Basic Analysis and Security Engine), Barnyard[55]. •An easy, powerful, and clean rule creation language, with several packs of rulepackages against Dos, Nmap, backdoors, etc. which can be downloaded from the Snort homepage[39]. •It is multi-platform, compatible with Unix, Linux and Windows SO. •Periodical updates with the signatures of the latest know-attacks. 6.3.1 Installation and Configuration Snort has been installed in the Linux Server. Assuming that Ubuntu 10.04 server is already installed, the next step to install snort has been to configure properly the virtual network. One particularity of the IDS is that all the traffic of the network has to arrive to the network interface of the machine where the IDS is installed. In order to the IDS do it function sniffing and analyzing all the traffic of the network to detect a possible attack, this is a necessary characteristic in the network configuration where it is installed. The typical way to do this is configure the port of the switch where the IDS is connected in mirroring mode(SPAN port). [56] With this configuration in the switch, all the traffic that goes throw it is resend to the SPAN port. Due to the resource limitations, has been not possible to use a switch which this characteristic and has been necessary to do a trick in the network configuration of the VirtualBox. This trick consist in configure the network of the virtual machines in “Host-only adapter” mode.[57][58] With this configuration the network works like if all the machines will be connected to a hub. By the properties of a hub[59], this configuration is valid to do test like this, but not to implement it in a real network. To continue with the installation of snort, it is necessary to give temporally access to Internet to the Virtual Machine. Once the Virtual Machine has Internet connection, first of all some required software have to be installed[60]: •Libpcap: pcap (packet capture) consist in an API for capturing network traffic. Unix systems implement pcap in the lipbcap library. 45 Master Thesis External Servers Security •PCRE: Perl Compatible Regular Expressions is a regular expression C library necessary for some open-source programs such as the Apache HTTP Server, the PHP scripting language, and Snort. •Libnet: Generic networking API that provides access to several protocols. •Barnyard: Snort creates a special binary output format called “unified”, barnyard reads this file and resend the data to a database back-end. Barnyard manages the sending of events to the database and stores them when the database temporarily cannot accept connections. Another required software to be able to access and configure snort are: Apache, php, mysql (another database like PostgreSQL, Oracle could be used). The following commands show how to do the installation of these packages: •sudo apt-get install apache2 •sudo apt-get install php5 •sudo apt-get install php5-mysql •sudo apt-get install php5-gd •sudo apt-get install libpcap0.8-dev •sudo apt-get install libpcre3-dev •sudo apt-get install mysql-server ◦During it installation the password for the user root for access to the MySQL database is asked. •sudo apt-get install lybmysqlclient16-dev Installation of snort: after download the last version of snort from it homepage[39] (in this case 2.8.6.1), typin the following commands Snort will be installed: •sudo tar zxvf snort-2.8.6.1.tar.gz •cd snort-2.8.6.1 •sudo ./configure - -prefix=/usr/local/snort •sudo make •sudo make install •sudo mkdir /var/log/snort •sudo groupadd snort (create a new group of users) •sudo useradd -g snort snort (create a new user in the group snort) •sudo chown snort:snort /var/log/snort (change file and group owner) •echo “create database snort;” | mysql -u root -p (create database for snort) •mysql -u root -p -D snort < ./schemas/create_mysql (create the structure of the database needed to run snort) •echo “grant create, insert, select, delete, update on snort.* to snort@localhost 46 Master Thesis External Servers Security identified by 'PASSWORD'” | mysql -u root -p (give privilege to the user snort in the database, this is a measure to prevent access to the database with the user root. The password used is the password of the user snort) Once SNORT has been installed, the next step is to download the latest public Snort rules. To do this, first of all it is necessary to create an account on the Snort homepage[39]. There are two types of users, Subscribers, requires a paid subscription and provides a real-time access to the rules and “Registered users”, which allow access during 30 days to download some rules of the homepage but not real-time access. For this test a “Registered user” account has been used. Once this account has been created and activated, the next step is to download the last version of the rules available for this type of users (in this case snortrules-snapshot2860.tar.gz). The installation of this rules can be done typing the following commands: •sudo tar zxvf snortrules-snapshot-2860.tar.gz -C /usr/local/snort •sudo mkdir /usr/local/snort/lib/snort_dynamicrules •sudo cp /usr/local/snort/so_rules/precomplided/Debian-Lenny/i386/2.8.6.0/* /usr/local/snort/lib/snort_dynamicrules At this point, Snort has been installed with its latest rules. In order to improve the efficiency of Snort, Barnyard2 has been installed. The following points show the steps to install it. •Download the last version of Barnyard2 from it homepage[61]. In this case the version installed is 1.8. •sudo tar zxvf barnyard2-1.8.tar.gz •cd barnyard2 •sudo ./configure - -with-myslq •sudo make •sudo make install •sudo cp etc/barnyard2.conf /usr/local/snort/etc •sudo mkdir /var/log/barnyard2 •sudo chmod 666 /var/log/barnyard2 •sudo touch /var/log/snort/barnyard2.waldo •sudo chown snort.snort /var/log/snort/barnyard2.waldo Now, it is necessary to modify the Barnyard2 configuration file to configure it in with the characteristics of the machine. To do this, the following modification must to be done in the file /usr/local/snort/etc/barnyard2.conf: •cp /usr/local/snort/etc/barnyard2.conf /usr/local/snort/etc/barnyard2.conf.orig •Change the lines: ◦config reference_file: /etc/snort/reference.config ◦config classification_file: /etc/snort/classification.config ◦config gen_file: /etc/snort/gen-msg.map 47 Master Thesis External Servers Security ◦config sid_file: /etc/snort/sid-msg.map ◦#config hostname: thor ◦#config interface: eth0 ◦#output database: log, mysql, user=root password=password_from_mysql_root dbname=db host=localhost By these: ◦config reference_file: /usr/local/snort/etc/reference.config ◦config classification_file: /usr/local/snort/etc/classification.config ◦config gen_file: /usr/local/snort/etc/gen-msg.map ◦config sid_file: /usr/local/snort/etc/sid-msg.map ◦config hostname: localhost ◦config interface: eth0 ◦output database: log, mysql, user=snort password=password_from_user_snort dbname=snort host=localhost Now that all the necessary software are installed and ready to run, it is time to configure Snort. To do this, the Snort configuration file /usr/local/snort/etc/snort.conf have to be modified. The next points show how to do it: •sudo cp /usr/local/snort/etc/snort.conf /usr/local/snort/etc/snort.conf.orig •Change the following lines: ◦dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/ ◦dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so ◦dynamicdetection directory /usr/local/lib/snort_dynamicrules ◦preprocessor http_inspect: global iis_unicode_map unicode.map 1252 compress_depth 20480 decompress_depth 20480 By these: ◦dynamicpreprocessor directory /usr/local/snort/lib/snort_dynamicpreprocessor/ ◦dynamicengine /usr/local/snort/lib/snort_dynamicengine/libsf_engine.so ◦dynamicdetection directory /usr/local/snort/lib/snort_dynamicrules ◦preprocessor http_inspect: global iis_unicode_map unicode.map 1252 •Delete the line: ◦inspect_gzip \ •Modify the line(outpot for barnyard2): ◦#output log_unified2: filename snort.log, limit 128, nostamp Add this: ◦output unified2: filename snort.log, limit 128 48 Master Thesis External Servers Security •In order to detect a port-scan against some machine, the following has to be modified[71]: ◦# preprocessor sfportscan: proto { all } memcap { 10000000 } sense_level { low } By this: ◦preprocessor sfportscan: proto { all } scan_type { all } memcap { 10000000 } sense_level { high } logfile { portscan.log } In this point, Snort has been installed and configured, now the next step is test if it run properly. To do this, the next command has to be executed: sudo /usr/local/snort/bin/snort -u snort -g snort -c /usr/local/snort/etc/snort.conf -i eth0 •-u <user>: Change the user/UID Snort runs under to user after initialization. •-g <group>: Change the group/GID Snort runs under to group after initialization. This switch allows Snort to drop root privileges after it initialization phase has completed as a security measure. •-c <config-file>: Use the rules located in file config-file •-i <interface>: Sniff packets on interface In this case the network interface is eth0, in other case it could be different. If all has gone correctly, a message saying “Initialization Complete” has to appear (Figure 12). The last step to have Snort working properly, is start Barnyard2. The next command show how to do it: /usr/local/bin/barnyard2 -c /usr/local/snort/etc/barnyard2.conf \ -G /usr/local/snort/etc/gen-msg.map \ -S /usr/local/snort/etc/sid-msg.map \ -d /var/log/snort \ -f snort.log\ -w /var/log/snort/barnyard2.waldo \ -D (not use to check the output and see if it is working properly) •-c <file>: Use configuration file <file> •-G <file>: Read the gen-msg map from <file> •-S <file>: Read the sid-msg map from <file> 49 Figure 12: Snort initialized Master Thesis External Servers Security •-d <dir>: Spool files from <dir> •-f <base>: Use <base> as the base filename pattern •-w <file>: Enable bookmarking using <file> •-D: Run barnyard2 in background (daemon) mode To check if Barnyard2 is running properly, one way is to do a ping to the machine and an output similar to Figure 13 most appear. To start automatically Snort and Barnyard2 in the start-up of the system, both commands has to be copied at the end of the file /etc/rc.local, just befor the “exit 0” line. 6.3.2 Report analyzers Once has been checked that Snort and Barnyard2 start properly, it is time to do some test and analyze the reports of Snort. In order to understand easier the reports of Snort have been implemented some application. In this tests, the version 1.4.5 of BASE[54] has been used to analyze the results of Snort. BASE provides a web front-end to query and analyze the alerts coming from a Snort IDS system. With BASE is possible to perform analysis of intrusions that Snort has detected on the network. Without this kind of applications, the analysis of the results should be done analyzing log files like Figure 14. This task would be harder and more attacks could be lost between such quantity of data. 50 Figure 13: Barnyard2 Initialized Master Thesis External Servers Security BASE needs to work ADOdb(Active Data Objects Data Base). ADOdb is a database abstraction library for PHP. After download both packages, the following has to be done to install them: •sudo mv adodb /var/www •sudo mv base /var/www •sudo cd /var/www/base •sudo cp base_conf.php.dist base_conf.php •Edif base_conf.php checking that the following parameters: ◦$BASE_urlpath = "/base"; ◦$DBlib_path = "/var/www/adodb/"; ◦$DBtype = "mysql"; ◦$alert_dbname = "snort"; ◦$alert_host = "localhost"; ◦$alert_port = ""; ◦$alert_user = "snort"; ◦$alert_password = "password_from_user_snort"; To configure BASE, in the URL of a web browser, type: IP_of_Snort_machine/base, in 51 Figure 14: Snort log file Master Thesis External Servers Security This Installation Guide (point 6.4.1 ) has been done based on the indications of the reference.[67][68] 6.5 Tests First of all say that all the attacks have been performed in a virtual and controlled environment and in any moment have been tried against a real machine. These attacks have been done for a educational purpose, see how Snort reacts against them. All the attacks has been performed from the “Linux Client2”. Most of them using the metasploit framework[70], integrate in the Backtrack distribution. 6.5.1 Port scan Nessus has been used to perform a port scan (typically the first step to carried out an attack) to check if Snort is able to detect this kind of attacks. To do this, first of all has been created a “Policy” in Nessus which has been configured to do a full scan. Once the “Policy” has been created, an “Scan” has been configured using this policy and setting the windows client (10.0.0.15) as the target of the scan. Figure 24 shows the file “portscan.log” created by Snort. Each field has the following meaning: •Time: make reference to the moment when the scan has been done •Event_id: used to link an alert with the corresponding Open Port tagged packet. •10.0.0.5 → 10.0.0.15: shows the source and the target of the scan. •Priority Count: keeps track of bad responses (resets, unreachables). The higher the priority count, the more bad responses have been received. •Connection count: lists how many connections are active on the hosts (src or dst). This 58 Figure 23: Nessus: Main Page Master Thesis External Servers Security is accurate for connection-based protocols, and is more of an estimate for others. Whether or not a portscan was filtered is determined here. High connection count and low priority count would indicate filtered (no response received from target). •IP count: keeps track of the last IP to contact a host, and increments the count if the next IP is different. For one-to-one scans, this is a low number. For active hosts this number will be high regardless, and one-to-one scans may appear as a distributed scan. •Scanner IP Range: changes depending on the type of alert. Port sweep (one-to-many) scans display the scanned IP range. Portscans (one-to-one) display the scanner IP. •Port/Proto Count: keeps track of the last port contacted and increments this number when that changes. This count is used (along with IP Count) to determine the difference between one-to-one portscans and one-to-one decoys. Figure 25 shows the log generated by Barnyard2 which is send to the database. And Figure 26 shows how BASE, after analyze the information of the Database, generate a report with all the portscan performed in the network analyzed by the IDS. All the porstcan are links to a report where more information is showed. 59 Figure 24: Portscan.log Figure 25: Barnyard2 log Figure 26: BASE report Master Thesis External Servers Security 6.5.2 Windows Client Different attacks have been done in the Windows Client. The realization of some of this attacks would require a previous Social Engineering Attack with the purpose to get that someone in his computer execute the malicious code generated. All the vulnerabilities are not zero day, so the most of the anti-virus must detect an attack which purpose is to exploit some of these vulnerabilities, by this reason, it is necessary to disable the anti-virus to carried out this tests but, in some moment (not much far), this vulnerabilities could be exploited without need to disable it, because, like declare a recent study about anti-virus[72], “Even after 30 days, many AV vendors cannot detect known attacks”, one reason more to install extra security measures in the companies. Furthermore, there are a huge quantity of common users who have not the anti-virus updated, or with the license expired, doing the system vulnerable to these attacks. 6.5.2.1 Test 1: Reverse shell embed in a PDF file In this test a vulnerability has been exploited in the PDF readers which allow the execution of code embed in a PDF file when it is open. To do this, first of all is necessary the creation of a .exe with reverse shell to embed in the PDF file (the creation of this PDF is explained in the Appendix II). This PDF will be send to the victim (this part is assumed that has been done by means of some Engineering Social Attack). When the victim open this PDF, the victim machine try to connect with the machine set in the PDF, which is listening, giving a session to the attacker machine (Figure 23) for where the “hacker” has full control of the the victim machine(Figure 28). 60 Figure 28: Victim machine controlled Figure 27: Session started Master Thesis External Servers Security As is showed in Figure 29, when this attack is performed, Snort only is able to detect that there a connection between two machines (the attacker and the victim). Although the information is very simple, in some scenarios it could be enough to detect this attack. For example, in a organization where the connections between an internal system with other system is really limited to some ports, to some specific IP, it is forbidden the fact to detect this log would generate an alert and the correspondent measure would be done. The problem is that typically the connection between the internal systems and the external is not so limited, and this information could be confused, for example, with a connection with some web server. Figure 30 shows the detection of the same attack in Base. Like it is possible to see in this example, Base show the information quite organized and even show the payload of the traffic detected. 6.5.2.2 Test 2: EasyFTP This second test is based in a vulnerability in the software EasyFTP. This vulnerability provoke a Buffer Overflow which can be used to execute arbitrary code. In this case, an exploit that provoke a Denial-of-Service (DoS) has been launched against the server. The version of the EasyFTP used is 1.7.0.11 and the exploit easyftp_cwd_fixret. As result of launch this exploit against the ftp service is that this is stopped. To perform this attack, first of all it is necessary to have an account in the ftp server, to do this test, the 61 Figure 29: Establishment of the reverse shell detected by Snort Figure 30: Detection of the reverse shell in Base Master Thesis External Servers Security user “thesis” with the password “thesis” has been created. With EasyFTP running (Figure 31) and once the attack is launched (see Appendix III for more details), the next Figures show how Snort is able to detect this attacks showing a FTP CWD(change working directory) overflow message. Figure 32 shows how Barnyard2 log this attack and Figure 33 shows how BASE report this attack. Figure 34 shows how the EasyFtp Server is stopped as a result of the exploit launched. This problem is solved in the new version, renamed to UplusFtp. 62 Figure 32: Barnyard2 log Figure 33: Base report Figure 31: EasyFTP running Master Thesis External Servers Security 6.5.2.3 Test 3: LNK Shortcut File code execution As is said in the Microsoft Security Bulltin MS10-46[73], the vulnerability used to do this test “could allow remote code execution if the icon of a specially crafted shortcut is displayed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user”. Actually Microsoft has published a security update which correct this vulnerability. By this reason, to do this test this security update has to be removed of the victim machine. This update is KB2286198. Like happened with the test 1, actually this vulnerability is solved, but until some days ago, Microsoft has not been published an update for this vulnerability, so all the systems have been exposed to this vulnerability during quite time since it has been published. System that do not have all the Microsoft updated installed, could be affected by this problem yet. The result of Snort when this attacks has been performed (see Appendix IV for more information) is not satisfactory because it has passed unnoticed for Snort. This is because has not been a direct attack against the virtual machine, only has been a visit to an specific URL by part of the victim, which has exploited a vulnerability in windows which has allow the establishment of a session between the victim and the attacker machine giving to the attacker the same privileges that this user has in the system attacked. This is an example of why is so important the user education in order to prevent successful social engineering attacks. Although for this concrete vulnerability, a proper user education did not prevented it exploitation, because it could be spread by means of flash memories, only connecting them to a computer. Fortunately, how has been said at the beginning of this point, there are already a solution for this dangerous vulnerability. A similar test with the same results has been done. In this case, the vulnerability exploited was in the Windows Help and Support Center and could allow remote code execution if a user views a specially crafted web page using a web browser or clicks a specially crafted link in an e-mail message.[74] Actually there are a windows update that resolve this vulnerability, concretely the update KB2229593. 63 Figure 34: EasyFtp stopped by the exploit Master Thesis External Servers Security 6.5.3 Test conclusions After the realization of these tests, has been showed that when an attack which create a reverse shell is carried out, Snort is not able to directly detect these kind of attacks (test1 and test3). The conclusion that can be extracted is that an IDS is an efficient security measure but, like the others, it is not perfect. It is a good tool to increase the security of a computer network but as a complement for other security measures like anti-virus and firewalls. 64 Master Thesis External Servers Security 7 Limitations Due to resource limitations of the host-base, where all the scenario has been deployed, have been problems to deploy some test. Tests that use attacks that require high broadband and systems requirement more exigents, blocked the virtual systems. 65 Master Thesis External Servers Security Page intentionally left blank. 66 Master Thesis External Servers Security 8 Future work An interesting future work could be the installation of a Signature-Based NIDS and an Anomaly-Based NIDS in a real infrastructure, for example in the laboratory of some subject. The purpose of this, would be study more in-depth the Signature-Based NIDS, and how the Anomaly-Based NIDS learns with the daily behavior of the students. Furthermore, in this real scenario, could be possible the installation of the NIDS using a switched port analyzer (SPAN) studding how to configure this characteristic of the switch. Furthermore, to study and install an IPS would be another interesting future work. This kind of intrusion detection system is really interesting because with it is possible to take measures against an attack faster than with the passive IDS, which generate an alert to be studied by an administrator who will take the correspondent measure. 67 Master Thesis External Servers Security <http://searchnetworking.techtarget.com/generic/0,295582,sid7_gci1083683,00.html> [43] Herzog, Pete. “OSSTMM - Open Source Security Testing Methodology Manual”. <http://www.isecom.org/osstmm/> [44] SANS Institute InfoSec Reading Room. “Conducting a Penetration Test on an Organization” <http://www.sans.org/reading_room> [45] SANS. “Penetration Testing: Assessing Your Overall Security Before Attacker Do”. <http://www.sans.org/reading_room/analysts_program/> [46] Nmap homepage. <http://nmap.org/> (Visited July 2010) [47] Hping homepage. <http://www.hping.org/> (Visited July 2010) [48] Wireshark homepage. <http://www.wireshark.org/> (Visited July 2010) [49] Nessus homepage. <http://www.nessus.org> (Visited July 2010) [50] SARA homepage. <http://www-arc.com/sara/> (Visited July 2010) [51] National Vulnerability Database homepage. <http://nvd.nist.gov/> (Visited July 2010) [52] VirtualBox homepage. <http://www.virtualbox.org/> (Visited July 2010) [53] Backtrack homepage. <http://www.backtrack-linux.org/> (Visited July 2010) [54] BASE homepage. http://base.secureideas.net/index.php. (Visited July 2010) [55] Barnyard2 homepage. http://www.securixlive.com/barnyard2/index.php. (Visited July 2010) [56] CISCO troubleshooting TechNotes. “Catalyst Switched Port Analyzer (SPAN) Configuration Example” <http://www.cisco.com/en/US/products/hw/switches/ps708/ products_tech_note09186a008015c612.shtml> [57] VirtualBox Forums. <http://forums.virtualbox.org/viewtopic.php?f=1&t=21701> (Visited July 2010) [58] VirtualBox Forums. <http://forum.virtualbox.org/viewtopic.php?f=6&p=139778> (Visited July 2010) 74 Master Thesis External Servers Security [59] About.com. “Introduction to hubs”. <http://compnetworking.about.com/od/ hardwarenetworkgear/l/aa012801a.htm> [60] Snort Required Software. <http://www.snort.org/start/requirements> (Visited July 2010) [61] Barnyard2 Homepage. <http://www.securixlive.com/barnyard2/index.php> (Visited July 2010) [62] IT Computer Help. “Installing SNORT on Ubuntu 10.04”. <http://it.thelibrarie.com/ weblog/?p=515> (Visited July 2010) [63] Internet Security Guru. “Snort, Apache, SSL, PHP, MySQL, and. BASE Install on CentOS 4, RHEL 4”. <www.internetsecurityguru.com/documents/Snort_Base_Minimal.pdf> [64] Gullet, David. “Snort 2.8.6 and Snort Report 1.3.1 on Ubuntu 10.04 LTS Installation Guide” May 12, 2010.<www.symmetrixtech.com/articles/004-snortinstallguide286.pdf> [65] Barnyard2 Project Page “Barnyard2 Manual”. <http://www.securixlive.com/barnyard2/ docs/manual.php> (Visited July 2010) [66] Linux man page. “Snort”. <http://linux.die.net/man/8/snort> (Visited July 2010) [67] Tenable Network security. “Nessus 4.2 Installation Guide” <www.nessus.org/ documentation/nessus_4.2_installation_guide.pdf> [68] Tenable Network Security. “Nessus 4.2 User Guide” <www.nessus.org/ documentation/nessus_4.2_user_guide.pdf> [69] Nessus Plugins <http://www.nessus.org/plugins/index.php?view=all> (Visited July 2010) [70] Metasploit Framework Homepage. <http://www.metasploit.com/> (Visited July 2010) [71] The Snort Project. “Snort user manual 2.8.6”, April 26, 2010. <www.snort.org/assets/140/snort_manual_2_8_6.pdf> [72] Cyveillance. “Cyveillance testing finds AV vendors detect on average less than 19% of malware attacks” <http://www.cyveillance.com/web/news/press_rel/2010/2010-0804.asp> 75 Master Thesis External Servers Security [73] Microsoft TechNet. “Microsoft Security Bulletin MS10-046”. <http://www.microsoft.com/technet/security/bulletin/MS10-046.mspx> [74] Microsoft TechNet. “Microsoft Security Bulletin MS10-042” <http://www.microsoft.com/technet/security/bulletin/MS10-042.mspx> [75] PKU Honeynet Project. “The Artemis Project: Honeynet Topology” <http://www.honeynet.org.cn/honeyneten/HoneynetTopology.htm> [76] Zul's Blog: Dawn of the new Security. “Lecutre 9: Intrusion detection system”. <http://zulcap.wordpress.com/2009/10/27/lecture-9-intrusion-detection-system-ids> (Visited July 2010) 76 Master Thesis External Servers Security Figures Index Figure 1: The security requirement triad[9]............................................................................................3 Figure 2: Security Technologies Used 2006/2007[4]..............................................................................4 Figure 3: Network topology....................................................................................................................5 Figure 4: Vulnerability risk level in function of the time........................................................................8 Figure 5: Profiles of Behavior of Intruders and Authorized Users[76].................................................17 Figure 6: NIDS Sensor Deployment.....................................................................................................21 Figure 7: IDS Classification.................................................................................................................25 Figure 8: IDS Architecture....................................................................................................................26 Figure 9: Example of Honeypot Deployment.......................................................................................33 Figure 10: Honeynet Topology[75].......................................................................................................34 Figure 11: Diagram virtual network......................................................................................................44 Figure 12: Snort initialized...................................................................................................................49 Figure 13: Barnyard2 Initialized...........................................................................................................50 Figure 14: Snort log file........................................................................................................................51 Figure 15: BASE: Setup page...............................................................................................................52 Figure 16: BASE: Create BASE AG.....................................................................................................52 Figure 17: BASE: Database created.....................................................................................................53 Figure 18: BASE: Main Page...............................................................................................................54 Figure 19: Nessus Installation...............................................................................................................55 Figure 20: Nessus: User configuration..................................................................................................56 Figure 21: Nessus: Started....................................................................................................................56 Figure 22: Nessus: Login page.............................................................................................................57 Figure 23: Nessus: Main Page..............................................................................................................58 Figure 24: Portscan.log.........................................................................................................................59 Figure 25: Barnyard2 log......................................................................................................................59 Figure 26: BASE report........................................................................................................................59 Figure 27: Session started.....................................................................................................................60 Figure 28: Victim machine controlled...................................................................................................60 Figure 29: Establishment of the reverse shell detected by Snort...........................................................61 Figure 30: Detection of the reverse shell in Base..................................................................................61 Figure 31: EasyFTP running.................................................................................................................62 Figure 32: Barnyard2 log......................................................................................................................62 Figure 33: Base report..........................................................................................................................62 Figure 34: EasyFtp stopped by the exploit............................................................................................63 Figure 35: Netcraft Results 1................................................................................................................80 Figure 36: Netcraft Results 2................................................................................................................80 Figure 37: msfpayload: creation of the exe file with a reverse shell.....................................................82 Figure 38: Running msfconsole............................................................................................................82 Figure 39: Msfconsole: Search exploit for adobe.................................................................................83 Figure 40: Adobe Embedded exe: Selecting exploit and payload.........................................................87 Figure 41: Adobe Embedded exe: Configuration and creation of the PDF...........................................87 Figure 42: Adobe Embedded exe: Start to listen the atacker machine..................................................88 Figure 43: EasyFTP: Select exploit and payload..................................................................................90 Figure 44: EasyFTP: Setting parameters and run exploit......................................................................91 Figure 45: LNK attack: Search and selection of exploit and payload...................................................92 Figure 46: LNK attack: Options of the exploit with the payload..........................................................92 Figure 47: LNK attack: Setting options and launching exploit.............................................................93 Figure 48: LNK attack: Getting session with the victim.......................................................................93 Figure 49: LNK attack: Openning session with the victim...................................................................94 77 Master Thesis External Servers Security Page intentionally left blank. 78 Master Thesis External Servers Security Appendix I – Netcraft Netcraft (http://news.netcraft.com/) results on www.kth.se 79 Figure 35: Netcraft Results 1 Figure 36: Netcraft Results 2 Master Thesis External Servers Security Page intentionally left blank. 80 Master Thesis External Servers Security Appendix II – Creation of a PDF with a reverse shell embed First of all the exe file to embed in the PDF file has to be created. To create this exe the tool msfpayload (from metasploit framework) has been used. The following Figures show how to create and embed the exe in a PDF file. Figure 37 show how to create an exe file with a reverse shell. In the command is indicated that the exe have to contain the payload “windows/meterpreter/reverse_tcp”, the address of the host (LHOST) that is listen in the port (LPORT) waiting that someone connect with it. The LHOST is the IP of the attacker machine, 10.0.0.2 in this scenario. Once the exe has been created, the next step is embed it in a PDF file. This have been done using the msfconsole (from metasploit framework). All the process is showed in the following Figures. 81 Figure 37: msfpayload: creation of the exe file with a reverse shell Figure 38: Running msfconsole Master Thesis External Servers Security Once the msfconsole is running (Figure 38), the next step is search the exploit to be used (Figure 39). In this case a vulnerability in Adobe Reader is going to be exploited so the exploit selected is “windows/fileformat/adobe_pdf_embedded_exe”. Figure 40 shows how to use this exploit, set the payload (reverse_tcp), and the options. Once of the options has been configured (Figure 41), the last step is to run the exploit to generate the PDF with the exe embed. Figure 42 shows how to leave the attacker machine listening to get the session in the victim machine. 82 Figure 39: Msfconsole: Search exploit for adobe Master Thesis External Servers Security 83 Figure 40: Adobe Embedded exe: Selecting exploit and payload Figure 41: Adobe Embedded exe: Configuration and creation of the PDF Master Thesis External Servers Security Page intentionally left blank. 90 Master Thesis External Servers Security Acronyms ABS Anomaly Based System API Application Programming Interface BASE Basic Analysis and Security Engine CHECK IT Security Health Check Service CIA Confidentiality, Integrity, Availability CWD Change Working Directory DB Database DDoS Distributed Denial of Service DHCP Dynamic Host Configuration Protocol DMZ Demilitarized Zone DNS Domain Name System DoS Denial of Service FIPS Federal Information Processing Standards FTP File Transport Protocol HIDS Host-based Intrusion Detection System HIHAT High Interaction Honeypot Analysis Toolkit HTTP Hypertext Transfer Protocol ICMP Internet Control Message Protocol IDS Intrusion Detection System IGMP Internet Group Management Protocol IMAP Internet Message Access Protocol IP Internet Protocol IPS Intrusion Prevention System IRC Internet Relay Chat ISACA Standards for Information Systems Auditing LDAP Lightweight Directory Access Protocol MBR Master Boot Record NASL Nessus Attack Scripting Language NFS Network File System NIDS Network-based Intrusion Detection System NIST National Institute of Standards and Technology NMAP Network Mapper NSM Network System Monitor 91 Master Thesis External Servers Security OS Operation System OSSTMM Open Source Security Methodology Manual OWASP Open Web Application Security Project PCRE Perl Compatible Regular Expressions POP Post Office Protocol RATs Remote Access Trojans SARA Security Auditor's Research Assistant SATAN Security Administrator's Tool for Analyzing Networks SBS Signature Based System SMB Server Message Block SPAN Switch Port Analyzer SQL Structured Query Language TCP Transmission Control Protocol TOS Type Of Service UDP User Datagram Protocol 92