PowerPoint Presentation

Size: px

Start display at page:

Download "PowerPoint Presentation"

湾燕
7 years ago
Views:

1 URL: Mail:

2 Process Server/Service Virus Worm Hacker Toolkits Trojan/back door Malicious code Exploit code

3 Process & Service (Process) (Run Ones) CPU Process Daemon Super Daemon Service (Windows )

4 Process process process exec thread PID Memory context Environment File descriptors Security credential

5 (Unix & Linux) Daemon Server Ex: web, smtp, ftp, ssh, vnc etc,. Super Daemon Ex: ftp, telnet, pop3.etc,.

6 (Unix & Linux) Daemon Runlevel Run Level 0 1 single user mode reboot

7 (Unix & Linux) Super Daemon Inetd /etc/inetd.conf /etc/service xinetd /etc/xinetd.conf /etc/xinetd.d

8 (Unix & Linux) Command ps (System V / BSD) ps elf/elf (System V) ps aux/aux (BSD) /Proc Process

11 (Windows) Windows Registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur rentversion\run* HKEY_LOCAL_USER\SOFTWARE\Microsoft\Windows\Current Version\Run C:\Documents and Settings\All Users\ Service Windows Registry HKEY_LOCAL_MACHINE\SYSTEM\Services

16 Server ( )& Service( ) Server ( ) Service( ) Server

17 Web Would Wide Web Mail SMTP POP 2/3 IMAP NFS DNS Remote Control SNMP

18 Windows process manager (Taskmgr) Other Tools Pstools-pslist ools.shtml Process Explorer ocexp.shtml

19 process System Idle Process 95 Process status ALT + CTRL + DEL

20 Process status Pstools-pslist e/pstools.shtml Process Explorer e/procexp.shtml

21 Pstools-pslist

22 Process Explorer

23 Unix/Linux process manager Process Status ps command (ps package) lsof /proc ps elf (SystemV) Ps aux (BSD) Cmdline

24 ps command

25 lsof command

26 Ref.

29 A flaw in a computer or network allowing unauthorized use or unauthorized access. Ignorance or errors in process of programming or configurations which lead to security problems

30 ( )

31 Design Phase (Weak algorithm) (Design error ) Implementation Phase (Input validation error) ( ) (Boundary check error) (Race condition )

32 Operation Phase (Configuration error) Human Nature (Weak Passwords) (Unsafe habits) Etc...,

33 (Weak algorithm) Eg: TCP CheckSums Etc.,

34 (Design error ) E.g: Etc,.

35 E.g: SQL Injection

36 ( ) E.g: Fetchmail - header parsing function readheaders()

37 Concurrent E.g: Redhat LogWatch Linux 2.2.x ~ 2.4.x - kmod.c (race condition) ptrace

38 E.g: Web Server (Would witted)

39 Human Nature (Weak Passwords) Username (Unsafe habits) Etc.,

40 Bruce Force, Resource Exhausting, Buffer Overflow Format String TCP Spoofing TCP Hijacking, etc. Social Engineering

41 Bruce Force Etc,.

42 Resource Exhausting SYN Flooding.. SYN Flooding Host A SYN SYN Etc,. ACK/SYN ACK/SYN ACK Host B chache chache

43 Buffer Overflow

44 Format String SQL Injection ' SQL strsql="select * FROM tbluser WHERE UserName='" & _ Request("UserName") & "' AND Password='" & Request("Pass") & "'" ' SQL Server Set rec=.execute(strsql)

45 Format String SQL Injection strsql= SELECT * FROM tbluser WHERE UserName= admin AND Password= 1234 Set rec=.execute(strsql) admin -- strsql= SELECT * FROM tbluser WHERE UserName='admin'--' AND Password= 1234' Set rec=.execute(strsql) AND -- SELECT * FROM tbluser WHERE UserName='admin'

46 TCP Spoofing

47 TCP Spoofing

48 TCP Hijacking Host C SEQ=8251 ACK=29236 LEN=XX SEQ=29232 ACK=8251+XX SEQ=8251 ACK=29232 LEN=XX

49 Social Engineering

50 (Program Error) (Gain Privilege) (Denial of Service) / / / (Information Leakage / Corruption) / (Backdoor / Trojan)

51 .. E.g. CERT Advisory-,. Whithats- Snort IDS Nessus plugins archives Nessus

52 CERT/CC Vulnerability Note; Bugtraq ID, ISS X-Force: Name& number, etc. CVE (Common Vulnerabilities and Exposures) : Dictionary CVE Compatible

53 Common Vulnerabilities and Exposures SecurityFocus Vulnerabilities X-Force Database Whitehats arachnids CERT/CC Vulnerability Notes Database

54 Top Vulnerabilities to Windows Systems W1 Internet Information Services (IIS) W2 Microsoft SQL Server (MSSQL) W3 Windows Authentication W4 Internet Explorer (IE) W5 Windows Remote Access Services W6 Microsoft Data Access Components (MDAC) W7 Windows Scripting Host (WSH) W8 Microsoft Outlook and Outlook Express W9 Windows Peer to Peer File Sharing (P2P) W10 Simple Network Management Protocol (SNMP)

55 Top Vulnerabilities to UNIX Systems U1 BIND Domain Name System U2 Remote Procedure Calls (RPC) U3 Apache Web Server U4 General UNIX Authentication Accounts with No Passwords or Weak Passwords U5 Clear Text Services U6 Sendmail U7 Simple Network Management Protocol (SNMP) U8 Secure Shell (SSH) U9 Misconfiguration of Enterprise Services NIS/NFS U10 Open Secure Sockets Layer (SSL)

56 (1)

57 (2)

58 Antivirus software

59 MBSA Microsoft Baseline Security Analyzer MBSA Version 1.2 : Windows XP Home Edition/Professional Windows 2000 Professional/Server Windows Server 2003 IP

61 Unix/Linux Tar ball recompiler Package manager Update Windows Windows Update Auto Update(win98SE,W2K sp4,winxp,win 2003) Download patch

C6_ppt.PDF

C6_ppt.PDF C01-202 1 2 - (Masquerade) (Replay) (Message Modification) (Denial of Service) - ( ) (Eavesdropping) (Traffic Analysis) 8 1 2 7 3 6 5 4 3 - TCP SYN (SYN flood) Smurf Ping of Death LAND Attack Teardrop