Hacking Basics
Wenger Thema 2
Wenger Thema 2
-
- 1 / 24
-
Lernkarten
What is the difference between hacker, cracker, attacker?
- a hacker, likes to get into his own computer and understand how it works
- a cracker or attacker, wants to get into other peoples systems and networks
- hacker term is falsely used in public for the malicious hacker (cracker or attacker)
What is a critical inftastructure?
- government websites
- industry websites - process control networks (nuclear systems)
- airports
- harbours
- railway station
- base internet infrastructure
- internet core routers
- DNS root name server
What two main categories of attackers do exist?
- insiders (work for the company - legitimated to use internal systems)
- outsiders (remote attacker - attack public systems or break into internal systems)
How does the insider (attacker) attack the system?
What's it's motivation?
- abuse privileges
- impersonate higher privileged users
- motivation: Gier, Veruntreuung, Betrug, Rache, Verärgernis, ehemaliger MA
What targets does the outsider have? (100 answers)
- deface web servers (entstellen)
- forward spam (misuse mail servers)
- ddos attacks (bring down services)
- go around firewalls
- create bot nets for spamming, ddos attacks
- sell, rent those networks
- steal confidential information
From where do outsiders attack?
- internet
- wireless networks
- dial-up lines
- physical breakins
- linked partner networks
Motivation of outside attackers?
- Gier, Respekt,
- identity / credit card theft
- espionage
- hacktivism, pranking
- script kiddies: -> fun/ignorance
Tell the 3 main intrustion techniques
- physical intrustion
- system intrustion / privilege escalation
- remote intrusion
Describe in more detail what physical intrusion is.
- attacker has physical access
- full control over system / data
- uses system console
- remove drives, copy data
Explain what system intrusion / privilege escalation is.
- attacker with lower privileged user account can try to raise his privileges
- use known exploits (dangerous if latest patches are not installed)
Remote intrusion, tell me more about it.
- penetrate system from across network
- figure out system type (OS, services etc) and users known
Wie kann man den OS-Typ bzw. die auf einem System laufenden Dienste herausfinden?
- mittels NMAP
NMAP scanned das Netzwerk, in dem es viele TCP/IP Packete an einen Zielhost schickt und anhand des Antwortmusters mit einer Datenbank abgleicht und dadurch das OS zuordnen kann
What are the most common vulnerabilities?
- software bugs
- system config bugs
- design flaws
- weak passwords
- unaware organizations / personas
Classification of software bugs?
- buffer overflow
- unexpected combinations
- unexpected input
Explain the terms authentication, authorization and enforcement.
- authentication: authenticate user prior the give access
- authorization: user access according to his authorization
- enforcement: system must provide enforcement to control a users behaviour
what auth methods exist?
- password
- otp
- access key
- biometric attribue
- MFA
Give 4 methods to crack a password. (there are much more)
- password guessing
- dictionary attacks
- bruteforce attacks
- use of pre-computed tables (rainbow tables)
- clear-text sniffing
- encrypted sniffing
- replay attack
- password file stealing
- observation
- social engineering
- keystroke logging
5 steps of intrustion scenario, what stages goes a attacker through?
- reconnaissance - Erkundung
- scanning (port scan, nmap)
- running exploits
- establish a foothold -
- playing for profit
Explain the stage reconnaissance
- attacker finds out as much information as possible without attacking yet
- whois, DNS tables, public websites, news
- hard to detect an attacker!
explain the stage Scanning.
- attacker does several scans
- icmp scans
- nmap
- can be detected by network and host firewalls, ids/ips systems, logfiles
explain stage 3 running exploits
- attacker crosses the line and startes exploiging
- automated tools or manual techniques
- common exploits: serfer-side scrips, web server attacks, phishing, ip/arp spoofing
- can be detected by host firewalls, ids/ips systems, logfiles
explain stage 4 esablish a foothold
- hide evidence of attack (manipulate logfiles)
- install rootkits
- replace services
- create user accounts
- probably detected by good ips/ids
explain the stage 5, playing for profit
- steal confidential data
- abuse system resources
- futher attacks to other systems
- sell rent the hacked systems
Give 4 examples of intrusion techniques - shorcuts.
- phishing
- backdoor (bypassing normal authentication procedure)
- scam (mail with attached software)
- virus and worms (infects system when executed - virus need user start, worm spread themself)
- bot (runs automated scripts over inet)
- malware (disrupt computer operations, gather information, gain access)
