Final presentation of IT security project
1 like1,499 views
The document outlines a security test performed on the terminal server of the xpunlimited.lt company, detailing break-in attacks, network vulnerabilities, and recommended security controls. It describes specific exploitation methods, including a man-in-the-middle attack and denial of service tactics, while identifying potential threats from human negligence and outdated systems. Control recommendations emphasize the importance of system updates, proper security configurations, and anti-virus implementation to mitigate risks and protect sensitive data.
Final presentation of IT security project
- 1. Security test and implementation of terminal computer Authors: Armandas Rokas Andrius Sinkevicius Edvinas Butenas December 7, 2011
- 2. Overview Background story Breakin attacks Risk determination and security control recommendations for breakin attacks Network attacks Risk determination and security control recommendations for network attacks Security solutions Questions?
- 3. Background story XpUnlimited.LT company Software works on all previous Windows OS`s Try the security of terminal server Built fully protected ( included network security)
- 5. System characterization Hardware: Acer , i3, 4GB RAM gt320 1GB video Software: Windows 7 Ultimate SP1 32bit/Windows Xp SP3 with XPUnlimited Data: Pictures, Sensitive Documents.
- 6. System characterization System interfaces SATA2, USB, 802.11b/g/n, HDMI, VGA, Ethernet. Users Administrator, Remote Users. Services running Printer, Web Server (IP Consult HTTP server), Remotes Desktops, Internal Database For ERP.
- 7. Control analysis Os Security Policies Local Access Policies System Backup Firewall Policies
- 9. Exploit (Infection with key logger) Exploited by executing file on victims machine File with payload Meterpreter command line Key log: On Windows 7 only affected user only affected On Windows Xp all user all
- 10. Mail infection External attack Attack was made from BackTrack 5 to infect the Terminal thin client server with Windows 7 operating system. Exploit which let me break in to victim computer when he got the infected message to his mail box.
- 11. Example
- 12. Some details reverse_tcp payload. local port 4444(it is vulnerable port) to create active server which listening when victim click on message. After victim activate the payload included into message I open meterpreter.
- 13. Human Threats Threat-Source Motivation Threat Action Computer Criminal Monetary Gain-my Computer Crime credit card info Fraudulent Act Hacker, Cracker Challenge, Ego Hacking, Social Engineering, System Intrusion, Unauthorized System Access. User Negligence Spill Fluids on System Idiocy Drop System
- 14. Vulnerability Identification Vulnerability Threat-Source Threat Action Outdated Software Hacker, Cracker, System File Loss, Computer Criminal. Unauthorized System Accesses. Misconfigured System Users, Computer System Files Loss, Criminal. Hacker, System Failure Cracker. Absence Of Security Hacker, Cracker, System Files Loss, Software Computer Criminal. System Failure.
- 15. Likelihood Determination Threat-Source Vulnerability Likelihood Hacker, Cracker, Outdated Software Medium Computer Criminal. Users, Computer Misconfigured System Medium Criminal. Hacker, Cracker, Absence Of Security High Computer Criminal. Software
- 16. Impact Analysis Threat-Source Loss of Loss of Loss of Integrity Availability Confidentialit y Hacker, None High High Cracker. Computer None High High Criminal. Users Low Low Low
- 17. Likelihood, Impact Analysis & Risk Vulnerability Threat - Likelihood Impact Risk Source Outdated Hacker, Medium Medium Medium Software Cracker, Computer Criminal. Misconfigured Users, High High High System Computer Criminal. Hacker, Cracker. Absence Of Hacker, High Medium Medium Security Cracker, Software Computer Criminal.
- 18. Control Recommendations Risk Risk Recommended Controls Activity Level Priority Outdated Software Medium Regularly Updating Software. Medium Misconfigured High Hire Qualified Specialists. High System Absence Of Security Medium Install legally IPS & IDS. Medium Software
- 19. Network attacks
- 20. ARP - Man in the middle attack After I broke in through Metasploit exploit to victim pc I try do more harm to him. I use ARP protocol vulnerability, with which you are invisible, but same time making damage to victim. With fake arpsoof regues and response package sending I make MITM “Man In The Middle” attack.
- 21. After that I get full information float from router and my selected other computer. In that information are included logins, emails other sensitive information. Victim become full infected, he needs get out of this situation and prevent for another time.
- 22. Dos attack • Used tools: Bactrack5 network penetration OS within Ettercap tool for maninthemidlle attack. • Goal: Make the terminal server unavailable to its intended users
- 23. DoS
- 24. TS before DoS attack
- 25. TS after DoS attack
- 26. Human Threats Threat-Source Motivation Threat Action Computer Criminal Monetary Gain-my Computer Crime credit card info Fraudulent Act Hacker, Cracker Challenge, Ego Hacking, Social Engineering, System Intrusion, Unauthorized System Access. Competitors Injure Company Economic Exploitation, Stability. Compromise System Penetration, Network work. Spoofing/Sniffing of Network. Run Of Company Data.
- 27. Vulnerability Identification Vulnerability Threat-Source Threat Action Absence Of System Hacker, Cracker System Failure, Security Competitors Connection Damage, Computer Criminal Information Conversion.
- 28. Likelihood Determination Threat-Source Vulnerability Likelihood Hacker, Cracker Absence Of System Medium Competitors Security Computer Criminal
- 29. Impact Analysis Threat-Source Loss of Loss of Loss of Integrity Availability Confidentialit y Hacker, None High High Cracker. Computer None High High Criminal. Competitors Medium High High
- 30. Likelihood, Impact Analysis & Risk Vulnerability Threat - Likelihood Impact Risk Source Absence Of Hacker, Medium High Medium System Cracker Security Competitors Computer Criminal
- 31. Control Recommendations Risk Risk Recommended Controls Activity Level Priority Absence Of System Medium Install legally IPS & IDS. High Security Implement encryption. Users Access Control.
- 33. Terminal server security configuration User groups: • Administrative Users group – privileges to configure terminal server • Remote Desktop Users group – privileges only to connect remote desktop without possibility to configure it. • All users including administrator have credentials to login the services, no password less connection available.
- 34. Application control for users • The users can use only specified applications by the system administrator. • Not active user sessions are terminated according time limit. • Applications that can be started by other application are not visible to user. • User attempt to open not assigned application are restricted by popout message that user have not privilege to open it.
- 35. Anti-virus Implement security antivirus, which gives you updated database and protect from intruders. Shut down any untruthful connection. Scanning web pages, your downloads. Made with reliable Firewall. Security isn’t about blocking malicious actions, it’s about keeping your data safe, so arrange the reliable Encryption software. Users to upload viruses for future updates. #1 Bitdefender
- 36. Security against network attacks ● IPS&IDS ● Snort ● Firewall ● Ipcop APF (Advanced Policy Firewall) from rfxnetworks ● Optional expensive solutions ● Cisco router ● Paid firewall
- 37. Questions?