![Vulnerability Probe: Buffer Overflow
• Minimalist vulnerable program
#include <string.h>
int main(int argc, char *argv[])
{
char buffer[512];
if (argc > 1)
strcpy(buffer,argv[1]);
}
• Compile the program with the following command :
• $ gcc -o vulnerable main.c](https://image.slidesharecdn.com/introductiontocybersecurity-200207085331/85/Introduction-to-cyber-security-32-320.jpg)
Introduction to cyber security
- 2. History • 1970’s, Robert Thomas, a researcher for BBN Technologies in Cambridge, Massachusetts, created the first computer “worm”. It was called The Creeper. • It infected computers by hopping from system to system with the message “I’M THE CREEPER: CATCH ME IF YOU CAN.” • Ray Tomlinson, the inventor of email, created a replicating program called The Reaper, the first antivirus software, which would chase Creeper and delete it. • In 1988, Robert Morris wrote a program Morris worm that went through networks, invaded Unix terminals, and copied itself. • The Morris worm was so aggressive that it slowed down computers to the point of being unusable. He subsequently became the first person to be convicted under Computer Fraud and Abuse Act.
- 3. What is Cyber Security Cybersecurity is the body of technologies, processes, and practices designed to protect networks, computers, programs and data from attack, damage or unauthorized access.
- 4. Why is cybersecurity important? • With each passing year, the sheer volume of threats is increasing rapidly. • According to the report by McAfee, cybercrime now stands at over $400 billion, while it was $250 billion two years ago. • Cyber attacks can be extremely expensive for businesses to endure. • In addition to financial damage suffered by the business, a data breach can also inflict untold reputational damage. • Cyber-attacks these days are becoming progressively destructive. • Cybercriminals are using more sophisticated ways to initiate cyber attacks. • Regulations such as General Data Protection Regulation (GDPR) are forcing organizations into taking better care of the personal data they hold.
- 5. The CIA Triad • Confidentiality, integrity, and availability, also known as the CIA triad, is a model designed to guide companies and organizations to form their security policies.
- 6. Confidentiality • Confidentiality is about preventing the disclosure of data to unauthorized parties. • It also means trying to keep the identity of authorized parties involved in sharing and holding data private and anonymous. • Often confidentiality is compromised by cracking poorly encrypted data, Man-in-the-middle(MITM) attacks, disclosing sensitive data. • Standard measures to establish confidentiality include: • Data encryption • Two-factor authentication • Biometric verification • Security tokens
- 7. Integrity • Integrity refers to protecting information from being modified by unauthorized parties. • It is a requirement that information and programs are changed only in a specified and authorized manner. • Challenges that could endanger integrity include turning a machine into a “zombie computer”, embedding malware into web pages. • Standard measures to guarantee integrity include: • Cryptographic checksums • Using file permissions • Uninterrupted power supplies • Data backups
- 8. Availability • Availability is making sure that authorized parties are able to access the information when needed. • Data only has value if the right people can access it at the right time. • Information unavailability can occur due to security incidents such as DDoS attacks, hardware failures, programming errors, human errors. • Standard measures to guarantee availability include: • Backing up data to external drives • Implementing firewalls • Having backup power supplies • Data redundancy
- 10. Attacks on CIA
- 11. How is Cybersecurity implemented?
- 12. Contd..
- 13. Classification of Security Hackers Black Hat Hackers’ objective: • To steal valuable information from another user • To steal money through transactions and accounts • To get access to free music and videos • Downloading free hacking software which is considered an illegal activity • To steal valuable information from military/navy organizations • To access restricted networking spaces White Hat Hackers’ objective: • To improve the security framework in a system • Developing high security programming language like Linux • Developing most of the security software for organizations • Checking and updating security softwares • Developing programs like pop up blocker, firewall and ad blocker
- 14. Vulnerability Scanner A vulnerability scanner can assess a variety of vulnerabilities across information systems like computers, network systems, operating systems, and software applications, that may be: 1. Vendor-originated: this includes software bugs, missing operating system patches, vulnerable services, insecure default configurations, and web application vulnerabilities. 2. System administration-originated: this includes incorrect or unauthorised system configuration changes, lack of password protection policies, and so on. 3. User-originated: this includes sharing directories to unauthorised parties, failure to run virus scanning software, and malicious activities, such as deliberately introducing system backdoors activities
- 15. Benefits of Vulnerability Scanners • Early detection and handling of known security problems • Identify security vulnerabilities that may be present in the network, from both the internal and external perspective. • Identification of new device or even a new system that may be connected to the network without authorisation • The scanner can help identify rogue machines, which might endanger overall system and network security. • Verify the inventory of all devices on the network. • Inventory includes the device type, operating system version and patch level, hardware configurations and other relevant system information. This information is useful in security management and tracking.
- 16. Limitations of Vulnerability Scanners • Snapshot only: a vulnerability scanner can only assess a "snapshot of time" in terms of a system or network's security status. • Scanning needs to be conducted regularly, as new vulnerabilities can emerge, or system configuration changes can introduce new security holes. • Human judgement is needed: Vulnerability scanners can only report vulnerabilities according to the plug-ins installed in the scan database. • They cannot determine whether the response is a false negative or a false positive. Human judgement is always needed in analysing the data after the scanning process. • Others: a vulnerability scanner is designed to discover known vulnerabilities only. • It cannot identify other security threats, such as those related to physical, operational or procedural issues.
- 17. Architecture of Vulnerability Scanners • Scan Engine executes security checks according to its installed plug-ins, identifying system information and vulnerabilities. • It can scan more than one host at a time and compares the results against known vulnerabilities. • Scan Database stores vulnerability information, scan results, and other data used by scanner. • Number of available plug-ins, and the updating frequency of plug-ins will vary depending on vendor. Scanners with an "auto-update" feature • Each plug-in might contain not only the test case itself, but also a vulnerability description, a Common Vulnerabilities and Exposures (CVE) identifier; and even fixing instructions for a detected vulnerability.
- 18. Architecture of Vulnerability Scanners (Contd..) • Report Module provides different levels of reports on the scan results, • Such as detailed technical reports with suggested remedies for system administrators, • Summary reports for security managers, • High-level graph and trend reports for executives. • User Interface allows the administrator to operate the scanner. • It may be either a Graphical User Interface (GUI), or just a command line interface. For enterprise networks : Use Distributed Network Scanners with more complex architecture, capable of assessing vulnerabilities across multiple or geographically dispersed networks . Composed • Remote scanning agents, • Plug-in update mechanism for those agents, • Centralised management point.
- 19. Types of Vulnerability Scanner • NETWORK-BASED SCANNERS • Usually installed on a single machine that scans a number of other hosts on the network. • It helps detect critical vulnerabilities such as mis-configured firewalls, vulnerable web servers, risks associated with vendor-supplied software, and risks associated with network and systems administration. • Different types of network-based scanners include: 1. Port Scanners that determine the list of open network ports in remote systems; 2. Web Server Scanners that assess the possible vulnerabilities (e.g. potentially dangerous files) in remote web servers; 3. Web Application Scanners that assess the security aspects of web applications (such as cross site scripting and SQL injection) running on web servers. Cross-site Scripting (XSS) is a client-side code injection attack. The actual attack occurs when the victim visits the web page or web application that executes the malicious code. SQL injection is a code injection technique that might destroy your database and is one of the most common web hacking techniques.
- 20. Types of Vulnerability Scanner (Contd..) • HOST-BASED SCANNERS • Scanner is installed in the host to be scanned, • Has direct access to low-level data, such as specific services and configuration details of the host's operating system. • Provide insight into risky user activities such as using easily guessed passwords or even no password. • Detect signs that an attacker has already compromised a system, including looking for suspicious file names, unexpected new system files or device files, and unexpected privileged programs. • Perform baseline (or file system) checks not done by Network-based scanners as they do not have direct access to the file system on the target host. • Database scanner is an example of a host-based vulnerability scanner. • It performs detailed security analysis of the authorisation, authentication, and integrity of database systems, and can identify any potential security exposures in database systems, ranging from weak passwords and security mis-configurations to Trojan horses.
- 21. Open Port Service Identification: Introduction • A port scanner is an application designed to probe a server or host for open ports. • Such an application may be used by administrators to verify security policies of their networks and by attackers to identify network services running on a host and exploit vulnerabilities. • A port scan is a process that sends client requests to a range of server port addresses on a host, with the goal of finding an active port. • Basically port scan are not attacks, but rather simple probes to determine services available on a remote machine. • Portsweep is to scan multiple hosts for a specific listening port. • For example, an SQL-based computer worm may portsweep looking for hosts listening on TCP port 1433.
- 22. Categories Result of a scan on a port is usually generalized into one of three categories: • Open or Accepted: The host sent a reply indicating that a service is listening on the port. • Closed or Denied or Not Listening: The host sent a reply indicating that connections will be denied to the port. • Filtered, Dropped or Blocked: There was no reply from the host. • Two vulnerabilities of which administrators must be cautioned: • Security and stability concerns associated with the program responsible for delivering the service- Open ports. • Security and stability concerns associated with the operating system that is running on the host- Open or Closed ports. • Filtered ports do not present any vulnerabilities.
- 23. Types • TCP scanning • Use the operating system's network functions and are generally the next option to go to when SYN is not a feasible option • If a port is open, • the operating system completes the TCP three-way handshake, • The scanner immediately closes the connection to avoid performing a Denial-of-service attack. • Otherwise an error code is returned. • Advantage of the mode • No special privileges required for user does not require. • Disadvantage of the mode • Since mode prevents low-level control, so this scan type is less common. • Method is "noisy", particularly if it is a "portsweep“. • The services can log the sender IP address and Intrusion detection systems can raise an alarm.
- 24. Types (Contd..) • SYN scanning • Another form of TCP scanning. • Port scanner generates raw IP packets itself, and monitors for responses instead of running OS based network functions. • Also known as "half-open scanning", because it never actually opens a full TCP connection. • The port scanner generates a SYN packet. • If the target port is open, it will respond with a SYN-ACK packet. • The scanner host responds with an RST packet, closing the connection before the handshake is completed. • If the port is closed but unfiltered, the target will instantly respond with an RST packet. • Advantages, • Scanner has full control of the packets sent and the timeout for responses, and allowing detailed reporting of the responses.
- 25. Types (Contd..) • UDP scanning • There are technical challenges as UDP is a connectionless protocol , hence no equivalent to a TCP SYN packet. • If a UDP packet is sent to a port that is not open, • System will respond with an ICMP port unreachable message. • Hence, use the absence of a response to infer that a port is open. • However, if a port is blocked by a firewall, this method will falsely report that the port is open. • If the port unreachable message is blocked, all ports will appear open. • Method is also affected by ICMP rate limiting. • Other scanning Method but rarely used are • ACK scanning • Window scanning • FIN scanning
- 26. Examples • For example a scanner could connect to using nmap application to • port 1 - to see if tcpmux is running. • Specification describes a multiplexing service that may be accessed with a network protocol to contact any one of a number of available TCP services of a host on a single, well-known port number • port 7 - to see if echo is running. • Display of data • port 22 - to see if openssh is available. • OpenSSH is a freely available version of the Secure Shell (SSH) protocol family of tools for remotely controlling, or transferring files between, computers. • port 25 - to see if smtp is available. • Set of communication guidelines that allow software to transmit an electronic mail over the internet i
- 27. Version Check • Footprinting is the technique to collect as much information as possible about the targeted network/victim/system. • It helps hackers in various ways to intrude on an organization's system. • Use nmap to discover the web server version, Operating System Version check the servers to make sure that their ports are operating properly, ping network segments. • Some commands for version check include • -sV (Version detection) • -allports (Don't exclude any ports from version detection) • -version-intensity <intensity> (Set version scan intensity) • -version-all (Try every single probe) • - version-trace (Trace version scan activity)
- 28. TRAFFIC PROBE • High-Speed Traffic Processing • LAN and MAN has evolved to support speeds from 1 Mb/s to 100 Gb/s. • The total amount of data created or replicated on the planet in 2010 was over 1 zettabyte (143 GB for each of the 7 billion people on the planet. • This volume of information requires high-speed links between server farms, cloud storage, and end users to make sure that it can be processed in a timely and reliable fashion. • It will not be possible to analyse such huge traffic volumes in the coming 100 GbE network installations with the current generation of network measurement tools • FPGA cards (intel 82599, Myri-10G Lanai Z8ES) are still used in applications which perform in-depth analysis, patter matching, and low latency operations in 40/100 Gb/s networks
- 29. TRAFFIC PROBE (Contd..) • Network Traffic Measurement • Full packet traces. • Flow statistics provide information from Internet Protocol (IP). • Volume statistics are provided by most network appliances for network management. • Network Intrusion Detection • Signature-based approach inspects the evaluated content. • Anomaly-based detection. • Stateful protocol analysis.
- 30. Vulnerability Probe: HTML injection check • Some security bugs can’t be identified without sending a payload that exploits a suspected vulnerability. • Vulnerability probe for a web application. Imagine a web app that has a search box for users to find text within its pages. HTML EXAMPLE :- • <div id="search"><span class="results">Results for '<xss>'...</span> Example of Cross Site Scripting (XSS) To do with caution <script>alert (1)</script>
- 31. Vulnerability Probe: Buffer Overflow • A buffer overflow occurs when a program or process attempts to write more data to a fixed length block of memory (a buffer), than the buffer is allocated to hold. • By sending carefully crafted input to an application, an attacker can cause the application to execute arbitrary code, possibly taking over the machine
- 32. Vulnerability Probe: Buffer Overflow • Minimalist vulnerable program #include <string.h> int main(int argc, char *argv[]) { char buffer[512]; if (argc > 1) strcpy(buffer,argv[1]); } • Compile the program with the following command : • $ gcc -o vulnerable main.c
- 33. References 1. What is Cybersecurity? – A Beginner’s Guide to Cybersecurity World available at https://www.edureka.co/blog/what-is- cybersecurity/ 2. Cybersecurity Fundamentals – Introduction to Cybersecurity available at https://www.edureka.co/blog/cybersecurity- fundamentals-introduction-to-cybersecurity/ 3. An Overview Of Vulnerability Scanners available at https://www.infosec.gov.hk/english/technical/files/