SlideShare a Scribd company logo

Superhelt 2013-screen

Henrik Kramshøj, profile picture
Henrik Kramshøj

The document summarizes a presentation on IT security given by Henrik Lund Kramshøj. The presentation covers topics such as password security, using encryption tools to protect data, and two-factor authentication. It provides examples of password managers and hardware security keys that can be used to replace passwords. It also discusses using encryption protocols and virtual private networks to securely transmit data.

Technology
1 of 56
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
Welcome to IT-sikkerhed 2013 PROSA Superhelteseminar Henrik Lund Kramshøj, internet samurai hlk@solido.net http://www.solidonetworks.com c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 1
Planen idag Don’t Panic! Kl 17:00-19:00 Mindre enetale, mere foredrag 2.0 med sociale medier, informationsdeling og interak- tion ˚ Send gerne spørgsmal senere ˚ PS er her nogle timer efter foredraget til spørgsmal og snak c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 2
˚ Formal: IT-sikkerhed passwords og dine services Vores passwords er overalt Vi er afhængige af cloud services Vi er afhængige af netværk Vi er afhængige af andres computere - servere og services c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 3
˚ Formal: sund paranoia Opbevaring af passwords c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 4
Superheltegerninger . Backup - jævnligt Kryptografi og kryptoværktøjer Sikre protokoller Tal frit - Lær og lær fra dig Følg med i nyheder, støt det frie internet c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 5
Hackerværktøjer • Nmap, Nping - tester porte, godt til firewall admins http://nmap.org • Metasploit Framework gratis pa http://www.metasploit.com/ ˚ • Wireshark avanceret netværkssniffer - http://http://www.wireshark.org/ • Burpsuite http://portswigger.net/burp/ • Skipfish http://code.google.com/p/skipfish/ • Kali Linux operativsystem med fokus pa sikkerhedstest http://www.kali.org ˚ Billede: Angelina Jolie fra Hackers 1995 c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 6
Evernote password reset Sources: http://evernote.com/corp/news/password_reset.php c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 7
Twitter password reset Sources: http://blog.twitter.com/2013/02/keeping-our-users-secure.html c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 8
January: Github Public passwords? Sources: https://twitter.com/brianaker/status/294228373377515522 http://www.webmonkey.com/2013/01/users-scramble-as-github-search-exposes-passwords-security-det http://www.leakedin.com/ http://www.offensive-security.com/community-projects/google-hacking-database/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 9
Are passwords dead? google: passwords are dead About 6,580,000 results (0.22 seconds) Can we stop using passwords? Muffett on Passwords has a long list of password related information, from the author of crack http://en.wikipedia.org/wiki/Crack_(password_software) http://dropsafe.crypticide.com/muffett-passwords c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 10
Opbevaring af passwords PasswordSafe http://passwordsafe.sourceforge.net/ Apple Keychain Browsere, Firefox Master Password c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 11
Google looks to ditch passwords for good ”Google is currently running a pilot that uses a YubiKey cryptographic card developed by Yubico The YubiKey NEO can be tapped on an NFC-enabled smartphone, which reads an encrypted one-time password emitted from the key fob.” Source: http://www.zdnet.com/google-looks-to-ditch-passwords-for-good-with-nfc-based-replacement c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 12
Yubico Yubikey A Yubico OTP is unique sequence of characters generated every time the YubiKey button is touched. The Yubico OTP is comprised of a sequence of 32 Modhex characters representing information encrypted with a 128 bit AES-128 key http://www.yubico.com/products/yubikey-hardware/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 13
Duosecurity Video https://www.duosecurity.com/duo-push https://www.duosecurity.com/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 14
Low tech 2-step verification Print af koder, low level pragmatisk Login fra nye enheder kræver ekstra sikkerhed google 2-faktor auth. SMS med backup codes Developed at Bellcore in the late 1980s http://en.wikipedia.org/wiki/S/KEY c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 15
Er dine data sikre Lorem ipsum dolor sit amet, consectetur adipiscing elit, set eiusmod tempor incidunt et labore et dolore magna aliquam. Ut enim ad minim veniam, quis nostrud exerc. Irure dolor in reprehend incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse molestaie cillum. Tia non ob ea soluad incommod quae egen ium improb fugiend. Officia deserunt mollit anim id est laborum Et harumd dereud facilis est er expedit distinct. Gothica quam nunc putamus parum claram anteposuerit litterarum formas humanitatis per seacula quarta; modo typi qui nunc nobis videntur parum clari fiant sollemnes in futurum; litterarum formas humanitatis per seacula quarta decima et quinta decima, modo typi qui nunc nobis videntur parum clari fiant sollemnes in futurum, anteposuerit ! Nam liber te conscient to factor tum poen legum odioque civiuda et tam. Neque pecun modut est neque nonor et imper ned libidig met, consectetur adipiscing elit, sed ut labore et dolore magna aliquam is nostrud exercitation ullam mmodo consequet. Duis aute in voluptate velit esse cillum dolore eu fugiat nulla pariatur. At vver eos et accusam dignissum qui blandit est praesent. ˚ Stjalet laptop Cloud services Slettede eller ødelagte data - og hvordan sletter man data? Huskede du mini SD kortet med dine private billeder? c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 16
harddisk beskyttelse og data kryptering Kryptering findes i alle de gængse klient operativsystemer • Microsoft Windows Bitlocker - kryptering af disken Ultimate eller Enterprise • Apple Mac OS X - krypterer nemt med FileVault og FileVault2 • FreeBSD GEOM og GBDE - giver mulighed for at kryptere enheder generelt • PGP disk - Pretty Good Privacy - laver en virtuel krypteret disk • ˚ Nogle producenter har kodeord pa disken - IBM harddisk BIOS kodeord c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 17
Sikre protokoller som bruger krypto Kryptering af e-mail • Pretty Good Privacy - Phil Zimmermann • PGP = mail sikkerhed Kryptering af sessioner SSL/TLS • Secure Sockets Layer SSL / Transport Layer Services TLS • krypterer data der sendes mellem webservere og klienter • SSL kan bruges generelt til mange typer sessioner, eksempelvis POP3S, IMAPS, SSH m.fl. Kryptering af netværkstrafik - Virtual Private Networks VPN • IPsec IP Security Framework, se ogsa L2TP ˚ • PPTP Point to Point Tunneling Protocol - darlig og usikker, brug den ikke mere! ˚ • OpenVPN m.fl. c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 18
Enigmail - GPG plugin til Mail • Enigmail er en udvidelse til • mailklienten i Mozilla/Netscape • standalone mailklienten Thunderbird • Billede fra http://enigmail.mozdev.org c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 19
Enigmail - OpenGPG Key Manager Key Manager funktionaliteten i Enigmail kan anbefales c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 20
GPGMail plugin til Mac OS X Mail.app • Bruger GPG • kilde: http://www.sente.ch/software/GPGMail/English.lproj/GPGMail.html • Mailserver udvidelser som https://github.com/infertux/zeyple c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 21
VPN VPN http://en.wikipedia.org/wiki/Virtual_private_network SSL/TLS VPN - Generelt koncept. Adskillige leverandører: Cisco, Juniper, F5 Big IP ˚ De snakker ikke ret godt sammen pa tværs. Brug IPSec for dette. IPsec er desværre blokeret mange steder og man skal bruge en klient (I praksis bruger SSL VPN ofte en klient, men den downloades fra web) Open source variant: OpenVPN c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 22
OpenVPN client OpenVPN GUI - easy to use c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 23
Internet sniffing by government Ægypten, Sudan, Tunesien, ... Den der kontrollerer ISPerne kontrollerer trafikken Facebook revolutionerne Blokering er umulig, men det forsøges Spredning af falsk information Diginotar Dutch Certificate Authority Kilde: http://irevolution.net/2011/02/10/facebook-for-repressive-regimes/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 24
HTTPS Everywhere HTTPS Everywhere is a Firefox extension produced as a collaboration between The Tor Project and the Electronic Frontier Foundation. It encrypts your commu- nications with a number of major websites. http://www.eff.org/https-everywhere c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 25
CertPatrol - which site uses which certificate An add-on formerly considered paranoid: CertPatrol implements ”pinning” for Firefox/Mozilla/SeaMonkey roughly as now recommended in the User Interface Guidelines of the World Wide Web Consortium (W3C). http://patrol.psyced.org/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 26
Convergence - who do you trust http://convergence.io/ Warning: radical change to how certificates work c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 27
Client side: Flash, PDF, Facebook Kan vi undvære Java, Flash og PDF? Kilde: http://en.wikipedia.org/wiki/Drive-by_download c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 28
Flash blockers Safari http://clicktoflash.com/ Firefox Extension Flashblock Chrome extension called FlashBlock Internet Explorer 8: IE has the Flash block functionality built-in so you don’t need to install any additional plugins to be able to block flash on IE 8. FlashBlock for Opera 9 - bruger nogen Opera mere? FlashBlockere til iPad? iPhone? Android? - hvorfor er det ikke default? c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 29
Tor project https://www.torproject.org/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 30
Tor project - how it works 1 pictures from https://www.torproject.org/about/overview.html.en c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 31
Tor project - how it works 2 pictures from https://www.torproject.org/about/overview.html.en c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 32
Tor project - how it works 3 pictures from https://www.torproject.org/about/overview.html.en c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 33
Hvordan bliver du sikker Lad være med at bruge een computer til alt ˚ Forskellige computere til forskellige formal, webserver vs mailserver Brug en sikker konfiguration, minimumskonfiguration Brug sikre protokoller, kryptering, evt. TOR Opsætning af netværk, hvordan? Security Configuration Guides + paranoia • http://csrc.nist.gov/publications/PubsSPs.html • http://www.nsa.gov/research/publications/index.shtml • http://www.nsa.gov/ia/guidance/security_configuration_guides/index.shtml c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 34
Følg med Twitter news Twitter has become an important new resource for lots of stuff Twitter has replaced RSS for me c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 35
Følg med Twitter news ˚ Exploits og nye sarbarheder c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 36
Checklisten • BIOS kodeord, pin-kode til telefon • Firewall - specielt pa laptops ˚ • Installer anti-virus og anti-spyware hvis det er pa Windows ˚ • Brug to browsere med forskellige indstillinger • Brug evt. PGP til mailkryptering • Brug Password Safe, Keychain Access (OSX) eller tilsvarende • Overvej at bruge harddisk eller filkryptering • Opdatere alle programmer jævnligt • Backup af vigtige data - harddiske i bærbare kan ogsa dø ˚ • Husk: sikker sletning af harddiske, medier osv. c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 37
Afbalanceret sikkerhed god sikkerhed dårlig sikkerhed Sikkerheds niveau Prod Test Dev Mail Web Prod Test Dev Mail Web Det er bedre at have et ensartet niveau Hvor rammer angreb hvis du har Fort Knox et sted og kaos andre steder Hackere vælger ikke med vilje den sværeste vej ind c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 38
Part II c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 39
Fri adgang til hackerværktøjer I 1993 skrev Dan Farmer og Wietse Venema artiklen Improving the Security of Your Site by Breaking Into it I 1995 udgav de softwarepakken SATAN Security Administrator Tool for Analyzing Networks We realize that SATAN is a two-edged sword - like many tools, it can be used for good and for evil purposes. We also realize that intruders (including wannabees) have much more capable (read intrusive) tools than offered with SATAN. Se http://sectools.org og http://www.packetstormsecurity.org/ Kilde: http://www.fish2.com/security/admin-guide-to-cracking.html c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 40
Pentest in the news c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 41
Attack overview http://www.sicherheitstacho.eu/?lang=en c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 42
Carna Botnet Internet Census 2012 Port scanning /0 using insecure embedded devices Abstract While playing around with the Nmap Scripting Engine (NSE) we discov- ered an amazing number of open embedded devices on the Internet. Many of them are based on Linux and allow login to standard BusyBox with empty or de- fault credentials. We used these devices to build a distributed port scanner to scan all IPv4 addresses. These scans include service probes for the most com- mon ports, ICMP ping, reverse DNS and SYN scans. We analyzed some of the data to get an estimation of the IP address usage. Additionally, with one hundred thousand devices scanning at ten probes per sec- ond we would have a distributed port scanner to port scan the entire IPv4 Internet within one hour. Source: http://internetcensus2012.bitbucket.org/paper.html http://www.theregister.co.uk/2013/03/19/carna_botnet_ipv4_internet_map/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 43
Shodan dark google http://www.shodanhq.com/search?q=Photosmart c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 44
Cisco IOS password Title: Cisco’s new password hashing scheme easily cracked Description: In an astonishing decision that has left crytographic experts scratch- ing their heads, engineer’s for Cisco’s IOS operating system chose to switch to a one-time SHA256 encoding - without salt - for storing passwords on the device. This decision leaves password hashes vulnerable to high-speed cracking - mod- ern graphics cards can compute over 2 billion SHA256 hashes in a second - and is actually considerably less secure than Cisco’s previous implementa- tion. As users cannot downgrade their version of IOS without a complete reinstall, and no fix is yet available, security experts are urging users to avoid upgrades to IOS version 15 at this time. Reference: via SANS @RISK newsletter http://arstechnica.com/security/2013/03/cisco-switches-to-weaker-h c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 45
Kali Linux the new backtrack BackTrack http://www.backtrack-linux.org Kali http://www.kali.org/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 46
it’s a Unix system, I know this Skal du igang med sikkerhed? Installer et netværk, evt. bare en VMware, Virtualbox, Parallels, Xen, GNS3, ... Brug BackTrack, se evt. youtube videoer om programmerne Quote fra Jurassic Park http://www.youtube.com/watch?v=dFUlAQZB9Ng c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 47
Hackerværktøjer • Nmap, Nping - tester porte, godt til firewall admins http://nmap.org • Aircrack-ng http://www.aircrack-ng.org/ • Wireshark netværkssniffer - http://http://www.wireshark.org/ • Burpsuite http://portswigger.net/burp/ • Skipfish http://code.google.com/p/skipfish/ ˚ Generelt findes der hackerværktøjer indenfor alle nicheomrader! Listen over de mest anvendte hacker tools http://sectools.org/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 48
Metasploit and Armitage Still rocking the internet http://www.metasploit.com/ Armitage GUI fast and easy hacking for Metasploit http://www.fastandeasyhacking.com/ Kursus Metasploit Unleashed http://www.offensive-security.com/metasploit-unleashed/Main_Page Bog: Metasploit: The Penetration Tester’s Guide, No Starch Press ISBN-10: 159327288X c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 49
Demo, snak, visning, surfing hackertools, step by step instruktioner, Kali Linux demo osv. c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 50
Security Onion securityonion.blogspot.dk c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 51
BRO IDS While focusing on network security monitoring, Bro provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Bro has successfully bridged the traditional gap be- tween academia and operations since its inception. http://www.bro.org/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 52
BRO more than an IDS The key point that helped me understand was the explanation that Bro is a domain-specific language for networking applications and that Bro-IDS (http://bro- ids.org/) is an application written with Bro. Why I think you should try Bro https://isc.sans.edu/diary.html?storyid=15259 c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 53
Bro scripts global dns_A_reply_count=0; global dns_AAAA_reply_count=0; ... event dns_A_reply(c: connection, msg: dns_msg, ans: dns_answer, a: addr) { ++dns_A_reply_count; } event dns_AAAA_reply(c: connection, msg: dns_msg, ans: dns_answer, a: addr) { ++dns_AAAA_reply_count; } source: dns-fire-count.bro from https://github.com/LiamRandall/bro-scripts/tree/master/fire-script c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 54
˚ Be careful - spørgsmal? Hey, Lets be careful out there! Henrik Lund Kramshøj, internet samurai hlk@solido.net Billede: Michael Conrad http://www.hillstreetblues.tv/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 55
VikingScan.org - free portscanning c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 56

More Related Content

PDF
2013 april-screen
Henrik Kramshøj
 
PDF
The ultimate privacy guide
JD Liners
 
PDF
Manipulating Memory for Fun & Profit
High-Tech Bridge SA (HTBridge)
 
PDF
Howto Crack Or Hack A Wireless Network With Wired Equivalent Privacy Wep
Praveen Kumar Sinha
 
PDF
CoreTrace Whitepaper: Combating Buffer Overflows And Rootkits
CoreTrace Corporation
 
PDF
Strong Authentication (Michal Sobiegraj)
msobiegraj
 
PDF
Security Theatre (PHP Leuven)
xsist10
 
PDF
Web appc pentesting_05_2012__teasers
Amiga Utomo
 
2013 april-screen
Henrik Kramshøj
 
The ultimate privacy guide
JD Liners
 
Manipulating Memory for Fun & Profit
High-Tech Bridge SA (HTBridge)
 
Howto Crack Or Hack A Wireless Network With Wired Equivalent Privacy Wep
Praveen Kumar Sinha
 
CoreTrace Whitepaper: Combating Buffer Overflows And Rootkits
CoreTrace Corporation
 
Strong Authentication (Michal Sobiegraj)
msobiegraj
 
Security Theatre (PHP Leuven)
xsist10
 
Web appc pentesting_05_2012__teasers
Amiga Utomo
 

What's hot (11)

PDF
Security theatre (Scotland php)
xsist10
 
PDF
Detecting dns-tunneling-34152
huynhvanphuc
 
PDF
Privacy is a UX problem (David Dahl)
Future Insights
 
PDF
Security Theatre - PHP UK Conference
xsist10
 
PDF
Gps4b
shacho
 
PDF
Security Theatre - Benelux
xsist10
 
PPT
Network Security fundamentals
Tariq kanher
 
PDF
ClubHack Magazine Issue May 2012
ClubHack
 
PPT
Firewalls (Distributed computing)
Sri Prasanna
 
PDF
Security Theatre - AmsterdamPHP
xsist10
 
PDF
150515 - Final project - FIN
Javid Gozalov
 
Security theatre (Scotland php)
xsist10
 
Detecting dns-tunneling-34152
huynhvanphuc
 
Privacy is a UX problem (David Dahl)
Future Insights
 
Security Theatre - PHP UK Conference
xsist10
 
Gps4b
shacho
 
Security Theatre - Benelux
xsist10
 
Network Security fundamentals
Tariq kanher
 
ClubHack Magazine Issue May 2012
ClubHack
 
Firewalls (Distributed computing)
Sri Prasanna
 
Security Theatre - AmsterdamPHP
xsist10
 
150515 - Final project - FIN
Javid Gozalov
 
Ad

Viewers also liked (6)

PDF
Tor talk-prosa-screen
Henrik Kramshøj
 
PDF
Ctf intro-print
Henrik Kramshøj
 
PDF
Paranoia or risk management 2013
Henrik Kramshøj
 
PDF
Ipv6 internetdagen-print
Henrik Kramshøj
 
PDF
Hackerworkshop print
Henrik Kramshøj
 
PDF
Basic Hacking Print
Henrik Kramshøj
 
Tor talk-prosa-screen
Henrik Kramshøj
 
Ctf intro-print
Henrik Kramshøj
 
Paranoia or risk management 2013
Henrik Kramshøj
 
Ipv6 internetdagen-print
Henrik Kramshøj
 
Hackerworkshop print
Henrik Kramshøj
 
Basic Hacking Print
Henrik Kramshøj
 
Ad

Similar to Superhelt 2013-screen (20)

PDF
Cybersecurity-NSIC.pdf
20CM040ChilakaniMahe
 
PPT
Lecture 5 ip security
rajakhurram
 
PPTX
Chapter 2 System Security.pptx
RushikeshChikane2
 
PDF
Så er lotus notes domino 8.5.3 kommet
IBM Collaboration Solutions - Denmark
 
PPT
E-COMMERCE SECURITY (2).ppt
Hemlata Gangwar
 
PPT
Electronic commerce security seventh annual edition
pathanaazim
 
PPT
E-COMMERCE SECURITY (1).ppt VI6R7UTGT6T5FRKDLKUTY
subhamkumar56644
 
PPT
E-COMMERCE SECURITY , e bussines nvjfffbjurgrujgkmdgnfblguisrljkfbbjsreio[q3g...
subhamkumar56644
 
PPT
Ibm risk management-30min
Kim Aarenstrup
 
PPT
Dmk bo2 k8_ccc
Dan Kaminsky
 
PPT
E commerce security
Shakti Singh
 
PPTX
Computer security and privacy
Haider Ali Malik
 
PPTX
Cyber Security Fundamentals and Ethical hackingpptx
GAMBOBAITA
 
PPTX
Chapter 5 Selected Topics in computer.pptx
AschalewAyele2
 
PDF
TOP10 Security Predictions for 2010
Kim Jensen
 
PPTX
Dmk sb2010 web_defense
Dan Kaminsky
 
PDF
Full Stack Python Security Cryptography TLS And Attack Resistance 1st Edition...
saaricosh
 
PDF
Advanced Cybersecurity Technologies 1st Edition Ralph Moseley
lewiczdiosay
 
PPTX
News bytes Oct-2011
Ashwin Patil, GCIH, GCIA, GCFE
 
PDF
Presentation- Introduction to Cybersecurity.pdf
fizarcse
 
Cybersecurity-NSIC.pdf
20CM040ChilakaniMahe
 
Lecture 5 ip security
rajakhurram
 
Chapter 2 System Security.pptx
RushikeshChikane2
 
Så er lotus notes domino 8.5.3 kommet
IBM Collaboration Solutions - Denmark
 
E-COMMERCE SECURITY (2).ppt
Hemlata Gangwar
 
Electronic commerce security seventh annual edition
pathanaazim
 
E-COMMERCE SECURITY (1).ppt VI6R7UTGT6T5FRKDLKUTY
subhamkumar56644
 
E-COMMERCE SECURITY , e bussines nvjfffbjurgrujgkmdgnfblguisrljkfbbjsreio[q3g...
subhamkumar56644
 
Ibm risk management-30min
Kim Aarenstrup
 
Dmk bo2 k8_ccc
Dan Kaminsky
 
E commerce security
Shakti Singh
 
Computer security and privacy
Haider Ali Malik
 
Cyber Security Fundamentals and Ethical hackingpptx
GAMBOBAITA
 
Chapter 5 Selected Topics in computer.pptx
AschalewAyele2
 
TOP10 Security Predictions for 2010
Kim Jensen
 
Dmk sb2010 web_defense
Dan Kaminsky
 
Full Stack Python Security Cryptography TLS And Attack Resistance 1st Edition...
saaricosh
 
Advanced Cybersecurity Technologies 1st Edition Ralph Moseley
lewiczdiosay
 
News bytes Oct-2011
Ashwin Patil, GCIH, GCIA, GCFE
 
Presentation- Introduction to Cybersecurity.pdf
fizarcse
 

More from Henrik Kramshøj (7)

PDF
Superhelt 2012-screen
Henrik Kramshøj
 
PDF
Hackerworkshop exercises
Henrik Kramshøj
 
PDF
Basic tcpip-print
Henrik Kramshøj
 
PDF
Basic tcpip-exercises
Henrik Kramshøj
 
PDF
IPv6 introduction
Henrik Kramshøj
 
PDF
Security Tools Foss
Henrik Kramshøj
 
PDF
Krimihacking
Henrik Kramshøj
 
Superhelt 2012-screen
Henrik Kramshøj
 
Hackerworkshop exercises
Henrik Kramshøj
 
Basic tcpip-print
Henrik Kramshøj
 
Basic tcpip-exercises
Henrik Kramshøj
 
IPv6 introduction
Henrik Kramshøj
 
Security Tools Foss
Henrik Kramshøj
 
Krimihacking
Henrik Kramshøj
 

Recently uploaded (20)

PDF
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
PDF
Shreyas Phanse Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
SHREYAS PHANSE
 
PPTX
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
PDF
NewMind AI Weekly Chronicles - August'25 Week I
NewMind AI
 
PDF
NewMind AI Monthly Chronicles - July 2025
NewMind AI
 
PDF
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
PDF
KodekX | Application Modernization Development
KodekX
 
PDF
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
PDF
Bridging biosciences and deep learning for revolutionary discoveries: a compr...
IAESIJAI
 
PDF
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
DOCX
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
PDF
Electronic commerce courselecture one. Pdf
OmerMohamed64
 
PPTX
PA Analog/Digital System: The Backbone of Modern Surveillance and Communication
AVTRON Technologies LLC
 
PDF
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
PPTX
MYSQL Presentation for SQL database connectivity
Swati270511
 
PPTX
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
PDF
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
PDF
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 
Machine learning based COVID-19 study performance prediction
IAESIJAI
 
Shreyas Phanse Resume: Experienced Backend Engineer | Java • Spring Boot • Ka...
SHREYAS PHANSE
 
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
Building Integrated photovoltaic BIPV_UPV.pdf
SandeepSingh286037
 
NewMind AI Weekly Chronicles - August'25 Week I
NewMind AI
 
NewMind AI Monthly Chronicles - July 2025
NewMind AI
 
Unlocking AI with Model Context Protocol (MCP)
Brian McKeiver
 
KodekX | Application Modernization Development
KodekX
 
The Rise and Fall of 3GPP – Time for a Sabbatical?
3G4G
 
Bridging biosciences and deep learning for revolutionary discoveries: a compr...
IAESIJAI
 
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
Electronic commerce courselecture one. Pdf
OmerMohamed64
 
PA Analog/Digital System: The Backbone of Modern Surveillance and Communication
AVTRON Technologies LLC
 
7 ChatGPT Prompts to Help You Define Your Ideal Customer Profile.pdf
SOFTTECHHUB
 
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
MYSQL Presentation for SQL database connectivity
Swati270511
 
Detection-First SIEM: Rule Types, Dashboards, and Threat-Informed Strategy
ReZa AdineH
 
Encapsulation_ Review paper, used for researhc scholars
gurumoop
 
Network Security Unit 5.pdf for BCA BBA.
Serpent6
 

Superhelt 2013-screen

  • 1. Welcome to IT-sikkerhed 2013 PROSA Superhelteseminar Henrik Lund Kramshøj, internet samurai hlk@solido.net http://www.solidonetworks.com c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 1
  • 2. Planen idag Don’t Panic! Kl 17:00-19:00 Mindre enetale, mere foredrag 2.0 med sociale medier, informationsdeling og interak- tion ˚ Send gerne spørgsmal senere ˚ PS er her nogle timer efter foredraget til spørgsmal og snak c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 2
  • 3. ˚ Formal: IT-sikkerhed passwords og dine services Vores passwords er overalt Vi er afhængige af cloud services Vi er afhængige af netværk Vi er afhængige af andres computere - servere og services c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 3
  • 4. ˚ Formal: sund paranoia Opbevaring af passwords c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 4
  • 5. Superheltegerninger . Backup - jævnligt Kryptografi og kryptoværktøjer Sikre protokoller Tal frit - Lær og lær fra dig Følg med i nyheder, støt det frie internet c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 5
  • 6. Hackerværktøjer • Nmap, Nping - tester porte, godt til firewall admins http://nmap.org • Metasploit Framework gratis pa http://www.metasploit.com/ ˚ • Wireshark avanceret netværkssniffer - http://http://www.wireshark.org/ • Burpsuite http://portswigger.net/burp/ • Skipfish http://code.google.com/p/skipfish/ • Kali Linux operativsystem med fokus pa sikkerhedstest http://www.kali.org ˚ Billede: Angelina Jolie fra Hackers 1995 c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 6
  • 7. Evernote password reset Sources: http://evernote.com/corp/news/password_reset.php c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 7
  • 9. January: Github Public passwords? Sources: https://twitter.com/brianaker/status/294228373377515522 http://www.webmonkey.com/2013/01/users-scramble-as-github-search-exposes-passwords-security-det http://www.leakedin.com/ http://www.offensive-security.com/community-projects/google-hacking-database/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 9
  • 10. Are passwords dead? google: passwords are dead About 6,580,000 results (0.22 seconds) Can we stop using passwords? Muffett on Passwords has a long list of password related information, from the author of crack http://en.wikipedia.org/wiki/Crack_(password_software) http://dropsafe.crypticide.com/muffett-passwords c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 10
  • 11. Opbevaring af passwords PasswordSafe http://passwordsafe.sourceforge.net/ Apple Keychain Browsere, Firefox Master Password c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 11
  • 12. Google looks to ditch passwords for good ”Google is currently running a pilot that uses a YubiKey cryptographic card developed by Yubico The YubiKey NEO can be tapped on an NFC-enabled smartphone, which reads an encrypted one-time password emitted from the key fob.” Source: http://www.zdnet.com/google-looks-to-ditch-passwords-for-good-with-nfc-based-replacement c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 12
  • 13. Yubico Yubikey A Yubico OTP is unique sequence of characters generated every time the YubiKey button is touched. The Yubico OTP is comprised of a sequence of 32 Modhex characters representing information encrypted with a 128 bit AES-128 key http://www.yubico.com/products/yubikey-hardware/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 13
  • 15. Low tech 2-step verification Print af koder, low level pragmatisk Login fra nye enheder kræver ekstra sikkerhed google 2-faktor auth. SMS med backup codes Developed at Bellcore in the late 1980s http://en.wikipedia.org/wiki/S/KEY c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 15
  • 16. Er dine data sikre Lorem ipsum dolor sit amet, consectetur adipiscing elit, set eiusmod tempor incidunt et labore et dolore magna aliquam. Ut enim ad minim veniam, quis nostrud exerc. Irure dolor in reprehend incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse molestaie cillum. Tia non ob ea soluad incommod quae egen ium improb fugiend. Officia deserunt mollit anim id est laborum Et harumd dereud facilis est er expedit distinct. Gothica quam nunc putamus parum claram anteposuerit litterarum formas humanitatis per seacula quarta; modo typi qui nunc nobis videntur parum clari fiant sollemnes in futurum; litterarum formas humanitatis per seacula quarta decima et quinta decima, modo typi qui nunc nobis videntur parum clari fiant sollemnes in futurum, anteposuerit ! Nam liber te conscient to factor tum poen legum odioque civiuda et tam. Neque pecun modut est neque nonor et imper ned libidig met, consectetur adipiscing elit, sed ut labore et dolore magna aliquam is nostrud exercitation ullam mmodo consequet. Duis aute in voluptate velit esse cillum dolore eu fugiat nulla pariatur. At vver eos et accusam dignissum qui blandit est praesent. ˚ Stjalet laptop Cloud services Slettede eller ødelagte data - og hvordan sletter man data? Huskede du mini SD kortet med dine private billeder? c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 16
  • 17. harddisk beskyttelse og data kryptering Kryptering findes i alle de gængse klient operativsystemer • Microsoft Windows Bitlocker - kryptering af disken Ultimate eller Enterprise • Apple Mac OS X - krypterer nemt med FileVault og FileVault2 • FreeBSD GEOM og GBDE - giver mulighed for at kryptere enheder generelt • PGP disk - Pretty Good Privacy - laver en virtuel krypteret disk • ˚ Nogle producenter har kodeord pa disken - IBM harddisk BIOS kodeord c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 17
  • 18. Sikre protokoller som bruger krypto Kryptering af e-mail • Pretty Good Privacy - Phil Zimmermann • PGP = mail sikkerhed Kryptering af sessioner SSL/TLS • Secure Sockets Layer SSL / Transport Layer Services TLS • krypterer data der sendes mellem webservere og klienter • SSL kan bruges generelt til mange typer sessioner, eksempelvis POP3S, IMAPS, SSH m.fl. Kryptering af netværkstrafik - Virtual Private Networks VPN • IPsec IP Security Framework, se ogsa L2TP ˚ • PPTP Point to Point Tunneling Protocol - darlig og usikker, brug den ikke mere! ˚ • OpenVPN m.fl. c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 18
  • 19. Enigmail - GPG plugin til Mail • Enigmail er en udvidelse til • mailklienten i Mozilla/Netscape • standalone mailklienten Thunderbird • Billede fra http://enigmail.mozdev.org c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 19
  • 20. Enigmail - OpenGPG Key Manager Key Manager funktionaliteten i Enigmail kan anbefales c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 20
  • 21. GPGMail plugin til Mac OS X Mail.app • Bruger GPG • kilde: http://www.sente.ch/software/GPGMail/English.lproj/GPGMail.html • Mailserver udvidelser som https://github.com/infertux/zeyple c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 21
  • 22. VPN VPN http://en.wikipedia.org/wiki/Virtual_private_network SSL/TLS VPN - Generelt koncept. Adskillige leverandører: Cisco, Juniper, F5 Big IP ˚ De snakker ikke ret godt sammen pa tværs. Brug IPSec for dette. IPsec er desværre blokeret mange steder og man skal bruge en klient (I praksis bruger SSL VPN ofte en klient, men den downloades fra web) Open source variant: OpenVPN c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 22
  • 23. OpenVPN client OpenVPN GUI - easy to use c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 23
  • 24. Internet sniffing by government Ægypten, Sudan, Tunesien, ... Den der kontrollerer ISPerne kontrollerer trafikken Facebook revolutionerne Blokering er umulig, men det forsøges Spredning af falsk information Diginotar Dutch Certificate Authority Kilde: http://irevolution.net/2011/02/10/facebook-for-repressive-regimes/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 24
  • 25. HTTPS Everywhere HTTPS Everywhere is a Firefox extension produced as a collaboration between The Tor Project and the Electronic Frontier Foundation. It encrypts your commu- nications with a number of major websites. http://www.eff.org/https-everywhere c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 25
  • 26. CertPatrol - which site uses which certificate An add-on formerly considered paranoid: CertPatrol implements ”pinning” for Firefox/Mozilla/SeaMonkey roughly as now recommended in the User Interface Guidelines of the World Wide Web Consortium (W3C). http://patrol.psyced.org/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 26
  • 27. Convergence - who do you trust http://convergence.io/ Warning: radical change to how certificates work c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 27
  • 28. Client side: Flash, PDF, Facebook Kan vi undvære Java, Flash og PDF? Kilde: http://en.wikipedia.org/wiki/Drive-by_download c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 28
  • 29. Flash blockers Safari http://clicktoflash.com/ Firefox Extension Flashblock Chrome extension called FlashBlock Internet Explorer 8: IE has the Flash block functionality built-in so you don’t need to install any additional plugins to be able to block flash on IE 8. FlashBlock for Opera 9 - bruger nogen Opera mere? FlashBlockere til iPad? iPhone? Android? - hvorfor er det ikke default? c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 29
  • 30. Tor project https://www.torproject.org/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 30
  • 31. Tor project - how it works 1 pictures from https://www.torproject.org/about/overview.html.en c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 31
  • 32. Tor project - how it works 2 pictures from https://www.torproject.org/about/overview.html.en c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 32
  • 33. Tor project - how it works 3 pictures from https://www.torproject.org/about/overview.html.en c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 33
  • 34. Hvordan bliver du sikker Lad være med at bruge een computer til alt ˚ Forskellige computere til forskellige formal, webserver vs mailserver Brug en sikker konfiguration, minimumskonfiguration Brug sikre protokoller, kryptering, evt. TOR Opsætning af netværk, hvordan? Security Configuration Guides + paranoia • http://csrc.nist.gov/publications/PubsSPs.html • http://www.nsa.gov/research/publications/index.shtml • http://www.nsa.gov/ia/guidance/security_configuration_guides/index.shtml c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 34
  • 35. Følg med Twitter news Twitter has become an important new resource for lots of stuff Twitter has replaced RSS for me c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 35
  • 36. Følg med Twitter news ˚ Exploits og nye sarbarheder c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 36
  • 37. Checklisten • BIOS kodeord, pin-kode til telefon • Firewall - specielt pa laptops ˚ • Installer anti-virus og anti-spyware hvis det er pa Windows ˚ • Brug to browsere med forskellige indstillinger • Brug evt. PGP til mailkryptering • Brug Password Safe, Keychain Access (OSX) eller tilsvarende • Overvej at bruge harddisk eller filkryptering • Opdatere alle programmer jævnligt • Backup af vigtige data - harddiske i bærbare kan ogsa dø ˚ • Husk: sikker sletning af harddiske, medier osv. c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 37
  • 38. Afbalanceret sikkerhed god sikkerhed dårlig sikkerhed Sikkerheds niveau Prod Test Dev Mail Web Prod Test Dev Mail Web Det er bedre at have et ensartet niveau Hvor rammer angreb hvis du har Fort Knox et sted og kaos andre steder Hackere vælger ikke med vilje den sværeste vej ind c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 38
  • 39. Part II c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 39
  • 40. Fri adgang til hackerværktøjer I 1993 skrev Dan Farmer og Wietse Venema artiklen Improving the Security of Your Site by Breaking Into it I 1995 udgav de softwarepakken SATAN Security Administrator Tool for Analyzing Networks We realize that SATAN is a two-edged sword - like many tools, it can be used for good and for evil purposes. We also realize that intruders (including wannabees) have much more capable (read intrusive) tools than offered with SATAN. Se http://sectools.org og http://www.packetstormsecurity.org/ Kilde: http://www.fish2.com/security/admin-guide-to-cracking.html c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 40
  • 41. Pentest in the news c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 41
  • 42. Attack overview http://www.sicherheitstacho.eu/?lang=en c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 42
  • 43. Carna Botnet Internet Census 2012 Port scanning /0 using insecure embedded devices Abstract While playing around with the Nmap Scripting Engine (NSE) we discov- ered an amazing number of open embedded devices on the Internet. Many of them are based on Linux and allow login to standard BusyBox with empty or de- fault credentials. We used these devices to build a distributed port scanner to scan all IPv4 addresses. These scans include service probes for the most com- mon ports, ICMP ping, reverse DNS and SYN scans. We analyzed some of the data to get an estimation of the IP address usage. Additionally, with one hundred thousand devices scanning at ten probes per sec- ond we would have a distributed port scanner to port scan the entire IPv4 Internet within one hour. Source: http://internetcensus2012.bitbucket.org/paper.html http://www.theregister.co.uk/2013/03/19/carna_botnet_ipv4_internet_map/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 43
  • 44. Shodan dark google http://www.shodanhq.com/search?q=Photosmart c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 44
  • 45. Cisco IOS password Title: Cisco’s new password hashing scheme easily cracked Description: In an astonishing decision that has left crytographic experts scratch- ing their heads, engineer’s for Cisco’s IOS operating system chose to switch to a one-time SHA256 encoding - without salt - for storing passwords on the device. This decision leaves password hashes vulnerable to high-speed cracking - mod- ern graphics cards can compute over 2 billion SHA256 hashes in a second - and is actually considerably less secure than Cisco’s previous implementa- tion. As users cannot downgrade their version of IOS without a complete reinstall, and no fix is yet available, security experts are urging users to avoid upgrades to IOS version 15 at this time. Reference: via SANS @RISK newsletter http://arstechnica.com/security/2013/03/cisco-switches-to-weaker-h c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 45
  • 46. Kali Linux the new backtrack BackTrack http://www.backtrack-linux.org Kali http://www.kali.org/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 46
  • 47. it’s a Unix system, I know this Skal du igang med sikkerhed? Installer et netværk, evt. bare en VMware, Virtualbox, Parallels, Xen, GNS3, ... Brug BackTrack, se evt. youtube videoer om programmerne Quote fra Jurassic Park http://www.youtube.com/watch?v=dFUlAQZB9Ng c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 47
  • 48. Hackerværktøjer • Nmap, Nping - tester porte, godt til firewall admins http://nmap.org • Aircrack-ng http://www.aircrack-ng.org/ • Wireshark netværkssniffer - http://http://www.wireshark.org/ • Burpsuite http://portswigger.net/burp/ • Skipfish http://code.google.com/p/skipfish/ ˚ Generelt findes der hackerværktøjer indenfor alle nicheomrader! Listen over de mest anvendte hacker tools http://sectools.org/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 48
  • 49. Metasploit and Armitage Still rocking the internet http://www.metasploit.com/ Armitage GUI fast and easy hacking for Metasploit http://www.fastandeasyhacking.com/ Kursus Metasploit Unleashed http://www.offensive-security.com/metasploit-unleashed/Main_Page Bog: Metasploit: The Penetration Tester’s Guide, No Starch Press ISBN-10: 159327288X c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 49
  • 50. Demo, snak, visning, surfing hackertools, step by step instruktioner, Kali Linux demo osv. c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 50
  • 51. Security Onion securityonion.blogspot.dk c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 51
  • 52. BRO IDS While focusing on network security monitoring, Bro provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Bro has successfully bridged the traditional gap be- tween academia and operations since its inception. http://www.bro.org/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 52
  • 53. BRO more than an IDS The key point that helped me understand was the explanation that Bro is a domain-specific language for networking applications and that Bro-IDS (http://bro- ids.org/) is an application written with Bro. Why I think you should try Bro https://isc.sans.edu/diary.html?storyid=15259 c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 53
  • 54. Bro scripts global dns_A_reply_count=0; global dns_AAAA_reply_count=0; ... event dns_A_reply(c: connection, msg: dns_msg, ans: dns_answer, a: addr) { ++dns_A_reply_count; } event dns_AAAA_reply(c: connection, msg: dns_msg, ans: dns_answer, a: addr) { ++dns_AAAA_reply_count; } source: dns-fire-count.bro from https://github.com/LiamRandall/bro-scripts/tree/master/fire-script c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 54
  • 55. ˚ Be careful - spørgsmal? Hey, Lets be careful out there! Henrik Lund Kramshøj, internet samurai hlk@solido.net Billede: Michael Conrad http://www.hillstreetblues.tv/ c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 55
  • 56. VikingScan.org - free portscanning c license CC BY 3.0. 2013 Solido Networks, Henrik Lund Kramshøj 56