Anatomy of a Hack - Revision history

Kevin.Williams at 22:41, 11 April 2014

2014-04-11T22:41:13Z

K7aay at 22:44, 4 April 2014

2014-04-04T22:44:36Z

K7aay: Add Categories reference at end

2013-08-29T19:54:58Z

Add Categories reference at end

K7aay: /* Lessons Learned */

2013-08-26T18:29:49Z

Lessons Learned

K7aay: /* Aftermath */ reorganized

2013-08-26T18:28:38Z

Aftermath: reorganized

K7aay: /* Anatomy of a Hack: */ Add reference to Mozilla Method for password creation

2013-08-26T18:25:15Z

Anatomy of a Hack:: Add reference to Mozilla Method for password creation

K7aay: /* Anatomy of a Hack: */ grammar fixes

2013-08-24T18:06:03Z

Anatomy of a Hack:: grammar fixes

Dheiber: /* Lessons Learned */

2012-12-28T23:57:53Z

Lessons Learned

GregTraylor at 22:13, 20 September 2012

2012-09-20T22:13:41Z

GregTraylor: /* Anatomy of a Hack: */

2012-09-20T21:36:13Z

Anatomy of a Hack:

← Older revision		Revision as of 22:41, 11 April 2014
Line 1:		Line 1:
−	{{~~migrate~~}}	+	{{migrated}}
		+	[https://docs.google.com/a/freegeek.org/document/d/1n0FMCL1aRY74Nq_3vxo2u7Luwvan5H8I82Y5uUGEPcw/edit?usp=sharing Link]

	== Anatomy of a Hack: ==		== Anatomy of a Hack: ==

← Older revision		Revision as of 22:44, 4 April 2014
Line 1:		Line 1:
		+	{{migrate}}
		+
	== Anatomy of a Hack: ==		== Anatomy of a Hack: ==

← Older revision		Revision as of 19:54, 29 August 2013
Line 208:		Line 208:
	* No matter how smart you are, you can be socially engineered		* No matter how smart you are, you can be socially engineered
	* Even if you are perfect, those around you are not		* Even if you are perfect, those around you are not
		+
		+	[[Category: Classes]]
		+	[[Category: Current Classes]]

@@ Line 117: / Line 117: @@
 * Follow best security practices:  This could apply to most of these mistakes in this example.  By not salting their MD5 hash, they left their user info open to attacks by Rainbow Tables which has been around since 1980 and for which software is commonly available.
 * Apply all the latest updates, especially security ones.  If the servers had been patched for a widely known vulnerability, the attack could have been stopped.
-* Best password practicesL
+* Best password practices:
 ** Use long passwords with both upper and lower-case characters plus numbers and non-alpha-numerical characters if possible.
 ** NEVER use a common word or password as those are very easily broken with dictionary attacks.
@@ Line 123: / Line 123: @@
 ** See the [http://www.labnol.org/internet/different-passwords-for-websites/17961/ Mozilla method] for password creation.
 * People with more power should have stronger passwords for security not weaker passwords for ease of use because they can object.
-* NEVER re-use passwords.  Firewall identities.  Aaron Barr used the same password for many sites, including his personal social media sites, email, internal and external servers and personal iPad.  Namechk.com
+* Firewall identities.  Aaron Barr used the same password for many sites, including his personal social media sites, email, internal and external servers and personal iPad.  [Namechk.com] makes it easy to find the reuse of usernames across sites.
 * Social engineering.  The hardest to defend against and probably the most common hacking tools.  In this case, a sense of urgency was used but they usually appeal to sexuality, greed or the human want/need to help.  It is much easier to get information from a human than to hack a computer.  Social engineering takes place in most hacking in some form.
 ** [http://en.wikipedia.org/wiki/Bradley_Manning PFC Manning] incident

@@ Line 102: / Line 102: @@
 ** Spying on union organizations for the US Chamber of Commerce
 ** Had plans to plant fake insiders within those organizations and then have them do something stupid to discredit the unions
-** Planned to create derisive 'humor pieces' on the US Chamber Watch which monitored the USCoC activities
+** Planned to create discrediting over-the-top 'humor pieces' on the US Chamber Watch,, the group monitoring USCoC activities.
-** Barr planned to release what he told was flawed information for millions of dollars, information he knew could or would get innocent people arrested
+** Barr planned to release what he told was flawed information for millions of dollars, information he knew could or would get innocent people arrested.
-** They were working on a presentation for Bank of America who wanted Wikileaks taken down.  What they were proposing was mostly illegal.  It included numerous cyber-attacks, creating internal strife within the funders of Wikileaks, spreading disinformation and a concerted media campaign to smear Julian Assange.  They intended to disrupt all payments to the site and make it impossible to have further submissions.  They also were in the process of creating unlicensed Windows games to release into the wild on Asian sites.  These games contained backdoors from which they could launch attacks.
+** They were working on a presentation for Bank of America who wanted Wikileaks taken down.  What they were proposing was mostly illegal.  It included numerous cyber-attacks, creating internal strife within the funders of Wikileaks, spreading disinformation and a concerted media campaign to smear Julian Assange.  They intended to disrupt all payments to the site and make it impossible to have further submissions.
 ** They planned to put pressure on civil liberties lawyers to make them fearful for their jobs and unwilling to offer more support or open criticism.
 ** Everyone distanced themselves from Barr and HBGary.
 ** Barr resigned in disgrace
 ** HBGary's potential company sale and work disappeared and they went under.
 ==== Lessons Learned ====

@@ Line 4: / Line 4: @@
 '''Hypothetical situations:'''
-* An email arrives from iTunes which says they have determined that your credit card number is fraudulent.  The email links to a website to go to, to fill out the correct credit card information.  It reads in part:
+* An email arrives from iTunes. It  says they found that your credit card number is bad.  The email links to a website to go to, to fill out the correct credit card information.  It reads in part:
   Please click the following link to update your credit card information
@@ Line 117: / Line 117: @@
 * Follow best security practices:  This could apply to most of these mistakes in this example.  By not salting their MD5 hash, they left their user info open to attacks by Rainbow Tables which has been around since 1980 and for which software is commonly available.
 * Apply all the latest updates, especially security ones.  If the servers had been patched for a widely known vulnerability, the attack could have been stopped.
-* Best password practices.  Length, upper and lower-case, numbers, non-alpha-numerical characters if possible.  NEVER a common word or password and dictionary attacks.
+* Best password practicesL
 * People with more power should have stronger passwords for security not weaker passwords for ease of use because they can object.
 * NEVER re-use passwords.  Firewall identities.  Aaron Barr used the same password for many sites, including his personal social media sites, email, internal and external servers and personal iPad.  Namechk.com
 * Social engineering.  The hardest to defend against and probably the most common hacking tools.  In this case, a sense of urgency was used but they usually appeal to sexuality, greed or the human want/need to help.  It is much easier to get information from a human than to hack a computer.  Social engineering takes place in most hacking in some form.
-** [http://en.wikipedia.org/wiki/Bradley_Manning Bradley Manning] incident
+** [http://en.wikipedia.org/wiki/Bradley_Manning PFC Manning] incident
-*** Manning exfiltrated classified information and gave it to reporters and Wikileaks.  Some of this information was comprised of sensitive diplomatic cables, video of American troops killing reporters, etc.  He used a CD-RW which he labeled ''Lady Gaga'' to get the information out.  Manning would simply knock on the door to the secure area and ask to listen to his CD.  He would lip-sync to songs that were not playing while in actuality he was downloading secrets onto the ''Lady Gaga'' CD.
+*** Manning exfiltrated classified information and gave it to reporters and Wikileaks.  Data included sensitive diplomatic cables, video of American troops killing reporters, as well as operationally secret military data.  Manning used a CD-RW labeled as ''Lady Gaga'' to get the information out.  Manning would simply knock on the door to the secure area and ask to listen to his CD.  He would lip-sync to songs that were not playing while in actuality secrets were copied to the ''Lady Gaga'' CD.
-*** This was not a technical hack but a human hack.  The use of technology was no more than inserting a CD and downloading information.  He played on their trust and used acting to continue the trust.
+*** This was not a technical hack but a human hack.  The use of technology was no more than inserting a CD and downloading information.  Manning played on their trust and used acting to continue the trust.
 ** Social engineering in email
 *** Phishing emails use things like fear of having your account terminated, getting in trouble for using a "bogus" credit card, fear that your bank account might have been compromised,etc.

@@ Line 4: / Line 4: @@
 '''Hypothetical situations:'''
-* iTunes says that they have determined that your credit card number is fraudulent.  They give you a website to go to to fill out the correct credit card information.  The email reads in part
+* An email arrives from iTunes which says they have determined that your credit card number is fraudulent.  The email links to a website to go to, to fill out the correct credit card information.  It reads in part:
   Please click the following link to update your credit card information
   and prevent disruption to your service. [http://sxserver.ru/credit.php www.itunes.com]
-* Call from IT support at work:  Sam, the head of IT calls to ask for your password so that he can fix you computer
+* You receive a phone call:  Sam, the head of IT, calls to ask for your password so that he can fix your computer.
-* Email from a long lost cousins:  A cousin you don't remember asks for your siblings' email and address.
+* An instant message comes in from a long lost cousin you don't recall, asking for your siblings' email and address.
@@ Line 17: / Line 17: @@
 === HBGary ===
-The story:
+The players:
-[http://en.wikipedia.org/wiki/Anonymous_%28group%29 Anonymous] is a group of hacktivists who are responsible for actions that could be considered either good, bad or both.  Many of their actions are illegal.   [http://en.wikipedia.org/wiki/HBGary HBGary] was a technology security company which sold it's products to the US Federal Government (including the Department of Defense), information assurance companies, computer emergency response teams and computer forensic investigators.  CEO Aaron Barr developed a technique which he thought would unmask the leaders of Anonymous using the timing of Anonymous IRC rooms matched up with social media posts though his lead programmer criticized his methodology.  His intention was to sell the list to the FBI and other law enforcement agencies.  When the Financial Times ran a story on this, Anonymous members attacked within 24 hours.
+[http://en.wikipedia.org/wiki/Anonymous_%28group%29 Anonymous] is a group of hacktivists who are responsible for actions that could be considered either good, bad or both.  Some of their actions are illegal.
 ==== Chronology of the attack: ====
 ===== [http://en.wikipedia.org/wiki/SQL_injection SQL INJECTION] =====
-SQL injection is a method of attack via entering portions of SQL statements into web form fields.  If the website is vulnerable, the SQL can send statements to the database and get it to dump out users, passwords, credit card numbers and other information.
+SQL injection is an old method of attack via entering portions of SQL statements into web form fields.  If the website is vulnerable, the SQL can send statements to the database and get it to dump out users, passwords, credit card numbers and other information.
 * A [http://en.wikipedia.org/wiki/Content_management_system Content Management System(CMS)] is a system that allows for creating, editing and publishing content without a need for programming or in-depth knowledge
 ** Wordpress, etc
-* No CMS is 100% safe but in this case a custom CMS was used which had gaping security holes in it, leaving it open to SQL injection attacks.  If they'd used an off-the-shelf product, there could be thousands of users and bug reports.  This custom CMS had no one reviewing it and fixing problems.
+* HBGary used a custom CMS on their site
 * SQL injection is a technique often used to attack databases through a website. This is done by including portions of SQL statements in a web form entry field in an attempt to get the website to pass a newly formed rogue SQL command to the database (e.g. dump the database contents to the attacker).  http://en.wikipedia.org/wiki/SQL_injection
-* This exploits were used to dump the table of usernames and passwords out of the website.
+* This exploit was used to dump the table of usernames and passwords out of the website.
 * A plaintext password would appear as '''password'''
-* These were encrypted using [http://en.wikipedia.org/wiki/Md5 MD5], but because these were not [http://en.wikipedia.org/wiki/Salt_%28cryptography%29 salted] a [http://en.wikipedia.org/wiki/Rainbow_table rainbow table] could reverse the encryption
+* Passwords were encrypted using [http://en.wikipedia.org/wiki/Md5 MD5], but because these were not [http://en.wikipedia.org/wiki/Salt_%28cryptography%29 salted] a [http://en.wikipedia.org/wiki/Rainbow_table rainbow table] could reverse the encryption
-** MD5 is cryptographic hash function
+** MD5 is a cryptographic hash function
 *** Imagine taking something that makes '''password''' into '''qbttxpse'''
 *** This they did right

@@ Line 125: / Line 125: @@
 *** Spam emails often play on your sexuality (porn, dating), greed (Get rich quick), or fears (Viagra, Rogaine, breast enhancement, weight loss)
 ** What Social Engineering looks like
-*** It doesn't and that's the point.  It comes at you sideways smiling.  It can be the person
+*** It doesn't and that's the point.  It comes at you sideways smiling.
 === Hacking Facebook ===

@@ Line 24: / Line 24: @@
 ===== [http://en.wikipedia.org/wiki/SQL_injection SQL INJECTION] =====
 * HBGary used a custom CMS on their site
@@ Line 43: / Line 44: @@
 ===== [http://en.wikipedia.org/wiki/Root_access ROOT ACCESS] =====
 * Using the now-cracked passwords, the attackers were able to gain non-root access the server support.hbgary.com
@@ Line 59: / Line 61: @@
 ===== [http://en.wikipedia.org/wiki/Social_engineering_%28security%29 SOCIAL ENGINEERING] =====
 * At this point, Anonymous has access to most of the communications within HBGary.  They know that Greg Hoglund is in Europe, two possible passwords to the server root and his security person from Nokia and contact info.
@@ Line 82: / Line 85: @@
   if anything just reset my password to changeme123 and give me public
   ip and ill ssh in and reset my pw.
-*  Once they had root access to that server they obtained further information and cracked all the poorly guarded username/password combinations again.
+*  Once they had root access to that server they obtained further information and cracked all the poorly guarded username/password combinations again.  Jussi had little reason to think he was not dealing with Greg Hoglund.  The email came from Greg's account, he knew 2 of the passwords - still, Jussi might have thought to verify but the social want to help and the fact that "Greg" was in a hurry rushed him into doing it without checking.
 ==== Aftermath ====
@@ Line 113: / Line 116: @@
 * People with more power should have stronger passwords for security not weaker passwords for ease of use because they can object.
 * NEVER re-use passwords.  Firewall identities.  Aaron Barr used the same password for many sites, including his personal social media sites, email, internal and external servers and personal iPad.  Namechk.com
-* Social engineering.  The hardest to defend against and probably the most common hacking tools.  In this case, a sense of urgency was used but they usually appeal to sexuality, greed or the human want/need to help.  They could have had an agreed upon password or phrase not
+* Social engineering.  The hardest to defend against and probably the most common hacking tools.  In this case, a sense of urgency was used but they usually appeal to sexuality, greed or the human want/need to help.  It is much easier to get information from a human than to hack a computer.  Social engineering takes place in most hacking in some form.
 ** [http://en.wikipedia.org/wiki/Bradley_Manning Bradley Manning] incident
-*** Manning exfiltrated classified information and gave it to reporters and Wikileaks.  Some of this information was comprised of sensitive diplomatic cables, video of American troops killing reporters, etc.  He used a CD-RW which he labeled ''Lady Gaga'' to get the information out.  Manning would simply knock on the door to the secure area and ask to listen to his CD.  He would lip-sync to songs that were not playing while in actuality he was downloading secrets onto the ''Lady Gaga'' CD
+*** Manning exfiltrated classified information and gave it to reporters and Wikileaks.  Some of this information was comprised of sensitive diplomatic cables, video of American troops killing reporters, etc.  He used a CD-RW which he labeled ''Lady Gaga'' to get the information out.  Manning would simply knock on the door to the secure area and ask to listen to his CD.  He would lip-sync to songs that were not playing while in actuality he was downloading secrets onto the ''Lady Gaga'' CD.
@@ Line 121: / Line 133: @@
 === Hacking Facebook ===
-	The story:  A friend and are both interested in computer security.  We were talking about hacking facebook accounts and he gave me permission to try to get into his
 At that time, Facebook had a web page where you could reset the password if your email associated with your Facebook account had been compromised and you could no longer access it.
@@ Line 133: / Line 146: @@
 I was to assume that all I knew was his full name and city he resided in.
 I logged out of Facebook and cleared my cache.  I logged back into the password reset page and:
-* Gave them my email address.  In real life I would have created a throwaway through proxies.
+* Gave them my email address created just for this.  In real life I would have created a throwaway account through [http://en.wikipedia.org/wiki/Proxy_server proxies].
-* I was able to find his email address because someone other than himself had posted it.  I looked up his name and city and found a listing for a hobby group he was the leader for. Someone asked for information and a 3rd party listed his email.
+* I was able to find his email address because someone other than himself had posted it.  I looked up his name and city and found a listing for a hobby group he was the leader for. Someone asked for information and a 3rd party listed his email for them.
-* I had his name to start with but was able to access available information to get a middle name and was prepared with variations on his name if I did not immediately succeed.
+* Using the username portion of his email “username@email.com”, I was able to take the standard Facebook format for user profiles and add his username (http://www.facebook.com/username).  I confirmed this was him and now had the correct web address.
-* I could not get the DOB on any of the public info sites.  He was raised out of the US
+* I had his name to start with but was able to access available information to get a middle name and was prepared with variations on his name if I did not immediately succeed with that question.
-* Using the username portion of his email “username@email.com”, I was able to take the standard format profiles and add his username where mine was.  I confirmed this was him and now hat the correct web address.
-At this point, I could not get the DOB.  I looked at publicly available information as to where my friend had lived in the US.  I started searching for his name in conjunction with these cities.  I found a city on the east coast where he'd had another public group he was involved with.
+==== SOCIAL ENGINEERING ====
-I then started looking at relatives and the places they had lived.  I searched for their names and cities listed.  I found a listing for his dad being involved with a volunteer organization.  There was no information listed for contact.  I read a newsletter stating his involvement with a certain individual in this organization.  Posing as a relative of this individual, I contacted the organization and asked for his contact information.  Because I knew his name and some information they probably considered private, they gave me his personal email address.  I emailed him stating that I was a friend from that east coast city and knew him through that public group.  I said I had a really nice gift for him but had forgotten his birthday.  I was so embarrassed because we were good friends and would he please not tell my friend that I'd forgotten his birthday.  The last piece of the puzzle was had.
+I read a newsletter stating his involvement with a certain individual in this organization.  Posing as a relative of this individual, I contacted the organization via phone and asked for his contact information.  Because I knew his name and some information they probably considered private, they gave me his personal email address.  I emailed him stating that I was a friend from that east coast city and knew him through that public group.  I said I had a really nice gift for him but had forgotten his birthday.  I was so embarrassed because we were good friends and would he please not tell my friend that I'd forgotten his birthday.  The last piece of the puzzle was had.
 LESSONS

@@ Line 11: / Line 11: @@
 * Call from IT support at work:  Sam, the head of IT calls to ask for your password so that he can fix you computer
-* Email from a long lost cousins:  A cousin you don't remember asks for you siblings email and address.
+* Email from a long lost cousins:  A cousin you don't remember asks for your siblings' email and address.
@@ Line 21: / Line 21: @@
 [http://en.wikipedia.org/wiki/Anonymous_%28group%29 Anonymous] is a group of hacktivists who are responsible for actions that could be considered either good, bad or both.  Many of their actions are illegal.   [http://en.wikipedia.org/wiki/HBGary HBGary] was a technology security company which sold it's products to the US Federal Government (including the Department of Defense), information assurance companies, computer emergency response teams and computer forensic investigators.  CEO Aaron Barr developed a technique which he thought would unmask the leaders of Anonymous using the timing of Anonymous IRC rooms matched up with social media posts though his lead programmer criticized his methodology.  His intention was to sell the list to the FBI and other law enforcement agencies.  When the Financial Times ran a story on this, Anonymous members attacked within 24 hours.
-Chronology of the attack:
+==== Chronology of the attack: ====
-[http://en.wikipedia.org/wiki/SQL_injection SQL INJECTION]
+===== [http://en.wikipedia.org/wiki/SQL_injection SQL INJECTION] =====
 * HBGary used a custom CMS on their site
@@ Line 42: / Line 42: @@
 * Passwords and usernames were gotten
-[http://en.wikipedia.org/wiki/Root_access ROOT ACCESS]
+===== [http://en.wikipedia.org/wiki/Root_access ROOT ACCESS] =====
 * Using the now-cracked passwords, the attackers were able to gain non-root access the server support.hbgary.com
@@ Line 48: / Line 48: @@
 * Using a known exploit for which the server had not been patched, they were able to take root access and removed gigabytes of information
-PASSWORD REUSE
+===== PASSWORD REUSE =====
 * Among others, high-level employees including the CEO and COO were gotten
@@ Line 58: / Line 58: @@
 * Through reading his emails they found out that he and a Nokia employee had SSH access to a server (rootkit.com) as well as possible root passwords for that server.
-[http://en.wikipedia.org/wiki/Social_engineering_%28security%29 SOCIAL ENGINEERING]
+===== [http://en.wikipedia.org/wiki/Social_engineering_%28security%29 SOCIAL ENGINEERING] =====
 * At this point, Anonymous has access to most of the communications within HBGary.  They know that Greg Hoglund is in Europe, two possible passwords to the server root and his security person from Nokia and contact info.
@@ Line 84: / Line 84: @@
 *  Once they had root access to that server they obtained further information and cracked all the poorly guarded username/password combinations again.
-AFTERMATH
+==== Aftermath ====
 * Aaron Barr tried to negotiate with Anonymous.  He lied to them repeatedly, not realizing they had all his emails and knew the truth.
 * Over 40,000 internal emails, many of them containing very sensitive information, were posted to the Pirate Bay
@@ Line 106: / Line 106: @@
-LESSONS LEARNED
+==== Lessons Learned ====
 * Use tried and tested software.  A custom CMS allowed the SQL injection that started this ball rolling.  Anything on the web with public access should be secured in the stronges manner in every way possible
 * Follow best security practices:  This could apply to most of these mistakes in this example.  By not salting their MD5 hash, they left their user info open to attacks by Rainbow Tables which has been around since 1980 and for which software is commonly available.