Meeting Minutes for Wednesday February 22, 2006

The minutes have been posted at:
http://www.morlug.org/index.php/Feb_22%2C_2006

Security
presented by Matt Harris

Question: What can get your box compromised?
Answer  : Things running on your box.

 Look for things in your system processes via internet sockets.

Commands to list network connections:
netstat -a = list open sockets

lsof = list of open files      lsof | grep IPv4
    lsof | grep {UDP,TCP}

gives you the pid so you can kill -9 it.

Port Scanning:
For system scanning     nmap -n -vvv

    commands  query
   nmap -sT  TCP SYN
   nmap -sU  UDP
   nmap -sO  IP protocol scan
   nmap -sP  ICMP
   nmap -sA  ACK packet to specific TCP port for the scan
   nmap -sX  FIN packet with an URG and PUSH flags on the tcp packet.
   nmap -sF  FIN
   nmap -sV  Probe open ports to determine service/version info
   nmap -O   Enable OS detection
   nmap -S/e Spoof source address/Use specified interface <iface>
   nmap -T Paranoid|Polite|Normal|Aggresive|Insane

 ACK scan will determine.  Stateful Firewall
IP Filter

Processes and Permissions:
What processes can write data where on the system? physical memory or
swap space

/tmp /var/tmp

webscripts run as unpriveledged httpd users

Client H4X0R -->  HOST  <-- Client Bob Smith  Is accessing PHP script
A via Apache via your Host.
H4X0R client injects data to /tmp/x as a process.
An array of processes can be accessed from this process... MySQL, LDAP..etc.
./x will try for rootkit.

A result of the script compromise is access to the Kernel and every SETUID
The ping command opens a raw socket so it can send ICMP echo packets.

Review:
Be careful of:  Setuid (FS)
root UNIX Domain socket
Shared memory
Semaphores

Use the find command to find any files with root level access.

Make use of encrypted methods of sending data over a network.. i.e. ssh
  You
  Router
  Firewall
  IDS / IPS  (Intrusion Detection System)

Inline Snort is a good way to setup passive/active prevention systems.

Proxies:
hax0r --> {romania} --> {korea} -->  {wvu proxies} --> hacks a good server.

Forensics:
When you believe you have been compromised.  Preserve chain of evidence.
Run the fsync command and yank the cord.
Take the disks out and do a dd on the disk to create an image
Present the disks to law enforcement.
You can keep the image to figure out why the box was compromised.

When you have been compromised.  Fill out a PMA/RCA for the authorities.
You'll want to review all logs on the systems.
Look for any processes that dies with signal 10 or 11 as buffer overflows.

Important to preserve the data and keep the physical disks for
personal analysis.

Steganography:
For more information on this subject visit:
 http://icmpchat.sourceforge.net/


Programming front:
kernels are written in C.

Buffer overflows:  x = malloc(10);
sprintf(x, stuff);
*snprintf(x,10,stuff) an alternative.
memset(x,'/000', 10)

HELO "AXAXAXAXAX"A in result buffer overflow.

Find out what a process is doing on your system.  strace gives you
system calls i.e. read() write()

 gdb - GNU Project Debugger
allows you to see what is going on `inside' another program while it executes

What you need to know:
Security Focus mailing list.  bug traq

CERT  FedCIRC

CISSP related study material SCP related for security.

--
Perriero, Derek
[email protected]