Security Archives - School for Hackers

May 10, 2018May 13, 2018

Review: EC-Council’s iLabs Platform

I’ve been trying to bring “hacker” training to UNM for over ten years without much success. Only in the past two semesters have I been able to run an Ethical Hacking class based on the CEH, but where my past efforts didn’t bring students, the CEH did.

Red Team work has long interested me, likely because years of managing high-traffic websites left me with lots of scars and an urge to fight back. There are some interesting programs: the OSCP, GIAC certifications, and the CEH probably make up the short list. I’m highly interested in the GIAC certs, but man are they expensive. The OSCP from Offensive Security is the real hardcore hacker’s cert, even if most HR people haven’t figured that out yet. The CEH, on the other hand, is widely recognized by HR but doesn’t enjoy quite the same purists’ esteem.

So I approached Jay Bavisi online, and he connected me with ECC VP Eric Lopez and ECC University VP David Oxenhandler. Eric and David met with me to talk about marketing ECC courses and materials to UNM administration, and gave me a stack of books two feet high – and an account on ECC’s online training platform, iLabs 2.0. I’ll have more to say about specific books and certs, but here I’m going to talk about iLabs itself.

By now almost every teacher has dealt with a few learning management systems (LMSs). My list includes build-it-yourself platforms like Blackboard, Moodle and WordPress LMS; ready-to-go courses on sites like Udemy and Coursera; and some great pre-built platforms for building tests and courses like Mettl and Braincert. They all have a lot in common in terms of features and interfaces: videos or scenarios to play, guided exercises, mostly textual interactions (if any) with the instructor and other students.

I’ve also been spending a lot of time on hacking sites like root-me.org and HacktheBox, which are very different from the LMSs. The best of them fire up virtual machines for students to practice on, which is a lot more realistic than the guided walk-throughs most LMSs offer.

iLabs merges these two models. ECC has given me permission to share screenshots from that environment, so let’s do a walkthrough, starting from the login page.

I received a welcome email with instructions on setting up my account and using an Access Key to start running the course materials. My key got me into the CEHv9 course. Remember that the CEH is transitioning to version 10, so there will be some differences in the newer version.

From here I had four tabs to choose from: My Training (the current screen), My Transcript, Courses and Contact.

My Transcript showed that at the moment, I had basically completed no training (at least on this platform). No surprise. I can see this being useful once I’ve studied a few more certs.

The Courses tab takes us to a Course Catalog that will immediately made my mouth water: Advanced Penetration Testing, Incident Handler, Forensics Investigator. It’s a lineup that’s grown dramatically, and seems aimed directly at GIAC. Yes, I tried getting into other courses (hacker!) and that wasn’t possible, at least without making myself a nuisance instead of a guest. But now I have an appetite for more.

Going back to the Courses tab, I clicked on the Certified Ethical Hacker – CEH v9 link, and arrived at the summary page for the program.

These are the familiar sections of the CEHv9 training. Clicking the Launch button takes us to a preliminary test of our system, then lets us launch the actual test lab. Clicking the button opens a new window while our test environment is launched.

Module 1 is all about learning to use the iLabs platform, and provides a walkthrough of the interface’s features. It’s an information-intensive environment, so pay close attention at this stage. There are a couple of places on every screen that may offer tips; learning where to look helps a lot once we’re doing active work.

Next, in this and all Modules, comes a couple of screens of information: Objectives and the lesson Scenario.

Clicking through the Information screens takes us to the first virtual machine we’ll use, a Windows Server 2012 instance. Choose the Machines tab and click on Windows Server 2012, if it’s not already selected.

We’ll need to locate the Commands menu at the top of the screen in order to log into the VM. It’s not clearly labeled; look for the lightning bolt at the top of the scroll bar on the right. It pops open a dialog where we can send a Ctrl-Alt-Delete to get a login form.

We’ve got an amusing choice here: use the Commands menu, click Type Text, then click Type Username; or click in the Machines tab on the username; or type it into the form ourselves. Do aspiring hackers really need this much hand-holding? Probably not, but this feature is also likely just an element of the LMS. Choose a method, and enter the username and password.

The next screen comes up every time we open this VM, which is just a result of starting an absolutely fresh installation. Obviously we don’t need to set up the whole server, so simply cancel the dialog.

Notice that the bottom of the VM’s screen is cut off on my 15″ laptop monitor (1366×768). Checking the available resolutions, I found it’s already at its lowest option, 1024×768. While this isn’t a big deal, it is a bit annoying to have to scroll to see everything. I couldn’t find a setting to resize the VM window, but the interface is complex enough that I may have missed it. (Let me know below if you find it.)

Next comes opening Firefox. This requires telling Firefox that we don’t want to update to the latest version. Why? Because the VM is running an older version that supports the outdated Firebug plugin. I expect that the version 10 course will use a newer utility that works in current versions of Firefox (as I mentioned, this is the now-retired version 9).

Note the instructions in the blue box at the bottom of the screen, which direct us to enter the target website’s URL (which is not an actual online domain).

Once we’re on the Moviescope site, open the Firebug console. Firebug, by the way, has since merged into the Firefox Developer Tools. In the lab, some Firebug features won’t work, but clicking through the interface tabs does for the most part. And of course the functions Firebug offered are still available in Firefox, so in real life you don’t have to stick to an old version of the browser.

The instructions steer us to the HTML inspector in Firesheep, and into the scripts present on the page.

Click to expand one of the scripts and it gives up its code.

After taking this quick look at the scripts the lab points out that these visible scripts are ripe for the plucking. Then the Module starts us into another software installation.

The CEH has a heavy concentration in hacking tools, and candidates are expected to be familiar with the functions of quite a few of them. This is where this LMS shines: we get to set up, run and see the output of these tools on a live VM system. When I studied for the CEH, everything I worked with was text and slideshows. I’m a geek and an instructor, so I went out and got, installed and tried out every tool that was mentioned (this took a LONG time), so it’s nice to see that this course puts the tools right in my hands.

Drive E: has a tasty little stash of software we’ll be using. In this case, we’re steered to the Web Data extractor, which we install and run.

“Web Data Extractor Pro is a web scraping tool specifically designed for mass-gathering of various data types. It can harvest URLs, phone and fax numbers, email addresses, as well as meta tag information and body text. Special feature of WDE Pro is custom extraction of structured data.” – http://www.webextractor.com/

Our target web site is small, so the scan completes quickly. When it’s done it lets us know.

Web Data Extractor - scan complete — Web Data Extractor – scan complete

Now we can dig through the results, which are excellent for Reconnaissance-stage hacking: one scan saves us the trouble of digging around for the target’s email addresses, phone numbers etc.

Web Data Extractor - scan results — Web Data Extractor – scan results

After some discussion, we’re led to another installation, this time of the WinHTTrack Website Copier.

iLabs: Installing WinHTTrack Website Copier

“HTTrack … allows you to download a World Wide Web site from the Internet to a local directory, building recursively all directories, getting HTML, images, and other files from the server to your computer. HTTrack arranges the original site’s relative link-structure. Simply open a page of the “mirrored” website in your browser, and you can browse the site from link to link, as if you were viewing it online.” – http://www.httrack.com/

iLabs: Starting WinHTTrack Website Copier

Once we’ve chosen a project name, we can review the configuration.

iLabs: Configuring WinHTTrack Website Copier

So bang, click OK and turn it loose. When it’s done it’s not completely clear what you’re supposed to do. From the Index of Projects page, click on the only one: our Test Project

iLabs: Scan Results WinHTTrack Website Copier

Now we can click through pages and examine code without waiting for the live site to load them for us.

After some discussion and examination, we’re shown out the door to this Module and back to our summary screen: Status Complete. From here we can scroll down and launch Module 2, Scanning Networks. We can’t, however, skip ahead. We’ll have to run the Modules in order. After doing each one, we can go back and review.

This is only the top of the page…

…there are a total of 17 Modules to work through. Most of them run between a half hour and 1.5 hours.

Going forward, we get to use more real VMs, not just Server 2012. Module 2 takes us straight into doing network scans in Kali (oh fun!). We’re not playing with a simulation, either. This is live practice on real machines.

By now it should be pretty clear that I really like the environment. If ECC had built it themselves I’d be amazed, because it’s such a large-scale project. Fortunately they did what any smart IT person does, namely finding the best and latest tech that currently exists. (You don’t try to re-create YouTube when you want to stream videos, do you?)

The ECC iLabs system is an instance of the Learn On Demand Systems (http://www.learnondemandsystems.com/) environment. They bill their product as “Experiential Learning Solutions,” and the name fits. This LMS isn’t just boring slide shows and droning videos; it’s real hands-on practice.

I should point out that iLabs is just one part of an ECC training course. ECC also provides a huge stack of printed material for the CEH and their other courses. But I’ll review that in another article and tie this review up for now.

Let me end by suggesting that this is a whole new game for the Certified Ethical Hacker credential. ECC has put huge work into updating the cert, as I’ve seen from brief looks at v10 materials. And the CEH is the pen testing/auditing cert that’s most recognized, and most requested, by the recruiters who are looking for my students. I feel pretty good about the prospects for bringing this cert to UNM, and attracting both current CS/MIS students and adult professionals. You’ll hear how it works out right here. Good luck!

March 10, 2018

Taking the beta CompTIA Pentester+ Test

Okay: I’m a “trifecta instructor” of some 20 years, plus a stack of certs and degrees, including the CEH. I’m going in to test this morning after a quick review of scripting languages. Currently teaching Net+ and Sec+ so I’m pretty fresh, but have no real idea what to expect. Have you reviewed the Objectives? They’re huge and wildly all over the place … SOAP and REST? Really? I’ll post thoughts after taking the test this morning (3/10).

AFTERWARDS

Oh, am I ever glad I’ve done a lot of coding/scripting, and reviewed my PHP, Python and Ruby before the test. Right off the bat I got a long series of long, detailed scenario and “drag and drop” questions that I let suck up too much time. One involved dragging lines or blocks of code from a random assortment into working locations in a script. Recognizing the language was instantly critical. Another “interactive” section comprised ten questions where I needed to identify one-liner payloads and the right control to block them. Be sure you’re very clear on the different types of SQL injection and XSS. The multiple-choice questions were, for a relief, pretty normal. Some did make clear to me some of the things I’ve never done: creating a sandbox, and setting up persistence on a target once it’s been compromised. I know the CEH pretty well (I’m on the review board), and no it is not particularly similar to this test. The CEH concentrates on higher-level tools, like gui exploit tools and specific-function apps. The Pentest+ seems much more focused on knowing low-level tools like nc and nmap, sometimes deeply into the switches and syntax. Definitely spend time working/playing with these so the long, complex multiple choices don’t become a blur. I got 120 question for my 165 minutes, plus a lengthy pre-test agreement and a fairly quick post-test review, both off the clock. It was a race all the way, especially with the intricately detailed commands to pick in multiple-choice questions. I only finished 105, racing to the end, though since I got so many questions maybe I’ll get some slack for that. 😉 Notably, I did NOT see any policy, risk calculations, subnetting or crypto, and no SOAP or REST. Reading other people’s experiences, though, I’m betting there’s a huge question pool (that will hopefully get trimmed down) and your mileage will likely differ. Do I think I passed? I practically never think so walking out of a test, but I practically always do pass. Is it a good alternative to the CEH? I’d say it’s more similar than different. Both certs are really much more focused on defense than offense. It still looks like the OSCP is the big dog of real pen testing, and that’s okay. We all need ladders with more rungs above us.

September 27, 2017October 11, 2017

Equifax Did Three Simple Things Wrong and Hacked Us All

So Equifax was hacked not once, but twice? No way. I don’t believe it. If you’ve been hacked twice, you’ve been hacked at least 3.6 million times (or pick any other really big number you like). And notification of this new hack, like the last one, came at a languid pace. I’ve gotta give it to Equifax: if I did something like this, anything like this in my own business, I’d quickly go to prison. Their people are just walking out the door.

What irritates the devil out of me is that Equifax took an equally languid attitude toward the security of my personal information by violating three simple tenets of security. I know it’s not easy to manage a corporate network; I’ve been there. But there are fundamental measures anyone with a brain or responsibility has to take in this field, and Equifax outright failed to do these obvious things.

Principle One: Isolation

Not every system needs to touch the internet. Of those that do, none of them should have access to anything but the absolute minimal resources (meaning other systems) they need to do their job. Production networks should always be totally isolated: human resources, accounts payable, management, customer service and every other production operation should be utterly isolated from each other. Even if systems within them are compromised via email or the internet, they should provide no ingress – absolutely none – across functions. Your deepest assets (consumer records would qualify) should be deeply isolated.

“But customer service needs access to records, and so do the customers!”

Yes, and that functionality is still available. You’ll do it via strongly encrypted, strongly authenticated, highly secured connections. In other words, the segregation cannot be simply VLANs on a switch or even casually configured internal routers. No. Every production network should be encapsulated, firewalled, filtered and logged as an independent unit, one that considers itself surrounded by hostile would-be intruders. If I can walk through your DMZ to your online-data network, that’s a problem. But if I can then pivot to other production networks, it’s time for a firing squad.

Principle Two: Patch Management

All the mainstream security firms will hound you about this: stay patched right up to the minute! There is a tiny minority who would dispute this, arguing that proper isolation makes urgent patch management a useless exercise in anxiety. For my money, I’m going to do both (and a lot more).

The likely culprit here was an unpatched Apache Struts installation. Frameworks like Struts are popular with developers but eventually have to be managed by sysadmins, who may not love or follow them as closely. This is where tight collaboration between these teams has to ensure things that need to be patched (which includes practically everything that’s installed) are included in patch management lists and applications. I shouldn’t have to say it but those lists and apps must be intensively managed. That’s a pain, but lawsuits are a bigger pain, and really big lawsuits can be fatally painful for organizations.

Principle Three: Competent Management

Repeat after me: a degree in music does not qualify you to be CSO. (A degree in music does not qualify ….) Experian did not get this memo, and hired as Chief Security Officer one Susan Mauldin, music major, whose LinkedIn profile was edited and made private shortly after the hack was revealed, likely because she listed no relevant qualifications whatsoever.

I have been working, studying and teaching in this field for some 20 years, and I consider myself hardly qualified for a job like CSO. You’re playing with blood and money in that job. Even if you’re a brilliant poker player, this is 3D chess played with lions. If you can only play Whack-a-Mole on the computer, you should not be managing computer security for a major corporation. You’ll need to be a fanatical, deeply involved security fiend to play cop or Batman for a company like Experian.

This whole question of qualifications goes far beyond this field. A Chief Scientist should, for instance, be a scientist. This quickly gets political (at least for me), so I’ll stop now. But what Experian has done is not political, and not forgivable. They’re doing something that affects far too many people to approach it lackadaisically.

Now, the kernel: if you’re a malicious hacker, you’re going to be looking for exactly these weaknesses. During the Reconnaissance stage, finding a weak CIO or CSO would be a whiff of blood in the water. If a simple scan reveals unpatched vulns, bingo. And if weak or nonexistent network segmentation lets me go bounding through the corporate cyberverse, oh joy, oh glad (assuming I’m that malicious hacker). If I’m NOT a cracker, I’d be testing exactly these same limits because I’d be a pen tester or researcher or bounty hunter or whatever. Right?

February 29, 2016

Hacking Tips from the Article, “How To Not Get Hacked, According To Expert Hackers”

TV personality Kevin Roose asked for it, and he got it. He wanted to research how people get hacked, so he decided to invite some prominent hackers to hack him. And hack him they did, cracking into everything from his webcam (pictures every two minutes) to all his online accounts (including banks).
Personally, I wouldn’t do this. It’s all too apparent, to the hack-literate, how people get hacked; the harder part is figuring out how NOT to.
Some of the solutions he proposes are familiar, like using a password manager, which is unfortunately a sword sharp on both sides. Others were new to me: have you heard of an app called Little Snitch? It monitors your outgoing traffic for suspicious activity. (Why is my computer uploading my credit card statements to China?)
And some “solutions” are as effective for the cracker as for the person trying to protect themselves: using a VPN, for instance. You’ll see more on that subject in this space going forward.
In the mean time, give this article a look, prospective crackers, hackers and security professionals.
(Image courtesy of User:Colin at wikimedia.org)

February 26, 2016February 26, 2016

Are you that very nice or emphasized of security?

are you that good When your neighbor sees the hosport you broadcasted, the very first thought he has is “oh, look at it, I’ve got my neighbor’s wifi, I might get access it luckily” and click!
So what do you up to? Are you so nice to let everyone access your wifi, or want to have privacy or share with specific people? If you concern about network security, you have better off from public. Keep in your mind that everyone who comes into your network is not but willing to use the internet access you shared.
At the movie Cinderella, the King held a party for the price to choose the girl he loved and the royal prince’s invitation said “Every maid in the town was invited to the party.” despite the one who the prince actually awaited was Cinderella. Unfortunately, the step-sisters and step-mother of Cinderella enjoyed the party. Then, the step-mother got eavesdropped the Royal Guard’s conversations then she blackmailed the Royal Guard, shortly. So, we could be considerate as everyone who enjoyed the party had willing not but to have the party, to dig their own advantages.
Immediately, min mg mg steps up from the moments of he was at the movie and said “Grandpa, we should maintain a protection at our wifi, we haven’t better give access to everyone.” And the grandpa said “protection? Does it make sense if I keep this inside my iron cabinet?”. “No it doesn’t make any sense, we have to keep it outside to be able to access from your smart phone and my laptop to share the internet access but others.” min mg mg said. “Look, here are so many protection options to protect most of attacks and firewall settings as well” he said with getting access his small business wifi access device via a browser. And he continued “Here are the options WEP, WPA, WPA2”. “What the heaven?” Grandpa responded. The grandson said “chill up, I’m putting you down, grandpa, WEP is wired equivalent privacy, the security algorithm for IEEE 802.11. It was recognizable by the key of 10 (or) 16 hexadecimal digits. Its primary encryption method is; the encrypted ciper text are generated by doing the XOR Gates (Exclusive OR gate) of the keysteam by the combination of (IV) Initialization vector and keys, encrypted by the RC4, the encryption algorithm ciper (cyper) and the plaintext. It was 64-bit encryptions increased to 128-bit, yet Wi-Fi Alliance announced that the WEP had been superseded by WPA in 2003. So, immediate question is what is WPA? WPA is Wi-fi Protected Access, IEEE 802.11i sometime referred to as the draft standard IEEE 802.11. It’s anticipated to a yet securer, more complex WPA2. WPA2 was started in 2004. WEP provided data confidentiality comparable to the traditional wired network and WPA was developed by Wi-Fi Alliance to protect wireless computer network. WPA-PSK (pre-shared Key) is the common WPA configuration, used 256-bit key encryption. And it is associated with a system called message integrity check, determined if an attacker had captured or altered packets passed between the access point and client as well. The most significant change between WPA and WPA II is, Advanced Encryption Standard (AES) has to be used mandatorily.” And Grandpa spill his guts and said “Just do your thing ahead, oh my, headache, headache” and he continuously said “so, use WPA, a yet securer”. He looks slightly got the point. Of course, having a bright grandson like min mg mg is gratifying.
Young people have intelligent capabilities. We should provide them to be able to implement their imaginations. Rather than teaching them how to do, what we can do and what will be in order are the needs. If you keep blocking their inspirations by any mean, they can’t be able to realize “why”, much less great intelligence. That’s the reason Hacker High School is going for, they intend youths to be great by doing great things with great humility. In our environment, likewise we need to have someone like min mg mg who to help us to be able to understand the technologies well, at least, to be able to purchase the technology materials in fair-deal.
Well, now min mg mg is getting busy for a school conference. He is working on a presentation, based on a real world scamming matter to present. “The Scammed IT Guy” he just bannered it. are you that good

February 19, 2016February 26, 2016

Social Engineering

“Social Engineering can be known as psychological manipulating in shortly, a legitimate lie, but yelling ‘Fire!’ in a crowed movie-theater and in a public is unlawful”

“Yes, this is definitely an attack vector, almost relies on human interactions. Often involve tricking people, indirectly prompting people to spill their guts and take advantages on their crush or their craziness, let’s talk social engineering” Min Mg Mg talked to Grandpa.

“This is a con game. For instance, an attacker pretend to be a co-worker who has some kind of urgent problem that requires access to office and asking his/her colleague to let him/her in.” he continued. “That’s a cheating. What different from a liar? Grandpa asked.

“Unlike a liar, it’s is more than a liar it is about to get what you want indirectly, because it is gentle. Ok, I’ll give you an remarkable example. In the video called “Catch Me If You Can” there are a lot of the social engineering topics. Sr Frank asked his Jr Frank that “You know why yankee always win, frank?” and Jr. Frank answered “Because, they have Mickey Mantle.” Sr Frank said “No, because of the other teams can’t stop staring at the pinstripes”.

Next more notable example is; by the time Jr. Frank started his business. He needed to have PAN AM airline’s pilot uniform to be able to successfully mimic as a PAN AM’s pilot. So, he called to PAN AM airline.

Receptionist: Pan Am, may I help you?

FRANK: Yeah, hello. I’m calling about a uniform.

Receptionist: Hold for Purchasing.

FRANK: Thank you.

WOMAN: Purchasing.

FRANK (Southern accent): Hi. I’m a copilot based out of San Francisco. I flew a flight into New York last night but I’m headed out to, uh, Paris in three hours. The problem is, I sent my uniform to be cleaned through the hotel and I… I guess they must have lost it.

WOMAN: They lost a uniform. It happens all the time. Don’t worry; go down to the Well-Built Uniform Companyat Ninth and Broadway. They’re our uniform supplier. I’ll tell Mr. Rosen you’re coming.

So, in the event he could have PAN AM’s uniform. That’s one of the social engineering methods, grandpa. Frenk is a confidence man. Of course, (con man) that’s the very important skill that a social engineer needs.” Min Mg Mg just gives an example to Grandpa. And.

“Frank Abagnale was one of the most famous back there. And Kevin Mitnick who is very famous within people who love and studying computer hacking and security awareness. I’d love to talk about some well-known methods of social engineering.” Min Mg Mg said when he started opening a presentation file.

“Popular types of social engineering attacks”…..