Easy stuff just dont have time to do it.


Objective
In this lab you will use several web sites and on-line resources concerning network security. While sur-veying theses resources, please take the time to follow up on topics that interest you. Some sites, like CERT, you may have seen before.

Step One – TCP/IP and Company
The Internet is built around a group of protocols called "The TCP/IP Protocol Suite." A protocol is set of rules. In order for your computer to view web pages, download files, or send email using the Internet, your computer must follow some set a rules. Go to W3schools.com at http://www.w3schools.com/website/web_tcpip.asp to get the basics on TCP/IP.
1. What does TCP/IP stand for?
2. What does TCP do? What does IP do?
3. So if you're going to use the Internet, does your computer have to use TCP/IP? Explain.

Originally, the US military's TCP/IP networks were secure because they used private lines and the ter-minals with access to those lines were guarded by soldiers. Because the network would have this physical security, TCP/IP had little or no security built into it. Today TCP/IP on the Internet is a public network. Security is something that needed be added later through protocols such as IPSec and through other means we'll cover in this course. Many TCP/IP networks that wish to be private connect to this public network. Any network connected to the public Internet is vulnerable to attack -- even your home computer.

4. Why isn't TCP/IP considered very secure? In other words, why is maintaining a secure TCP/IP network problematic?
Now go to http://compnetworking.about.com/od/dns_domainnamesystem/f/dns_servers.htm to learn a little about how domain names are turned into IP addresses using the Domain Name Service (DNS). Consider the hierarchical structure and how it culminates in 13 root servers in the world.

5. With that in mind how might DNS be considered one of the Internet's major vulnerabilities (hint: think DoS attack)?
Since TCP/IP is inherently insecure how are you going to secure your network, stop all of these potential attacks? See how http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci1255592,00.html defines "defense in depth".

6. What does "defense in depth" mean? What are at least five of the defenses given in this defini-tion?
So while TCP/IP is still inherently insecure by itself, there's a lot you can do to protect yourself and your network.

Step Two – Trojans
The textbook already covered this briefly in Chapter 2, but it’s time to take another look at Trojans. Over the last decade, there has been a tremendous increase in the number of ready-made, easy-to-use hacking tools that are available on public Internet sites. In this class, we will survey some of these tools. A simple tool that a script kiddie can use to hack a system is a Trojan horse program, or just, Trojan.

7. How does the textbook define a Trojan horse (see page 49)?
In English, that means a program that looks harmless on the outside, but when run something on the in-side damages or compromises a system.
Back Orifice
Let's look at a well-known tool that script kiddies can be used as a Trojan horse. This tool can be used by almost anyone who is reasonably familiar with a Windows PC, and is often used to hack home-user's systems. The tool is called Back Orifice, or BO. Its name is an adolescent play on Microsoft's software package called Back Office. This tool is not secret or illegal. In fact, its creators, a group called Cult of Dead Cow, are well known. On the Cult of the Dead Cow web page, BO is described as:
Back Orifice Windows Remote Administration Tool
Back Orifice is a remote administration system which allows a user to control a com-puter across a tcpip connection using a simple console or GUI application.
Translation: Our excuse for creating this hacker tool is that it could – conceivably - be used legitimately by people to remote control their own Windows computers (yeah, right). If the target (aka, victim) com-puter is running Windows and has a TCP/IP connection, you can control that computer by pointing and clicking using a GUI (Graphical User Interface). The web page continues:
BO is small, and entirely self installing. Simply executing the server on any windows machine installs the server, moving the executable into the system where it will not interfere with other running applications. To ease distribution, BO can also be attached to any other windows executable which will run normally after installing the server.

Once running, BO does not show up in the task list or close-program list, and is re-run every time the computer is started. The filename that it runs as is configurable before it is installed, and it's as easy to upgrade as uploading the new version and running it.

Translation: Your victims won't know what hit them. The victims won't be able to find the small program that runs on their computer. The program acts as a server on the Internet. The server listens for TCP/IP connections from the hacker. When the hacker connects... The web page continues:

Create dialog boxes with the text of your choice. Log keystrokes. Lockup or reboot the machine. Get detailed system information, including:
• current user
• cpu type
• windows version
• memory usage
• mounted disks
(including hard drives, cdroms, removable drives and remote network drives) and information for those drives
• screensaver password
• passwords cached by the user
(including those for dialups, web and network access, and any other password cached by the operating system)
File system control
Copy, rename, delete, view, and search files and directories. File compression and decompression.
Process control
List, kill, and spawn processes.
Registry control
List, create, delete and set keys and values in the registry.
Network control
View all accessible network resources, all incoming and outgoing connections, list, create and delete network connections, list all exported resources and their pass-words, create and delete exports.
Multimedia control
Play wav files, capture screen shots, and capture video or still frames from any video input device (like a webcam).
Packet redirection
Redirect any incoming TCP or UDP port to any other address & port.

Translation: That hacker has total control of your system. He can delete or copy your files. The hacker can watch what you do and what you type (software that does this is called spyware). With spyware, a hacker can get your passwords, your credit card information, and even determine whether or not you are faithful to your significant other. BO allows a hacker to disable a key on your keyboard just to irritate you. The hacker can even see your face or your room if you have a web camera connected to your com-puter.

Perhaps more important than all of these, the hacker can control your network connections. This means the hacker can use your computer to attack someone else.

8. Why do you think a hacker would use your computer to hack another computer? Why don't hackers typically launch attacks from their own machines?

The BO tool is incredibly easy to use, BUT, it must be installed on the victim's computer before the hacker can attack. This is where the Trojan horse part comes in. How can someone, and not just a kid from New Jersey, but someone working for a criminal gang in Eastern Europe, get access to your home computer? He can send the BO program to your email account as an email attachment. The email might tell you that the attached program is a report, a game, or whatever he thinks you might find interesting. In any case, if you open the attachment, you will install the BO server program on your computer. Re-member, once the BO program is installed, it is incredibly difficult to track down! Once the program is installed on your system, the attacker only needs to know the Internet address of your computer in order to launch the attack. Every computer on the Internet must have a unique IP address.* How will an at-tacker find yours? There are many ways he can do this with or without your help. Remember how easy this was to do in the Chapter 3 Lab?
*There are exceptions to every rule. If you are using Network Address Translation (NAT) it makes it possible for your computer to have one address, while the outside world thinks you have a different ad-dress. If you use NAT to connect to the Internet, you may be protected from the BO attack.

Step Three – Defending Against a Break-in
The bottom line is that your home computer can be hacked by just about anyone if you are connected to the Internet and using Microsoft Windows. For a lot of people, disconnecting from the Internet or using an operating system other than Windows is not really feasible. So what to do?
9. What are at least two ways to protect your computer from a hacker break-in?
For those of you who read ahead before answering that last question, I’m going to give away the answer right here. First, never open unsolicited email attachments, even if they come from someone you know. That person may have had their email account hacked and the hacker is using that address book to send out his malware. At the very least, only open attachments when you've requested or are expecting the file. Second, you may be able to put software on your computer that listens for incoming TCP/IP con-nections and alerts you, such as Zone Alarm. http://www.zonelabs.com. (Install it at your own risk!). Third, consider using an alternative operating system like Mac OS X or one of the many Linux distribu-tions. Are Macs invulnerable to malware? Far from it, but if you’re a hacker, who are you going to target? The 85% Windows users or the 8% Mac or even smaller percent of Linux users? Even then, the Mac version of Microsoft Office, including Outlook, is vulnerable to attack.

Step Four – Defending Against a DoS Attack
So far we’ve been concerned with a hacker trying to access – more honestly – break-in - to your com-puter. Sadly, there’s another way for the hacker to make your life miserable. Deny you use of the Internet or at least part of it. The Chapter 3 Lab had you look at DoS and Distributed DoS (DDoS) at-tacks. These forms of Internet vandalism pose a severe threat to Internet security. Why? Because DoS attacks are relatively simple to carry out. DoS can also be difficult to recognize and stop because the at-tack itself can look just like legitimate Internet traffic.


DoS attacks first became highly publicized in February of 2000 when a hacker known as "Mafiaboy" al-legedly used DoS attacks to bring down or slow down websites owned Yahoo, Amazon, CNN, and others. Over time this has escalated from an individual hacker to the allegedly state-sponsored DDoS at-tack against American banks by Iran in 2012. For a quick summary of the means to defend against DoS and DDoS attacks, read the Wikipedia entry at http://en.wikipedia.org/wiki/DDoS#Handling.
10. Based on the Wikipedia entry, what are some of the ways to handle a DDoS attack?