Introduction to Ethical Hacking

 

What are the Objectives of Ethical Hacking?

If hacking per se today is bent on stealing valuable information, ethical hacking on the other hand is used to identify possible weak points in your computer system or network and making them secure before the bad guys (the black hat hackers) use them against you. It’s the objective of white hat hackers or ethical hackers to do security checks and keep everything secure.

That is also the reason why some professional white hat hackers are called penetration testing specialists. One rule of thumb to help distinguish penetration testing versus malicious hacking is that white hat hackers have the permission of the system’s owner to try and break their security.

In the process, if the penetration testing is successful, the owner of the system will end up with a more secure computer system or network system. After all the penetration testing is completed, the ethical hacker, the one who’s doing the legal hacking, will recommend security solutions and may even help implement them.

It is the goal of ethical hackers to hack into a system (the one where they were permitted and hired to hack, specifically by the system’s owner) but they should do so in a non-destructive way. This means that even though they did hack into the system, they should not tamper with the system’s operations.

Part of their goal is to discover as much vulnerability as they can. They should also be able to enumerate them and report back to the owner of the system that they hacked. It is also their job to prove each piece of vulnerability they discover. This may entail a demonstration or any other kind of evidence that they can present.

Ethical hackers often report to the owner of the system or at least to the part of a company’s management that is responsible for system security.  They work hand in hand with the company to keep the integrity of their computer systems and data. Their final goal is to have the results of their efforts implemented and make the system better secured.

As part of ethical hacking, you should also know the actual dangers and vulnerabilities that your computer systems and networks face. Next time you connect your computer to the internet or host a WiFi connection for your friends, you ought to know that you are also opening a gateway (or gateways) for other people to break in.

Network Infrastructure Attacks

Network infrastructure attacks refer to hacks that break into local networks as well as on the Internet.

A lot of networks can be accessed via the internet, which is why there are plenty out there that can be broken into. One way to hack into a network is to connect a modem to a local network. The modem should be connected to a computer that is behind the network’s firewall.

Another method of breaking into a network is via NetBIOS, TCP/IP, and other transport mechanisms within a network. Some tricks include creating a denial of service by flooding the network with a huge load of requests.

Network analyzers capture data packets that travel across a network. The information they capture is then analyzed and the information in them is revealed. Another example of a fairly common network infrastructure hack is when people piggyback on WiFi networks that aren’t secured. You may have heard of stories of some people who walk around the neighborhood with their laptops, tablets, or smartphones looking for an open WiFi signal coming from one of their neighbors. 

Non-Technical Attacks

Non-technical attacks basically involve manipulating people into divulging their passwords, willingly or not. The term social engineering comes to mind and it is the tool used in these kinds of attacks. An example of this is by duping (or even bribing) a coworker to divulge passwords and usernames. We’ll look into social engineering a little later on.

Another form of non-technical attack is simply walking into another person’s room where the computer is, booting the computer, and then gathering all the information that you need – yes it may sound like Tom Cruise and his mission impossible team, but in reality these non-technical attacks are a serious part of hacking tactics. 

Attacks on an Operating System

Operating system attacks are one of the more frequent hacks performed per quota. Well, it’s simply a numbers game. There are many computers out there and a lot of them don’t even have ample protection. There are a lot of loopholes in many operating systems – even the newest ones around still have a few bugs that can be exploited.

One of the avenues for operating system attacks is password hacking or hacking into encryption mechanisms. Some hackers are just obsessed with hacking other people’s passwords just for the sheer thrill of it.

Attacks on Applications

Apps, especially the ones online and the ones that deal with connectivity, get a lot of attacks.

Examples of which include web applications and email server software applications. Some of the attacks include spam mail (remember the Love Bug or ILOVEYOU virus back in 2000?). Spam mail can carry pretty much anything that can hack into your computer system. 

Malware or malicious software is also another tool in the hands of a hacker when they try to attack pretty much everything, especially apps. These software programs include Trojan horses, worms, viruses, and spyware. A lot of these programs can gain entry into your computer system online. Another set of applications that get attacked frequently are SMTP applications (Simple Mail Transfer Protocols) and HTTP applications (Hypertext Transfer Protocols). Most of these applications are usually allowed to get by firewalls by the computer users themselves. They are allowed access simply because they are needed by the users or a company for its business operations. 

Compromising Physical Security Flaws

Physical security is actually a vital part of information security. Hackers can eventually find access to one of your computers. They can’t get past your company’s firewall but they can install a hardware or software within your network inside your firewall by simply walking in the door and connecting a device into one of your employee’s computers.

Smaller companies that have few employees will have very little to worry about. These employees usually don’t allow a stranger to use their computers. Larger companies have a bigger problem – they have more employees, more computer hardware, and plenty of other access points that hackers can use.

Hackers may not always want to just install a piece of hardware and have a point of entry from the inside. They may just need to access a computer, steal some important documents, or grab anything that seems to contain some vital information. They will usually have an alibi when asked. They will try to enter a building through any door including outside smoking areas where employees go to, cafeteria doors, fire escapes, or any entry point that is available. They may even just tailgate employees reentering a building and all they need to say to get in is “thank you for keeping the door open.”

Read More

Ethical Hacking : Penetration Testing

 

Penetration Testing 

Penetration testing can be defined as a legal and authorized attempt to locate and successfully exploit computer systems for  the purpose of making those systems more secure. The process includes probing for vulnerabilities as well as providing proof of concept attacks to demonstrate the vulnerabilities are real. Proper penetration testing always ends with specific  recommendations for addressing and fixing the issues that were discovered during the test. On the whole, this process is used to help secure computers and networks against future attacks. The general idea is to find security issues by using the same tools and techniques as an attacker. These findings can then be mitigated before a real hacker exploits them. Penetration testing is also known as

1) Pen testing

2 )PT

3) Hacking

4)  Ethical hacking

5 )White hat hacking

6) Offensive security

7) Red teaming.

It is important to spend a few moments discussing the difference between penetration testing and vulnerability  assessment.  Many people (and vendors) inthe security community incorrectly use these terms interchangeably. A  vulnerability assessment is the process of reviewing services and systems for potential security issues, whereas a penetration test actually performs exploitation and Proof of Concept (PoC) attacks to prove that a security issue exists. Penetration tests go a step beyond vulnerability assessments by simulating hacker activity and delivering live payloads. In this book, we will cover the process of vulnerability assessment as one of the steps utilized to complete a penetration test.

SETTING THE STAGE

Understanding all the various players and positions in the world of hacking and penetration testing is central to  comprehending the big picture. Let us start by painting the picture with broad brush strokes. 

In the pen testing world, it is not uncommon to hear the terms “white hat” and “black hat” to describe the Jedis and Siths. Throughout this book, the terms “white hat”, “ethical hacker”, or “penetration tester” will be used interchangeably to describe the Jedis or good guys. The Siths will be referred to as “black hats”, “crackers”, or “malicious attackers”. It is important to note that ethical hackers complete many of the same activities with many of the same tools as malicious attackers. In nearly every situation, anethical hacker should strive to act and think like a real black hat hacker. The closer the penetration test simulates a real-world attack, the more value it provides to the customer paying for the penetration testing (PT). 

The first and simplest way to differentiate between white hats and black hats is authorization. Authorization is the process of obtaining approval before conducting any tests or attacks. Once authorization is obtained, both the  penetration tester and the company being audited need to agree upon the scope of the test. The scope includes specific information about the resources and systems to be included in the test. The scope explicitly defines the authorized targets for the penetration tester. It is important that both sides fully understand the authorization and scope of the PT. White hats must always respect the authorization and remain within the scope of the test. Black hats will have no such constraints on the target list. 

The second way to differentiate between an ethical hacker and a malicious hacker is through examination of the attacker’s motivation. If the attacker is motivated or driven by personal gain, including profit through extortion or other devious methods of collecting money from the victim, revenge, fame, or the like, he or she should be considered a black hat. However, if the attacker is preauthorized and his or her motivation is to help the organization and improve their security, he or she can be considered a white hat. In addition, a black hat hacker may have a significant amount of time focused on attacking the organization. In most cases, a PT may last 1 week to several weeks. Based on the timeallotted during the PT, a white hat may not have discovered more advanced timeintensive exposures.

 

It is also important to understand that not all penetration tests are carried out in the same manner or have the same purpose. White box penetration testing, also known as “overt” testing, is very thorough and comprehensive. The goal of the test is to examine every nook and cranny of the target’s system or network. This type of test is valuable in assessing the overall  security of an organization. Because stealth is not a concern .By disregarding stealth in favor of thoroughness the  penetration tester is often able to discover more vulnerabilities. The downside to this type of test is that it does not provide a very accurate simulation of how most modern day, skilled attackers exploit networks. It also does not provide a chance for the organization to test its incident response or early-alert systems. Remember, the tester is not trying to be stealthy. The tester is attempting to be thorough 

Black box penetration testing, also known as “covert” testing, employs a significantly different strategy. A black box test is a much more realistic simulation of the way a skilled attacker would attempt to gain access to the target systems and network. This type of test trades thoroughness and the ability to detect multiple vulnerabilities for stealth and pin-point precision. Black box testing typically only requires the tester to locate and exploit a single vulnerability. The benefit to this type of test is that it more closely models how a realworld attack takes place. Not many attackers today will scan all 65,535 ports on a target. Doing so is loud and will almost certainly be detected by firewalls and intrusion detection systems. Skilled malicious hackers are much more discrete. They may only scan a single port or interrogate a single service to find a way of compromising and owning the target. Black box testing also has the advantage of allowing a company to test its incident response procedures and to determine if their defenses are capable of detecting and stopping a targeted attack.

Clearly defining and understanding the scope of the test is crucial. The scope formally defines the rules of engagement for both the penetration tester and the client. It should include a target list as well as specifically listing any systems or attacks which the client does not want to be included in the test. The scope should be written down and signed by authorized personnel from both the testing team and the client. Occasionally, the scope will need to be amended during a penetration test. When this occurs, be sure to update the scope and resign before proceeding to test the new targets. 

Ultimately, penetration testing should play an important role in the overall security of your organization. Just as policies, risk assessments, business continuity planning, and disaster recovery have become integral components in keeping your organization safe and secure, penetration testing needs to be included in your overall security plan as well. Penetration testing allows you to view your organization through the eyes of the enemy. This process can lead to many surprising discoveries and give you the time needed to patch your systems before a real attacker can strike.

Read More