Below are the 6 most recent journal entries recorded in muad_dib356's InsaneJournal:

Saturday, January 7th, 2012
6:11 pm	Firewall Penetration Techniques NOTICE: TO ALL CONCERNED Certain text files and messages contained on this article deal with activities and devices which would be in violation of various Federal, State, and local laws if actually carried out or constructed. The webmasters of this site do not advocate the breaking of any law. Our text files and message bases are for informational purposes only. We recommend that you contact your local law enforcement officials before undertaking any project based upon any information obtained from this or any other web site. We do not guarantee that any of the information contained on this system is correct, workable, or factual. We are not responsible for, nor do we assume any liability for, damages resulting from the use of any information on this site. The methodology that I will discuss in the next section on how to perform firewall penetration testing is not THE methodology in this field. As this is a quite new field, a lot of approaches are valid and I leave it to the reader to come up with something different. For me, this methodology worked best from the few I found existing. For a different approach see for example [7]. First, we want to find out as much as possible about our target. To do so, we collect information first in a way that can not be detected by any logging or alarming system. For this step, we use publicly available information from sources outside the network. These are services like nslookup or whois to get an idea about the structure of the targeted network. This should principally not reveal inside information on the network but sometimes topologies are exported although this should not be the case. Another source of information is to search on the internet. We can also access the targets anonymous FTP and WWW servers if they are available and hope we find something there (try to list directories on WWW servers if this is not disabled). We also search newsgroups for postings made by employees of the target. If mail headers are not rewritten, we may find more specific sender addresses than just the general e-mail address. This would be for example j. instead of j.. We also search for peoples e-mail address in white page databases for the same reason. The above approaches are quite simple but can give us a first idea of the target and its security implementation. By far the best resources for this type of data gathering are mailing lists. Here, I would like to point out specially to the firewall mailing list [4]. With setting up the firewall's filter rules, I block all inbound traffic. This includes ICMP packets. However, when I am pinging the firewall with ping -l XXXXX, the firewall -1's GUI seems somehow to crash and so do all the filter rules. During the time that I did the pinging, I was able to telnet to the firewall and with this to bypass the filter rules that seem to have crashed with the GUI. The filter rules and the GUI came back to life several minutes later but too late. As I did more tests, it seems that there is also a logging problem. The firewall was so busy logging the ping, it forgot to do anything else. Comment: While the text describes an actual posting, I changed the structure of it so don't waste your time using a search engine to find out who did the posting and crack this firewall. If the guys from evil.com are also reading this newsgroup, this site is easy pray if the administrator did not take the right precautions before making this posting. Mails like this help also in our testing task as we could have the same configuration to test or maybe the origin of this mail is even our targeted network. This step can sometimes not easily be separated from the last. The main difference would be that we are now approaching the targeted network and that most of our steps should be detected. We would typically begin with looking for additional information that the company's name server could have been stored on the network topology. Valuable information can also be discovered in bounced mail headers. If we want to get more information on vital systems in our target network, we can send an e-mail message to a non-existent user. The bounced mail header could contain valuable topographic information as you can see in the following example: By sending just one e-mail message (from to j), we got in this case information on three hosts, of which one will be their main e-mail gateway. To get other topological information, we will launch in addition a scan of the entire address space of the targeted network. To do so, we use automated tools like SATAN that perform this task for us. We can there define network classes or even just the network name which would be in this case solar.com. Principally, we should only be able to see the firewall or even nothing when using this approach. When additional hosts are detected by this scan, they are not protected by the firewall and therefore we can probably enter through these systems. While we used network scanning to determine if the security parameter is intact, we use stealth scanning to determine which ports of the firewall are open and are therefore a potential point of entry. The difference between stealth scanning and the way security scanners do scanning (what we used before) is that the scanners are invoking a complete TCP session which can be detected by the targeted systems. At this point, we are still interested that as little as possible of our actions get detected and therefore we are interested in an alternative way to do scanning. Due to a bug in most existing TCP implementations [13], we can use the following approach to see if a port is open or not Most of the activities that I described in this section should be detected from the targeted systems. However, the information collections should still be on such a level that the alarming of the firewall was not set off. This section now discusses direct attacks from the outside. Our targets are on one hand the firewall but also other designated systems like WWW server or hosts that seems to have a connection to the outside world and are not protected with a firewall. Although if the main target is the firewall, we want to try overtaking the WWW server (or FTP server, outside mail-server) first. This can give us additional advantages if the firewall (which should principally not be the case) trust these hosts or there were also examples that the filesystem of the firewall was mounted to the WWW server for easier maintenance. To have one of these systems (lets take the WWW server for example) under our control has also its advantages when we are later (following section) trying to launch an IP spoofing attack. Another general idea is, that we are launching our attacks from different subnets as the firewall could trust on of these addresses. Quite a small chance but worth a shot. When we now begin with the testing of the firewall, we have to ask ourselves what the best approach is. This is now influenced by the design of the firewall. We have principally two different types of firewalls. The packet filtering firewall and the application layer firewall (proxy). Both demand a different approach. This firewall type uses the IP addresses to do authentication. That is the point where we base our attack. A lot of software based firewalls cannot tell from which network interface a packet is coming. Therefore they have no means to tell if a packet is really coming from our side of the network or is just pretending to be by having an IP address that belongs to this network This lack of verification can be exploited by IP spoofing attacks. I will describe a blind and a non blind IP spoofing attack more in detail but before this, we have to have deeper knowledge on how a TCP connection is established. A TCP connection is established by a connection request from Host A to Host B. This connection request bears its own Initial Sequence Number (ISN) from Host A. Host B will then acknowledge the ISN from Host A with the ACK flag and sends its own ISN to Host B with the SYN flag enabled. We want to know in addition how this Initial Sequence Number is created. Principally, it is a 32 bit counter. This counter is then advanced every second by 128,000 units. firewall hardware In addition, every TCP connection advances this counter by an additional 64,000 units. For this attack, the attacker is located outside of the firewall and takes advantage of the before discussed circumstance that the firewall cannot determine from what side an IP packet is coming. The Attacker wants to establish a TCP connection with the target host. This TCP connection is typically a r* service (mostly a rlogin) that uses the IP address as authentication and no password is needed. Therefore, we need a pattern of trust. The host that the attacker pretends to be must be trusted by the target. To determine this, we can use tools as rpcinfo or showmount -e (the latter one shows mounted filesystems and indicates therefore a trusted relationship). Another method would be brute force guessing of neighbors of the target host. The first step in the IP Spoofing attack is to disable the trusted host. For this, we can typically use a TCP Syn Flood attack [3]. The trusted host has to be disabled so that the targeted host thinks that the traffic that the attacker will generate emanates from there. If the trusted host is still reachable, it will interfere in our attack and send RST packets to indicate that it did not start a connection and the target will ignore further packets with our ISN. Next, we have to prepare for guessing the targets ISN. For this, we take advantage that the SMTP port (25) is often open so that mail can be passed through the firewall. Through this port we open a TCP connection to the target host and get back his initial sequence number. We are repeating this several times to get an idea on the roundtriptime so that we can guess the target's ISN more precisely. After doing so, we are sending a connection request (SYN) to the target where we are using the IP address of the disabled trusted host. The target sends now its response with its ISN to the trusted host as this appears to be the sender. This host is still busy waiting that the connections that we opened with our SYN flood are continued and drops all incoming TCP traffic. Therefore, the target does not get a response back from the trusted host. When we were correct with our guessed initial sequence number of the target then we have now a session established. If our guessed ISN is too low in relation to what the target was expecting, then the packet will be discarded. If our guessed ISN is too high, the packet will be regarded as a future one and held in the queue. We established this way a login to the target where we need no further authentication with the rights of a standard user. We will typically try if the target accepts root logins over the network as this would give us complete power over this system. Still, we never see an output from the target and have to guess what our commands are provoking. non-blind IP Spoofing attack One of the main disadvantages with the previous described IP Spoofing attack is, that we never see the actual output of our target. We can guess in a lot of cases what this output could be but we are restricted in the use of commands. This problem can be solved in a few cases where we can actually launch a non blind IP Spoofing attack. To do so, we need a similar topology as that described in the above picture. The firewall has to be unable to detect on which interface a packet is arriving and therefore can not tell if a packet comes from the inside network or the outside world. This may sound as a quite basic feature but a lot of today's firewall don't have this capability. In fact, a software based firewall is mostly not capable of distinguishing between the inside and the outside interface and makes the decision based upon the IP address. Our attack approach takes advantage of this. Another restriction for this attack is, that our target and the WWW server are not separated with a router (or an intelligent bridge) that filters the traffic. The attack is quite straight forward. We are attacking and overtaking the WWW server (normally enough security holes there). In addition, we have to gain root access on this machine. As the web server is freely accessible from the internet we don't have problems connecting to it. After we have gained root access, we change the servers IP address to an unused IP address from the same C class network that our target belongs to and that our target potentially trusts. To make the change active, we now reboot the server after we set up an account for us to come back. After rebooting, the server will now have the new IP address. As this address belongs to the inside network, all traffic to and from this host can now freely pass the firewall. We are still able to connect for example with telnet to the server and launch an attack from there to the target. As the traffic will pass the firewall, we have now established a non-blind IP spoofing attack. Filter rules on packet filtering firewalls are typically based on source and destination port addresses. On a TCP/IP enabled host, we have 65,535 possible virtual ports. Some of these ports are assigned to specific services and a lot are for general use. While we could have the policy that we allow FTP services but not telnet services to pass our firewall, when source porting is enabled, an attacker can modify telnet to make the connection come from source port 20 (port 20 is assigned to the FTP service). Source routing is an option in the IP protocol that allows defining how packets are routed between source and destination. If source routing is allowed, we are often able to bypass the filter rules of the firewall. We could also probably turn a blind-IP-spoofing attack into a non-blind attack if we can define how the packets are routed. Proxy type firewalls require a different approach as the authentication is not based on IP addresses. Proxies are demons and don't have much code that could have bugs to exploit in them. To my knowledge, no proxy exploitation due to a programming error is known to date. Authentication is normally quite strong by using hardware tokens and one-time passwords so that also brute force attacks are not very dangerous. However, to check for default accounts and passwords or simply password guessing is still a valid tool. However, I came up with a possible attack if a firewall is running the NTP (network time protocol) service in combination with the one-time password SecurID. SecurID uses hardware tokens in combination with passwords to authenticate users. The one-time password is time based. The user enters an 8 digit code before the assigned password. This 8 digit code changes every 60 second. Normally, this prevents from sniffer attacks where passwords are collected. If the attacker could install a sniffer, he could store the login sequence with a timestamp. If the hacker can launch his attack from a high level (penetrated the targets service provider first), he can try to shut down the firewall (e.g. ping with oversized packets, flooding). When the firewall comes up again, it will ask the current time through NTP. The attacker can now forge the NTP responses and set the time of the firewall back. When the attacker now replays the SecurID login sequence at the right time, he should be able to gain access our network. I never heard that this attack was described or used but it is still a valid threat and shows us that critical hosts should not rely on any information (in this case the time) from outside our trusted network. Most of the tests that we run when testing a proxy firewall will be tests for wrong configurations or poor implementation of the security policy. SOCKs can serve here as an example. SOCKs is a library for proxy application firewalls that was designed to allow certain services to pass the firewall. Unfortunately, SOCKs is often misconfigured in a way that the administrator established the rules to allow certain services through the firewall but forgot to define the rules necessary for denying access to intruders. The firewall will seem to work fine until a hacker finds this misconfiguration or it is discovered in a firewall test. The following list covers the most dangerous threats that a firewall should block. It is not complete at all and a longer list can be accessed at , the vulnerability database of ISS (Internet Security Systems)[15]. A method that can possibly lead to success is the combination of attacks or trying to keep the firewall busy (e.g. ping it with large packets) during an attack. The firewall can be so busy handling the ping requests that it "forgets" its filtering rules. However, while being creative is a good thing - we shall never forget that we are probably not allowed to shut down the firewall. Therefore our probing should not lead to denial of service attacks. If possible and during a very specified time window of the testing, we can also try if denial of service attacks can force the firewall into a failure condition. After a denial of service attack, we are interested in the state of the firewall. There are four potential states: While we would like to see the firewall in the first state after a denial of service attack, the next two can be still acceptable, while we definitely want to avoid the latest one. While our previous approaches were concentrated on attacks from the outside, we are trying to attack the firewall from the inside in our last part of the firewall penetration testing. Why should anyone try to attack a firewall from the inside- you might ask. There may be different reasons. With additional security (what a firewall provides) access has been made more difficult. Before the firewall was installed, an employee could telnet into its computer during non office hours and check the mail or send his newest papers to a friend using FTP. Even worse, access to the internet (surfing) can be disabled (or audited) for a group of users. There are a lot of reasons that someone is not too happy with this firewall and he (or she) can try to disable it to gain back the old capabilities. In this case, the target is the firewall or probably more often the operating system on which the firewall is running. This belongs now not any more to network security but more to host security as this specific host (the firewall) is attacked. There are a few quite good tools that you (and anyone else!) can use to test for OS vulnerabilities (SATAN, ISS..). Until now, I have described the methodology on firewall testing and how we are doing it in theory but I have not discussed how to perform an actual test. While manual probing and interactive testing are related to each other, the latter two approaches are more or less automated. With manual tests, you have the big advantage that you really know what is going on at the target system. You see the output/response that your probing and testing creates and you can react accordingly. This is much more flexible than using automated tools or hacking scripts. The danger of disrupting services is also not as great as with the other approaches. Unfortunately, this takes a lot of time and needs a considerable degree of knowledge. You are sitting behind your terminal equipped with a checklist of vulnerabilities that you want to test and you certainly spend a lot of time typing and searching for possible entry points. This method requires in addition also good knowledge of the security problems of your target system. A possibility to get results faster is the use of security scanners. Until now, there is not much available that target firewalls and scans for problems. Although a lot of scanners are declared as "network security tools", they target more host security and scan mostly for operating system vulnerabilities and dangerous enabled services. While this can help when testing a firewall, its not enough. At this moment (Dec 96), the only available package that has an option for firewall testing is the firewall scanner of ISS [14]. Even if this option is available, it means that it adds a number of firewall security checks (we discussed all of these in this paper) to the Internet Security Scanner. Hacking tools can be easily found on the internet. Just go to Alta Vista (or your favorite search engine) and do a search for "UNIX hacking" and you will get links to around 250 so called "underground" pages where self defined "hackers" make their knowledge (sometimes knowledge and a lot of noise) openly available. With a little time, you will find tools for exploiting a lot of vulnerabilities. However, the use of these tools is not without problems. Before using them, analyze the source code thoroughly until you know what the program is really doing and then test it in a closed environment on one of your own machines before letting it free. You never will be really sure what these tools are doing so be extremely careful. In my opinion, automated tools can make a firewall test more efficient and take care of lengthy tasks but cannot replace them. To run just ISS against a firewall and declare it as a firewall penetration test is not an option in my point of view and should not be accepted by the client. Current Mood: sympathetic (Comment on this)
Tuesday, January 3rd, 2012
8:13 am	Windows Firewall and its Significance Windows Firewall acts as a protective shield for your computer against possible safety intrusions. It is highly effective in blocking computer worms and viruses from reaching the computer and making unauthorized changes and "stealing" information. It is worth noting here that Windows Firewall protects your PC by five services: packet filtering, application filtering, proxy server, circuit-level, and Stateful inspection. Firewall prompts the user to accept or decline certain connection requests so that PC security is not compromised at any stage and all operations are authorized, to say the least. In other words, PC users can specify rules for source and destination IP addresses and port ranges. It is, however, important to note that Windows Firewall does not block spam or unsolicited emails. Firewall also does not stop PC users from opening emails that can include dangerous attachments and doesn't detect or remove computer worms or viruses. It is, therefore, recommended that PC users must install powerful antivirus software and update the same on regular intervals so that PC security is not exposed before threats. Now that we have read about Windows Firewall and its importance, it is now time to read what to do in case the very purpose of Windows Firewall, PC security, is defeated by an intrusion. In case you are experiencing problems with Windows Firewall, you can always refer to computer troubleshooting service. This will help you identify the problem and even treat in some cases. In case the intrusion is severe, it is highly recommended that you opt for professional computer help desk service. This computer support service can be accessed for free or little cost from a reliable computer tech help provider. If you are not aware of any such providers, you can go online to find a provider specializing in such services. For this, you need not make any special efforts. You can just search engines such as Google, Yahoo!, or MSN and type words such as "computer support service", "computer tech help", "computer troubleshooting service", or "computer help desk service". You will be redirected to sites of computer support service providers and then you can compare and choose from the available options. It will now be time to clarify any doubts (if any) from the provider and setting the computer tech help terms so that things are simplified for a better understanding. All in all, it is always better to opt for Windows Firewall and get an added layer of security by opting for professional computer support services. business firewalls This will surely help in making your rendezvous with the PC and the Internet delighting, satisfying, hassle-free, and rewarding. Current Mood: full (Comment on this)
Thursday, December 29th, 2011
9:18 pm	Network Types that Connect Computers The world of computers is a world made of computers and other networking devices interconnected together with wires while others are interconnected wirelessly to form what we call a network firewall hardware. A computer network is an interconnection of two or more computers in order to share data and peripherals. We have a number of network designs but the 3 main network types are:-. A Local Area Network is a network type comprising of a group of computers and other systems located reasonably close to one another within a given area in such a way that users communicate and share resources e. g. within a college, Cyber Cafe' or an office business firewalls. A LAN connects computers and network devices over a relatively short distance. A Local Area Network uses TCP/IP network protocol for communication between computers and other connected peripherals. LANs are the basis of all other types of networks. So if you connect two or more computers in an office, the end result will be a Local Area Network. This is a network that covers an entire city or town. This type of network usually makes use of wireless infrastructure or optical fiber connections to link sites. It can be created by connecting several LANs together. For example, it can be a network covering all the police stations in a big city, local government authorities, a college with a number of branches can also interlink their LANs and come up with a Metropolitan Area Network etc firewall software. Disadvantages It is expensive to install and maintain. It's susceptible to tapping. It's susceptible to attenuation (Attenuation is the gradual loss of signal strength as data flows further from the point of origin). It has high error rates. It's a type of network design that connects computers across a large geographical area of a city, region and even spans beyond country boundaries. It consists of several sections of LAN's and MAN's connected together by devices such as routers. A WAN transmits information by telephone lines, ISDN (Integrated Services Digital network) lines, Radio waves, or satellite Microwave. The Internet is the best example of the largest Wide area network as it covers the whole world. So the moment you connect two or more computers located reasonably close to one another, you will be creating a LAN. Even when you are to create a MAN or a WAN, you will have to start with a Local Area Network. Current Mood: guilty (Comment on this)
Sunday, December 25th, 2011
4:18 am	Cobra Administration Software - Some Words network security Cobra administration can be defined as a program which is used by different companies in order to organize and keep track of the events taking place within the office arena. The organizing procedure takes place in a chronological way and the reports are saved into such a system that is integrated and fully automatic. firewall hardware management is a great software tool that can be used to handle all the events and procedures that is taking place within the organization. It is highly cost effective and can be handled quite easily. The software is easy to maintain and can be operated in a rather fast way. The ultimate task of the software is to store data in a systematic way inside a single selected area. There is an in-built word processor available which helps much in generating all sort of personalized documents. Through the help of this software tool, the billing and payment related functions. The full form of COBRA is Consolidated Omnibus Budget Reconciliation Act, 1985. This has been effective since the month of July in the year of 1986. There are certain companies which should have the COBRA administration associated with them. Those companies which features schemes related to group health are viable to take the coverage. But there is some sort of exceptions also to this rule firewall software. There are certain companies which features employees of twenty or less. They do not fall under this rule. Then there are also those companies that are under the church or even those government (federal) agencies do not fall under this act. If you want more information, then it will be better to open up the webpage of COBRA to get a detailed view of everything that is associated with it. Current Mood: giggly (Comment on this)
Wednesday, December 21st, 2011
1:05 am	Wireless Broadband Routers The 802.11g is one of the standards for wireless local area network or the WLAN communication. It was ratified in 2003 as the latest in the series of IEEE 802.11 standards. The newest version is an improvement of the 802.11b standard. The 802.11g can handle a maximum capacity of 54 Mbps. This is in comparison to 11 Mbps of the earlier 802.11b. For compatibility with earlier standards, the 802.11g also uses the frequency range of 2.4 GHz. The latest standard is also supporting Ethernet networking exclusively. Wireless broadband routers 802.11g technologies have higher speed. It is capable of quicker file sharing and printing than the older 802.11b wireless broadband router. The 802.11g router has more computer capacity than the other router technology. Bogging down of the network or the router is avoided even when more computers are loaded to the network. There is still a newer wireless broadband router technology. The newer version is the 802. 11n router standard. This particular wireless broadband router is speedier and has more features than the 802. 11g. The most appropriate wireless broadband router for home use is the 802. 11g. The reasons for the choice are solid performance, overall capability and affordability of the 802 network security. 11g wireless broadband router. There are several wireless broadband routers available in the market. These routers are sold through the traditional stores located in strategic areas. firewall hardware Purchase of wireless broadband routers can also be done through the online stores easily accessible. D-Link DI-624 AirPlus Xtreme G is a device which encompasses the elements of other similar gadgets. It is stated that the router is easy to install and reliable in usage. The WEP and WPA security are supported. The wireless router is functional at 100m signal range. Netgear WGR614 is a wireless broadband router representing a tradition in home products. Remarkable signals are a feature of the Netgear device. Signal penetration is not a problem. Problems are solved by resetting the WGR614 router once in a while. The router is offered at three-year warranty. Linksys WRT54G Wireless-G - there are conflicting claims among the owners of this router regarding the installation, performance and signal range business firewalls. Customer assistance is available. The owners of the wireless broadband router must be aware of the updates in the routers versions. SMC SMC2804WBR Barricade is competitive in terms of features and overall quality. Macintosh, Linux and Windows users are compatible with this router brand. It has two detachable antennas, strong firewall and good signal strength. The product is worth buying since it is low-priced and has a lifetime warranty. Belkin F5D7230-4 can be connected with Macintosh and Linux/Unix systems so with personal computers. Its Easy Install Wizard enables the router to be interconnected with the internet wirelessly in a couple of minutes. The warranty accompanying the product is lifetime. Buffalo G54 AirStation is not a well known brand of wireless router in the USA. Difficulties are experienced in its setup interface. External antenna improves signal range. Similarities are noted with Linksys. Customer service is quite superior as against other competitors. There are other wireless routers that are cheaper in prices. These include those discontinued router models which are still functional. These brands could offer the best bargain for home users. Current Mood: dirty (Comment on this)
1:05 am	Windows 7 Firewall The Best So Far Firewalls have been designed to block unauthorized access to the computer and allow authorized access. And a firewall could be a piece of hardware device or software or a combination of both software and hardware. To prevent unauthorized access over the Internet, firewalls play a very crucial role. Firewall that has been combined with the Windows 7 operating system is powerful, high-end and the best among all the Windows operating system. network security In this article we will talk about some of the notable features of Windows 7 firewall. Windows 7 Firewall is very useful for those who are looking for a high level of security for their computer system or for the network security. This is a basic firewall, and once it is installed, it will block all malware and other malicious contents from entering the computer. Like the earlier version of Windows, Windows 7 Firewall is also turned on by default. To check the firewall settings, you can go to Start, then to Control Panel and System and Security. You can also consult a provider for any firewall related issues. Windows 7 Firewall is more advanced and you can create home group with this firewall. This feature was not present on the earlier version of Windows OS. The home group allows the user to add the other computers to the network. But these computers should have Windows 7 installed. It is very easy to share resources like printers, or specific folders like music, videos or documents among the computers on home network group. In Windows 7 the private network has been split into two categories - Home and Work networks. Security is another parameter by which you can determine how good the firewall is. The security system in Windows 7 firewall is very strong. At the time of working in a public network, it will block access to and from other devices on the Internet for security purposes. You will also get notifying message if certain programs are blocked by the Windows 7 Firewall. Notification is built-in feature of the Windows 7 Firewall. There has been a lot of change in the Windows 7 Firewall and it is more user-friendly. For instance, with the earlier version of firewalls, it was necessary to put in the port numbers and IP addresses one at a time while with the new Windows 7 firewall you can put in a range. This eventually renders better speed and easy to set up. However, there might be certain shortcomings in Windows 7 Firewall but it is far better than all the previous versions of the firewall. If you need help for , you can consult a provider. There are several service providers that offer tech support to the computer users in this regard. Current Mood: excited (Comment on this)