Counter Hack: A Step-by-Step Guide to Computer Attacks and Effective Defenses - Softcover

Skoudis, Edward

Softcover

ISBN 10: 0130332739 ISBN 13: 9780130332738

Publisher: Prentice Hall PTR, 2002

Synopsis

This informal, step-by-step guide will empower every network and system administrator to defend their network assets, whether or not they have security experience. It covers both Unix and Windows platforms, presenting in-depth descriptions of the inner workings of the most destructive hacker tools, and proven, step-by-step countermeasures. Skoudis begins by presenting the hacker's view of networks and their vulnerabilities, with especially detailed coverage of how hackers view the TCP/IP protocol suite. He introduces all five phases of hacking: reconnaissance (targeting of a network); scanning for network vulnerabilities; gaining access and exploiting the system; maintaining access; and preventing detection. Counter Hack presents in-depth descriptions of the most widespread and dangerous attack scenarios, and the most widely-used hacker tools, including war dialers, port scanners, firewall scanners, sniffers, session hijackers, and more. For all system administrators, network administrators, security specialists, and others directly involved in protecting network and computing infrastructure.

About this title

About the Author

EDWARD SKOUDIS is Vice President of Security Strategy for Predictive Systems, a leading independent infrastructure network consulting company, helping global enterprises and service providers harness the power of network technology. His specialty is identifying and resolving security vulnerabilities in UNIX, Windows, firewall architectures, and Web servers. Skoudis is a frequent speaker at major security conferences such as SANS and has demonstrated hacker techniques for the United States Senate.

From the Back Cover

The Next Generation Hacker Book

The step-by-step guide to defending against hacker intrusions!

• Defend against today's most powerful hacker attacks!
• Hands-on, step-by-step techniques for UNIX/Linux and Windows environments
• Intrusion detection: New evasion techniques—and countermeasures
• By the security expert who demonstrated hacking to the U.S. Senate!

This easy-to-use, step-by-step guide will empower network and system administrators to defend their information and computing assets—whether or not they have security experience. In Counter Hack, leading network security expert Edward Skoudis presents comprehensive, insider's explanations of today's most destructive hacker tools and tactics-and specific, proven countermeasures for both UNIX and Windows environments. Skoudis covers all this and more:

• Know your adversary: from script kiddies to elite attackers
• A hacker's view of networks, TCP/IP protocols, and their vulnerabilities
• Five phases of hacking: reconnaissance, scanning, gaining access, maintaining access, and preventing detection
• The most dangerous and widespread attack scenarios—explained in depth
• Key hacker tools: port scanners, firewall scanners, sniffers, session hijackers, RootKits, and more
• How hackers build elegant attacks from simple building blocks
• Detecting and preventing IP spoofing, covert channels, denial of service attacks, and other key attacks
• How hackers cover their tracks—and how you can uncover their handiwork
• A preview of tomorrow's hacker tools, attacks, and countermeasures

Whatever your role in protecting network infrastructure and data, Counter Hack delivers proven solutions you can implement right now—and long-term strategies that will improve security for years to come.

Excerpt. © Reprinted by permission. All rights reserved.

Preface

My cell phone rang. I squinted through my sleepy eyelids at the clock. Ugh! 4 a.m., New Year's Day. Needless to say, I hadn't gotten very much sleep that night.

I picked up the phone to hear the frantic voice of my buddy, Fred, on the line. Fred was a security administrator for a medium-sized Internet Service Provider, and he frequently called me with questions about a variety of security issues.

"We've been hacked big time!" Fred shouted, far too loudly for this time of the morning.

I rubbed my eyes to try to gain a little coherence.

"How do you know they got in? What did they do?" I asked.

Fred replied, "They tampered with a bunch of Web pages. This is bad, Ed. My boss is gonna have a fit!"

I asked, "How did they get in? Have you checked out the logs?"

Fred stuttered, "W-Well, we don't do much logging, because it slows down performance. I only snag logs from a couple of machines. Also, on those systems where we do gather logs, the attackers cleared the log files."

"Have you applied the latest security fixes from your operating system vendor to your machines?" I asked, trying to learn a little more about Fred's security posture.

Fred responded with hesitation, "We apply security patches every three months. The last time we deployed fixes was?um?two-and-a-half months ago."

I scratched my aching head and said, "Two major buffer overflow attacks were released last week. You may have been hit. Have they installed any RootKits? Have you checked the consistency of critical files on the system?"

"You know, I was planning to install something like Tripwire, but just never got around to it," Fred admitted.

I quietly sighed and said, "OK. Just remain calm. I'll be right over so we can start to analyze your machines."

You clearly don't want to end up in a situation like Fred, and I want to minimize the number of calls I get at 4 a.m. on New Year's Day. While I've changed Fred's name to protect the innocent, this situation actually occurred. Fred's organization had failed to implement some fundamental security controls, and it had to pay the price when an attacker came knocking. In my experience, many organizations find themselves in the same state of information security unpreparedness.

But the situation goes beyond these security basics. Even if you've implemented all of the controls discussed in my Fred narrative above, there are a variety of other tips and tricks you can use to defend your systems. Sure, you may apply security patches, use a file integrity checking tool, and have adequate logging, but have you recently looked for unsecured modems? Or, how about activating port-level security on the switches in your critical network segments to prevent powerful, new active sniffing attacks? Have you considered implementing non-executable stacks to prevent one of the most common types of attacks today, the stack-based buffer overflow? Are you ready for kernel-level RootKits? If you want to learn more about these topics and more, please read on.

As we will see throughout the book, computer attacks happen each and every day, with increasing virulence. To create a good defense, you must understand the offensive techniques of your adversaries. In my career as a system penetration tester, incident response team member, and information security architect, I've seen numerous types of attacks ranging from simple scanning by clueless kids to elite attacks sponsored by the criminal underground. This book boils down the common and most damaging elements from these real-world attacks, while offering specific advice on how you can proactively avoid such trouble from your adversaries. We'll zoom in on how computer attackers conduct their activities, looking at each step of their process so we can implement in-depth defenses.

The book is designed for system administrators, network administrators, and security professionals, as well as others who want to learn how computer attackers do their magic and how to stop them. The offensive and defensive techniques laid out in the book apply to all types of organizations using computers and networks today, including enterprises and service providers, ranging in size from small to gigantic.

Computer attackers are marvelous at sharing information with each other about how to attack your infrastructure. Their efficiency at information dissemination about victims can be ruthless. It is my hope that this book can help to even the score, by sharing practical advice about how to defend your computing environment from the bad guys. By applying the defenses from this book, you can greatly improve your computer security and, perhaps, we'll both be able to sleep in late next New Year's Day.

Edition details

• Publisher: Prentice Hall PTR
• Publication date: 2002
• Language: English
• ISBN 10: 0130332739
• ISBN 13: 9780130332738
• Binding: Paperback
• Edition number: 1
• Number of pages: 564