System Hacking

Attacker performs password cracking without communicating with the authorizing party.

• Wire Sniffing
• Man-in-the-Middle
• Replay

• Offline attacks occur when an attacker checks the validity of passwords. The attacker observes how the password is stored. If the usernames and passwords are stored in a readable file, it is easy for the attacker to gain access to the system. Hence, it is important to protect the list of passwords and keep it in an unreadable form, preferably encrypted.
• Offline attacks are often time-consuming but have a high success rate as the password hashes can be reversed owing to their small keyspace and short length. Notably, different password-cracking techniques are available on the Internet.

Default passwords are those supplied by manufacturers with new equipment (e.g., switches, hubs, routers). Usually, default passwords provided by the manufacturers of password-protected devices allow the user to access the device during the initial setup and then change the password. However, often an administrator will either forget to set the new password or ignore the password-change recommendation and continue using the original password. Attackers can exploit this lapse and find the default password for the target device from manufacturer websites or using online tools that show default passwords to access the target device successfully. Attackers use default passwords in the list of words or dictionary that they use to perform password-guessing attacks.

• https://open-sez.me
• https://www.fortypoundhead.com
• https://cirt.net
• http://www.defaultpassword.us
• https://www.routerpasswords.com
• https://default-password.info
• https://192-168-1-1ip.mobi

1Vertical Privilege Escalation

• Refers to gaining higher privileges than the existing

2 Horizontal Privilege Escalation:

• The unauthorized user tries to access the resources, functions, and other privileges that belong to an authorized user who has similar access permissions. For instance, online banking user A can easily access user B’s bank account.

v After gaining access and escalating privileges on the target system, now attackers try

to maintain their access for further exploitation of the target system or make the compromised system a launchpad from which to attack other systems in the network.

v Attackers remotely execute malicious applications such as keyloggers, spyware, and

other malicious programs to maintain their access to the target system and steal critical information such as usernames and passwords.

v Attackers hide their malicious programs or files using rootkits, steganography, NTFS

data streams, etc. to maintain their access to the target system.

v Once attackers gain higher privileges in the target system by trying various privilege

escalation attempts, they may attempt to execute a malicious application by exploiting a vulnerability to execute arbitrary code. By executing malicious applications, the attacker can steal personal information, gain unauthorized access to system resources, crack passwords, capture screenshots, install a backdoor for maintaining easy access, etc.

v Attackers execute malicious applications at this stage in a process called “owning” the

system. Once they acquire administrative privileges, they will execute applications.

Attackers may even try to do so remotely on the victim’s machine to gather the same information as above.

• Backdoors: Program designed to deny or disrupt the operation, gather information that leads to exploitation or loss of privacy, or gain unauthorized access to system resources.
• Crackers: Components of software or programs designed for cracking a code or passwords.
• Keyloggers: These can be hardware or software. In either case, the objective is to record each keystroke made on the computer keyboard.
• Spyware: Spy software may capture screenshots and send them to a specified location defined by the hacker. For this purpose, attackers have to maintain access to victims’ computers. After deriving all the requisite information from the victim’s computer, the attacker installs several backdoors to maintain easy access to it in the future.

Different types of Hardware Keyloggers

v Covering tracks is one of the main stages during system hacking. In this stage, the attacker tries to

hide and avoid being detected or “traced out” by covering all “tracks,” or logs, generated while accessing the target network or computer.

v Erasing evidence is a must for any attacker who would like to remain obscure. It is a method used to

evade a traceback. It starts with erasing the contaminated logs and possible error messages generated in the attack process.

v The attacker makes changes to the system configuration such that it does not log the future

activities. By manipulating and tweaking event logs, the attacker tricks the system administrator into believing that there is no malicious activity in the system and that no intrusion or compromise has taken place.

The main activities that an attacker performs toward removing his/her traces on a computer are as follows:

• Disabling auditing
  • If auditing is disabled, attacker can deprive system owner of ability to detect activities that have been carried out.
• Data hiding
  • Hiding files placed on the system
  • Can use file attributes and Alternate Data Streams to hide files
• Clearing Logs
  • An attacker clears/deletes the system log entries corresponding to his/her activities.

The various countermeasures to overcome covered tracks are as follows:

• Activate the logging functionality on all critical systems. ▪ Conduct periodic audits on IT systems to ensure that the logging functionality is in accordance with the security policy.
• Ensure that new events do not overwrite old entries in the log files when the storage limit is exceeded.
• Configure the appropriate and minimal permissions necessary to read and write log files stored in critical systems
• Maintain a separate logging server in the DMZ so that all critical servers such as DNS server, mail server, and web server forward and store their logs on that server.

• Close all unused open ports and services.
• Encrypt the log files stored in the system so that they cannot be altered without an appropriate decryption key.
• Set log files to the “append only” mode to prevent the unauthorized deletion of log entries.
• Periodically back up the log files to unalterable media. ▪ Use restricted

ACLs to secure the log files.