CompTIA Security+ Certification Study Guide
This page intentionally left blank
CompTIA Security+ Certification Study Guide Exam SYO-201 3E
Ido Dubrawsky Naomi J. Alpern, Michael Cross, Jeremy Faircloth, Kevvie Fowler, Michael Gregg, Mark Horninger, Eric Irvin, Alun Jones, Mohan Krishnamurthy, Kenneth Majors, Tony Piltzecker and David K. Wallace
AMSTERDAM • BOSTON • HEIDELBERG • LONDON NEW YORK • OXFORD • PARIS • SAN DIEGO SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO Syngress is an imprint of Elsevier
SYNGRESS®
Elsevier, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents.The Work is sold AS IS and WITHOUT WARRANTY.You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable care, including backup and other appropriate precautions, when working with computers, networks, data, and files. Syngress Media®, Syngress®,“Career Advancement Through Skill Enhancement®,”“Ask the Author UPDATE®,” and “Hack Proofing®,” are registered trademarks of Elsevier, Inc.“Syngress:The Definition of a Serious Security Library™,”“Mission Critical™,” and “The Only Way to Stop a Hacker is to Think Like One™” are trademarks of Elsevier, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. PUBLISHED BY Syngress Publishing, Inc. Elsevier, Inc. 30 Corporate Drive Burlington, MA 01803 CompTIA Security+ Certification Study Guide Copyright © 2009 by Elsevier, Inc. All rights reserved. Printed in the United States of America. Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication. ISBN 13: 978-1-59749-426-7 Publisher: Acquisitions Editor: Technical Editor: Developmental Editor: Indexer:
Laura Colantoni Rachel Roumeliotis Ido Dubrawsky Gary Byrne diacriTech
Project Manager: Page Layout and Art: Copy Editors: Cover Designer:
Andre Cuello diacriTech diacriTech Alisa Andreola
For information on rights, translations, and bulk sales, contact Matt Pedersen, Commercial Sales Director and Rights, at Syngress Publishing; email:
[email protected]. Library of Congress Cataloging-in-Publication Data Dubrawsky, Ido. The CompTIA Security+ Certification Guide / Ido Dubrawsky. p. cm. ISBN 978-1-59749-426-7 1. Electronic data processing personnel—Certification. 2. Computer security—Examinations—Study guides. 3. Computer networks—Security measures—Examinations—Study guides. I.Title. QA76.3.D77 2009 005.8—dc22 2009018985 Printed in the United States of America 1234567890
Contents About the Authors....................................................................................................xvii
PART 1 Systems Security CHAPTER 1 Systems Security Overview............................................................... 3 Introduction........................................................................................3 Security Threats..................................................................................4 Privilege Escalation........................................................................4 Viruses and Worms........................................................................5 Trojan...........................................................................................14 Spyware and Adware...................................................................14 Rootkits and Botnets....................................................................19 Logic Bombs................................................................................21 Hardware and Peripheral Security Risks..........................................22 BIOS.............................................................................................22 USB Devices.................................................................................25 Cell Phones..................................................................................28 Removable Storage Devices.........................................................30 Network-Attached Storage...........................................................35 Summary of Exam Objectives..........................................................35 Exam Objectives Fast Track..............................................................36 Security Threats...........................................................................36 Hardware and Peripheral Security Risks.....................................37 Exam Objectives Frequently Asked Questions.................................38 Self Test.............................................................................................39 Self Test Quick Answer Key.............................................................42
CHAPTER 2 OS Hardening................................................................................ 43 Introduction......................................................................................43 General OS Hardening......................................................................44 MAC/DAC/RBAC..........................................................................44 Services........................................................................................48 File System...................................................................................49 Hotfixes/Patches..........................................................................51 Service Packs/Maintenance Updates...........................................53 Patch Management......................................................................54 Windows Group Policies.............................................................55 Creating a Policy..........................................................................56
v
vi Contents
Security Templates......................................................................58 Configuration Baselines...............................................................61 Server OS Hardening........................................................................65 Nonessential Services..................................................................66 Nonessential Protocols................................................................66 Disabling Nonessential Processes...............................................67 Disabling Nonessential Programs................................................67 FTP Servers..................................................................................67 DNS Servers.................................................................................68 Network News Transfer Protocol Servers...................................69 File and Print Servers...................................................................69 DHCP Servers...............................................................................71 Data Repositories.........................................................................72 Workstation OS.................................................................................75 Summary of Exam Objectives..........................................................76 Exam Objectives Fast Track..............................................................76 General OS Hardening.................................................................76 Workstation OS............................................................................77 Exam Objectives Frequently Asked Questions.................................77 Self Test.............................................................................................78 Self Test Quick Answer Key.............................................................81
CHAPTER 3 Application Security...................................................................... 83 Introduction......................................................................................83 Threats Are Moving “Up the Stack”..................................................84 Rationale......................................................................................85 Threat Modeling..........................................................................86 Application Security Threats............................................................88 Browser........................................................................................88 Configuring Security Zones.........................................................95 Buffer Overflows.......................................................................109 Instant Messaging (IM).............................................................. 112 Peer-to-Peer................................................................................ 114 SMTP Open Relays..................................................................... 116 Summary of Exam Objectives........................................................ 117 Exam Objectives Fast Track............................................................ 118 Threats Are Moving “Up the Stack”.......................................... 118 Application Security Threats..................................................... 118 Exam Objectives Frequently Asked Questions............................... 118 Self Test........................................................................................... 119 Self Test Quick Answer Key...........................................................123 References.......................................................................................123
Contents vii
Chapter 4 Implementing System Security Applications.................................. 125 Host Intrusion Detection System....................................................125 Signature Based.........................................................................127 Behavior Based..........................................................................129 Personal Software Firewall.............................................................132 Windows XP Firewall................................................................133 Windows Vista Firewall.............................................................133 Configuring the Windows Firewall...........................................134 Advanced Configuration of the Windows Firewall................... 143 CheckPoint ZoneAlarm............................................................. 172 Antivirus.........................................................................................182 Viruses, Worms, and Trojan Horses..........................................183 Spyware and Adware.................................................................190 Prevention and Response.......................................................... 192 Windows Defender.................................................................... 193 Using Windows Defender..........................................................194 How to Use the Windows Defender Software Explorer...........195 Antispam.........................................................................................196 Pop-Up Blockers.............................................................................198 12Ghosts Popup-Killer...............................................................198 Yahoo! Anti-Spy Toolbar............................................................199 Google Toolbar..........................................................................202 Mozilla Firefox...........................................................................203 Summary of Exam Objectives........................................................203 Exam Objectives Fast Track............................................................204 Host Intrusion Detection System...............................................204 Personal Software Firewalls......................................................205 Antivirus....................................................................................205 Antispam....................................................................................206 Pop-Up Blockers........................................................................206 Exam Objectives Frequently Asked Questions...............................206 Self Test...........................................................................................208 Self Test Quick Answer Key........................................................... 211
CHAPTER 5 Virtualization Technologies.......................................................... 213 Introduction.................................................................................... 213 The Purpose of Virtualization........................................................ 213 Benefits of Virtualization................................................................ 214 Types of Virtualization.............................................................. 217 Designing a Virtual Environment..............................................221
viii Contents
System Virtualization......................................................................227 Management of Virtual Servers.................................................230 Application Virtualization..............................................................230 Terminal Services (Remote Desktop Services).........................232 XenApp......................................................................................233 Application Streaming...............................................................233 Summary of Exam Objectives........................................................235 Exam Objectives Fast Track............................................................237 The Purpose of Virtualization...................................................237 Benefits of Virtualization...........................................................237 System Virtualization.................................................................237 Application Virtualization.........................................................238 Exam Objectives Frequently Asked Questions...............................238 Self Test...........................................................................................240 Self Test Quick Answer Key...........................................................245
PART 2 Network Infrastructure CHAPTER 6 Network Security......................................................................... 249 Introduction....................................................................................249 General Network Security..............................................................250 Network Services and Risks Associated with Them.................250 Network Design Elements.........................................................250 Network Security Tools..................................................................250 Intrusion Detection and Prevention Systems............................ 251 Installing WinDUMP for Packet Capture and Analysis.............254 Firewalls.....................................................................................255 Honeypots..................................................................................262 Install a HoneyPot......................................................................265 Content Filters...........................................................................267 Protocol Analyzers.....................................................................267 Network Ports, Services, and Threats............................................267 Network Ports and Protocols....................................................268 Scanning for Vulnerabilities......................................................270 Network Threats........................................................................ 274 ARP Spoofing.............................................................................277 Network Design Elements and Components.................................281 What Is a DMZ?..........................................................................289 Subnets.......................................................................................295 VLANs........................................................................................296 Network Address Translation....................................................297
Contents ix
Network Access Control/Network Access Protection..............300 Telephony..................................................................................301 Summary of Exam Objectives........................................................302 Exam Objectives Fast Track............................................................302 General Network Security.........................................................302 Network Security Tools.............................................................303 Network Ports, Services, and Threats.......................................303 Network Design Elements and Components............................303 Exam Objectives Frequently Asked Questions...............................303 Self Test...........................................................................................304 Self Test Quick Answer Key...........................................................307
Chapter 7 Wireless Networks....................................................................... 309 Introduction....................................................................................309 Wireless Network Design............................................................... 310 Wireless Communications......................................................... 310 Spread Spectrum Technology.................................................... 311 Wireless Network Architecture................................................. 313 CSMA/CD and CSMA/CA.......................................................... 314 Service Set ID Broadcast................................................................. 315 Wireless Security Standards........................................................... 316 Security of 40-Bit versus 104-Bit Keys....................................... 317 WPA and WPA2......................................................................... 318 Wireless Application Protocol................................................... 318 Wireless Transport Layer Security............................................ 319 Authentication........................................................................... 319 Rogue APs.......................................................................................325 Data Emanation...............................................................................326 Bluetooth........................................................................................327 Summary of Exam Objectives........................................................327 Exam Objectives Fast Track............................................................329 Wireless Network Design..........................................................329 Service Set ID Broadcast............................................................330 Wireless Security Standards......................................................330 Rogue APs.................................................................................. 331 Data Emanation.......................................................................... 331 Bluetooth................................................................................... 331 Exam Objectives Frequently Asked Questions............................... 331 Self Test...........................................................................................333 Self Test Quick Answer Key...........................................................335 References.......................................................................................335
x Contents
PART 3 Access Control Chapter 8 Network Access........................................................................... 339 Introduction....................................................................................339 General Network Access................................................................340 Access Control...........................................................................340 Access Control Models...............................................................341 Authentication Models and Components..................................344 Identity.......................................................................................349 Access Control Methods and Models..............................................349 Implicit Deny.............................................................................349 Separation of Duties..................................................................349 Least Privilege............................................................................350 Job Rotation............................................................................... 351 MAC........................................................................................... 351 DAC............................................................................................353 Viewing DAC Settings................................................................354 Role-Based Access Control (RBAC)........................................... 355 Access Control Organization..........................................................357 Security Groups.........................................................................357 Security Controls.......................................................................358 Logical Access Control Methods....................................................360 ACLs...........................................................................................360 Group Policies...........................................................................361 Domain Policies.........................................................................361 Time of Day Restrictions...........................................................362 Account Expiration....................................................................362 Logical Tokens...........................................................................362 Physical Access Security Methods..................................................363 Access Lists and Logs.................................................................366 Hardware Locks.........................................................................366 ID Badges...................................................................................367 Door Access Systems.................................................................368 Mantrap......................................................................................369 Video Surveillance.....................................................................370 Summary of Exam Objectives........................................................370 Exam Objectives Fast Track............................................................ 371 General Network Access........................................................... 371 Access Control Methods and Models......................................... 371 Access Control Organization.....................................................372 Logical Access Control Methods...............................................372 Physical Access Security Methods.............................................372
Contents xi
Exam Objectives Frequently Asked Questions...............................372 Self Test........................................................................................... 375 Self Test Quick Answer Key...........................................................379
Chapter 9 Network Authentication................................................................ 381 Introduction....................................................................................381 Introduction to AAA..................................................................381 Access Control...........................................................................382 Authentication...........................................................................383 Auditing.....................................................................................383 Authentication Methods.................................................................383 One-Factor.................................................................................384 Two-Factor.................................................................................386 Three-Factor..............................................................................387 Single Sign-On............................................................................388 Authentication Systems..................................................................388 Remote Access Policies and Authentication..............................389 Biometrics..................................................................................389 RADIUS......................................................................................390 Kerberos....................................................................................393 LDAP..........................................................................................396 Password Authentication Protocol............................................402 Challenge Handshake Authentication Protocol.........................402 TACACS/TACACS+.....................................................................403 Mutual Authentication...............................................................405 802.1x Methods.........................................................................406 Extensible Authentication Protocol...........................................409 Protected EAP............................................................................ 411 Summary of Exam Objectives........................................................ 413 Exam Objectives Fast Track............................................................ 414 Authentication Methods............................................................ 414 Authentication Systems............................................................. 414 Exam Objectives Frequently Asked Questions............................... 415 Self Test........................................................................................... 416 Self Test Quick Answer Key........................................................... 419
PART 4 Assessments and Audits CHAPTER 10 Risk Assessment and Risk Mitigation............................................ 423 Introduction....................................................................................423 Conduct Risk Assessments and Implement Risk Mitigation..........424 Vulnerability Assessment Tools.................................................424 Packet Sniffing...........................................................................424
xii Contents
Password Crackers.....................................................................428 Network Mapping Tools............................................................429 Use Monitoring Tools on Systems and Networks...........................430 Workstations.............................................................................. 431 Performing a Simple Metasploit Attack.....................................432 Logging and Auditing.....................................................................441 Auditing Systems........................................................................441 Configuring Auditing in Microsoft Windows............................443 Preventing Access to a Computer Using Password-Protected Screensavers............................................. 451 Audits.............................................................................................. 452 Summary of Exam Objectives........................................................ 452 Exam Objectives Fast Track............................................................ 452 Conduct Risk Assessments and Implement Risk Mitigation........................................................................... 452 Use Monitoring Tools on Systems and Networks......................453 Exam Objectives Frequently Asked Questions...............................453 Self Test...........................................................................................454 Self Test Quick Answer Key...........................................................457 References.......................................................................................457
PART 5 Cryptopgraphy Chapter 11 General Cryptographic Concepts................................................... 461 Introduction....................................................................................461 General Cryptography....................................................................462 Symmetric Key Cryptography...................................................462 Asymmetric Key Cryptography.................................................464 Hashes and Applications............................................................464 Digital Signatures.......................................................................468 Certificates.................................................................................469 Confidentiality, Integrity, and Availability—For All Your Security Needs...........................................................................473 Nonrepudiation.........................................................................475 Comparative Strength of Algorithms.........................................475 Key Management.......................................................................476 Encryption Algorithms...................................................................477 DES.............................................................................................477 Triple DES..................................................................................479 RSA.............................................................................................479 Advanced Encryption Standard.................................................480 Elliptic Curve Cryptography.....................................................480
Contents xiii
One-Time Pads...........................................................................480 Transmission Encryption...........................................................481 Protocols.........................................................................................482 Cryptographic Protocols...........................................................483 Cryptography in Operating Systems..............................................494 File and Folder Encryption........................................................494 E-mail.........................................................................................496 Whole Disk Encryption.............................................................497 TPM............................................................................................498 Summary of Exam Objectives........................................................499 Exam Objectives Fast Track............................................................499 General Cryptography...............................................................499 Encryption Algorithms..............................................................500 Protocols....................................................................................500 Cryptography in Operating Systems.........................................500 Exam Objectives Frequently Asked Questions...............................501 Self Test...........................................................................................504 Self Test Quick Answer Key...........................................................507
CHAPTER 12 Public Key Infrastructure.............................................................. 509 Introduction....................................................................................509 PKI Overview................................................................................. 510 PKI Encryption.......................................................................... 510 PKI Standards............................................................................ 513 PKI Solutions............................................................................. 514 Components of PKI........................................................................ 516 Digital Certificates..................................................................... 518 Reviewing a Digital Certificate.................................................. 519 Certificate Authority..................................................................525 Certificate Revocation List (CRL)..............................................527 Key Escrow................................................................................529 Registration..................................................................................... 531 Recovery Agents............................................................................. 531 Implementation..............................................................................533 Certificate Management.................................................................534 Summary of Exam Objectives........................................................536 Exam Objectives Fast Track............................................................537 PKI Overview............................................................................537 Components of PKI...................................................................537 Registration................................................................................537 Recovery Agents........................................................................537
xiv Contents
Implementation.........................................................................538 Certificate Management............................................................538 Exam Objectives Frequently Asked Questions...............................538 Self Test...........................................................................................539 Self Test Quick Answer Key...........................................................542
PART 6 Organizational Security CHAPTER 13 Redundancy Planning.................................................................. 545 Introduction....................................................................................545 Alternate Sites.................................................................................545 Hot Site.......................................................................................547 Warm Site...................................................................................547 Cold Site.....................................................................................547 Redundant Systems.........................................................................548 Servers.......................................................................................549 Connections...............................................................................550 Internet Service Provider..........................................................550 Redundant Arrays of Inexpensive Disks........................................ 551 Spare Parts...................................................................................... 552 Backup Generator...........................................................................554 Uninterruptible Power Supply........................................................554 Summary of Exam Objectives........................................................ 555 Exam Objectives Fast Track............................................................ 555 Alternate Sites............................................................................ 555 Redundant Systems....................................................................556 Redundant Arrays of Inexpensive Disks...................................556 Spare Parts.................................................................................557 Backup Generator......................................................................557 Uninterruptible Power Supply...................................................558 Exam Objectives Frequently Asked Questions...............................558 Self Test...........................................................................................559 Self Test Quick Answer Key...........................................................562
CHAPTER 14 Controls and Procedures.............................................................. 563 Introduction....................................................................................563 Environmental Controls.................................................................563 Fire Suppression........................................................................564 HVAC..........................................................................................566 Shielding....................................................................................568 Implementing Disaster Recovery and Incident Response Procedures.....................................................................570
Contents xv
Disaster Recovery......................................................................571 Incident Response.....................................................................576 Defending against Social Engineering.......................................587 Summary of Exam Objectives........................................................593 Exam Objectives Fast Track............................................................593 Environmental Controls............................................................593 Implementing Disaster Recovery and Incident Response Procedures.................................................................................594 Exam Objectives Frequently Asked Questions...............................596 Self Test...........................................................................................596 Self Test Quick Answer Key.......................................................... 600
CHAPTER 15 Legislation and Organizational Policies........................................ 601 Introduction....................................................................................601 Secure Disposal of Systems............................................................602 Retention/Storage......................................................................603 Destruction................................................................................604 Acceptable Use Policies..................................................................605 Password Complexity.....................................................................607 Strong Passwords...................................................................... 608 Password Changes and Restrictions......................................... 608 Using Passwords as Part of a Multifaceted Security System..........................................................................609 Administrator Accounts.............................................................609 Change Management...................................................................... 610 Information Classification.............................................................. 610 Vacations......................................................................................... 612 Separation of Duties.................................................................. 613 Personally Identifiable Information................................................ 614 Privacy....................................................................................... 614 Due Care......................................................................................... 616 Due Process.................................................................................... 617 Due Diligence................................................................................. 618 Service Level Agreements............................................................... 618 User Education and Awareness Training........................................620 Communication......................................................................... 621 User Awareness..........................................................................622 Education...................................................................................623 Online Resources.......................................................................625 Security-Related HR Policies...........................................................625 Code of Ethics............................................................................627
xvi Contents
Summary of Exam Objectives........................................................627 Exam Objectives Fast Track............................................................628 Exam Objectives Frequently Asked Questions...............................629 Self Test...........................................................................................630 Self Test Quick Answer Key...........................................................634 Appendix......................................................................................................... 635 Index................................................................................................................ 741
About the Authors Technical Editor Ido Dubrawsky (CISSP, Security+, CCNA) is the Chief Security Advisor for Microsoft’s Communication Sector Americas division. His responsibilities include providing subject matter expertise on a wide range of technologies with customers as well as discussions on policy, regulatory concerns, and governance. Prior to working at Microsoft, Ido was the acting Security Consulting Practice Lead at AT&T’s Callisma subsidiary and a Senior Security Consultant where he as tasked with helping to rebuild the practice. Ido has held a wide range of previous roles including Network Security Architect for Cisco Systems Inc. on the SAFE Architecture Team. He has worked in the systems and network administration field for almost 20 years in a variety of environments from government to academia to private enterprise and has a wide range of experience in various networks, from small to large and relatively simple to complex. Ido is the primary author of three major SAFE white papers and has written, and spoken, extensively on security topics. He has been a regular contributor to the Security Focus Web site on a variety of topics covering security issues. He holds a B.Sc. and an M.Sc. in Aerospace Engineering from the University of Texas at Austin.
Contributing Authors Naomi J. Alpern currently works for Microsoft as a consultant specializing in unified communications. She holds many Microsoft certifications, including an MCSE and MCT, as well as additional industry certifications such as Citrix Certified Enterprise Administrator, Security+, Network+, and A+. Since the start of her technical career, she has worked in many facets of the technology world, including IT administration, technical training, and, most recently, full-time consulting. She likes to spend her time reading cheesy horror and mystery novels when she isn’t browsing the Web. She is also the mother of two fabulous boys, Darien and Justin, who mostly keep her running around like a headless chicken. Michael Cross (MCSE, MCP+I, CNA, Network+) is an internet specialist/programmer with the Niagara Regional Police Service. In addition to designing and maintaining the Niagara Regional Police’s Web site (www.nrps.com) and intranet, he has also provided support and worked in the areas of programming, hardware, database administration, graphic design, and network administration. In 2007, he was awarded a Police Commendation for the work he did in developing a system to track high-risk offenders and sexual offenders in the Niagara Region. As part of an IT team that provides support to a user base of over 1000 civilian and uniformed users, his theory is that when the users carry guns, you tend to be more motivated in solving their problems.
xvii
xviii About the Authors
Michael was the first computer forensic analyst in the Niagara Regional Police Service’s history, and for five years, he performed computer forensic examinations on computers involved in criminal investigations. The computers he examined for evidence were involved in a wide range of crimes, including homicides, fraud, and possession of child pornography. In addition to this, he successfully tracked numerous individuals electronically, as in cases involving threatening e-mail. He has consulted and assisted in numerous cases dealing with computer-related/Internet crimes and served as an expert witness on computers for criminal trials. Michael has previously taught as an instructor for IT training courses on the Internet, Web development, programming, networking, and hardware repair. He is also seasoned in providing and assisting in presentations on Internet safety and other topics related to computers and the Internet. Despite this experience as a speaker, he still finds his wife won’t listen to him. Michael also owns KnightWare, which provides computer-related services like Web page design, and Bookworms, which provides online sales of merchandise. He has been a freelance writer for over a decade and has been published over three dozen times in numerous books and anthologies. When he isn’t writing or otherwise attached to a computer, he spends as much time as possible with the joys of his life: his lovely wife, Jennifer; darling daughter Sara; adorable daughter Emily; charming son Jason; and beautiful and talented daughter Alicia. Jeremy Faircloth (Security+, CCNA, MCSE, MCP+I, A+, etc.) is a Senior Principal IT Technologist for Medtronic Inc., where he and his team architect and maintain enterprisewide client/server and Web-based technologies. He also acts as a technical resource for other IT professionals, using his expertise to help others expand their knowledge. As a systems engineer with over 18 years of real-world IT experience, he has become an expert in many areas, including Web development, database administration, enterprise security, network design, and project management. He currently lives in Minnesota with his wife, Christina, and son, Austin, both of whom support his lifestyle as a professional geek (which he greatly appreciates). Jeremy has contributed to several Syngress books, including Microsoft Log Parser Toolkit (Syngress, ISBN: 978-1-932266-52-8), Managing and Securing a Cisco SWAN (ISBN: 978-1-932266-91-7), C# for Java Programmers (ISBN: 978-1-931836-54-8), Snort 2.0 Intrusion Detection (ISBN: 978-1-931836-74-6), Perl Scripting for Windows Security (ISBN: 978-1-59749-173-0), and Security+ Study Guide & DVD Training System (ISBN: 978-1-931836-72-2). Kevvie Fowler (GCFA Gold, CISSP, MCTS, MCSD, MCSE) is the Director of Managed Security Services at TELUS, where he delivers specialized security, incident response, and forensic services. He is also the founder and principal consultant of Ringzero, a company focusing on the security and forensic analysis of Microsoft products. Kevvie is the author of SQL Server Forensic Analysis and the contributing author of How to Cheat at Securing SQL Server 2005, and The Best Damn Exchange, SQL, and IIS Book Period. In addition to writing books, he also reviews security- and
About the Authors xix
forensic-related book proposals for publishers and is a SANS GIAC Gold advisor who reviews and helps guide the direction of emerging security and forensic research. As an expert within the information security industry, Kevvie has presented at leading security conferences such as Black Hat and SecTor and is a member of the High Technology Crime Investigation Association. Michael Gregg (CISSP, CISA, CISM, MCSE, MCT, CTT+, A+, N+, Security+, CNA, CCNA, CIW Security Analyst, CCE, CEH, CHFI, DCNP, ES Dragon IDS) is the founder and Chief Technology Officer of Superior Solutions Inc., a Houston-based IT security consulting firm. Superior Solutions performs security assessments and penetration testing for Fortune 1000 firms. Michael is responsible for working with organizations to develop cost-effective and innovative technology solutions to security issues and for evaluating emerging technologies. Michael supervises client engagements to ensure high-quality solutions are developed for software design issues, systems administration concerns, policy development, and security systems testing. Michael has more than 20 years of experience in the IT field and holds two associate’s degrees, a bachelor’s degree, and a master’s degree. He has written or cowritten a number of other books, including Que’s Certified Ethical Hacker Exam Prep 2 and Wiley’s How to Build Your Own Network Security Lab. He is a member of the American College of Forensic Examiners, the Independent Computer Consulting Association, and speaks at many security conferences and events. Mark Horninger (A+, Net+, Security+, MCSE+I, MCSD, MCAD, MCDBA, MCTS, MCITP, MCPD) is manager of database operations at Internet Pipeline Inc. He is also the founder of Haverford Consultants Inc. (www.haverford-consultants.com/), located in the suburbs of Philadelphia, PA. He develops custom applications and system engineering solutions, specializing primarily in Microsoft .NET technology and Microsoft SQL Server. He is a contributing author to Securing SQL 2005, Configuring and Troubleshooting Windows XP Professional MCSE Windows 2000 Professional Study Guide, and Designing SQL Server 2000 Databases for .NET Enterprise Servers published by Syngress, an imprint of Elsevier Inc. Mark has also served as an adjunct professor at Kaplan University teaching Web design. Mark has over 20 years of computer consulting experience and has passed 50+ Microsoft certification exams. He lives with his wife, Debbie, and son, Robby, in the Philadelphia area. C. Eric Irvin (CISSP, MCITP: Enterprise Admin, MCSE, MCSA, CCNA) is a Security Engineering Analyst for Blue Cross and Blue Shield of Alabama, and consultant for IrvTech, LLC. He specializes in security project management, as well as end-user security awareness, and security compliance assurance. He specializes in Cisco routers, switches, and VPN solutions. His focus is in providing business-enablement solutions that provide functionality and security to the customers of his organization. Eric holds a bachelor’s degree from Amridge University, and is a member of Infragard and the Information Systems Security Association. He volunteers his
xx About the Authors
security background with local municipal government organizations. Eric currently resides in Birmingham, Alabama. Eric wrote the practice exam questions for this book. Alun Jones (MVP, MCP) is the President of Texas Imperial Software. Texas Imperial Software develops secure networking software and provides security engineering consulting services. Texas Imperial Software’s flagship product is WFTPD Pro, a secure FTP server for Windows, written entirely by Alun. Alun entered the security engineering field as more and more of WFTPD’s support needs indicated that few companies were trying to meet their needs for security on the Internet. His current day job is as an Information Systems Security Engineer at Premera Blue Cross, a health insurance provider based in the Pacific Northwest of the USA. Alun has attended, but not completed, university at Corpus Christi College, Cambridge, and Bath University, and now lives in Seattle, Washington, with his wife, Debbie, and son, Colin. Mohan Krishnamurthy Madwachar is the GM–Network Security at Almoayed Group in Bahrain. Mohan is a key contributor to Almoayed Group’s projects division and plays an important role in the organization’s security initiatives including network, information, and physical security. Mohan has a strong networking, security, and training background. His tenure with companies such as Schlumberger Omnes and Secure Network Solutions India adds to his experience and expertise in implementing large and complex network and security projects. Mohan holds leading IT industry-standard and vendor certifications in systems, networking, and security. Mohan would like to dedicate his contributions to this book to his beloved wife Pallavi. Mohan has coauthored six books published by Syngress: Designing & Building Enterprise DMZs (ISBN:1597491004), Configuring Juniper Networks NetScreen & SSG Firewalls (ISBN:1597491187), How to Cheat at Securing Linux (ISBN: 1597492078), How to Cheat at Administering Office Communications Server 2007 (ISBN:1597492126), Microsoft Forefront Security Administration Guide (ISBN: 1597492447), and The Real MCTS/MCITP Windows Server 2008 Configuring Applications Infrastructure Exam 70-643 Prep Kit (ISBN:1597492478). He also writes in newspaper columns on various subjects and has contributed to leading content companies as a technical writer and a subject matter expert. Kenneth Majors (MCSE, MCSA, Project+, VMware VCP, Citrix CCEA, CCA) is a Senior Technology Advisor for Choice Solutions LLC. Choice Solutions is a systems integrator headquartered in Overland Park, Kansas. Choice Solutions provides IT design, project management, and support for enterprise computing systems. Kenneth is a key contributor to defining best practices for Microsoft technologies including Windows Server, Hyper-V and SharePoint, Citrix XenApp, XenServer, and XenDesktop, VMware ESX and VDM, and development of documentation
About the Authors xxi
standards. As such, he develops technology solutions and methodologies focused on improving client business processes.These technology solutions touch every part of a system’s lifecycle—from assessment, blueprint, construct, and deployment on projects to operational management and strategic planning for the business process. Kenneth holds a bachelor’s degree from Colorado Technical University. He currently resides in Olathe, Kansas, with his loving and supportive wife, Sandy, and near their children, Tabitha and Keith, and their grandsons, Wesley “Peanut” and Austin. Tony Piltzecker (CISSP, MCSE, CCNA, CCVP, Check Point CCSA, Citrix CCA), author and technical editor of Syngress Publishing’s MCSE Exam 70-296 Study Guide and DVD Training System and How to Cheat at Managing Microsoft Operations Manager 2005, is an independent consultant based in Boston, Massachusetts. Tony’s specialties include network security design, Microsoft operating system and applications architecture, and Cisco IP telephony implementations. Tony’s background includes positions as systems practice manager for Presidio Networked Solutions, IT manager for SynQor Inc., network architect for Planning Systems Inc., and senior networking consultant with Integrated Information Systems. Along with his various certifications, Tony holds a bachelor’s degree in business administration. Tony currently resides in Leominster, Massachusetts, with his wife, Melanie, and his daughters, Kaitlyn and Noelle. David K. Wallace is Director of Network Operations and Chief Security Officer for Internet Pipeline, the leader in SAS that supports marketing, selling, and processing solutions for the nation’s top insurance carriers and producers, David oversees all data center operations, infrastructure, business continuity planning, and security. He brings to iPipeline over 15 years of systems and management experience. Since joining iPipeline, David’s team has implemented multiple security enhancements and programs (HIPAA Compliance), infrastructure upgrades, and VMware to provide scalability and redundancy of Internet Pipeline’s services. iPipeline’s infrastructure growth and scalability are key as they continue to bring cutting edge technology to the insurance and financial markets. Prior to iPipeline, David spent seven years as the Director of Information Technology at ICG Commerce in King of Prussia, Pennsylvania. ICG Commerce is one of the largest and most successful Procurement Outsourcing Providers in the world. There he built their data center capabilities from scratch to a 24 × 7 fully redundant network and systems that are utilized throughout the world. David holds a bachelor’s degree in business administration and a minor in information systems. He is currently working on an M.B.A. from Villanova University, Villanova, Pennsylvania. David lives in Ardmore, Pennsylvania, a suburb just outside of Philadelphia. He would like to thank his nine nieces and nephews (Ben, Claire, Fiona, Owen, Jane, Gavin, Kieran, Colin, and Torin) for all their love, support, and the joy they add to his life.
This page intentionally left blank
PART
Systems Security
1
This page intentionally left blank
CHAPTER
Systems Security Overview
1
E x a m o b j e c tiv e s in this c hapt e r Security Threats..................................................................................................................... 4 Hardware and Peripheral Security Risks................................................................................ 22
Introduction There are security risks to almost any system. Any computer, network, or device that can communicate with other technologies either allows software to be installed or is accessible to groups of people and, therefore, faces an increasing number of potential threats. The system may be at risk of unauthorized access, disclosure of information, destruction or modification of data, code attacks through malicious software, or any number of other risks discussed in this book. Some of the most common threats to systems come in the form of malicious software, which is commonly referred to as malware. Malware programs are carefully crafted, written, and designed by attackers to compromise security and/or do damage. These programs are written to be independent and do not always require user intervention or for the attacker to be present for their damage to be done. Among the many types of malware, the ones we will look at in this chapter are viruses, worms, Trojan horses, spyware, adware, logic bombs, and rootkits. Every year, an increasing number of devices are at risk. The communication methods and functionality traditionally associated with computers have expanded over the years, moving from stand-alone computers to networks to mobile devices. The core components of a computer, like the basic input/output system (BIOS), can be compromised, and the data stored on network and removable devices can be stolen, corrupted, or destroyed. In addition, there are other technologies that can be threatened by attacks and malicious software. Every year more Universal Serial Bus (USB) devices are introduced into the market, and these devices can either be used to disseminate malicious code or be damaged by attacks, while software installed on cell phones can be just as vulnerable to viruses as programs running on computers. Preparing for potential threats requires understanding what devices exist in your organization and taking the appropriate steps to ensure their security.
3
4 CHAPTER 1 Systems Security Overview
Security Threats In terms of computers and networks, security is the process of protecting systems and data from unauthorized access, from malicious users and software, and from other threats that could result in the loss of integrity, damage, or loss of data and equipment. Securing systems requires safeguarding not only data but also the equipment on which this information resides on and is transmitted across. To do this, companies may incorporate a wide variety of security measures, including cameras to monitor and prevent damage and theft of computers, peripherals, media, and other technology. They will also hire professionals with a level of expertise in using firewalls and other software to protect data. Threats can come from internal and external sources, and both can be equally dangerous. System administrators commonly deal with external threats, but may overlook an organization’s internal threats. While it’s important to set up firewalls to protect against hackers and virus-infected file attachments in e-mail, this action would do nothing against a disgruntled or uneducated employee who could insert a USB flash drive into a computer and release a virus or unwittingly install a program that sends sensitive information to a third party. When you are protecting an organization against threats, it is important to identify the sources so that you can then set up appropriate countermeasures. There are many reasons why these threats exist to various systems. Programming students may merely want to exercise their skills and prove they can write the code that creates a virus, whereas other groups may have a particular agenda in destroying data. Other people may use a variety of tools and skills to gain entry to systems, with some of them simply satisfying the curiosity of wanting to see what they’re not supposed to see. Others will attempt to perform these actions for financial motivation, such as in cases of corporate espionage, blackmail, or other criminal activities. All of these threats have one thing in common, however … it’s up to you to understand and stop them from harming your organization.
Privilege Escalation Privilege escalation occurs when a user acquires greater permissions and rights than he or she was intended to receive. Of course, network administrators can make mistakes and assign a user greater privilege than originally intended, but the major threat we’ll discuss here comes from software. A user could gain unauthorized access and elevated privileges through bugs or backdoors in programs. Bugs are errors in software, causing the program to function in a manner that wasn’t intended. Backdoors are methods of accessing a system in a manner that bypasses normal authentication methods. For example, a developer may include a backdoor into a program, so that he or she can gain access to an application when it’s being debugged. Unfortunately, if the backdoor remains after the software is released or bugs don’t get fixed, a hacker or other unauthorized user can exploit these vulnerabilities and gain greater access to systems, such as having administrator access to the system.
Security Threats 5
Preventing privilege escalation from occurring relies on the software developer providing good support, and system administrators being diligent in keeping up-to-date on any security issues and fixes available for software on systems. Programmers need to ensure that after a program has been debugged, any backdoors in the software have been removed. If the software has already been released and a developer discovers any backdoors and/or errors in the code, these need to be reported to the development team so that a patch can be created that will fix the problem. System administrators should check the software vendor’s Web site to see if any patches or security updates are available. These should then be downloaded and installed on systems to fix any problems. For example, Microsoft regularly provides fixes to potential security problems on its Windows Update Web site (http://windowsupdate.microsoft.com), which can automatically scan your computer to identify if there are any patches or updates that need to be applied to Microsoft products.
Viruses and Worms Malicious software has appeared in many forms over the decades, but the problem has increased as more computers and devices communicate with one another. Before networking became common, a person transferring data needed to physically transport software between machines, often using floppy disks or other removable media. Malicious software could write itself to the media without the user’s knowledge, but the chances of this event occurring in a secure environment was minimal. After all, without networks, data was being passed from one computer within an organization to another, with minimum connectivity to the outside world. Unless an employee wrote malicious code or accidentally acquired one from a vendor or client, there was little chance of being infected. This changed dramatically with the widespread use of networking (especially the Internet), where exploitable vulnerabilities, file sharing, or e-mail attachments make it very easy for malware to disseminate. There are many different types of malicious code that are written with the intention of causing damage to systems, software, and data.The code may be used to target a particular person or organization, but in most cases, it is a mass attack; whoever comes in contact with it becomes a victim. While we’ll discuss many different types of malicious code in the pages that follow and see how they can wreak havoc on networks and computers, two of the most common forms are viruses and worms.
Head of the Class Viruses, Worms, and Removal Information A good resource for keeping up-to-date on the latest threats, risks, and vulnerabilities is Symantec’s Threat Explorer site at www.symantec.com/norton/security_response/threatexplorer/ index.jsp. At this site, you can view information on new threats, and browse or search Symantec’s database for information on viruses, worms, and other malicious software. When
6 CHAPTER 1 Systems Security Overview
looking at a particular virus in the database, you’ll find information on how significant a threat the worm or virus is, the technical details about the worm or virus, and information on how to remove the worm or virus from a system.
Viruses Viruses are probably the most well-known type of malicious code. A computer virus is defined as a self-replicating computer program that interferes with the hardware, software, or operating system (OS) of a computer. It is code that has the primary purpose of creating a copy of itself that attaches to other files. These code segments contain enough information to replicate and perform other damage, such as deleting or corrupting important files on your system. Like any other computer program, a virus must be executed to function (it must be loaded into the memory of the computer) and then the computer must follow the virus’s instructions. Those instructions constitute the payload of the virus. The payload may disrupt or change data files, display a message, or cause the OS to malfunction. Using this definition, let’s explore in more depth exactly what a virus does and what its potential dangers are. Viruses spread when the instructions (executable code) that run programs are transferred from one computer to another. A virus can replicate by writing itself to removable media, hard drives, or legitimate computer programs across the local network or even throughout the Internet. One positive aspect is that a computer attached to an infected computer network or one that downloads an infected program does not necessarily become infected. Remember, the code has to actually be executed before your machine can become infected. However, chances are good that if you download a virus to your computer and do not explicitly execute it, the virus may contain the logic to trick your OS into running the viral program. Other viruses exist that have the capability to attach themselves to otherwise legitimate programs. This could occur when programs are created, opened, or even modified. When the program is run, so is the virus. Let’s take a closer look at the following categories that a virus could fall under and the definitions of each: ■■
■■
■■
■■
Parasitic Parasitic viruses infect executable files or programs in the computer. This type of virus typically leaves the contents of the host file unchanged, but appends to the host in such a way that the virus code is executed first. Bootstrap sector Bootstrap sector viruses live on the first portion of the disk, known as the boot sector (this includes both hard disks and other removable media). This virus replaces either the programs that store information about the contents of the disk or the programs that start the computer. This type of virus is most commonly spread through the physical exchange of removable media. Multipartite Multipartite viruses combine the functionality of the parasitic virus and the bootstrap sector viruses by infecting either files or boot sectors. Companion A companion virus, instead of modifying an existing program, creates a new program with the same name as an already existing legitimate
Security Threats 7
rogram. It then tricks the OS into running the companion program, which p delivers the virus payload. ■■
■■
Link Link viruses function by modifying the way the OS finds a program, tricking it into first running the virus and then the desired program. This virus is especially dangerous, because entire directories can be infected. Any executable program accessed within the directory will trigger the virus. Data File A data file virus can open, manipulate, and close data files. Data file viruses are written in macro languages and automatically execute when the legitimate program is opened. A well-known type of data file virus is a macro virus, which can be embedded in such files as Microsoft Office documents and spreadsheets.
Hoax Viruses Hoax viruses are inauthentic warnings of viruses. These hoaxes consist of a warning designed to fool the recipient into believing that the virus is real. Although the viruses aren’t real, they can sometimes be as dangerous as the real thing. ■■
■■
■■
The warnings may provide instructions on how to “remove” the virus, informing the recipient to delete crucial files or make registry changes that may cause the OS or specific programs to fail. Users who become jaded by hoax viruses may begin to ignore legitimate warnings about real viruses. In some cases, a known virus hoax may be modified to include a real virus. For example, in March 1997, a hoax warning began to be distributed on America Online advising that an e-mail with the subject “aol4free.com” contained a virus that could delete files from your hard disk. This e-mail warning was a hoax. However, around the same time, someone attached a Trojan horse program named AOL4FREE.COM to the original hoax e-mail. People who believed the e-mail to be a hoax would click the attachment, executing the Trojan which invoked the DOS program DELTREE.exe to delete files from the victim’s hard disk.
Worms Worms are another common type of malicious code, and are often confused with viruses. A worm is a self-replicating program that does not alter files but resides in active memory and duplicates itself by means of computer networks. It can travel across a network from one computer to another, and in some cases, different parts of a worm run on different computers. Worms run automatically within the OSes and software and are invisible to the user. Often, worms aren’t even noticed on systems until the network resources are completely consumed or the victim PC’s performance is degraded to unusable levels. Some worms not only self-replicate but also contain a malicious payload. As we’ll see later in this chapter when we discuss botnets, some worms will create a backdoor that allows access to the computer. A backdoor is an undocumented and, generally,
8 CHAPTER 1 Systems Security Overview
an unauthorized way of gaining remote access to a computer. Once the system is compromised, the backdoor will listen for commands on a network port, allowing the computer to be accessed by a hacker or controlled by the worm’s creator. Exam Warning A worm can take down a system because it has the capability to replicate itself inside of the memory of the target computer. Once it uses up the memory, the system goes down. Similarly, the replication of worms across a network can use up bandwidth, causing any transmission of legitimate data across the network to slow dramatically.
Hackers create malicious worms that replicate wildly and can also exploit weaknesses in the OS and perform other harmful actions. Their capability to replicate quickly makes them an attractive tool for attackers. There are many ways in which worms can be transmitted, including e-mail, Internet chat rooms, peer-to-peer (P2P) programs, and of course the Internet.
Difference Between Viruses and Worms The distinction between viruses and worms has become blurred. Originally, the term worm was used to describe code that attacked multiuser systems (networks), whereas the term virus described programs that replicated on individual computers. However, these attributes are no longer the key factors that discriminate between the two, as both are used for widespread attacks and are commonly disseminated using networks like the Internet. However, while there are similarities between worms and viruses, there are also a number of key differences. Like a normal virus, worms replicate themselves to spread across the network. However, a virus needs a host application to transport itself, whereas worms are selfcontained. For example, a hacker may incorporate a virus in an executable, so that when someone executes the program, that person’s computer becomes infected. A worm, however, will replicate from system-to-system, and duplicates itself by means of computer networks. Worms use the facilities of an OS that are meant to be automatic and invisible to the user. It is common for worms to be noticed only when their uncontrolled replication consumes the resources of the system, which then slows or halts other tasks. Whereas a virus intends to damage the system and files stored there, a worm is intended to consume the resources on the system. A worm doesn’t alter the files on a computer, but will replicate to the point that network bandwidth is used up (making the network slow up) and/or use up memory on a machine until it finally shuts down. This results in a server crash that cannot be remedied until the worm has been removed from the system. Test Day Tip On the day of the exam, review the differences between viruses and worms. By understanding the differences, you will be able to identify whether a question is asking you about one or the other, and this knowledge may lead you toward the correct answer.
Security Threats 9
Virus Examples There are thousands of viruses that have been disseminated over the decades, resulting in innumerable annoying messages and damaged files on people’s computers. To understand some of the elements and damage caused by viruses, let’s look at a couple of the more recent ones: ■■
■■
In July 2008, the Repulik. A virus appeared, and it began infecting computers running Windows 9x, Windows NT, Windows ME, Windows 2000, Windows XP, Windows Server 2003, or Windows Vista. It infects files with the extensions .doc, .pps, .ppt, .rtf, and .xls (that is, Microsoft Office files) and renames the infected files as .vbs. This is the file extension for Visual Basic Script files, meaning that opening one of the infected files will execute the virus’s code. Repulik. A will also copy files to removable drives and rename these drives as “REPVBLIK,” modify MP3 files, and modify the registry. Another virus that can infect computers running Windows 9x, Windows NT, Windows ME, Windows 2000, Windows XP, Windows Server 2003, and Windows Vista is the W32. Shoren virus. This virus first appeared in March 2009, and infection spreads through executable files that are infected with the virus. Once the virus has infected a file, it is rendered unusable because the virus has prepended itself to the file, thus corrupting the data.
Worm Examples Some of the most infamous viruses that have infected computers on the Internet are actually worms. Using the Internet to move from one computer to another, worms have infected millions of machines and cost billions of dollars in damage to data, lost labor costs, and so on. To understand worms better, it’s worthwhile to look at some of the most infamous ones from previous years: ■■
■■
The SQL Slammer worm in 2003 exploited a known buffer overflow in Microsoft’s SQL Server and Microsoft SQL Server Desktop Engine (MSDE). The worm, in its self-replicating attempts, caused infected machines to generate enormous amounts of traffic. Local networks and the Internet itself slowed down considerably and infected thousands of machines and servers. The Nimda and Code Red worms in 2001 attacked known vulnerabilities in Microsoft’s Internet Information Server (IIS) Web server. These two worms and their variants replicate themselves on the victim machines and begin scanning the network for additional vulnerable machines. Nimda and Code Red certainly set another precedent for the danger of worms, and they are not harmless. Nimda creates open network shares on infected computers, and it also creates a Guest account with Administrator privileges, thus allowing access to the system and opening it up to whatever a knowledgeable hacker wants to do to it. Code Red (and its variant, Code Red II, which also opened a backdoor for the attacker) defaces Web sites, degrades system performance, and causes instability by spawning multiple threads and using bandwidth.
10 CHAPTER 1 Systems Security Overview
■■
■■
■■
The Sasser worm in 2004 exploited a known buffer overflow in Microsoft’s Local Security Authority Subsystem Service (LSASS) through port 139, and caused infected machines to spontaneously reboot. It affected networks, including those of Delta Airlines, Goldman Sachs, and the British Coastguard. The Zotob worm in 2005 used vulnerability in Microsoft Windows’s Plug-andPlay service to spread through networks. It was prominent in that it infected CNN computers and so was reported live on television. A year later, a Moroccan teenager was sentenced for its creation. Conficker (also known as Downadup) is a worm that first appeared in November 2008, and has infected upwards of 20 million computers including those used by the French Air Force, Royal Navy, and UK Ministry of Defence. The worm exploits a known vulnerability in computers running Windows 9x, Windows NT, Windows ME, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. It can do considerable damage to systems by turning off the automatic backup service, deleting restore points, and disabling security. It is so serious that Microsoft allocated $250,000 as a reward to those who would help the company find the source of the worm.
Exam Warning There are thousands of worms, viruses, and other malicious software that can infect your computer. Don’t spend significant time memorizing information about them, as in the exam there won’t be questions that target your knowledge about specific viruses and worms. The information provided here allows you to see what viruses, worms, and other malware can do to your system, and how they work.
From looking at these worms, we note that it is easy to understand that effective protection against many worms is the timely and prompt installation of patches released by software vendors, especially Microsoft because of its market presence. In the case of the Conficker worm, Microsoft had released a patch that would have protected many systems infected by the worm. Unfortunately, only those who downloaded and installed the patch were protected. It is also important to correctly configure firewalls to allow only necessary ports both inbound and outbound: Sasser replicated using Network Basic Input/Output System (NetBIOS) and SQL-Server ports, which should not be allowed exposed outside the enterprise network.
Defending Against Viruses and Worms Protection against viruses, worms, and other malicious code usually includes up-to-date antivirus software, a good user education program, and diligent application of the software patches provided by vendors. When network administrators or security professionals take the necessary steps to protect systems, many of the viruses and worms on the market are unable to infect or do significant damage to systems. Antivirus software applications are designed to detect viruses, worms, and other malware on a computer system. These programs may monitor the system
Security Threats 11
for suspicious activity that indicates the presence of malware, but more often will detect viruses using signature files. Signature files are files that contain information on known viruses, and these files are used by antivirus software to identify viruses on a system. The antivirus software will compare data in files on your system with a dictionary of viral code in the signature files, and use this comparison to identify the presence of a virus. If the signature of a virus (that is, viral code) is found in a file on your system, the antivirus software will then attempt to remove the virus. There are many ways it may attempt to do this, including cleaning the virus from the file (that is, removing the viral code), deleting the infected file, or quarantining the file so that it can’t be used. There are numerous vendors of antivirus software, including the following: ■■
AVG (www.avg.com)
■■
F-Prot Anti-Virus (www.f-prot.com)
■■
McAfee Anti-Virus (www.mcafee.com)
■■
Norton Anti-Virus (www.norton.com) or Symantec (www.symantec.com)
Vendors of antivirus software provide regular updates of signature files, ensuring their software can detect code from the latest viruses. Unfortunately, if a person doesn’t update the signature files, then their antivirus software can’t detect any viruses that came out after the software was initially released. Therefore, it is vital that the antivirus software is updated on a regular basis. In some cases, a virus or worm may be so difficult to remove that besides running an antivirus software, you may also need to download special removal software or follow specific instructions that are available from the antivirus vendor’s site. When a virus has been detected, it is wise to review the details on the antivirus vendor’s site to determine whether additional actions are required. User education is an important factor in preventing viruses from being executed and infecting a system. Because a virus is a program, it must be started before it can be loaded into the memory and begin doing the damage. Because the virus requires user interaction to load, it is important for users to be aware that they shouldn’t open attached files that have executable code (such as files with the extension .com, .exe, and .vbs). Users should also avoid opening attachments from people they don’t know. Of course, since viruses and other malware may exploit an e-mail program to forward the virus to everyone in an address book, infected files can be sent from people you know. Therefore, you should verify that the person did send you an attachment, especially in cases where an executable file has been sent. Updating your system and applying the latest patches and updates are other important factors in protecting your system. In the established security community, when researchers discover a flaw or vulnerability, they report it to the software vendor, and the vendor then typically works on quickly developing a fix to the flaw. The vulnerability (without an exploit) is reported once a fix has been found and is available. Although there are exceptions to this rule, this is the standard operating procedure. However, if hackers discover the flaw, it is possible that
12 CHAPTER 1 Systems Security Overview
an exploit is developed and disseminated through the hacking community before the vendor is aware of the flaw or a patch is developed. Such an exploit is called a zero-day attack, because there is no warning before the attack can take place. The best defenses against zero-day attacks are security devices that can detect attacks without the need for attack signatures. Another important factor in protecting data is to prepare for the worst. You can prepare for an infection by a virus or worm by creating backups of legitimate original software and data files on a regular basis. These backups will help to restore your system, should that ever be necessary. For the individual user, using Write-Once media (compact disc-recordable [CD-R] or digital video disc-recordable [DVD-R]), and activating the write-protection notch on removable media like a USB disk or a floppy disk will help to protect against a virus on your backup copy. For networks, keeping a series of backups is vital in restoring data to the state it was in prior to being infected. You can also help to prevent against infection by using only software that has been received from legitimate, secure sources. Always test software on a “test” machine (either not connected to your production network or using a virtual machine) prior to installing it on any other machines to help ensure that it is virus-free.
Notes from the Field Anyone Want an Infection? For Some, the Answer is Yes! In 2007, Computer specialist Didier Stevens paid for a Google advertisement that offered to infect a person’s computer with a virus. The advertisement asked, “Is your PC virusfree? Get it infected here!” Surprisingly, over a period of six months, 409 people clicked on the advertisement. Clicking the advertisement took them to a Web site that thanked them for visiting and recorded their visit. Fortunately, no viruses or malware were installed on computers visiting the site, but it does show that some people will click anything, and even the most obvious signs of being infected by a virus may be ignored. For more information, you can visit Didier Stevens’ blog at http://blog.didierstevens. com/2007/05/07/is-your-pc-virus-free-get-it-infected-here/.
Common File Types That Carry Viruses There are a number of file types that are commonly used to disseminate viruses. As we’ve mentioned, file types that are susceptible to viruses can be attached to e-mails and sent out to other users in a person’s address book. These files can be compiled programs or contain code that is executed by the OS when the file is opened. Because virus writers target these types of files, it is wise to prevent users from opening certain file types. You can also configure mail servers to remove specific file types from e-mail. As it reaches the mail server, the susceptible file is removed from the e-mail so that the e-mail can be sent to the recipient without the attachment.
Security Threats 13
File types that are commonly used to distribute viruses include those with the following extensions: ■■
■■
■■
■■
■■
■■
■■
■■
■■
■■
■■
■■
■■
.bat This specifies batch files that will run one or more commands automatically in sequence. .cmd This specifies batch files that will run one or more commands automatically in sequence. .com This specifies command files that are binary executables, similar to files with the extension.exe. For example, in Windows you’ll find many executable programs that use the .com extension. It is unrelated to the domain .com used on the Internet. Unfortunately, if a file is received with a name like www.microsoft.com, it can appear to be a Web site link but it will actually execute as a program on the machine. .doc This specifies Microsoft Word document files, which can contain macro viruses. .dll This specifies dynamic-link library files that contain programming code that may be used by one or more programs. The functions in these files are executable and can be invoked by commands in other programs or files. .exe This specifies executable binary files. These are programs that can be loaded into memory, and provide various functions and execute commands automatically or with user intervention. .htm or .html This specifies Web pages (documents written in Hypertext Markup Language and opened in Web browsers). .js This specifies scripts written in the JavaScript language and contain programming code that can execute upon opening the file. .mdb This specifies Microsoft Access database files, which can contain macro viruses. .scr This specifies screensavers and is commonly used in the dissemination of viruses. .reg This specifies extracts of Registry settings. Running these files can add or modify registry settings on your computer. .vbs This specifies scripts written in Microsoft Visual Basic Scripting language and contains programming code that can execute code upon opening the file. .xls This specifies Microsoft Excel spreadsheets, which can contain macro viruses.
Test Day Tip It’s important to know the file types that are most likely to contain a virus. Before taking the exam, review the listing of file types, and understand what these files do.
14 CHAPTER 1 Systems Security Overview
Trojan A Trojan horse closely resembles a virus, but is actually in a category of its own. The Trojan horse is often referred to as the most elementary form of malicious code. A Trojan horse is used in the same manner as it was in Homer’s Iliad; it is a program in which malicious code is contained inside of what appears to be harmless data or programming. It is most often disguised as something fun, such as a game or other application. The malicious program is hidden, and when called to perform its functionality, can actually ruin your hard disk. One saving grace of a Trojan horse, if there is one, is that it does not propagate itself from one computer to another (selfreplication is a characteristic of the worm). A common way for you to become the victim of a Trojan horse is for someone to send you an e-mail with an attachment that purports to do something useful. To the naked eye, it will most likely not appear that anything has happened when the attachment is launched. The reality is that the Trojan has now been installed (or initialized) on your system. What makes this type of attack scary is the possibility that it may be a remote control program. After you have launched this attachment, anyone who uses the Trojan horse as a remote server can now connect to your computer. Hackers have tools to determine what systems are running remote control Trojans, which can include communication over chat networks, e-mails, or Web pages, to alert the hacker that a new system has been infected and is available. After the specially designed port scanner on the hacker’s end finds your system, all of your files are accessible to that hacker. Although many people get Trojans from programs shared and downloaded from the Internet, viruses can be disseminated using devices that attach to your computer. In February 2008, the Motmex Trojan was found on digital picture frames shipped from China. These frames were sold by many large companies throughout North America, and allowed people to store their images on removable storage, which were then displayed on the frame’s screen. When a person attaches the frame to their computer using a USB cable and activates the Trojan, the computer then becomes infected. The Trojan was able to block many antivirus programs from detecting it, and it was unstoppable by Windows Firewall. However, because people generally don’t scan such removable storage devices with antivirus software, many people wouldn’t have realized their computer was compromised until after the Trojan had infected their computer. Test Day Tip Remember the story of the Trojan horse to help you remember what a Trojan horse is in terms of computer security. A Trojan horse seems to be a legitimate program or file (such as a game, utility, or application) but it actually contains malicious code that will attack your system.
Spyware and Adware Spyware and adware are two other types of programs that can be a nuisance or malicious software. Both of these may be used to gather information about your
Security Threats 15
computer, or other information that you may not want to share with other parties. In some cases, they may be a platform for distributing other malicious software.
Spyware As its name states, spyware is a type of program that is used to track user activities and spy on their machines. They have the capability to scan systems, gather personal information (with or without the user’s permission), and relay that information to other computers on the Internet. The information that is gathered may be used for a variety of purposes, including those with unethical or criminal intentions. Spyware has become such a pervasive problem that dozens of antispyware programs have been created. Most spyware programs do not have harmful payloads, and their danger lies in the instability and the consumption of computing resources they cause in the infected systems. There are a lot of types of spyware in terms of their purpose, their installation method, their collection methods, and so forth. Some spyware will hijack browser settings, changing your home page, or redirect your browser to sites you didn’t intend to visit. Some are used for even criminal purposes, stealing passwords and credit card numbers, sending it to the spyware’s creator. Users may unknowingly download them from Web sites or willingly install the spyware believing it to be something else. But more often than not they are tricked into installing it as it is covertly installed as part of another utility’s installation or installed through the exploitation of vulnerability in the user’s browser. As for the method of collecting information, they can record and inform on Web site browsing history, look for information stored in the file system of the computer, or even log keystrokes looking for passwords. It is important to compare spyware versus other malware. Spyware usually does not self-replicate, meaning that they need to be installed in each computer they infect. Some spyware programs are well-behaved and even legal. Many spyware programs take the form of browser toolbars and, in some cases, infected machines usually have more than one spyware program installed. As they’re normally linked to browsing activity, they can flood the victim’s desktop with nonstop pop-up windows, many to pornographic sites.
Adware Adware is software that displays advertising while the product is being used, allowing software developers to finance the distribution of their product as freeware (software for which you don’t have to pay for its usage). Legitimate products will display advertising in a section of the application, game, or utility. The developer makes money from the sale of advertisements, and the user gets to use the application for free. The advertising funds the software’s development, and allows users to “try before you buy.” If the user wishes to no longer see the advertisements, he or she can pay for the full version and register the program, or remove the program from their computer. Despite its positive points, some adware programs can be risky to use. Some include features that are used for gathering information for the purposes of marketing
16 CHAPTER 1 Systems Security Overview
by gathering information on browsing habits. For example, a program might track the sites you’ve visited for marketing or other purposes, and send the information from your computer to an Internet location. In some cases, the pop-up advertisements you receive will be related to the types of sites you’ve visited. This can cause an added security risk, since you have no control over the advertisements being displayed, and don’t know if Web pages used for the advertisements contain or can download something malicious. Another problem is that adware can cause performance issues. These graphical advertisements may use up bandwidth, and multiple windows opening to show the advertisements can use up memory. Some of these programs may also try to download additional programs that aren’t required for the application to run, or try to hijack browser settings. For example, the application may attempt to download and install toolbars for your Web browser, or try to change the search engine or homepage in your Web browser. Because of these and other reasons that we’ll discuss next, adware has developed a bad reputation that’s synonymous with spyware.
The Difference between Spyware and Adware In looking at adware and spyware, we can see that they are two distinctly different types of programs. Adware is a legitimate way for developers to make money from their programs. Although the advertisements may be a nuisance, it allows you to use the software for free and is generally harmless. Spyware, however, is an insidious security risk. Without a person knowing, their computer may be monitored and information may be sent to a third party. This could include personal information, credit card numbers, passwords, or other sensitive data that’s transmitted to an Internet location. While adware displays what someone wants to say, spyware monitors and shares what you do. Adware and spyware are often confused with one another, mostly because of the overlap between them. Adware may incorporate some elements that track information, but this should only be with the user’s permission. Spyware will send information whether you like it or not. A problem is that while you may believe that you’re using a simple adware program, it may actually be bundled with other programs that run in the background, which may be spyware or malicious software.
Spyware Example There are numerous examples of spyware that have caused significant problems for people, and can be extremely difficult to fully remove once they are installed. Some of these include CoolWebSearch, BargainBuddy, Zango (formerly 180 solutions), and Internet Optimizer. There are also versions that are commercially available, and can be purchased and used by anyone. For example, CYBERsitter (www.cybersitter. com) is a company that has provided Internet filtering software that parents can use to prevent their children from viewing unwanted content on the Internet. One of their products is a controversial spyware tool called Snoopstick, which is available at www snoopstick.com.
Security Threats 17
Snoopstick is a suite of tools stored on a flash drive. By plugging it into the USB port of a computer, you can install a hidden program to monitor the computer, or install tools that allow you to do the following: ■■ ■■
■■ ■■
■■
Connect to a remote computer and monitor a person’s activities. View logs of a person’s activities, such as Web sites they’ve visited, instant messages, and e-mail a person has sent or received, view screenshots, and so on. Block the computer from viewing certain Web sites. Send commands to the remote computer, including having it shut down, restart, log off a person, and disabling a person’s Internet access. Deny the computer access to certain Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) ports (such as those used for File Transfer Protocol [FTP], Dynamic Host Configuration Protocol [DHCP], instant messaging, Simple Mail Transfer Protocol [SMTP], or those used by specific programs [such as Apple iTunes]).
As seen in Figure 1.1, Snoopstick provides a user friendly Activity Viewer to connect to another computer and view their activity and modify the settings. While this occurs, the person on the remote computer has no idea their activities are being monitored or possibly having settings reconfigured. Obviously, this can be a serious privacy and security issue in an organization. Although designed as a parental
Figure 1.1 Snoopstick Activity Viewer
18 CHAPTER 1 Systems Security Overview
control tool for checking what a child is doing online, it has the potential for causing significant problems for a user who’s unaware he or she is being watched or having the settings of a computer modified.
Adware Example
Figure 1.2 Eudora Options ■■
■■
■■
An example of adware is Qualcomm’s e-mail program Eudora (www.eudora. com). Prior to version 7.1, Eudora was an adware program that allowed users to use a fully functional version without paying for it, so long as they didn’t mind viewing advertisements in the lower left-hand pane of the program. As seen in Figure 1.2, Eudora provided three ways to use its program:
Paid Mode A mode in which the person paid for a registration code that allowed them to use all of the program’s features and not see any advertisements. Sponsored Mode A mode which allowed people to use all of the program’s features without paying, but displayed random paid advertising in the advertisement window, along with sponsored links. Lite Mode A mode which allowed people to use it for free but provided only a limited set of features.
The graphics and links that appeared in Eudora’s advertisement window were pushed to computers at regular intervals from Qualcomm’s Internet advertisement servers. This allowed only those sponsors who paid to have their advertisements displayed on the computers of potential customers. After years of commercial success with Eudora, in 2006, Qualcomm announced that the e-mail program would become open source after their last commercial version, 7.1. As a result, it would no longer be pushing advertisements to computers running Eudora.
Defending Against Spyware and Adware Preventing spyware and adware from being installed on a computer can be difficult, as a person will either give or be tricked into giving permission for the program to install on a machine. For example, a Web site may trick a user into clicking a link that pushes spyware onto the person’s computer, or a person may install a program they want, not realizing that it’s an adware. People need to be careful in the programs they install on a machine, including the following:
Security Threats 19
■■
■■
■■
■■
■■
Read the end user license agreement (EULA), as a trustworthy freeware program that uses advertising to make money will specifically say it’s an adware. If it says it is, and you don’t want an adware, don’t install it. Avoid installing file-sharing software, as these are commonly used to disseminate adware/spyware. Install and/or use a pop-up blocker on your machine, such as the one available with Google Toolbar, MSN Toolbar, or the pop-up blocking feature available in Internet Explorer running on Windows XP SP2 or later. The pop-up blocker prevents browser windows from opening and displaying Web pages that display advertisements or may be used to push spyware to a computer. Be careful when using your Web browser and clicking on links. If you see a dialog box asking you to download and install an ActiveX control or another program, ensure that it’s something you want to install and that it’s from a reliable source. If you’re unsure, don’t install it. Use tools that scan for spyware and adware, and can remove any that are found on a machine.
Fortunately, there are a lot of programs available that provide protection against spyware and adware. Many of the antivirus vendors, including those we discussed earlier in this chapter, offer security suites that have the capability to detect and remove malicious software. There are also programs that are specifically designed to scan systems and remove spyware and adware, such as: ■■
Ad-Aware (www.lavasoft.com)
■■
Spyware Doctor (www.pctools.com/spyware-doctor)
■■
Spybot—Search and Destroy (www.safer-networking.org)
As is the case with antivirus programs, you must keep antispyware/antiadware programs up-to-date. Programs like Ad-Aware (seen in Figure 1.3) use signature or definition files, similar to those used by antivirus software, which we discussed earlier. The definitions in these files are compared to files on your system, and used to identify and remove any spyware or adware that is found.
Rootkits and Botnets Botnets and rootkits are tools used to exploit vulnerabilities in OSes and other software. Rootkits are software that can be hidden on systems, and can provide elevated privileges to hackers. They are a collection of tools, which are used to gain high levels of access to computers (such as that of an administrator). Even though the rootkit is running on a machine, it may run as a series of processes that makes function calls that filter its appearance on the machine, so that it won’t appear in Task Manager or other tools.
20 CHAPTER 1 Systems Security Overview
Figure 1.3 Ad-Aware Scanning a Computer and Finding a Potential Threat
Bots are a type of program that runs automatically, as robots performing specific tasks without the need for user intervention. For example, a type of bot was developed and used by Google to seek out Web pages and return information about each page for use in their search engine. Unfortunately, while bots can be used for legitimate reasons, they can also be used for malicious purposes. Bots can be installed on a computer without a user being aware of it, accepting commands from a remote user called a bot herder. The bot herder can send simultaneous commands to multiple machines that work together as a network of bots, called a botnet. Using these bots, the bot herder can make the computers perform various actions, such as sending out spam, or simultaneously sending e-mail to a single address or sending a request to a single Web site to cause that server to crash.This is called a denial of service (DoS) attack.
Rootkits A rootkit is a type of malware that tries to conceal its presence from the OS and antivirus programs in a computer. Its name comes from the UNIX world, where hackers try to keep root-level (superuser) access to a computer long after they infect it. A rootkit can modify the basic blocks of an OS like the kernel or communication drivers, or replace commonly used system programs with rootkit versions. Security researchers have even demonstrated rootkits that install as a virtual machine manager, and then load the victim’s OS as a virtual machine. Such a rootkit would be virtually impossible to detect. Rootkits can make it easy for hackers to install remote control programs or software that can cause significant damage. Note J. K. Rutkowski’s article titled “Execution path analysis: finding kernel based rootkits” provides detailed information on the detection of kernel rootkits. The article is available to view at www.phrack.com/issues.html?issue=59&id=10#article.
Security Threats 21
The most famous and widespread rootkit infestation happened in 2005, when Sony BMG Music Entertainment used a rootkit to implement copy protection in some of its music CDs. Even worse, other attackers could use the rootkit’s stealth features to hide their own viruses on infected computers. The rootkit was very hard to uninstall, and according to some researchers, it could have infected over 500,000 computers. Eventually, major antivirus vendors included removal tools for the rootkit, but it was a public relations nightmare for Sony.
Botnets Botnets are one of the biggest and best hidden threats on the Internet. Often, a botnet will be installed on a machine as a worm or Trojan horse, and run silently on a person’s machine. The person who controls the botnets is referred to as the bot herder, and he or she can send commands to the bots and receive data (such as passwords or access to other resources) from them. The reason the bot herder does this can vary, ranging from using the bots to store files on other people’s machines, instruct them to send simultaneous requests to a single site in a DoS attack, or for sending out spam mail. To illustrate how a bot may be used, consider a bot herder who wishes to send spam to large numbers of users. These e-mail messages may claim they’re from e-Bay or another popular site, and request the person to update their personal and credit card information. The bot herder sends out a Trojan horse that infects computers with the botnet. These infected computers are now referred to as agents or zombies, and will automatically log on to a Web server or Internet Relay Chat (IRC) server, which is referred to as the Command and Control (C&C) server. The bot herder can now send messages to the botnets through the C&C server, instructing each of the zombie machines to send out the spam. The problem with identifying the person responsible is that the e-mail or other data leads back to a victim and not a bot herder. If you traced who sent out the e-mail back to its source, such an e-mail would lead back to the zombie computer, and not the actual bot herder. In other words, if a bot on your computer had sent out the e-mail, it would appear that it came from you. To identify whether a bot was used, you can use antivirus software. Antivirus software like those we discussed previously will search a system using up-to-date signature files. Scanning for Trojans on the machine may identify the existence of known bots that have infected the machine. Bots may be disseminated using Trojan horses, which are programs that provide a functional use (such as games), but when executed will also install the bot on a computer. Test Day Tip Remember that botnets are a network of bots (robots) that can be used to take over a computer to send spam or do DoS attacks.
Logic Bombs A logic bomb is a type of malware that can be compared to a time bomb. It is designed to execute and do damage after a certain condition is met. This can be the passing of
22 CHAPTER 1 Systems Security Overview
a certain date or time, or other actions like a command being sent or a specific user account being deleted. Often attackers will leave a logic bomb behind when they’ve entered a system to try to destroy any evidence that system administrators might find. Logic bombs may exist on systems for long periods of time, without anyone being aware of their existence until they are triggered. For example, a disgruntled employee might program a logic bomb to trigger on the date of his or her retirement, or have it go off if he or she doesn’t send a specific command each month to delay its execution. Widely disseminated logic bombs may be distributed with worms or viruses, with ones containing common elements being detected by antivirus software. There have been a wide variety of different logic bombs that have appeared on people’s computers over the years. Well-known logic bombs include the Michelangelo virus, which was set to go off on March 6, the birthday of the famous Renaissance painter, and delete the data from hard disks; the DDoS attack Blaster attempted on http://windowsupdate.com, and Code Red’s attempted attack on the White House Web site. Although most logic bombs aren’t this well publicized, they can easily do similar or greater damage.
Hardware and Peripheral Security Risks If someone is given the chance, there are many ways to threaten a network or computer. Having physical access to a computer or other device can enable an unauthorized or uneducated user to make changes to settings that can seriously impact its security and functionality. Conversely, a system administrator can configure hardware settings so that authentication is required, or disable features that could be used for malicious purposes. Although making such changes to a computer is vital to ensuring a system is secure, it’s important to realize that there are more devices on a network than just computers. Technologies like USB have provided the means to plug a wide variety of devices into computers and have also led to advances in how data can be stored. Devices like cell phones have incorporated technology to provide similar functions to that of a computer, allowing them to communicate with other devices using Bluetooth or the Internet. More and more, computers are moving away from devices that need to be installed inside the machine or screwed into a port. Peripherals are devices that are connected to a computer using cables or wireless technologies. When you think of peripherals, you probably might think of printers, monitors, and keyboards. However, this category can also include various storage devices like removable drives, USB flash drives, memory cards, and other devices and media. In the forthcoming sections, we’ll discuss the various types of hardware and peripherals that are commonly found on a network, and see how these devices and media can affect an organization or network’s overall security.
BIOS BIOS is an acronym for basic input/output system, and refers to a chip that resides on the motherboard of a computer. This chip contains instructions on how to start
Hardware and Peripheral Security Risks 23
the computer and load the OS, and low-level instructions about how the system is to handle various hardware and peripherals. Information used by the BIOS is set and stored through the complementary metal oxide semiconductor (CMOS). The CMOS uses a battery on the motherboard to retain power, so that any settings used by the BIOS aren’t lost when the computer turns off. A user interface allows you to edit CMOS settings, so that you can configure the date, time, boot sequence, video settings, hard drive configuration, and security settings. When a computer starts, the BIOS checks for the presence of certain types of hardware and whether it is working properly. For example, it will check for the presence of a video card, check the voltage of the power supply, and so on. If there is an issue, it will inform the user of the problem through a series of audible beeps. If not, it will check the amount of memory on your computer, identify, and configure hardware on the computer, and identify the boot drive. It is at this point that the boot sector of the boot drive is used to start the OS.
How Can the BIOS Be a Security Risk? Because of the importance of the BIOS, you can see that making changes to it can seriously affect how the computer starts, or if it will start at all. The CMOS settings are the lowest level that you can provide instructions to the computer, or implement security settings like passwords. If someone were to modify settings or upgrade the BIOS incorrectly or maliciously, it could cause that computer to be unable to start. This would be a major issue in cases where the machine was a production server.
Passwords A basic method of protecting a computer is by setting passwords that prevent unauthorized users from starting up the machine and/or changing the settings. The CMOS setup program allows you to configure the system, and can be accessed on many machines by pressing specific keys (such as the F10 or DEL key) when the computer is first turned on. When the setup software appears, there are generally options that allow you to set passwords. A power-on password can be set, requiring anyone who starts the computer to enter a password before the OS loads. This prohibits hackers from using password-cracking tools to gain entry through the OS. Another password may also be set to prevent unauthorized persons from accessing the setup software and making changes to the computer. Setting this password also prevents malicious users from configuring power-on and BIOS passwords, which would restrict valid users from starting the computer or making system changes. A drawback to using power-on passwords is that the protection it offers can also be a danger in some situations. A person who’s authorized to use the computer and doesn’t have the password would be unable to start the system. One such situation could be a DoS attack, which would require restarting the server. If the person rebooting the server didn’t have the power-on password, the server would remain offline until the password could be found. Another example would be a user who has put a power-on password on a laptop, and delivered it to be repaired or upgraded. The hardware technician would be unable to properly complete the necessary tasks
24 CHAPTER 1 Systems Security Overview
for upgrading or repairing without being able to start the machine and load the OS. Although power-on passwords can provide a great deal of security, it can also cause significant problems in organizations if the people who need the passwords don’t have them. Exam Warning Once a person has physical access to a computer, the power-on password is the first line of defense in accessing any data on the machine. The power-on password is required before the OS loads, and is necessary to start up the computer.
Flashing the BIOS Because the BIOS and CMOS incorporate software to control low-level settings and security, it follows that there are times when this software may need to be upgraded to a newer version. As with any software, the BIOS may have known bugs that can be fixed with updated software. Similarly, the CMOS may need updating to fix errors or changes, and allow you to modify settings related to new features or hardware. Since the software is stored in a chip on the motherboard, this requires using special software that erases information on the chip and replaces it with updated programming. This special program is called a flash utility, which is why upgrading the BIOS is called flashing. Flashing the BIOS is generally done on rare occasions, because any mistakes could cause the computer to stop functioning. Some of the reasons why BIOS is upgraded is because there is a need to support newer hardware (such as larger hard disks or newer processors) or fix certain bugs. For example, the most widespread instance of people flashing the BIOS of computers was in 1999 to fix the Y2K bug. Because the date on computers was two digits, it was feared that when the year switched from 1999 to 2000, computers would register this date change as being 1900. Fortunately, because people and organizations upgraded the BIOS on computers and updated programming, there were few cases in which this caused problems. There are two main reasons why flashing the BIOS would fail. If there were a power failure during the upgrade, the BIOS would be corrupt. While flashing, if the wrong version of BIOS is used, the BIOS wouldn’t function properly afterwards. In other words, if you flashed the BIOS with software that was meant for a different computer, it would be filled with bad information. Because the computer wouldn’t start again after either of these situations, you wouldn’t be able to fix the machine. While flashing the BIOS is a relatively easy process, it is the potential catastrophic damage that keeps many from upgrading to later versions. Because you are overwriting all of the information used by the BIOS, flashing it will subsequently erase any passwords that have been set. This means that even if you’ve set a power-on password or a CMOS settings password, these will no longer exist after the BIOS has been flashed. If an authorized technician is flashing the BIOS, this means he or she will need to reset the passwords. If an unauthorized person does it, they now have access to the computer.
Hardware and Peripheral Security Risks 25
Exam Warning The CMOS settings are the lowest level that you can configure settings on a computer. Any changes to these settings will affect the BIOS and can impact how it starts the computer.
Booting the Computer The CMOS settings allow you to control the boot order of disks and disable certain hardware on the computer. Using these settings, you can control the order in which the computer will try to find an OS to load. It determines if the computer will first check the floppy disk, USB ports, or CD/DVD ROM for an OS to boot from, or if it will boot from the hard disk. For example, let us say a computer was set to first check a floppy drive, then a compact disc read-only memory (CD-ROM) or DVD-ROM, USB ports, and finally the hard disk for the presence of an OS. If these devices are active, an unauthorized user with physical access to the machine could insert a floppy or CD/ DVD into the drive, or a USB flash drive into a USB port. When the computer started, it would bypass the OS on the hard disk, and start the machine from the media he or she inserted into the computer. Now that the person has access, they can view any data stored on the machine, modify or delete files, or do other malicious activities. To prevent users from booting the machine from a disk or USB flash drive, administrators will often set the computer to first (or only) boot from a hard disk, and/or disable drives and USB ports. Unauthorized users are thereby prevented from using the drives or port to start the machine. If IT staff need to modify the boot order or use one of these devices, they would then temporarily change the CMOS settings.
USB Devices USB is an acronym for Universal Serial Bus, and is a standard technology that is used to allow devices to connect through a port on a computer. USB devices can be plugged into the computer and recognized by the OS, without the need to shut down the computer. Using USB, a wide variety of peripherals, such as mice, keyboards, external hard disks, flash drives, scanners, printers, and so on, can be installed on a machine by simply plugging them in. With improvements in technology, gigabytes of storage capacity are now available on flash drives, memory cards, MP3 players, external hard disks, or other USB devices. This obviously creates a security risk for organizations. In the past, an organization would be concerned that a series of files might be copied to a floppy disk or CD, and then removed from the office, but today a user could potentially copy an entire hard disk of information and carry it home in their pocket or briefcase. Because of this, there is a justified fear of data being lost or stolen with these devices. Organizations deal with the potential loss of data from USB devices in a number of ways. Some companies have strict policies that discourage users from transferring data from their computers. It is also common in secure environments for USB ports on computers to be disabled through CMOS settings, so that even if a flash drive
26 CHAPTER 1 Systems Security Overview
were inserted into a USB port, the computer wouldn’t recognize it. However, by preventing user access to technology, they are also limited from doing work at home or perhaps performing certain functions at work. To ensure that data stored on USB devices is secure, it is wise to encrypt and/or password-protect the files stored on them. In doing so, if a USB flash drive or other device were lost or stolen, anyone with access to the device would need to decrypt the data or have a password to open any files on the device. Another issue that should be considered with USB devices is possible infection from viruses, worms, and other malicious software. Because some USB devices can be used for storage, it follows suit that some of the files may be infected. To prevent the computer from being infected by a virus or other malware, the autoplay feature in Windows should be turned off. This is the feature that will start any programs on media inserted into drives or USB ports automatically. Turning off the autoplay feature can prevent an infected program from being executed as soon as Windows reads the disk or device. In addition to this, any USB storage devices should be scanned with up-to-date antivirus software before any files are opened. Test Day Tip USB devices are common to computers, with USB flash drives replacing other media like floppy disks. Because they are a commonly used technology, you can expect to see questions that directly ask about USB or include them as part of a scenario.
Flash Memory Cards Flash memory cards and sticks are popular for storing and transferring varying amounts of data. Memory cards have typically ranged from 8 to 512 MB, but new cards are capable of storing upwards of 8 GB of data. They are commonly used for storing photos in digital cameras (and transferring them to PCs) and for storing and transferring programs and data between handheld computers (pocket PCs and palm OS devices). Although called “memory,” unlike random access memory (RAM), flash media is nonvolatile storage; that means that the data is retained until it is deliberately erased or overwritten. PC Card (Personal Computer Memory Card International Association [PCMCIA]) flash memory cards are also available. Flash memory reader/writer come in many handheld and some laptop/notebook computers and external readers can be attached to PCs through USB or serial port. Flash memory cards include the following: ■■
Secure digital (SD) memory card
■■
CompactFlash (CF) memory card
■■
Memory stick (MS) memory card
■■
Multimedia memory card (MMC)
■■
xD-Picture card (xD)
■■
SmartMedia (SM) memory card
Hardware and Peripheral Security Risks 27
USB Flash Drives USB flash drives are small, portable storage devices that use a USB interface to connect to a computer. Like flash memory cards, they are removable and rewritable, and have become a common method of storing data. However, while flash memory cards require a reader to be installed, USB flash drives can be inserted into the USB ports found on most modern computers. The storage capacity of these drives range from 32 MB to 64 GB. USB flash drives are constructed of a circuit board inside of a plastic or metal casing, with a USB male connector protruding from one end. The connector is then covered with a cap that slips over it, allowing the device to be carried in a pocket or on a key fob without worry of damage. When needed, the USB flash drive can then be inserted into the USB port on a computer, or into a USB hub that allows multiple devices to be connected to one machine. USB flash drives often provide a switch that will set write-protection on the device. In doing so, any data on the device cannot be modified, allowing it to be easily analyzed. This is similar to the write protection that could be used on floppy disks, making it impossible to modify or delete any existing data, or add additional files to the device. Although USB flash drives offer limited options in terms of their hardware, a number of flash drives will come with software that can be used to provide additional features. Encryption may be used, protecting any data on the device from being accessed without first entering a password. Compression may also be used, allowing more data to be stored on the device. There are also a number of programs that are specifically designed to run from a USB flash drive rather than a hard disk. For example, Internet browsers may be used that will store any history and temporary files on the flash drive. This makes it more difficult to identify the browsing habits of a person.
iPod iPod is the brand name of portable media players that was developed by Apple Inc. in 2001. iPods were originally designed to play audio files, with capability to play media files added in 2005. Variations of the iPod were introduced by Apple with different capabilities. For example, the full-sized iPod stores data on an internal hard disk, whereas iPod nano and iPod shuffle both use flash memory, which we’ll discuss later in this chapter. Although iPod is a device created by Apple, the term has come to apply in popular culture to any portable media player. iPods store music and video by transferring the files from a computer. Audio and video files can be purchased from iTunes, or can be acquired illegally by downloading them from the Internet using P2P software or other Internet sites and applications, or sharing them between devices. iPods can be used to store and transfer photos, video files, calendars, and other data. As such, they can be used as storage devices to store files. Using the Enable Disk Use option in iTunes activates this function, and allows you to transfer files to the iPod. Because any media files are stored in a hidden folder on the iPod, you
28 CHAPTER 1 Systems Security Overview
will need to enable your computer to view hidden files to browse any files stored on the iPod. iPods use a file system that is based on the computer formatting the iPod. When you plug an iPod into a computer, it will use the file system corresponding to the type of machine it’s connecting to. If you were formatting it on Windows XP, it would use a FAT32 format, but if it were formatted on a machine running Macintosh OS X, then it would be formatted to use the HFS Plus file system. The exception to this is the iPod shuffle, which only uses FAT32.
Damage and Defense IPod Virus and Windows There are some sources of viruses that don’t immediately spring to mind. When you think of iPods, you probably associate them with Apple computers, and might never think they could infect a computer running Windows with a virus. However, iPods are designed to work with Windows, and many owners will connect them to Windows machines so they can transfer video and music files between the device and their computer. Unfortunately, in 2006, people bought more than they bargained for with the purchase of a new iPod. In 2006, Apple estimates that about 1% of the video iPods shipped between September 12 and October 18 were infected with the RavMonE worm. This worm opens a backdoor on Windows computers, allowing remote access to the machine. As soon as the iPod was plugged into a Windows machine, the autoplay feature would start programs that were designed for Windows and activate the worm. If the autoplay feature was disabled and had up-to-date antivirus software, the antivirus program would detect and remove the worm before it could infect the computer.
Cell Phones Cell phones, also known as wireless or mobile phones, are handheld devices that allow people to communicate over a network. Although cell phones were originally only used for voice communication, many mobile phones provide additional services that are comparable to features previously only seen on computers. These include e-mail, Internet browsing, personal digital assistant (PDA) functionality, digital camera, short message service (SMS) for text messaging, games, and the ability to watch video or listen to music. As new features are added to cell phones, the risks associated with owning one also increase. Because they’re smaller and more portable than laptops or other computers, they are more at risk of being stolen or lost. Someone with access to an insecure device could then access e-mail or other sensitive data on the phone and use the features of the device for their own purposes. Because of this, it’s important that cell phones used by an organization have as much security as possible set up on the device. People using these devices should never leave them unattended (that is, on a desk or left in a car), and they should be carried in a holster or case that can be
Hardware and Peripheral Security Risks 29
closed, making it more difficult to be stolen. If the cell phone supports a power-on password or has a key lock, which prevents the phone from being used unless a personal identification number (PIN) is entered, these features should be activated on the phone. Because data can be stored on memory cards used by cell phones, and phone calls can be intercepted, encryption should be used when possible. Encryption prevents any calls made with the phone from being heard and text messages, passwords, and other data from being viewed by outside parties who may intercept the cell phone’s transmissions. Organizations should also decide whether they want to limit or prohibit the use of cameras on cell phones. Using a camera on a cell phone, a person could take pictures of sensitive data displayed on a screen, or other classified information that may be displayed in plain sight. Because of this, companies who issue cell phones to employees may want to disable any feature that allows pictures or video to be taken.
Cell Phone Viruses There was a time when cell phone viruses were nothing more than a hoax. After all, as we discussed earlier in this chapter, viruses needed to be attached to a file that when executed would infect the computer. Even as late as the early 2000s, it was virtually impossible to acquire a virus on your cell phone, because any software on the phone was installed at the factory or by a vendor. By the mid-2000s, however, many of the most basic cell phones had an OS with services to access Internet sites, download applications, games, and other files that could be installed on the phone, and could attach to a computer using a cable or wirelessly using Bluetooth technology. Whereas people used to be limited to using a computer to read e-mail or send instant messages, mobile phones became a common tool for text messages and e-mails. Because of these advances, viruses not only gained the capability to run on cell phones, but also could be easily disseminated to cell phone users. The first virus targeting cell phones appeared in 2004. Cabir spread between cell phones that used the Symbian OS by transmitting itself using Bluetooth. Apart from displaying a message when the cell phone was turned on, the virus did little other than prove that cell phones could be infected. In 2005, the source code for Cabir was posted to the Internet, and other cell phone viruses have appeared. This includes the following: ■■
■■
■■
Mabir This indicates a version of Cabir that could also spread through a multimedia messaging service (MMS). Mosquito This indicates a Trojan horse that’s spread through a version of the downloadable game of the same name. This virus sends messages to premium numbers, which the cell phone user is charged for calling. Brador This indicates the first backdoor Trojan infecting mobile phones using Windows CE and Windows Mobile. It has the capability to reset the phone, delete files, and send data to a third party.
30 CHAPTER 1 Systems Security Overview
Bypassing Network Firewalls A firewall is software and/or hardware that serve as a barrier between an internal network or computer and an external network, such as the Internet. Networks commonly incorporate firewalls into their security to prevent hackers or malicious software from accessing internal resources. Unfortunately, even in cases where cell phones are configured to get internal e-mail from a corporate mail server, they are always able to bypass network firewalls because they use technologies that are external to the network. For example, a user will enter a Web site address into their Web browser, and this request will go through the firewall before being passed to the Internet. In doing so, the firewall has rules set up that will allow or deny access. A cell phone user has no such restrictions, as he or she can browse the Internet using the services provided by the wireless phone company. In doing so, the cell phone can bypass the network firewall and any security set up on it. Another issue with cell phones is that they can be used as modems. By connecting a cell phone to a computer, it can be used as a modem to connect to the Internet or a remote computer. Once connected, a person could then transfer files from the computer by e-mailing them as attachments or copying them to a remote computer or an Internet location. Another method of transferring data is using Bluetooth technology. Bluetooth is a wireless protocol and service that allows Bluetooth-enabled devices to communicate and transfer data with one another. For example, you could use Bluetooth to copy a picture from your cell phone to a laptop computer, or vice versa. Unfortunately, Bluetooth is notoriously insecure. It has a discovery mode that allows devices to automatically detect and connect with other devices. Without authentication, a person could connect to a Bluetooth-enabled cellphone or other device and download data. Bluesnarfing is a term used for someone who leaves their laptop or another device in discovery mode, so that they can connect to any nearby Bluetooth device that’s unprotected. Cell phones have become the common way of making voice calls, and are increasingly used for other services that were only available on computers. Because Blackberry devices and other mobile phones have become a necessity for some people and businesses to stay in contact, it is important that security policies and procedures remember to include cell phone technologies.
Removable Storage Devices Removable storage, also referred to as removable media, is any device that can be attached to a system and used for storing data. Storage is referred to as removable because the disk itself is separate from the drive (the device that reads and writes to it). As we discussed previously, there are also devices that attach to a computer through a port, allowing data to be transferred between the machine and storage device. Because they can be attached and removed from the computer, using this kind of storage adds an element of risk that the media will be lost, damaged, or stolen. Removable storage includes devices like USB flash drives and memory cards
Hardware and Peripheral Security Risks 31
(which we discussed earlier), but also include devices that provide the capability to store data on such media as: ■■
CD
■■
DVD
■■
Blu Ray
■■
Floppy disks
■■
Magnetic tape
Exam Warning Removable media refers to media that can have a disk or other storage method removed from a drive or port. This isn’t the same as hard disks or other devices that can be removed from the computer. For example, removable disk racks and bays allow you to easily slide an Integrated Device Electronics (IDE) or small computer system interface (SCSI) hard disk drive (mounted in a carrier rack) in and out of a docking bay, which remains attached to the advanced technology attachment (ATA) or SCSI interface of a computer. Hard disk drives can also be inserted into external bays that are easily plugged into and removed from the USB port of a computer. The distinction is that in these cases you are removing the entire drive, not just the disk itself, whereas with true removable storage media, the drive stays attached to the computer and only the media—disk, tape, or card—is removed.
CD/DVD CDs and DVDs are rigid disks a little less than 5 in. in diameter, made of hard plastic with a thin layer of coating. CDs and DVDs are called optical media because CD and DVD drives use a laser beam, along with an optoelectronic sensor, to write data and read the data that is “burned” into the coating material (a compound that changes from reflective to nonreflective when heated by the laser). The data is encoded in the form of incredibly tiny pits or bumps on the surface of the disc. CDs and DVDs work similarly, but the latter can store more data because the pits and tracks are smaller, because DVDs use a more efficient error-correction method (that uses less space), and because DVDs can have two layers of storage on each side instead of just one.
CD The term CD originates from “compact disc” under which audio disks were marketed. Philips and Sony still hold the trademark to this name. There are several different types of CDs that have developed over the years, with the first being CD audio or compact disc digital audio (CDDA). CD audio were the first CDs that were used to record audio disks. Little has changed in the physics of CD since the origin of CD audio disks in 1980. This is due
32 CHAPTER 1 Systems Security Overview
in part to the desire to maintain physical compatibility with an established base of installed units, and because the structure of CD media was both groundbreaking and nearly ideal for this function. There are different variations of CDs available for data storage. These include the following: ■■
■■
CD-R This implies CD-Recordable. This type of CD is a write once-read many (WORM) media that allows you to record data to it once, so that you can later read the data. Once data is written to a CD-R, no additional data can be written to the CD. CD-RW This implies CD-Rewritable. This type of CD allows you to erase and write to the disk multiple times.
CD-ROM Until 1985, CDs were used only for audio, when Philips and Sony introduced the CD-ROM standard. CD-ROM is an acronym for compact disc read-only memory, and it refers to any data CD. However, the term has grown to refer to the CD-ROM drive used to read this optical storage media. For example, when you buy software, the disc used to install the program is called an installation CD. These discs are capable of holding up to 700 MB of data, and they remain a common method of storing data.
DVD Originally, DVD was an acronym for digital video disc and then later digital versatile disc. Today, it is generally agreed that DVD is not an acronym for anything. However, while these discs were originally meant to store video, they have become a common method of storing data. In fact, in addition to being capable of copying (ripping) or creating (burning) data on a DVD, DVD-ROM drives are also backwards compatible and able to copy and create CDs. DVDs are an evolutionary growth of CDs with slight changes. Because development of DVD follows the CD by 14 years, you can see that the CD was truly a revolutionary creation in its time. It is important to understand that both CDs and DVDs are electrooptical devices, as opposed to nearly all other computer peripherals which are electromagnetic. There are no magnetic fields in the reading or recording of these discs; therefore, they are immune to magnetic fields of any strength, unlike the hard drives. Owing to its immunity to magnetic fields, CDs and DVD media are unaffected by electromagnetic pulse (EMP) effects, X-rays, and other sources of electromagnetic radiation. The primary consideration with recordable CD media (and to a lesser extent, manufactured media) is energy transfer. It takes a significant amount of energy to affect the media that the writing laser transfers to the disc. Rewritable discs (which we’ll discuss later) require even more energy to erase or rewrite data. This is in direct contrast to floppy discs and hard drives, both of which can be affected by electromagnetic devices such as magnetic resonance imaging (MRI)
Hardware and Peripheral Security Risks 33
machines, some airport X-ray scanners, and other devices that create a strong magnetic field. CDs and DVDs are also immune to EMP from nuclear detonations. It is important to understand that CD and DVD media are read with light, and recordable discs are written with heat. Using an infrared (IR) laser, data is transferred to a CD or DVD onto a small, focused area that places all of the laser energy onto the target for transfer. It should be noted that all CD and DVD media are sensitive to heat (that is, above 120 °F/49 °C), and recordable media are sensitive to IR, ultraviolet (UV), and other potential intense light sources. Some rewritable media are affected by erasable programmable read-only memory (EPROM) erasers, which use an intense UV light source. Both CD and DVD media are organized as a single line of data in a spiral pattern. This spiral is over 3.7 miles (or 6 km) in length on a CD, and 7.8 miles (or 12.5 km) for a DVD. The starting point for the spiral is toward the center of the disc with the spiral extending outward. This means that the disc is read and written from the inside out, which is the opposite of how hard drives organize data. With this spiral organization, there are no cylinders or tracks like those on a hard drive. The term track refers to a grouping of data for optical media. The information along the spiral is spaced linearly, thus following a predictable timing. This means that the spiral contains more information at the outer edge of the disc than at the beginning. It also means that if this information is to be read at a constant speed, the rotation of the disc must change between different points along the spiral.
Types of DVDs Just as there are several types of CDs that may be used for various purposes, there are a wide variety of DVDs available. As mentioned previously, the storage capacity of a DVD is immense when compared with that of a CD, and can range from 4.5 GB on a single-layer, single-sided DVD to 17 GB on a dual layer, double-sided DVD. The various types of DVDs on the market include the following: ■■
■■
■■
DVD-R This stands for DVD minus recordable. A DVD-R disc will hold up to 4.5 GB of data, and is a WORM medium. In other words, once it is written to, the data on the DVD cannot be modified. DVD+R This stands for DVD plus recordable. A DVD+R disc will also hold up to 4.5 GB of data, and is similar to the DVD-R. Choosing between DVD-R and DVD+R discs should be guided by the intended use of the disc. There is some evidence that DVD-R discs are more compatible with consumer DVD recorders than DVD+R discs; however, there are consumer players that will only read DVD+R discs. DVD-R discs are often the best choice for compatibility if the disc being produced contains data files. Early DVD-ROM drives can generally read DVD-R discs but are incapable of reading DVD+R discs. DVD writers that only write DVD+R/RW discs will read DVD-R discs. DVD-RW This stands for “DVD minus read write.” This, like CD-RW discs, allows an average of 1000 writes in each location on the disc before failing. A DVD-RW disc will hold up to 4.5 GB of data and is recordable.
34 CHAPTER 1 Systems Security Overview
■■
■■
■■
DVD+R DL (dual layer) This is an extension of the DVD standard to allow for dual-layer recording. Previously the only dual-layer discs were those manufactured that way. This allows up to 8.5 GB of data to be written to a disc. Most current DVD drives support reading and writing DVD+R DL discs. DVD+RW This stands for “DVD plus read write.” This, like CD-RW discs, allows an average of 1000 writes in each location on the disc before failing. A DVD+RW disc will hold up to 4.5 GB of data and is recordable. DVD-RAM This is a relatively obsolete media format, which emphasized rewritable discs that could be written to more than 10,000 times. There were considerable interoperability issues with these discs and they never really caught on.
Blu-Ray Blu-Ray is a high-density optical storage method that was designed for recording high-definition video. The name of this technology comes from the blue-violet laser that is used to read and write to the discs. A single-layer Blu-Ray disc can store up to 25 GB of data, whereas a dual-layer Blu-Ray disc can store up to 50 GB of data. Although many people are familiar with the stand-alone Blu-Ray players to play movies, there are also Blu-Ray drives that allow users to record and play data on computers. In 2007, Pioneer announced the release of a Blu-Ray drive that can record data to Blu-Ray discs, as well as DVDs and CDs. In addition to this, Sony has also released their own rewritable drive for computers.
Floppy Disks In the early days of personal computing, floppy disks were large (first 8 in., then later 5.25 in. in diameter), thin, and flexible. Today’s “floppies,” often and more accurately called disks, are smaller (3.5 in.), rigid, and less fragile. The disk inside the disk housing is plastic, coated with magnetic material. The drive into which you insert the disk contains a motor to rotate the disk so that the drive heads, made of tiny electromagnets, can read and write to different locations on the disk. Standard disks today hold 1.44 MB of data; SuperDisk technology (developed by Imation Corporation) provides for storing either 120 or 240 MB on disks of the same size.
Magnetic Tape In the early days of computing, magnetic tapes were one of the few methods used to store data. Magnetic tapes consist of a thin plastic strip that has magnetic coating, on which data can be stored. Early systems throughout the 1950s to 1970s used 10.5 in. magnetic tape, whereas home computers in the early 1980s used audiocassette tapes for storing programs and data. Today, magnetic tape is still commonly used to back up data on network servers and individual computers. Magnetic tape is a relatively inexpensive form of removable storage, especially for backing up data. It is less useful for data that needs to be accessed frequently
Summary of Exam Objectives 35
because it is a sequential access media. You have to move back and forth through the tape to locate the particular data you want. In other words, to get from file 1 to file 20, you have to go through files 2 through 19. This is in contrast to direct access media like disks, in which the heads can be moved directly to the location of the data you want to access without progressing in sequence through all the other files.
Network-Attached Storage Corporate networks commonly request users to store their data on shared, centralized storage. Users commonly access through a mapped drive on their computer, which allows them to save to a file server. The file server has one or more hard disks that users utilize to save or retrieve data. Because the data is centralized, network administrators can back up the data stored on the server easily. Users who don’t use this storage, and choose to back up the data on a local drive generally don’t have the benefit of data being backed up. Although file servers have been a common component of networks, another storage system is becoming increasingly popular on networks. Network-attached storage (NAS) is a system that is connected to a network to provide centralized storage of data. Unlike a traditional file server, which can be used to run applications, databases, or provide other resources, NAS is only used for data storage. It is scaled down to only providing access to a file system in which data is stored, and management tools that are accessed remotely. It consists of a set of hard disks that can be configured as redundant array of independent disks (RAID) arrays, and supports authentication, encryption, permissions, and rights. To access the data, users connect using protocols like network file system (NFS) or server message blocks (SMB).
Summary of Exam Objectives In this chapter, we discussed a number of technologies, tools, and risks associated with computer and network security. Code attacks are carefully crafted programs written by attackers and designed to do damage. Trojan horses, viruses, spyware, rootkits, and malware, are all examples of this kind of attack. These programs are written to be independent and do not always require user intervention or for the attacker to be present for their damage to be done. By configuring your computer and using antivirus/antispyware utilities, you can protect your systems from known versions of malicious software. In addition to discussing how data can be threatened, we also discussed methods of storing and transferring data. Today, there are more data storage devices and methods for getting devices to communicate with one another than ever before. In addition to more traditional technologies like floppy disks, CDs, and DVDs, there are USB devices that can store more data than early hard disks on PCs. Other devices like iPods and cell phones can also be used to store and transmit data. Each of these technologies brings increased benefits to users, and new challenges to security professionals.
36 CHAPTER 1 Systems Security Overview
Exam Objectives Fast Track Security Threats ■■
■■
■■
■■
■■
■■
■■
■■
■■
■■
■■
Malware is malicious software, carefully crafted programs written and designed by attackers to compromise security and/or do damage. Computer security is the process of protecting systems and data from unauthorized access, malicious users and software, and other threats that could result in the loss of integrity, damage, or loss of data and equipment. Privilege escalation occurs when a user acquires greater permissions and rights than he or she was intended to receive. This can occur as a result of bugs or backdoors in the software. Bugs are errors in software, causing the program to function in a manner that wasn’t intended. Backdoors are methods of accessing a system in a manner that bypasses normal authentication methods. Viruses are programs that automatically spread, usually when an innocent victim executes the virus’ payload, and generally causes damage. Viruses have a long history in computing, and take many different forms. Today’s antivirus software is effective in catching most viruses before they can spread or cause damage. Worms are basically network viruses, spread without user knowledge that wreaks havoc on computers and systems by consuming vast resources. Because they are self-replicating, a worm outbreak can reach hundreds of thousands of machines in a matter of days or hours. Antivirus software is an application that is designed to detect viruses, worms, and other malware on a computer system. These programs may monitor the system for suspicious activity that indicates the presence of malware, or use signature files to detect and remove viruses from your system. Signature files are files that contain information on known viruses, and are used by antivirus software to identify viruses on a system. Trojan horses are different from viruses in that they require the user to run them. They usually come hidden, disguised as some kind of interesting program, or sometimes even as a patch for a virus or common computer problem. Installing back doors or deleting files are common behaviors for Trojan horses. Most antiviral software can catch and disable Trojan horses. Rootkits are a collection of tools that are used to acquire elevated privileges on a computer, thereby allowing a hacker access to data or functions he or she wouldn’t normally have. Rootkits try to hide their presence from the OS by modifying the kernel, drivers, or common applications. They are hard to detect and eliminate, and are used to plant other malicious software like backdoors or viruses.
Exam Objectives Fast Track 37
■■
■■
■■
■■
Spyware is currently one of the most prevalent, although in theory less harmful, code attacks. Most of them are more annoying than dangerous, but some can have criminal intentions, and most cause instability in affected systems. Adware is software that displays advertising while the product is being used, and is used by software developers to finance the distribution of their product as freeware. Bots (short for robots) are a type of program that run automatically, and can be used to receive commands from a remote computer used by a bot herder. A network of bots is known as a botnet, and can be used for simultaneous attacks on sites, or to send spam from multiple machines. Logic bombs are a type of program that is designed to execute and do damage after a certain condition is met, such as after a certain amount of time has passed, a specific date occurs, or other events or actions that activate malicious code.
Hardware and Peripheral Security Risks ■■
■■
■■
■■
■■
■■
■■
BIOS is a chip on the motherboard of a computer, and contains instructions on how to start the computer and load the OS, and low-level instructions about how the system is to handle various hardware and peripherals. Information used by the BIOS is set and stored through the CMOS. The CMOS uses a battery on the motherboard to retain power, so that any settings used by the BIOS aren’t lost when the computer turns off. A power-on password can be set in the CMOS settings, requiring anyone who starts the computer to enter a password before the OS loads. Another password may also be set to prevent unauthorized persons from accessing the setup software and making changes to the computer. Flashing the BIOS is done to upgrade it to a newer version. It will overwrite all information, clearing any power-on passwords or CMOS settings. USB is a standard technology that’s used to allow devices to connect through a port on a computer, so that devices can be installed on a computer without having to shut down the machine. There are numerous USB devices available, including storage devices like flash drives. USB flash drives are storage devices that can store any type of data, including photos, video, documents, and various other types of data. They come in a range of storage sizes (upwards to 64 GB) and can be used with almost any system that supports the USB version of the device. iPod is the brand name of portable media players that was developed by Apple, and can be used to store audio, video, and other files.
38 CHAPTER 1 Systems Security Overview
■■
■■
■■
■■ ■■
■■
■■
■■
Flash memory cards and sticks are storage devices that are commonly used for storing photos in digital cameras (and transferring them to PCs) and for storing and transferring programs and data between handheld computers (pocket PCs and palm OS devices). Cell phones, also known as wireless or mobile phones, are handheld devices that allow voice and data communication. Although older cell phones only provided voice communication, most modern phones provide features like e-mail, text messaging, gaming, Internet access, digital camera, and other tools and services that were only available previously with a computer. CD is an acronym for compact disc. CD is a 5-in. optical disc that can contain up to 700 MB of data. DVDs are 5-in. optical discs with the capacity to store 4.7 to 17 GB of data. Blu-Ray is a high-density optical storage method that was designed for recording high-definition video. A single-layer Blu-Ray disc can store up to 25 GB of data, whereas a dual-layer Blu-Ray disc can store up to 50 GB of data. Floppy disks have been a common method of storing data since the early days of personal computers. The 3.5-in. floppy disks are disks that are coated with a magnetic material and housed in plastic. They are capable of storing 1.44 MB of data. Magnetic tapes consist of a thin plastic strip that has magnetic coating, on which data can be stored. Tapes are commonly used to back up data on network servers and individual computers. NAS is a system that is connected to a network to provide centralized storage of data.
EXAM OBJECTIVES Frequently Asked Questions Q: If I don’t open file attachments from people I don’t know, will this prevent me from getting a virus? A: It is always wise not to open file attachments from people you don’t know, but this won’t completely protect you from a virus. As we discussed in this chapter, a virus may send itself to everyone in an e-mail program’s address book, so it may appear that it’s coming from someone you know. It’s important not to open any documents you weren’t expecting, especially when they come from people you don’t know. If you do receive an e-mail attachment you weren’t e xpecting or that seems suspicious, don’t open it. If you know the sender, you can always contact that person to confirm if they have sent you a file attachment. Q: My company has a firewall, do I need to worry about worms?
Self Test 39
A: Yes. Many users these days have laptop computers that are connected to a number of different networks. Each new network is a new vector for worm attack. Many companies stand to face outages caused by worms brought in on employee laptops. Also, some worms/viruses/Trojans are unwittingly downloaded from seemingly harmless Web sites. Firewalls need to inspect all allowed traffic to filter out attacks through normally safe protocols. Q: Should I avoid opening common file types used by viruses, and completely block them with the firewall? A: In configuring firewalls and educating users on how to handle different file extensions, common sense must be exercised. For example, if your boss e-mailed an internal memo in the form of a Microsoft Word document, it would probably be wise not to ignore it. Similarly, a bookkeeper may need to send regular spreadsheets to an external payroll company, or else no one would get paid. Business doesn’t stop simply because of the possibility of viruses. While you should never open an executable file that you weren’t expecting, such as those ending in .com, .exe, .scr, and so on, it is important to identify what business processes rely on transmitting certain file types over the network or Internet.
Self Test
1. You are analyzing the current security of your network and are concerned about the possibility that users will bypass authentication and gain greater permissions than they were given. What are the two major causes of privilege escalation? Choose all that apply. A. Bugs in software C. Backdoors B. Spyware D. BIOS
2. A user reports that his machine frequently crashes, and that he believes someone has accessed his e-mail account with his password. He has performed an antivirus scan on his computer and it is clean. What other likely culprit is behind the attack? A. A worm C. A Rootkit B. A Trojan horse D. A logic bomb
3. You open a Microsoft Word document and notice that other files you have open suddenly close. When you reopen these files, you find that the information in them has been modified. The same behavior doesn’t occur when other programs are used. What type of virus has probably infected your system? A. Parasitic C. Boot sector B. Data file D. A logic bomb
40 CHAPTER 1 Systems Security Overview
4. A programmer has recently been fired from the organization. On the programmer’s next birthday, your server suddenly locks up. Upon investigating, you find that there have been numerous Registry changes, and system files have been deleted by a service created by the dismissed programmer. What has a ffected your system? A. Nothing. Programs often modify Registry settings. B. Link C. Boot sector D. Logic bomb
5. You have installed a new program on your computer. The software doesn’t cost anything, but it does display intermittent advertisements for products in a corner of the screen. After installing, you notice that there is a sudden increase in received data across your Internet connection, although there is no real increase in data being sent. You’re not using your Web browser, e-mail software, or other Internet applications, so you’re concerned whether the new program is sending data over the Internet. Which of the following has most likely been installed? A. Virus C. Adware B. Antivirus D. Worm
6. What are good ways to protect against worms? (Select all that apply.) A. User education programs B. Correct firewall configuration C. Timely software patches D. Antivirus scans
7. You receive an e-mail warning you about a virus, stating that if a Windows XP computer contains the file mstsc.exe, you have been infected with the virus. As such, you should delete that file and a series of others. In searching the Internet, you find information that this is a normal Windows file. What type of virus is this? A. Link C. Data file B. Companion D. Hoax
8. A user has a laptop computer that normally isn’t connected to the network. She complains that her computer has slowed down considerably, and certain programs on the machine no longer open. She ran her antivirus program, but it found nothing. You establish a remote connection to the computer so that you can view what’s installed on the laptop, and see that she has antivirus software installed and running. When you map a drive letter to the laptop and run the antivirus software on your computer, you find several viruses have infected the laptop. Why are you able to find the viruses but not her?
Self Test 41
A. The antivirus software on her laptop hasn’t been updated with the latest signature files. B. It is a hoax virus. C. You are getting a false positive. The virus must be on your machine and not the laptop, because you can’t scan mapped drives with antivirus software. D. She didn’t have antivirus software installed or running on her machine.
9. You are configuring a firewall to block certain file types from being attached to incoming e-mail. When the e-mail reaches the firewall, you want these files to be removed from the e-mail, so that only the message reaches the user on your network. Which of the following file extensions are associated with executables that are commonly targeted by viruses and should be removed? Choose all that apply. A. .doc C. .exe B. .com D. .reg
10. Your company’s Web server suddenly gets tens of thousands of simultaneous requests for a Web page. After the Web server crashes, you restart the server and then take a look at the log files. You see that some of the requests came from your own network. What kind of attack has most likely happened? A. Rootkit C. Virus B. Botnet D. Worm 11. You have purchased a used computer in an auction. When you power-on the computer, you are asked for a password before the OS even loads. Since you don’t have it, how will you clear the password so that you can start the computer and begin using it? A. Clear the password in the CMOS settings B. Flash the BIOS C. Press F10 or DEL on the keyboard D. There is nothing you can do if you don’t have the power-on password. 12. You have heard that upgrading the BIOS on a computer can help to fix any bugs and provide new features. You download a new BIOS version and begin the upgrade. Everything seems to go well, and you recycle the power on the computer. It doesn’t start but produces a blank screen. What most likely is the cause of the computer not starting? A. The wrong BIOS version was installed. B. There was a power outage during the upgrade. C. The CMOS editor needs to be reconfigured. D. You should never flash the BIOS as it will cause the computer to fail.
42 CHAPTER 1 Systems Security Overview
13. Your company has started issuing USB flash drives to employees. Employees now use the devices to copy data from their home computers, insert them into computers used by other businesses, and so on. Members of the sales team and others who deal with outside organizations need this removable storage, so they can obtain copies of specifications, orders, and so forth. In copying files from computers outside of your network, you’re concerned about viruses. Which of the following should you do to ensure that users can benefit from the functionality of their flash drives, while protecting the network from any viruses? A. Turn off autoplay on Windows computers used by your company B. Disable USB ports on any computers attached to your network C. Set write-protection on the flash drive so that viruses can’t be written to the device D. Create a policy that prohibits users from copying data outside of the organization to flash drives 14. You are planning to implement removable storage devices in your organization. Before doing so, your boss wants you to provide information on various types of removable media that users can use to read, write, and rewrite data to. Which of the following storage devices will you discuss? A. Hard disks B. CD-R
C. DVD-R D. Flash memory card
15. You need to migrate 40 GB of data from a hard disk to removable media. You want to ensure that all of the data is stored on a single disc or media. Which of the following will you use? A. Blu-Ray B. DVD
C. CD D. Disk
Self Test Quick Answer Key 1. 2. 3. 4. 5.
A, and C C B D C
6. 7. 8. 9. 10.
B, and C D A B, and C B
11. 12. 13. 14. 15.
A A A D A
CHAPTER
OS Hardening
2
E x a m o b j e c tiv e s in this c hapt e r General OS Hardening........................................................................................................... 44 Server OS Hardening............................................................................................................. 65 Workstation OS..................................................................................................................... 75
Introduction Security+ technicians need to fully understand the fundamentals of system hardening (also described as “locking down” the system). This knowledge is needed not only to pass the Security+ exam, but also to work in the field of information security. You will learn that the skills needed to detect breeches and exploits are an essential part of the security technician’s repertoire. The Security+ exam covers the general fundamentals of hardening. Operating system (OS) hardening covers important concepts such as locking down file systems, controlling software installation, and use and methods for configuring file systems properly to limit access and reduce the possibility of a breach. Some other steps to take to harden the OS include installing only protocols that are used, enabling only services that are needed, installing only the software that is needed and approved, and granting the minimum rights to users as required. Additional steps could be to limit the users’ ability to perform tasks they would not perform, such as installing unauthorized software, or changing Windows settings. In some cases, it may also be necessary to encrypt files on disk to further restrict access to sensitive data. Many OS default configurations do not provide an optimum level of security, because priority is given to those who need access to data. Even so-called secure OSes may have been configured incorrectly to allow full access. Thus, it is important to modify OS settings to harden the system for access control. Other topics covered in the area of OS hardening are how to receive, test, and apply service packs and hotfixes to secure potential vulnerabilities in systems. Depending on the environment, it may be necessary to disable external devices, such as USB interfaces and compact disc, read-only memory (CD-ROM) drives to prevent users from installing unauthorized software.
43
44 CHAPTER 2 OS Hardening
General OS Hardening OS hardening involves making the OS less vulnerable to threats. In this chapter, we’ll cover many of the ways you can help to harden the OS. You should follow a documented, step-by-step process to harden your OS. It is recommended you use standard approaches to securing your OSes across the board. When looking at ways to provide file and directory security, you must first look at how file security can be structured. ■■ ■■
Start with everything accessible and lock down the things you want to restrict. Start with everything locked down and open up the things you want to allow access to.
Of these two potential methods, the second, which is also referred to as the rule of least privilege, is the preferred method. Least privilege is when you start with the most secure environment and then loosen the controls as needed. Using this method works to be as restrictive as possible with the authorizations provided to users, processes, or applications that access these resources. Accessibility and security are usually at opposite ends of the spectrum; this means that the more convenient it is for users to access data, the less secure the network. While looking at hardening security through permissions (for example, authentication, authorization, and accounting [AAA]), administrators should also consider updating the methods used to access the resources. It starts with the process of evaluating risk. That’s one of the key steps in the hardening process, as the question will often arise as to what is secure enough? That’s the role of the risk assessment in this process. As an example, your child’s piggy bank may be protected by no more than a small lock hidden on the bottom. Although that’s suitable for your child’s change, you have probably noticed that your bank has many more controls protecting you and their other customers’ assets. Risk assessment works the same way in that the value of the asset will drive the process of access control and what type of authorization will be needed to access the protected resource. It is important to look at the use and appropriateness of mandatory access control (MAC), discretionary access control (DAC), and role-based access control (RBAC) in controlling access appropriately and to coordinate this effort with the establishment of file system controls. Let’s discuss each type of access control.
MAC/DAC/RBAC In discussing access control, MAC, DAC, and RBAC are individual areas that take on a new meaning. ■■
MAC In this context, is not a network interface card (NIC) hardware address but rather a concept called MAC.
General OS Hardening 45
■■ ■■
DAC Is often referred to as the use of discretionary access control lists (DACLs). RBAC Should not be confused with rule-based access control but is instead an access control method based on the use of the specific roles played by individuals or systems.
All three methods have varying uses when trying to define or limit access to resources, devices, or networks. The following sections explore and illustrate each of the three access control methods.
MAC MAC is generally built into and implemented within the OS being used, although it may also be designed into applications. MAC components are present in UNIX, Linux, Microsoft’s Windows OSes, OpenBSD, and others. Mandatory controls are usually hard-coded and set on each object or resource individually. MAC can be applied to any object within an OS and allows a high level of granularity and function in the granting or denying of access to the objects. MAC can be applied to each object and can control access by processes, applications, and users to the object. It cannot be modified by the owner or creator of the object. The following example illustrates the level of control possible. When using MAC, if a file has a certain level of sensitivity (or context) set, the system will not allow certain users, programs, or administrators to perform operations on that file. Think of setting the file’s sensitivity higher than that of an e-mail program. You can read, write, and copy the file as desired, but without an access level of root, superuser, or administrator, you cannot e-mail the file to another system, because the e-mail program lacks clearance to manipulate the file’s level of access control. For example, this level of control is useful in the prevention of Trojan horse attacks, since you can set the access levels appropriately to each system process, thus severely limiting the capability of the Trojan horse to operate. The Trojan horse would have to have intimate knowledge of each of the levels of access defined on the system to compromise it or make the Trojan horse viable within it. To review briefly, MAC is ■■
Nondiscretionary The control settings are hard-coded and not modifiable by the user or owner.
■■
Multilevel Control of access privileges is definable at multiple access levels.
■■
Label-based May be used to control access to objects in a database
■■
Universally Applied Applied to all objects
DAC DAC is the setting of access permissions on an object that a user or application has created or has control of. This includes setting permissions on files, folders, and shared resources. The “owner” of the object in most OS environments applies DACs. This ownership may be transferred or controlled by root or other superuser/
46 CHAPTER 2 OS Hardening
administrator accounts. It is important to understand that DAC is assigned or controlled by the owner rather than being hard-coded into the system. DAC does not allow the fine level of control available with MAC, but requires less coding and administration of individual files and resources. To summarize, DAC is ■■
■■
■■
Discretionary Not hard-coded and not automatically applied by the OS/ network operating system (NOS) or application Controllable Controlled by the owner of the object (file, folder, or other types) Transferable The owner may give control away.
RBAC RBAC can be described in different ways. The most familiar process is a comparison or illustration using the “groups” concept. In Windows, UNIX/Linux, and NetWare systems, the concept of groups is used to simplify the administration of access control permissions and settings. When creating the appropriate groupings, you have the ability to centralize the function of setting the access levels for various resources within the system. We have been taught that this is the way to simplify the general administration of resources within networks and local machines. However, although the concept of RBAC is similar, it is not the exact same structure. With the use of groups, a general level of access based on a user or machine object grouping is created for the convenience of the administrator. However, when the group model is used, it does not allow for the true level of access that should be defined, and the entire membership of the group gets the same access. This can lead to unnecessary access being granted to some members of the group. RBAC allows for a more granular and defined access level, without the generality that exists within the group environment. A role definition is developed and defined for each job in an organization, and access controls are based on that role. This allows for centralization of the access control function, with individuals or processes being classified into a role that is then allowed access to the network and to defined resources. This type of access control requires more development and cost but is superior to MAC in that it is flexible and able to be redefined more easily. RBAC can also be used to grant or deny access to a particular router or to File Transfer Protocol (FTP) or Telnet. RBAC is easier to understand using an example. Assume that there is a user at a company whose role within the company requires access to specific shared resources on the network. Using groups, the user would be added to an existing group which has access to the resource and access would be granted. RBAC on the other hand would have you define the role of the user and then allow that specific role access to whatever resources are required. If users get a promotion and change roles, changing their security permissions is as simple as assigning them to their new
General OS Hardening 47
roles. If they leave the company and are replaced, assigning the appropriate role to the new employees grants them access to exactly what they need to do their jobs without trying to determine all of the appropriate groups that would be necessary without RBAC. In summary, RBAC is: ■■ ■■
■■
■■
Job Based The role is based on the functions performed by the user. Highly Configurable Roles can be created and assigned as needed or as job functions change. More Flexible Than MAC MAC is based on very specific information, whereas RBAC is based off of a user’s role in the company, which can vary greatly. More Precise Than Groups RBAC allows the application of the principle of least privilege, granting the precise level of access required to perform a function.
An example of this would be using groups in Windows Active Directory to grant access to users, as opposed to granting access directly. For example, a file share used by accounting could be granted read-write access to the accounting group. The accounting group would contain all the accountants within an organization. Exam Warning Be careful! RBAC has two different definitions in the Security+ exam. The first is defined as Role-Based Access Control. A second definition of RBAC that applies to control of (and access to) network devices is defined as Rule-Based Access Control. This consists of creating access control lists (ACL) for those devices and configuring the rules for access to them.
The challenge is to secure the OS and provide what’s needed to allow the system to perform as desired without allowing anything that is unnecessary. For example, you should turn off any unused services or features that could be exploited. Surface area refers to the area (services, ports, and so forth) available on a computer for attack. Reducing the surface area, which means reducing the area that’s available for a hacker to attack, is a good part of securing an OS. While this extends beyond the OS, we will focus on reducing surface area in the OS in this chapter. More services, file shares, features, or programs running on a computer provide more opportunity for a hacker to attack. For example, if a file server has Internet Information Services (IIS) running on it, this would provide more avenues or surface exposed for attack. Exposing the least amount of surface area for attack will greatly enhance the security of your computer. You can use tools such as port scanners to analyze what’s open and exposed from outside the computer. “Penetration testing” to see if you can get past the computer’s defenses is one method of testing.
48 CHAPTER 2 OS Hardening
The following sections discuss and explore the methods used to harden defenses and reduce vulnerabilities that exist in systems. To get things started, let’s review the general steps to follow for securing an OS:
1. Disable all unnecessary services
2. Restrict permissions on files and access to the Registry
3. Apply the latest patches and fixes
4. Remove unnecessary programs
Services Windows-based computers also have the capability to enable and disable services. Figure 2.1 shows some of the services dialog on a workstation. Services can be disabled through the properties for the service (see Figure 2.2). Best practices would be to disable any services on a server or workstation that are not required. Note As you begin to evaluate the need to remove protocols and services, make sure that the items you are removing are within your area of control. Consult with your system administrator on the appropriate action to take and make sure you have prepared a plan to back out and recover if you make a mistake.
While considering removal of nonessential services, it is important to look at every area of the computer’s application to determine what is actually occurring and running on the system. The appropriate tools are needed to do this, and the Internet contains a wealth of resources for tools and information to analyze and inspect systems.
Figure 2.1 Workstation Services
General OS Hardening 49
Figure 2.2 Workstation Services Properties
File System Controlling access is an important element in maintaining system security. The most secure environments follow the “least privileged” principle, as mentioned earlier. This principle states that users are granted the least amount of access possible that still enables them to complete their required work tasks. Expansions to that access are carefully considered before being implemented. Law enforcement officers and those in government agencies are familiar with this principle regarding noncomputerized information, where the concept is usually termed need to know. Generally, following this principle means that network administrators receive more complaints from users unable to access resources. However, receiving complaints from authorized users is better than suffering access violations that damage an organization’s profitability or ability to conduct business. In practice, maintaining the least privileged principle directly affects the level of administrative, management, and auditing overhead, increasing the levels required to implement and maintain the environment. One alternative, the use of user groups,
50 CHAPTER 2 OS Hardening
is a great time saver. Instead of assigning individual access controls, groups of similar users are assigned the same access. In cases where all users in a group have exactly the same access needs, this method works. However, in many cases, individual users need more or less access than other group members. When security is important, the extra effort to fine-tune individual user access provides greater control over what each user can and cannot access. Keeping individual user access as specific as possible limits some threats, such as the possibility that a single compromised user account could grant a hacker unrestricted access. It does not, however, prevent the compromise of more privileged accounts, such as those of administrators or specific service operators. It does force intruders to focus their efforts on the privileged accounts, where stronger controls and more diligent auditing should occur.
Head of the Class How Should We Work with File System Access? Despite the emphasis on group-based access permissions, a much higher level of security can be attained in all operating platforms by individually assigning access permissions. Administratively, however, it is difficult to justify the expense and time involved in tracking, creating, and verifying individual access permissions for thousands of users trying to access thousands of individual resources. RBAC is a method that can be used to accomplish the goal of achieving the status of least privileged access. It requires more design and effort to start the implementation, but develops a much higher level of control than does the use of groups. Good practice indicates that the default permissions allowed in most OS environments are designed for convenience, not security. For this reason, it is important to be diligent in removing and restructuring these permissions.
Encrypted File System Encrypted file system (EFS) can be used on Windows machines to provide an additional layer of protection when it comes to securing the OS. The encrypting file system is part of the Windows OS. What it does is encrypt the files on the disk using symmetric and asymmetric keys. EFS occurs at the OS level. If someone tries to access the file without the appropriate key, they get an “access denied” message. This is used to help ensure unauthorized users don’t get access to encrypted files. The keys are generally tied to an account—once they are imported to the account the access is relatively transparent to the user. This is why it’s important to protect the keys—if someone gains access to the keys, they would be able to access the files, so the keys should be well protected. Using EFS is particularly useful with laptop users. In this day and age with reports of personal data such as credit card information and social security numbers being lost by large companies, EFS would help to protect that data in the event that the
General OS Hardening 51
Figure 2.3 Encrypting a File
hardware is lost or stolen. While the thief may have the files, he won’t be able to access them since he does not have the key. It’s also important to protect the keys from loss, as if the keys are lost, it’s nearly impossible to recover the data. There is a recovery agent that should have the keys imported to it. By encrypting sensitive files, and preventing access to them by unauthorized users, this will contribute to the overall security of the machine being hardened. Figure 2.3 shows how to encrypt files. Clicking the details will show the information about encryption after the file has been encrypted (see Figure 2.4). The main drawback to using EFS is performance. Even though encryption and decryption occur at the OS level, there is still some overhead involved in the process which will add to the CPU load on the machine performing the encryption and decryption. Exam Warning The Security+ exam requires good knowledge of the hardening processes. It includes questions relating to hardening that you may not have thought about. For example, hardening can include concepts present in other security areas, such as locking doors, restricting physical access, and protecting the system from natural or unnatural disasters.
Hotfixes/Patches Updates for OSes are provided by the manufacturer of the specific component. Updates contain improvements to the OS, and new or improved components that the manufacturer believes will make the product more stable, usable, secure, or otherwise attractive to end users. For example, Microsoft updates are often specifically
52 CHAPTER 2 OS Hardening
Figure 2.4 Encryption Details
labeled Security Updates. If you have never taken a look at these, you can find the latest updates at www.microsoft.com/protect/default.mspx. These updates address security concerns recognized by Microsoft and should be evaluated and installed as needed. Updates should be thoroughly tested in nonproduction environments before implementation. It is possible that a “new and improved” function (especially one that enhances user convenience) may actually allow more potential for a security breach than the original component. Complete testing is a must. It’s a good idea to keep up with the hotfixes and patches for your respective OSes. Most vendors will provide regular patch releases and periodic hotfixes. Many of the hotfixes and patches will address security-related features. Microsoft has a mailing list you can subscribe to for information about security updates. To receive automatic notifications whenever Microsoft Security Bulletins and Microsoft Security Advisories are issued or revised, subscribe to Microsoft Technical Security Notifications on www.microsoft.com/technet/security/bulletin/notify.mspx. Another good location would be to subscribe to the Computer Emergency Response Team (CERT) Web site, which may be found at www.cert.org. CERT is located at Carnegie Mellon University’s Software Engineering Institute. One other really good resource is the SecurityFocus Web site at www.securityfocus. com. They have OS specific mailing lists you can join to receive regular updates on
General OS Hardening 53
available patches as well as security flaws to beware of and discussions on current security topics and best practices.
Service Packs/Maintenance Updates Microsoft offers service packs and maintenance updates. Service packs are regular releases with bug fixes and sometimes minor enhancements in them. They are usually a good idea to install; however, it’s a good idea to test.
Hotfixes Hotfixes are packages that can contain one or more patches for software. They generally fix a specific issue or group of issues with a particular piece of software or OS. Hotfixes are generally created by the vendor when a number of clients indicate that there is a compatibility or functional problem with a manufacturer’s products used on particular hardware platforms. These are mainly fixes for known or reported problems that may be limited in scope. As with the implementation of updates, these should be thoroughly tested in a nonproduction environment for compatibility and functionality before being used in a production environment. Because these are generally limited in function, it is not a good practice to install them on every machine. Rather, they should only be installed as needed to correct a specific problem.
Service Packs Service packs are accumulated sets of updates or hotfixes. Service packs are usually tested over a wide range of hardware and applications in an attempt to assure compatibility with existing patches and updates and to initiate much broader coverage than just hotfixes. The recommendations discussed previously also apply to service pack installation. Service packs must be fully tested and verified before being installed on live systems. Although most vendors of OS software attempt to test all the components of a service pack before distribution, it is impossible for them to test every possible system configuration that may be encountered in the field, so it is up to the administrator to test their own. The purpose is to slow or deter compromise, provide security for resources, and assure availability.
Damage & Defense What Should I Do to Try to Minimize Problems with Updates, Service Packs, Patches, and Hotfixes? 1. Read the instructions. Most repair procedures include information about their applicability to systems, system requirements, removal of previous repairs, or other conditions. 2. Install and test in a nonproduction environment, not on live machines. 3. If offered, use the option to back up the existing components for repair if the update fails.
54 CHAPTER 2 OS Hardening
4. Verify that the condition that is supposed to be updated or repaired is actually repaired. 5. Document the repair.
Patch Management Patches for OSes are available from the vendor supplying the product. These are available by way of the vendor’s Web site or from mirror sites around the world. They are often security related and may be grouped together into a cumulative patch to repair many problems at once. Except for Microsoft, most vendors issue patches at unpredictable intervals; it is therefore important to stay on top of their availability and install them after they have been tested and evaluated in a nonproduction environment. The exception to this is when preparing a new, clean install. In this case, it is wise to download and install all known patches prior to introducing the machines to the network.
Patches Windows-based platforms allow the configuration of OS and network services from provided administrative tools. This can include a service applet in a control panel in Windows NT Server or a Microsoft Management Console (MMC) tool in Windows 2000 and above (XP/2003/Vista/2008). It may also be possible to check or modify configurations at the network adapter properties and configuration pages. In either case, it is important to restrict access and thus limit vulnerability due to unused or unnecessary services or protocols.
Scripts Scripts are a versatile way to manage patches. They can be used to perform custom installations, automatic installations, and pretty much anything a programmer is clever enough to write a script for. Windows provides Windows Scripting Host, which would enable you to create scripts or use predefined script to perform almost any task. You can add users to groups, set features, and so forth. PowerShell is an extensible command line shell which has its own full-featured scripting language. It’s very powerful and integrates with .Net Framework. You can write more complex code using PowerShell.
Patch Management Systems There are quite a few systems out there for managing patches, including homemade systems, Microsoft’s SMS/System Center, Microsoft’s Software Update Services, and so forth.
Altiris Altiris is now part of Symantec, the company that produces Norton Antivirus and Norton utilities. Altiris allows for the management of a wide spectrum of clients from Windows to UNIX to Linux and MacOS machines—all from a single management platform. Altiris has the ability to discover, catalog, and inventory software on
General OS Hardening 55
Windows, UNIX, Linux, and Mac machines, which can help determine the patch level of the computers in your organization.
SMS/System Center Microsoft SMS 2003 and System Center 2007 products are designed to aid in monitoring system health and also can be used to distribute software and settings out to different groups of computers in your organization. SMS 2003 and System Center rely heavily on Active Directory and integrate with Windows Group Policy.
Windows Software Update Services Windows Software Update Services (WSUS) is a freely available product that allows enterprise users to manage Microsoft updates on their computers running the Windows OS. WSUS in its simplest form gets the latest updates from Microsoft and allows the administrators to determine whether to approve or decline individual updates as well as to distribute them across their infrastructure. By distributing the updates from a local server, an administrator can not only control which updates are applied but also help control the amount of Internet bandwidth needed for those updates as well as the time of day the updates are installed.
Windows Group Policies Group Policy in Windows allows you to set security settings as well as install specific software (such as virus scanning) on a group of computers. To understand Group Policy, we need to step back and take a look at Active Directory. You can use Group Policy to manage all aspects of the client desktop environment for Windows clients (Windows servers and workstations), including Registry settings, software installation, scripts, security settings, and so forth. The possibilities of what can be done with Group Policy are almost limitless. With VBScript, Jscript, or PowerShell you can write entire applications to execute via Group Policy. You can install software automatically across the network and apply patches to applications. When deciding on the Group Policies you plan to enforce on your network, keep in mind that the more policies applied, the more network traffic, and hence the longer it could take for users to log onto the network. Group Policies are stored in Active Directory as Group Policy Objects (GPOs). These objects are the instructions for the management task to perform. Group Policy is implemented in four ways: ■■
■■
Local Group Policy Using local Group Policy involves setting up Group Policy on the local machine. This is not very useful for managing computers on a network. Local Group Policy is configured on the local computer. Site Group Policy Site Group Policy is when the GPO is linked to the site. Site Group Policies can generate unwanted network traffic, so use these only when absolutely necessary.
56 CHAPTER 2 OS Hardening
■■
■■
Domain Group Policy Domain Group Policy is when the GPO is linked to the domain. This will apply the GPO to all computers and users within a domain. This is especially useful for enforcing company-wide settings. This is one of the two most commonly used applications of Group Policy. Organizational Unit Group Policy Organizational Unit Group Policy is when the GPO is linked to the organizational unit (OU). OU Group Policy is especially useful for applying a GPO to a logical grouping (OU) of users or computers. This is particularly useful when placing computers for specific tasks in an OU container. For example, you can place all the Web servers in an OU to apply specific settings to those Web servers via Group Policy.
Group Policies provide administrators with the ability to control and configure users’ settings, manage users’ data, and perform remote software installation and maintenance. Group Policies require Active Directory and it is important to remember that the number and complexity of GPOs can adversely affect network performance and login times. Ideally, you should segregate computers that will have the same settings applied into defined OUs. This can be done on a Windows machine using the Active Directory users and computers MMC snap-in. Figure 2.5 shows three OUs for computers: Once the OUs have been created, you can use the Group Policy editor and Group Policy management console to create a Group Policy. In Figure 2.6, we show the Group Policy management console. Most of the options in this console are self-explanatory and help is built-in. Figure 2.5 This can be used to explore and create new GPOs. Three OUs
Exercise 1 Creating a Policy For this exercise, we will create a policy that will audit login events for our Structured Query Language (SQL) Servers. 1.
Right click on the policy and select edit. This starts the Group Policy editor allowing us to define the policy. There are quite a few options available as far as defining restrictions and hardening the computer. Take care when defining options so that the options selected won’t inhibit users from getting their jobs done.
General OS Hardening 57
Figure 2.6 The Group Policy Management Console
2.
Expand the nodes on the right and select audit policy.
3.
Pick audit account login events on the right panel (see Figure 2.7).
4.
Once you’ve made a selection from the right panel, a dialog box opens. In this example, we will enable auditing and click OK. If you were not sure what a setting did, you could view information about the setting on the “Explain This Setting” tab (see Figure 2.8).
5.
Once you click OK, you’ll see the GPO edit screen. You should see the selection reflected in the settings in the right panel as shown in Figure 2.9.
6.
Now close out the GPO editor. Your policy has been created. Note that it is possible to define as many settings as you’d like in the GPO editor, even though in this example we’ve only defined one (see Figure 2.10).
In Figure 2.10, we could check the settings tab and see more information about the settings defined in this GPO. Microsoft provides an easy method to define Group Policy and apply it to groups of machines. This is one way we can harden the OSes and make them less vulnerable to attack.
58 CHAPTER 2 OS Hardening
Figure 2.7 Selecting Audit Account Login Events
Security Templates
Figure 2.8 Viewing Information about Settings
Security templates are basically a “starting point” for defining system settings in Windows. These templates contain hundreds of possible settings that can control a single computer or a whole network of computers and can be customized extensively. Some of the areas which security templates control include user rights, password policies, system policies, and user and system permissions. The base security templates provided by Microsoft are predefined settings to accomplish a specific task. For example, compatws in Windows is used to reduce the security level to allow older applications to run, hisecdc is used to apply a high security level to a domain controller. Similarly,
General OS Hardening 59
Figure 2.9 The GPO Edit Screen
Figure 2.10 A Group Policy Setting
60 CHAPTER 2 OS Hardening
hisecws is used to apply stringent security controls on a workstation. Windows security templates can be found in C:\Windows\Security\templates in XP/Server 2003. The security templates for Windows Vista are available in the Vista Security Guide available at www.microsoft.com.
Windows Security templates are actually part of Group Policy in the Microsoft Windows OS. The security templates can be copied and modified. Windows comes with the following default security templates. ■■
■■
■■ ■■
■■
■■
■■
Compatws.inf This template will change the file and Registry permissions to make the security settings consistent with what would be needed to support older applications. It is generally used when older application support is needed. This should only be used when necessary. DC security.inf This template is created when a server is promoted to a domain controller. It can be used to set a domain controller back to the default settings applied when it was promoted to a domain controller. Hisecdc.inf This is used to increase the security on a domain controller. Hisecws.inf This is used to increase the security on client computers and member servers. Notssid.inf This specifies to remove Windows Terminal Server Security Identifier (SIDs) from the file system and Registry locations. It is used to allow older applications to run under terminal services. Securedc.inf This is used to increase the security on a domain controller, but not to the level of the High Security DC security template. Securews.inf This is used to increase the security on client computers and member servers, but not to the level of the High Security DC security template.
Setup security.inf This is created during installation and will be different between computers. This represents the default security settings that get applied during the installation. Security templates can be managed through the security template snap-in (see Figure 2.11). ■■
Notes from the Field New Templates When making a new template, you can save a lot of time and aggravation by starting with one of the Windows templates that’s already created.
General OS Hardening 61
Figure 2.11 The Security Template Snap-in
SE Linux Linux also has a number of different tools and many different templates which can be used to help harden the OS. While each version of Linux may have differences, there are also a lot of similarities. The same principles that can be applied to Windows can also be applied to Linux. The principle of least access, disabling services and daemons that are not used, and so forth all should be considered. An example would be if you were using a Linux server for file storage, it wouldn’t make sense to have Apache installed and configured on that particular server. Ideally, only services that are used should be enabled. Bastille is an automated security setup tool that provides a level of security based on the usage of the server. The administrator answers a series of questions and based on the answers the settings are determined and then applied. Bastille is freely available at http://bastille-linux.sourceforge.net and works not only on Linux but on UNIX and MacOS X as well.
Configuration Baselines Configuration baselines are standard setups used when configuring machines in organizations. Configuration baselines are used to provide a starting point where machines can then be customized with respect to their specific roles in the network. For example, a Windows domain controller may not require Windows Media Services to be installed since its primary function is that of a directory service. A Web server would not necessarily require a database to be installed. Additionally specific
62 CHAPTER 2 OS Hardening
services would be installed, turned off, or even removed completely based on the final location of the system in the network architecture.
Determining Configuration Baselines When considering baselines for an organization, it is important to always keep in mind the principle of least access. You should determine each of the “functions” that will be needed within your organization and create baseline configurations for each. This could apply to both people and machines; in this case, we’ll use machines as an example. The following example describes the different baselines or types of computers used in a typical organization. Each category would have its own baseline “build” which would consist of set groups of services, programs, settings, and features on a particular machine. In the following example, the consulting organization, Haverford Consultants, Inc. has seven categories of systems that are deployed on their network. These categories are: ■■
Web server
■■
File and print server
■■
Database server
■■
Domain controller
■■
Normal workstation
■■
Developer workstation
■■
Domain name system (DNS), Dynamic Host Control Protocol (DHCP) server
Each category requires specific settings to be applied. The domain controllers may have the hisecdc security template applied since they contain user account information as well as directory services for the organization as a whole. The normal workstation may only need to have the compatws template applied as the end workstations will only be used by the regular users. The Web servers as well as the DNS servers will most likely have tight security requirements as they could be placed outside the corporate firewall in a demilitarized zone (DMZ) that is accessible from the Internet. It is important to remember that the generic security templates provided by Microsoft or used in such hardening tools as Bastille will need to be further customized by an organization to meet their specific security requirements.
Utilizing Configuration Baselines for Security Metrics Microsoft Baseline Security Analyzer The Microsoft Baseline Security Analyzer (MBSA) is a free tool for small and medium businesses that can be used to analyze the security state of a Windows network relative to Microsoft’s own security recommendations. In addition to identifying security
General OS Hardening 63
Figure 2.12 The MBSA Startup Screen
issues, the tool offers specific remediation guidance. MBSA will detect common security misconfigurations and missing security updates on Windows systems. The initial MBSA startup screen is shown in Figure 2.12. MBSA can scan multiple computers or a single computer. In Exercise 2, we’ll scan one computer.
Exercise 2 Running MBSA
1. Start up by either double-clicking on the MBSA shortcut on the desktop or by selecting MBSA from the Programs menu. Once MBSA starts up, you are presented with the “Tasks” screen. Select “Scan a computer.”
2. Enter the information of the computer to be scanned as shown in Figure 2.13. This could be either the computer name or its IP address. Click “Start Scan.”
3. When the scan completes, the results are available in a report shown in the MBSA tool (see Figure 2.14).
Each of the items on the report should be evaluated in detail to ensure all security issues are understood and resolved. The MBSA is an excellent tool that will provide insight into security vulnerabilities in your organization.
64 CHAPTER 2 OS Hardening
Figure 2.13 Scanning a Computer
Figure 2.14 Results from Scanning a Computer
Server OS Hardening 65
Server OS Hardening Server OS hardening can be a very complex and daunting task. However, by following a standard set of procedures and using tools such as security templates and MBSA, this task can be made significantly easier and can result in improved security across your network. One of the first tasks to focus on is deciding which services and protocols need to be enabled and which should be disabled.
Enabling and Disabling Services and Protocols When you are considering whether to enable and disable services and protocols in relation to network hardening, there are extra tasks that must be done to protect the network and its internal systems. As with the OSes and NOSes discussed earlier, it is important to evaluate the current needs and conditions of the network and infrastructure, and then begin to eliminate unnecessary services and protocols. This leads to a cleaner network structure with more capacity and less vulnerability to attack. Eliminating unnecessary network protocols includes eliminating such protocols as Internetwork Packet Exchange (IPX), Sequenced Packet Exchange (SPX), AppleTalk, and/or NetBIOS Extended User Interface (NetBEUI). It is also important to look at the specific operational protocols used in a network such as Internet Control Messaging Protocol (ICMP), Internet Group Management Protocol (IGMP), Service Advertising Protocol (SAP), and the Network Basic Input/Output System (NetBIOS) functionality associated with Server Message Block (SMB) transmissions in Windows-based systems. Note As you begin to evaluate the need to remove protocols and services, make sure that the items you are removing are within your area of control. Consult with your system administrator on the appropriate action to take, and make sure you have prepared a plan to back out and recover if you make a mistake.
While you are considering removal of nonessential protocols, it is important to look at every area of the network to determine what is actually occurring and running on the system. The appropriate tools are needed to do this, and the Internet contains a wealth of resources for tools and information to analyze and inspect systems. A number of functional (and free) tools can be found at sites such as www. foundstone.com/us/resources-free-tools.asp. Among these, tools like SuperScan 4.0 are extremely useful in the evaluation process. If working in a mixed environment with Windows, UNIX, Linux, and/or NetWare machines, a tool such as Big Brother for monitoring may be downloaded and evaluated (or in some cases used without charge) by visiting www.bb4.com. Another useful tool is Nmap, which is available at http://insecure.org/nmap/. These tools can be used to scan, monitor, and report on multiple platforms, giving a better view of what is present in an environment. In Linux-based systems, nonessential services can be controlled in different ways, depending on the distribution being worked with. This may include editing or
66 CHAPTER 2 OS Hardening
making changes to xinetd.conf or inetd.conf or use of the graphical Linuxconf or ntsysv utilities or even the Webmin configuration tool. It may also include the use of ipchains or iptables in various versions to restrict the options available for connection at a firewall.
Nonessential Services Let’s begin with a discussion about the concept of nonessential services. Nonessential services are the ones you do not use or have not used in some time. For many, the journey from desktops to desktop support to servers to entire systems support involves a myriad of new issues to work on. And as we progressed, we wanted to see what things could be done with the new hardware and its capabilities. In addition, we were also often working on a system that we were not comfortable with, had not studied, and had little information about. Along with having a superior press for using the latest and greatest information, we hurried and implemented new technologies without knowing the pitfalls and shortcomings. Nonessential services may include network services, such as DNS or DHCP, Telnet, Web, or FTP services. They may include authentication services for the enterprise, if located on a nonenterprise device. They may also include anything that was installed by default that is not part of your needed services. Systems without shared resources need not run file and print services. In a Linux environment, if the machine is not running as an e-mail server, then remove sendmail. If the system is not sharing files with a Windows-based network, then remove Samba. Likewise, if you are not using NIS for authentication, you should disable the service or remove it. This is applicable for any type of OS. The Security+ exam is OS agnostic, meaning that the same general principles apply regardless of the OS that you use. Being familiar with the services that are unnecessary for the specific OS that you are working with is an important part of ensuring that the system is well secured. The basic premise is to disable the services that you do not need. The list of services that this covers varies by OS or even the specific version or release of the OS.
Nonessential Protocols Nonessential protocols can provide the opportunity for an attacker to reach or compromise your system. These include network protocols such as IPX/SPX (in Windows OSes, NWLink) and NetBEUI. It also includes the removal of unnecessary protocols such as ICMP, IGMP, and specific vendor supplied protocols such as Cisco’s Cisco Discovery Protocol (CDP), which is used for communication between Cisco devices, but may open a level of vulnerability in your system. Evaluation of protocols used for communication between network devices, applications, or systems that are proprietary or used by system device manufacturers, such as the protocols used by Cisco to indicate private interior gateways to their interoperating devices, should also be closely examined.
Server OS Hardening 67
Evaluation of the protocols suggested for removal may show that they are needed in some parts of the system but not others. Many OS platforms allow the flexibility of binding protocols to certain adaptors and leaving them unbound on others, thus reducing the potential vulnerability level.
Disabling Nonessential Processes Processes running on your systems should be evaluated regarding their necessity to operations. Many processes are installed by default but are rarely or never used by the OS. In addition to disabling or removing these processes, you should regularly evaluate the running processes on the machine to make sure they are necessary. As with disabling unnecessary protocols and services and systems, you must be aware of the need for the processes and their potential for abuse that could lead to system downtime, crashes, or breach. UNIX, Linux, Windows server and workstation systems, and NetWare systems all have mechanisms for monitoring and tracking processes, which will give you a good idea of their level of priority and whether they are needed in the environments you are running.
Disabling Nonessential Programs Like the other areas we have discussed, it is appropriate to visit the process of disabling or removing unnecessary programs. Applications that run in the background are often undetected in normal machine checks and can be compromised or otherwise affect your systems negatively. An evaluation of installed programs is always appropriate. Aside from the benefit of more resources being available, it also eliminates the potential that a breach will occur.
FTP Servers FTP servers are potential security problems, as they are often exposed to outside interfaces, thereby inviting anyone to access them. The vast majority of FTP servers open to the Internet support anonymous access to public resources. Additionally, incorrect file system settings in a server acting as an FTP server allow unrestricted access to all resources stored on that server and could lead to a system breach. FTP servers exposed to the Internet are best operated in the DMZ rather than the internal network and should be hardened with all of the OS and NOS fixes available. All services other than FTP should be disabled or removed. Contact from the internal network to the FTP server through the firewall should be restricted and controlled through ACL entries to prevent possible traffic through the FTP server from returning to the internal network. FTP servers providing service in an internal network are also susceptible to attack; therefore, administrators should consider establishing access controls including usernames and passwords, as well as the use of Secure Sockets Layer (SSL) for authentication.
68 CHAPTER 2 OS Hardening
Some of the hardening tasks that should be performed on FTP servers include: ■■
Protection of the server file system
■■
Isolation of the FTP directories
■■
Positive creation of authorization and access control rules
■■
Regular review of logs
■■
Regular review of directory content to detect unauthorized files and usage
DNS Servers Hardening DNS servers consists of performing normal OS hardening and then considering the types of control that can be done with the DNS service itself. Older versions of Berkeley Internet Name Domain (BIND) DNS were not always easy to configure, but current versions running on Linux and UNIX platforms can be secured relatively easily. Microsoft’s initial offering of DNS on NT was plagued with violations of their integrity, making internetwork attacks much easier to accomplish, since information about the internal network was easy to retrieve. With Windows 2003, Microsoft made significant strides to secure their DNS server. Among the many changes made were the addition of controls to prevent zone transfer operations to machines that are not approved to request such information, thus better protecting the resources in the zone files from unauthorized use. With the release of BIND 9, a new capability was added to provide different functionality from the software based on the hosts accessing the server. This capability is invoked with the view clause in the named.conf. When hardening a DNS server, it is critical to restrict zone transfers. Zone transfers should only be allowed to designated servers. Additionally, those users who may successfully query the zone records with utilities such as nslookup should be restricted via the ACL settings. Zone files contain all records of a zone that are entered; therefore, an unauthorized entity that retrieves the records has retrieved a record of what is generally the internal network, with host names and IP addresses. There are records within a DNS server that can be set for individual machines. These include HINFO records, which generally contain descriptive information about the OS and features of a particular machine. HINFO records were used in the past to track machine configurations when all records were maintained statically, and were not as attractive a target as they are today. A best practice in this case would be to not use HINFO records in the DNS server. Attackers attempt zone transfers by using the following command: First, by typing nslookup from the command line, next the target server’s DNS server address is entered, server
, then the set type=any command is entered. Finally, the ls -d target.com is entered to try and force the zone transfer. If successful, a list of zone records will follow. There are a number of known exploits against DNS servers in general. For example, a major corporation placed all their DNS servers on a single segment. This made
Server OS Hardening 69
it relatively simple to mount a denial of service (DoS) attack using ICMP to block or flood traffic to that segment. Other attacks that administrators must harden against are attacks involving cache poisoning, in which a server is fed altered or spoofed records that are retained and then duplicated elsewhere. In this case, a basic step for slowing this type of attack is to configure the DNS server to not do recursive queries. It is also important to realize that BIND servers must run under the context of root and Windows DNS servers must run under the context of Local System to access the ports they need to work with. It is possible to run BIND under a chroot jail in UNIX and to run Windows DNS under a different, lower privilege, account as well. If the base NOS is not sufficiently hardened, a compromise can occur.
Network News Transfer Protocol Servers Network News Transfer Protocol (NNTP) servers are also vulnerable to some types of attacks, because they are often heavily used from a network resource perspective. NNTP servers that are used to carry high volumes of newsgroup traffic from Internet feeds are vulnerable to DoS attacks that can be mounted when “flame wars” occur. This vulnerability also exists in the case of listserv applications used for mailing lists. NNTP servers also have vulnerabilities similar to e-mail servers, because they are not always configured correctly to set storage parameters, purge newsgroup records, or limit attachments. It is important to be aware of malicious code and attachments that can be attached to the messages that are being accepted and stored. NNTP servers should be restricted to valid entities, which require that the network administrator correctly set the limits for access. It is also important to be aware of the platform being used for hosting a NNTP server. If Windows-based, it will be subject to the same hardening and file permission issues present in Windows IIS servers. Therefore, there are additional services and protocols that must be limited for throughput and defenses such as virus scanning that must be in place.
File and Print Servers The ability to share files and printers with other members of a network can make many tasks simpler and, in fact, this was the original purpose for networking computers. However, this ability also has a dark side, especially when users are unaware that they are sharing resources. If a trusted user can gain access, the possibility exists that a malicious user can also obtain access. On systems linked by broadband connections, crackers have all the time they need to connect to shared resources and exploit them. The service called file and print sharing in Windows allows others to access the system from across the network to view and retrieve files or use resources. Other OSes have similar services (and thus similar weaknesses). The Microsoft file- and print-sharing service uses NetBIOS with SMB traffic to advertise shared resources, but does not offer security to restrict who can see and access those resources.
70 CHAPTER 2 OS Hardening
This security is controlled by setting permissions on those resources. The problem is that when a resource is created in a Windows-based system, they are set by default to give full control over the resource to everyone who accesses that system. By default, the file- and print-sharing service is bound to all interfaces being used for communication. Under Windows XP and 2000 when sharing is enabled for the purpose of sharing resources with a trusted internal network over a NIC, the system is also sharing those resources with the entire untrusted external network over the external interface connection. This is no longer the case with Windows Vista, however connecting to an untrusted network automatically turns off file sharing. Many users are unaware of these defaults and do not realize their resources are available to anyone who knows enough about Windows to find them. For example, users with access to port scanning software or using the basic analysis provided through the use of NetBIOS statistics (NBTSTAT) or the net view command in a Windows network would have the capability to list shared resources if NetBIOS functionality exists.
Notes from the Field Look at What Is Exposed To look at the resources exposed in a Windows network, open a command window in any version of Windows that is networked. Click the Start button at the bottom left of the task bar. Click the “Run” option and in the dialog box type cmd. In the command window that opens up type net view and press the Return [Enter] key. You will see a display showing machines with shared resources in the network segment and the machines they are attached to. The display will look something like this: Server Name Remark ----------------------------------------\\EXCELENTXP \\EXC2003 The command completed successfully. Next, type net view \\machine name at the prompt, and hit the Enter or Return key. That display might look like this: Shared resources at \\excnt4 Share name Type Used as Comment -----------------------------------------public Disk The command completed successfully. As can be seen, it does not take much effort for attackers inside or outside a network to view vulnerabilities that are shown when NetBIOS functionality is present.
Server OS Hardening 71
At the very least, the file- and print-sharing service should be unbound from the external network interface’s adapter. Another solution (or a further precaution to take in addition to unbinding the external adapter) is to use a different protocol on the internal network. For example, computers could communicate over NetBEUI on a small local nonrouted network. If file and print sharing is bound to NetBEUI and unbound from Transmission Control Protocol/Internet Protocol (TCP/IP), internal users can still share resources, but those resources will be unavailable to “outsiders” on the Internet. If a user does not need to share resources with anyone on the internal (local) network, the file- and print-sharing service should be completely disabled. On most networks where security is important, this service is disabled on all clients. This action forces all shared resources to be stored on network servers, which typically have better security and access controls than end-user client systems.
DHCP Servers DHCP servers add another layer of complexity to some layers of security, but also offer the opportunity to control network addressing for client machines. This allows for a more secure environment if the client machines are configured properly. In the case of the clients, this means that administrators have to establish a strong ACL to limit the ability of users to modify network settings, regardless of platform. Nearly all OSes and NOSes offer the capability to add DHCP server applications to their server versions. As seen in each of the application server areas, administrators must also apply the necessary security patches, updates, service packs, and hotfixes to the DHCP servers they are configuring and protecting. DHCP servers with correct configuration information will deliver addressing information to the client machines. This allows administrators to set the node address, mask, and gateway information, and to distribute the load for other network services by creation of appropriate scopes (address pools). Additional security concerns arise with DHCP. Among these, it is important to control the creation of extra DHCP servers and their connections to the network. A rogue DHCP server can deliver addresses to clients, defeating the settings and control efforts for client connection. In most systems, administrators are required to monitor network traffic consistently to track these possible additions and prevent a breach of the system. Some OS and NOS manufacturers have implemented controls in their access and authentication systems to require a higher level of authority for authorizing DHCP server operation. In the case of Windows, a Windows DHCP server that belongs to an Active Directory domain will not service client requests if it has not been authorized to run in Active Directory. However, a stand-alone Windows DHCP server can still function as a rogue. Someone could still also introduce a rogue server running a different OS and NOS or a stand-alone server that does not belong to the domain. Administrators should also restrict access to remote administration tools to limit the number of individuals who can modify the settings on the DHCP server.
72 CHAPTER 2 OS Hardening
Data Repositories Data repositories include many types of storage systems that are interlinked in systems for maintenance and protection of data. It is important to discuss the need for protection and hardening of the various types of storage that are maintained. This includes different storage media combinations, methods of connection to the information, consideration of the access implications and configurations, and maintenance of the integrity of the data. When considering tightening and securing the data repository area, file services such as those detailed earlier in the file and print section and also the Network Attached Storage (NAS) and Storage Area Network (SAN) requirements must be considered. NAS and SAN configurations may present special challenges to hardening. For example, some NAS configurations used in a local area network (LAN) environment may have different file system access protections in place that will not interoperate with the host network’s OS and NOS. In this case, a server OS is not responsible for the permissions assigned to the data access, which may make configuration of access or integration of the access rules more complex. SAN configuration allows for intercommunication between the devices that are being used for the SAN, and thus freedom from much of the normal network traffic in the LAN, providing faster access. However, extra effort is initially required to create adequate access controls to limit unauthorized contact with the data it is processing.
Directory Services Directory services information can be either very general in nature and publicly available or restricted in nature and subject to much tighter control. While looking at directory services in the application area, it is important to look at different types of directory service cases and what should be controlled within them. Directory services data are maintained and stored in a hierarchical structure. One type of directory service is structured much like the white pages of a telephone book and may contain general information such as e-mail addresses, names, and so forth. These servers operate under the constraints of Lightweight Directory Access Protocol (LDAP) and the X.500 standard. This type of service contains general information that is searchable. Typically, these directories are write-enabled to the administrator or the owner of the record involved and read-enabled to all other users. A second type of directory services operation includes the operation of systems like Novell’s eDirectory and Windows 2003s Active Directory. Both of these services are based on the X.500 standard, as is the conventional LDAP directory service. They are not LDAP-compliant, however, as they can interoperate with LDAP directories, but have been modified for use in their respective directory services. These types of directories usually follow the LDAP/X.500 naming convention to indicate the exact name of the objects, which include designations for common name, organization, country, and so on. This might appear as CN=Joe User, O=His Company or C=US, which would designate that the record was for Joe User, a member of his company, in the United States. It is important to impose and verify
Server OS Hardening 73
stringent control on what is allowed to be written to a records database and who can write to it, because much of the information in this directory service is used to authenticate users, processes, services, and machines for access to other resources within the networks. At the same time, administrators will want to control who can read information in specific areas of the database, because they need to restrict access to some parts of the directory information. Hardening of directory services systems requires evaluation not only of the permissions to access information, but of permissions for the objects that are contained in the database. Additionally, these systems require the use of the LDAP on the network, which also requires evaluation and configuration for secure operation. This includes setting perimeter access controls to block access to LDAP directories in the internal network, if they are not public information databases. Maintenance of security-based patches and updates from the NOS manufacturer is absolutely imperative in keeping these systems secure.
Network Access Control As seen in this chapter, hardening is an important process. Another way to harden the network is to use network access control (NAC). There are several different incarnations of NAC available. These include infrastructure-based NAC, endpoint-based NAC, and hardware-based NAC.
1. Infrastructure-based NAC requires an organization to be running the most current hardware and OSes. OS platforms such as Microsoft’s Windows Vista have the capability to participate in NAC.
2. Endpoint-based NAC requires the installation of software agents on each network client. These devices are then managed by a centralized management console.
3. Hardware-based NAC requires the installation of a network appliance. The appliance monitors devices for specific behavior and can limit connectivity should noncompliant activity be detected.
NAC offers administrators a way to verify that devices meet certain health standards before they’re allowed to connect to the network. Laptops, desktop computers, or any device that doesn’t comply with predefined requirements can be prevented from joining the network or can even be relegated to a controlled network where access is restricted until the device is brought up to the required security standards.
Databases Database servers may include servers running SQL or other databases such as Oracle. These types of databases present unique and challenging conditions when considering hardening the system. For example, in most SQL-based systems, there is both a server function and a client front end that must be considered. In most database
74 CHAPTER 2 OS Hardening
systems, access to the database information, creation of new databases, and maintenance of the databases is controlled through accounts and permissions created by the application itself. Although some databases allow the integration of access permissions for authenticated users in the OS and NOS directory services system, they still depend on locally created permissions to control most access. This makes the operation and security of these types of servers more complicated than is seen in other types. Unique challenges exist in the hardening of database servers. Most require the use of extra components on client machines and the design of forms for access to the data structure to retrieve the information from the tables constructed by the database administrator. Permissions can be extremely complex, as rules must be defined to allow individuals to query database access to some records and no access to others. This process is much like setting access permissions but at a much more granular and complex level. Forms designed for the query process must also be correctly formulated to allow access only to the appropriate data in the search process. Integrity of the data must be maintained, and the database itself must be secured on the platform on which it is running to protect against corruption. Other vulnerabilities require attention when setting up specific versions of SQL in a network. For example, Microsoft’s SQL Server 2000 and earlier versions set two default conditions that must be hardened in the enterprise environment. First, the “sa” account, which is used for security associations and communication with the SQL processes and the host machine, is installed with a blank password. Second, the server is configured using mixed mode authentication, which allows the creation of SQL-specific accounts for access that are not required to be authenticated by the Windows authentication subsystem. This can lead to serious compromise issues and allow control of the server or enterprise data. It is strongly recommended that administrators harden these two conditions, using a strong password on the sa account and using Windows authentication instead of mixed-mode authentication. Network access concerns must also be addressed when hardening the database server. SQL, for example, requires that ports be accessible via the network depending on what platform is in use. Oracle may use ports 1521, 1522, 1525, or 1529, among others. MS SQL Server uses ports 1433 and 1434 for communication. As can be seen, more consideration of network access is required when using database servers. Normal OS concerns must also be addressed. SQL Server security takes an ongoing and constant effort to try to protect databases and their content. An excellent discussion of the SQL Server security model by Vyas Kondreddi can be viewed at www.sql-server-performance.com/vk_sql_security.asp. Test Day Tip Spend a few minutes reviewing port and protocol numbers for standard services provided in the network environment. This will help when you are analyzing questions that require configuration of ACL lists and determinations of appropriate blocks to install to secure a network.
Workstation OS 75
Exam Warning The Security+ exam can ask specific questions about ports and what services they support. It’s advisable to learn common ports before attempting the exam. 21 FTP 22 Secure Shell (SSH) 23 Telnet 25 Simple Mail Transfer Protocol (SMTP) 53 DNS 80 HTTP 110 Post Office Protocol (POP) 161 Simple Network Management Protocol (SNMP) 443 SSL Memorizing these will help you with the Security+ exam.
Workstation OS Workstations can present special challenges. Depending on the users’ knowledge and capabilities, they may tinker with the steps IT takes to secure their workstation and violate company policy when it comes to best practices. As laptops become more commonplace, they present specific challenges to the organization when it comes to securing OSes. Since laptops are portable, it’s very possible they could be stolen. If you have sensitive data on your laptop, it should not be placed on laptop drives, but in some cases, this cannot be avoided. In these cases, you should at a minimum encrypt the sensitive data. There are a number of third-party applications, such as utimaco’s safeguard— available at http://go.utimaco.com.
User Rights and Groups Ideally, the minimum required rights for a person to perform their job should be given. Under older Windows OSes (XP and 2000 most notably), the user of a machine was given administrative rights or was added to the “Power Users” group to gain full functionality from the OS. However, if a user account is compromised, the entire machine could be compromised and could potentially lead to the entire domain being compromised. Under Vista and Windows 7, users no longer need to have administrative privileges to their systems to be able to be fully functional. This allows the system administrator to reduce the rights assigned to regular users and follows the principle of least access. Figure 2.15 shows the common workstation groups on a Windows XP computer. You’ll note the Users group and the Power Users group. In many cases, being in the Users group or Power Users group would be enough rights for a person to perform their tasks.
76 CHAPTER 2 OS Hardening
Figure 2.15 Common Workstation Groups on a Windows XP Computer
Test Day Tip Remember the principle of least access! In many cases, this will help you to make the correct choice
Summary of Exam Objectives This chapter looked at the broad concept of infrastructure security and specifically discussed the concepts and processes for hardening various sections of systems and networks. OS security and configuration protections were discussed as were file system permission procedures, access control requirements, and methods to protect the core systems from attack. Security+ exam objectives were studied in relation to OS hardening and in relation to hardening by visiting potential problem areas including configuration concerns, ACLs, and elimination of unnecessary protocols and services from the computer. We also looked at how these hardening steps might improve and work with the OS hardening and ways to obtain, install, and test various fixes and software updates.
Exam Objectives Fast Track General OS Hardening ■■
Harden following the principle of “least privilege” to limit access to any resource
■■
Set file access permissions as tightly as possible
■■
■■
Track, evaluate, and install the appropriate OS patches, updates, service packs, and hotfixes in your system environment Remember the principle of least access!
Exam Objectives Frequently Asked Questions 77
Server OS Hardening ■■
■■
■■
Eliminating unnecessary network protocols includes eliminating such protocols as Internetwork Packet Exchange (IPX), Sequenced Packet Exchange (SPX), AppleTalk, and/or NetBIOS Extended User Interface (NetBEUI). As you begin to evaluate the need to remove protocols and services, make sure that the items you are removing are within your area of control. Consult with your system administrator on the appropriate action to take and make sure you have prepared a plan to back out and recover if you make a mistake. While you are considering removal of nonessential protocols, it is important to look at every area of the network to determine what is actually occurring and running on the system.
Workstation OS ■■
■■
■■
Follow best practices for hardening specific application-type servers such as e-mail, FTP, and Web servers Data repositories require more consideration, planning, and control of access than other application servers Application-specific fixes, patches, and updates are used in addition to OS and NOS fixes.
Exam Objectives Frequently Asked Questions Q: How should I determine how much access a person needs to a system? A: By applying the principle of least privilege. Users should be granted the minimum level of access that will allow them to do their job effectively. Q: Should I apply patches directly to my production machines? A: As a general rule, as patches and updates become available, they should be tested as soon as possible in a nonproduction environment before applying to production. Q: What protocols and services should I enable on my server? A: You should enable only the protocols and services you are using. Do not enable services and protocols “just in case” you might need them at some future point. Enable them as they are used. Q: What exactly is operating system hardening? A: Operating system hardening consists of locking down file systems and controlling software installation and use and methods for configuring file
78 CHAPTER 2 OS Hardening
systems properly to limit access and reduce the possibility of a breach. The idea is to reduce the likelihood of someone gaining access to or harming the operating system. Q: What is Windows Group Policy? A: Windows Group Policy uses active directory to apply settings to groups of computers. In this way, it becomes easier to manage many computers (and users) by applying consistent operating system settings to the computers and/or users in a group.
Self Test
1. You have a computer and through a portscan discover that port 25 is enabled. This computer is used for file and print services only. What should you do? A. Disable SMTP B. Disable POP C. Disable IIS D. Port 25 should be enabled
2. You have a computer and through a portscan discover that port 25 and Port 80 are enabled. This computer is used for serving Web pages only. What should you do? A. Disable SMTP B. Disable POP C. Disable IIS D. Port 25 and 80 should be enabled.
3. You notice port scans on a Web server. The server processes both secure and insecure pages. What steps can you take to help secure the OS? A. Enable port 80, disable all other ports B. Enable port 443, disable all other ports C. Enable port 25, disable all other ports D. Enable port 80, 443, and 25, disable all other ports E. Enable port 80 and 443, disable all other ports
4. What port does SNMP use? A. Port 80 B. Port 25
C. Port 161 D. Port 443
Self Test 79
5. As part of the overall OS hardening process, you are disabling services on a Windows server machine. How do you decide which services to disable? A. Disable all services, and then re-enable them one by one B. Research the services required and their dependencies, then disable the unneeded services C. Leave all services enabled, since they may be required at some point in the future D. Disable all workstation services
6. You are configuring a server to be used for IIS. You have disabled all unused services. All access to the server will be through secure pages using HTTPS. What ports should you enable? A. Port 80 C. Port 161 B. Port 25 D. Port 443
7. Robby is preparing to evaluate the security on his Windows XP computer and would like to harden the OS. He is concerned as there have been reports of buffer overflows. What would you suggest he do to reduce this risk? A. Remove sample files B. Upgrade is OS C. Set appropriate permissions on files D. Install the latest patches
8. Marissa is planning to evaluate the permissions on a Windows 2003 server. When she checks the permissions, she realizes that the production server is still in its default configuration. She is worried that the file system is not secure. What would you recommend Melissa do to alleviate this problem? A. Remove the anonymous access account from the permission on the root directory B. Remove the system account permissions on the root of the C:\ drive directory C. Remove the “everyone” group from the permissions on the root directory D. Shut down the production server until it can be hardened
9. You have been asked to review the general steps used to secure an OS. You have already obtained permission to disable all unnecessary services. What should be your next step? A. Remove unnecessary user accounts and implement password guidelines B. Remove unnecessary programs C. Apply the latest patches and fixes D. Restrict permissions on files and access to the Registry
80 CHAPTER 2 OS Hardening
10. Yesterday, everything seemed to be running perfectly on the network. Today, the Windows 2003 production servers keep crashing and running erratically. The only events that have taken place are a scheduled backup, a CD/ DVD upgrade on several machines, and an unscheduled patch install. What do you think has gone wrong? A. The backup altered the archive bit on the backup systems B. The CD/DVDs are not compatible with the systems in which they were installed C. The patches were not tested before installation D. The wrong patches were installed 11. Debbie is reviewing open ports on her Web server and has noticed that port 23 is open. She has asked you what the port is and if it presents a problem. What should you tell her? A. Port 23 is no problem because it is just the Telnet client B. Port 23 is a problem because it is used by the Subseven Trojan C. Port 23 is open by default and is for system processes D. Port 23 is a concern because it is a Telnet server and is active 12. Monday morning has brought news that your company’s e-mail has been blacklisted by many Internet service providers (ISPs). Somehow your e-mail servers were used to spread spam. What most likely went wrong? A. An insecure e-mail account was hacked B. Sendmail vulnerability C. Open mail relay D. Port 25 was left open 13. Management was rather upset to find out that someone has been hosting a music file transfer site on one of your servers. Internal employees have been ruled out as it appears it was an outsider. What most likely went wrong? A. Anonymous access B. No Web access control C. No SSL D. No bandwidth controls 14. You have been given the scan below and asked to review it. Interesting ports on (18.2.1.88): (The 1263 ports scanned but not shown below are in state: filtered) Port 22/tcp
State open
Service ssh
Self Test Quick Answer Key 81
53/udp 80/tcp 110/tcp 111/tcp
open open open open
dns http pop3 sun rpc
Your coworker believes it is a Linux computer. What open port led to that assumption? A. Port 53 B. Port 80 C. Port 110 D. Port 111 15. During a routine check of a file server, you discover a hidden share someone created that contains 100 Gb of music content. You discover the share was created on a drive that everyone has full control over. What steps should you take to ensure this doesn’t happen again? A. Define an acceptable use policy B. Remove full control from the “everyone” group C. Remove full control from the offending user D. Remove the files and the directory
Self Test Quick Answer Key 1. 2. 3. 4. 5.
A A E C A
6. 7. 8. 9. 10.
D D C A C
11. 12. 13. 14. 15.
D C A D A, B, and D
This page intentionally left blank
CHAPTER
Application Security CHAPTER
3
E x a m o b j e c tiv e s in this c hapt e r Threats Are Moving “Up the Stack”��������������������������������������������������������������������������������������� 84 Application Security Threats������������������������������������������������������������������������������������������������� 88
Introduction In today’s business world, applications are utilized to automate processes and provide 24/7/365 services to customers. Outside the business world, applications are also heavily used by millions of home Internet users. Whether these applications are used for processing online merchandise orders, renewing medical subscriptions, or utilized by the government to transfer information and control your country’s national defenses, they are a critical component of most organizations. Consequently, applications that are not effectively secured can pose a grave risk to information security and allow unauthorized data access, computer misuse, or even be used to monitor the actions of an unsuspecting victim. Because of the complexity and dynamic nature of applications, they can prove to be quite challenging to secure. Organizations ranging from large financial payment processors, to law-enforcement, to major software vendors’ themselves have suffered security incidents resulting from the exploitation of application vulnerabilities. Today, application security is an essential skill for information security professionals. This chapter will provide you with a good overview of application security including: ■■
■■
■■
How to effectively identify application vulnerabilities including some of the most dangerous application vulnerabilities that are frequently targeted by hackers. Countermeasures application developers can use to correct existing vulnerabilities and prevent the occurrence of new ones. Steps that home and business application users can take to configure applications such as Web browsers and instant messaging clients in a secure manner and help to prevent the exploitation of application vulnerabilities.
83
84 CHAPTER 3 Application Security
Upon completion of this chapter, you will have the knowledge required to pass the Application Security Security+ exam objective, and effectively secure applications in your professional career and at your home.
Threats Are Moving “Up the Stack” Data must pass through multiple layers of communication when sent from one network device to another. These layers of communication were documented and released in 1984 within the Open Systems Interconnection (OSI) model. The OSI model details seven layers of communication and when viewing the model from the bottom up, each layer ultimately supports the layer above it. Figure 3.1 is an illustration of the OSI model. An example of the dependency between OSI model layers, the physical layer (Layer 1) relates to the physical connection of two devices such as connecting a computer to a switch with a network cable. This physical connection between the two devices allows the second layer of the OSI model, the data link layer to verify that the connection between the two devices is intact. When data is sent from one computer to another it starts at the application layer (Layer 7) and works its way down the stack. When the other network device receives data, the process is reversed and data begins at the physical layer and works its way up. Over recent years, there has been a large shift in the focus of computerrelated attacks moving from lower layers of the OSI model to the application layer.
Figure 3.1 The OSI Model
Threats Are Moving “Up the Stack” 85
This is due to changes in network architecture and security technologies as well as efforts by vendors of operating systems (Sun, Microsoft, etc.) to harden the underlying operating system from attack. Examples of lower level attacks include Address Resolution Protocol (ARP) spoofing attacks, which allow an attacker to intercept and modify data sent between two network devices and ultimately allow the hijacking of networking communications. ARP spoofing attacks target the data link layer of the OSI model and have been largely overshadowed today by attacks targeting buffer overflow, cross-site scripting, and other application-related vulnerabilities residing within the application layer. When an attacker launches an application-based attack against another networked system, it would be received by the victim system at the physical layer and effectively work its way “up the stack.” In this chapter, we’ll discuss some of the most dangerous attacks targeting the application layer of the OSI model, but first let’s take a closer look at the reason for this shift in hacker focus. Test Day Tip In preparation for the exam, you should understand the seven layers of the OSI model as well as the specific function within each.
Rationale In recent years, the objective of computer attacks has shifted from generating large denial-of-service (DoS) conditions such as those caused by the Blaster and Nachi worms to covert attacks involving data that is withheld, manipulated, or resold for financial benefit. The reason for this shift in focus is simple, crime pays. Attackers today are much more interested in receiving financial rewards for their crimes as opposed to gaining recognition within the digital underground. (For more information refer to www.symantec.com/business/resources/articles/article.jsp?aid=symantec_ threat_report_documents_increasingly_sophisticated_attacks.) Personal information such as health and financial data are prime targets of cyber crime. When attackers gain access to data for resale they often advertise it within black market forums referred to as an “underground economy.” Symantec, a leading antivirus and research organization, has recently released its 2008 report on the underground economy. Symantec’s findings show that in 2008 the most popular commodity advertised within the underground economy over a 12-month period was credit card numbers with an advertised price ranging between 10 cents and US$25 per number.1 Data that is resold within the underground economy typically resides within the application layer of the OSI model. Because of this it’s not surprising that research by Gartner shows that 75 percent of attacks occur within the application layer. Applications ranging from large e-commerce sites, such as ebay.com, to small applications, such as Internet Explorer (IE), installed on a local user’s computer are a critical component of any digital system and it’s imperative that there are knowledgeable information security professionals who can effectively secure them. Over the past few years, security professionals have turned to a process called threat modeling to identify and assess security risks.
86 CHAPTER 3 Application Security
Threat Modeling Threat modeling is a comprehensive process for assessing a system’s security risks. Threat modeling has been in use within large software organizations for many years; however, recently over the past few years, it has caught the eye of security professionals to address internal security challenges. Threat modeling can be applied to any information system; however, in this chapter we’ll look at how it can be used to secure applications. Threat modeling differs from other traditional forms of vulnerability assessments. A traditional vulnerability assessment performed within the corporate world involves running some sort of automated vulnerability scanning tool against an infrastructure. Scan results are generated and findings are associated with a generic risk rating that was developed by the vulnerability scanning tool vendor. Scan results at this point may be qualified and sent out to the appropriate individuals for remediation. This approach may be viewed by many as effective; however, the reality is that this type of vulnerability assessment typically detects only a small subset of vulnerabilities that actually exist within an application. The reason for this is automated scans look primarily at common forms of insecure coding practices, misconfigurations, and missing patches. However, serious risks that don’t fit into this category often go undetected. As an example, running a vulnerability scan against an application may identify vulnerabilities, such as buffer overflow vulnerability within an application, which could be exploited to gain unauthorized access to data. This is good if your only security objective is preventing an unauthorized user from gaining access to data. Taking a step back, we note that information security is more than just protecting an application against a hacker; what about an attack from within? If the attacker is an insider— let’s say a database administrator (DBA)—he or she would have little reason to exploit a buffer overflow vulnerability to gain access to data if he or she could simply walk up to a server and steal the targeted sensitive information. Viewing information security with a narrow focus often neglects other high-risk attack vectors. Threat modeling uses a systematic approach setting clear objectives and taking a holistic view of security to identify the threats and vulnerabilities that threaten defined objectives. There have been several books, articles, and case studies written about the threat modeling process. Although these publications each cover the practice of threat modeling, the various sources often have slightly different views about the phases of the threat modeling process. In this chapter, we’ll look at the threat modeling process as defined by Microsoft, an organization that has made a considerable investment in it and developed a vendor-neutral process that will prepare you for the exam. Figure 3.2 illustrates the five major phases of the threat modeling process. Details on the phases illustrated within Figure 3.2 are covered in greater detail in the following sections: Security Objective Definition: Security is a broad subject, which without clear focus can quickly become overwhelming. In this phase, the security objectives placed on the application are identified, thus helping to control the scope of the threat modeling process. For example, one might define the security objective of ensuring the confidentiality and integrity of credit card data stored, processed, or
Threats Are Moving “Up the Stack” 87
accessed by a Web application. This Web application may contain multiple components some of which are in no way involved in accessing, storing, or processing credit card data and these components should be omitted from the threat modeling process. Application Review: In this stage, the application solution and design documentation is reviewed to identify key functionality. Special attention should be placed on the application architecture and technologies in use, how the application is used, and the security mechanisms in use. An application diagram is developed based on the information gathered Figure 3.2 during the application review and used The Five Major Phases of Threat Modeling to plan further in-depth analysis within the application decomposition phase. Application Decomposition: This stage focuses on the in-depth review of application internals such as ingress and egress data flows and application trust boundaries. Trust boundaries mark areas within applications that require a change in trust, for example, a trust boundary would be placed on an administrator function seeing it cannot be accessed by a normal user account or receiving data input from an untrusted source. This section involves further application diagramming and the findings within this phase will aid in threat identification. Threat Identification: Threats to the earlier defined security objectives are identified factoring in knowledge gained during application decomposition. This is normally completed by way of brain-storming sessions where participants review prior collected information to identify possible areas of attack. To aid in threat categorization, a threat model framework such as Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, Elevation of privilege (STRIDE)2 is used. An example of a common application threat is gaining unauthorized access through a brute force attack. Vulnerability Identification: On the basis of the earlier documented threats, the application is reviewed and specific vulnerabilities are documented. In a brute force attack, the exploitable vulnerability would be weak password controls including password complexity and account lock out settings within the application. Threat modeling can be an effective process if the correct people are involved. The best threat models involve representation from many groups within an organization including security analysts, developers, business analysts, and information architects. Combined, this group will provide a comprehensive understanding of the application, associated technologies, and vulnerabilities, therefore creating a much better threat model than the one created solely by a security analyst.
88 CHAPTER 3 Application Security
Because of the large amount of time and effort required to build a threat model, they are usually reserved for securing large or complex applications such as those that are custom developed by organizations. Test Day Tip You will neither be expected to develop nor analyze a provided threat model during the exam. For preparation gain an understanding of the benefits and the five process phases.
Now that we have walked through an overview of threat models, we’ll look at some of the most dangerous application security threats that may find their way onto threat models that you are tasked with creating or reviewing.
Application Security Threats When one thinks of application security one often thinks of custom developed applications as opposed to those developed and distributed by major software vendors. However, application security involves securing both custom developed as well as Common Off The Shelf (COTS) applications. Web applications dominate the business world so it’s only fitting that we look at the insecurities of the number one client application used to interact with these Web applications, the Web browser.
Browser The primary purpose of using a Web browser is to navigate and interact with Webbased applications. On a daily basis a large number of Internet users store and process sensitive financial and health data within these Web browsers. With more than 248 million Internet users in North America alone, it’s not difficult to see why these widely deployed applications are a target for cybercrime. Browser-based security was ranked the No. 1 threat in 2007 by the SysAdmin, Audit, Network, Security Institute (SANS) in their Top 20 Security Risks report3 and again in 2008 within their Top 10 Cyber Security Menaces report.4 We won’t cover all browser-based attacks featured in these reports; however, we will take a look at an extremely serious method of attack, d rive-by-download, that was a large factor for these ratings.
Drive-by-Download Drive-by-download attacks occur when a user navigates to or is unknowingly directed to a malicious Web site and hostile content is automatically downloaded and executed on the user’s computer. This code when executed can provide a hacker full control of the visiting user’s computer and the user normally has no idea this attack has occurred. When a hacker gains access to a user’s computer, he or she can perform
Application Security Threats 89
any action, such as downloading hacking, keystroke logging, or other types of tools to run on the victim’s computer to steal data. What makes these attacks so devastating is that a user doesn’t need to formally perform any interaction and computers are actively being compromised silently in the background of standard user Web browsing. Most users have no idea at all that they have been comprised or were ever at risk. According to research by Symantec in 2008, there were more than 18 million drive-by-download attacks.5 Figure 3.3 Figure 3.3 illustrates a drive-by-download attack. Drive-by-Download Attack Drive-by-download attacks apply to many popular Web browsers including IE and Firefox. Although the same general principles apply, each of the popular Web browser programs has slightly different security features and methods to configure them. As we look at the technologies within these browsers that are exploited to launch browser-based attacks such as drive-by-download, we’ll also look how settings within IE, the most widely used Web browser in the world, can be used to prevent or minimize the impact of browserbased threats. To find information on how to secure other browsers available on the Internet, you can visit their individual Web sites and refer to the browser documentation to determine which options are available and how to properly configure them. The Web sites for other popular browsers include the following: ■■
Konqueror www.konqueror.org
■■
Mozilla Firefox www.mozilla.com/en-US/firefox/
■■
Apple Safari www.apple.com/safari
■■
Opera www.opera.com/support/tutorials/security
One of the most widely used Web technologies actively exploited by hackers to carry out drive-by-download and other forms of attack is ActiveX.
ActiveX ActiveX is a Microsoft-created technology that enables software applications to share and reuse software components. This functionality is routinely implemented within ActiveX controls, which are tiny applications that can be developed using various programming languages such as C-Sharp (C#), Visual C++, Visual Basic, and Java. ActiveX controls written in one language can actually share code with controls written in another. The use of ActiveX controls greatly enhances Web applications as they can access operating system functionality which is not readily available via
90 CHAPTER 3 Application Security
Hypertext Markup Language (HTML) or the Web browser. An example of this is a Web application that reuses the spell-check functionality of the operating system within a Web page displayed to the user. Reusing ActiveX features is widely performed on the Internet and even several Microsoft applications including IE use ActiveX controls to load other applications within the Web browser. Depending on the configuration of a user’s browser, it’s possible for downloaded ActiveX controls to have no restrictions when executing on a local computer including accessing and manipulating files within the local file system or the system registry. Microsoft Windows Operating Systems are shipped with several ActiveX controls; however, in addition to these default controls many organizations write and compile their own ActiveX controls. Many vulnerabilities have been and continue to be discovered in both Microsoft-issued and third-party ActiveX controls, which make them a prime concern for security professionals. One such example is Microsoft Security bulletin MS08-041,6 which details an ActiveX vulnerability that was discovered within a Microsoft-developed ActiveX control. This vulnerability when executed could grant an attacker full control over victim users’ computers. These types of vulnerabilities aside from being used by drive-by-download attacks are being exploited and can be used by hackers to compromise computers, monitor user actions, and steal data both sent and received from victim computers. In response to vulnerabilities within ActiveX controls, Microsoft introduced Authenticode to help ensure the integrity and nonrepudiation of ActiveX controls.
Developing Secure ActiveX Controls Authenticode is a method of code signing that allows developers to obtain a digital certificate generated by a certificate authority (CA) and digitally sign an ActiveX control. This process helps Web users to identify the true issuer of a control and verify that the control has not been modified since it was developed. Although implementing Authenticode on an ActiveX control does not certify that it contains no security vulnerabilities, it is often regarded within the industry as safer than a nonsigned control. Additional security features were introduced within Web browsers to support Authenticode, allowing users to configure security policies that grant controls with Authenticode greater access without user interaction for an improved user experience then those that were not signed when executing within the browser. One of the most common vulnerabilities with ActiveX controls has to do with the programmer’s perception of the capabilities of the control. Programmers are usually driven to write efficient ActiveX controls that are also user-friendly. User-friendly controls often avoid any unnecessary pop-up messages that can cloud the user interface. There is a conflict of interest associated with ActiveX control security as the same programmer who is motivated to write user-friendly controls also has the ability to mark it as “safe-for-scripting,” meaning that it bypasses the code checking process and is not checked for an Authenticode signature. The end result is that the control may contain serious security vulnerabilities but can be run without the user being aware of a problem. As you can see, this is a double-edged sword. If it is not
Application Security Threats 91
marked “safe,” users will be inundated with warnings and messages on the potential risk of using a control that is not signed or not marked as safe. Depending on the security settings in the browser, they may not be allowed to run it at all. However, after it is marked as safe, other applications and controls have the ability to execute the control without requesting the user’s approval. You can see how this situation could be dangerous. A good example of the potential effects of ActiveX is the infamous Windows Exploder control. This was a neat little ActiveX control written by Fred McLain (www.halcyon.com/mclain/ActiveX) that demonstrates what he calls “dangerous” technology. His control only performs a clean shutdown and power-off of the affected Windows system. This might not seem so bad, but it was written that way to get the point across that the control could be used to perform much more destructive acts. Programmers have to be careful with ActiveX controls and be sure that they know everything their control is capable of before releasing it. Ultimately, developers have the decision on marking their controls as safe or using Authenticode. Regardless of what that decision is in the default configuration of most Web browsers, ActiveX controls will still ultimately function as designed with the proper user interaction. Developers can use the following recommendations to help minimize the number of vulnerabilities that exist within developed ActiveX controls. ■■
■■
Follow secure coding practices Adhering to secure coding processes will minimize the number of vulnerabilities identified within ActiveX controls. Secure coding practices including data validation (which we’ll cover later in this chapter) can be obtained from the Microsoft Development Network (MSDN).7 Use Authenticode Sign controls with a certificate issued from a trusted CA to ensure ActiveX controls are not tampered with after they are developed.
Following the above recommendations will help to improve the security of ActiveX controls. Even taking these into consideration, people are human and regardless of secure coding practices or Authenticode, vulnerabilities are inevitably discovered and exploited. With this in mind, let’s look at how users can secure the executing of these potential malicious ActiveX controls within their browsers.
Securing the Execution of ActiveX Controls within the Web Browser Numerous vulnerabilities have been identified with both vendor-shipped and thirdparty-developed ActiveX controls. Typically, these ActiveX controls are downloaded when a user visits a Web site and executes the control within the user’s browser. Even security companies are not immune to developing and shipping vulnerable ActiveX controls within their products. One such example is Symantec corporation which in 2008 disclosed that there was a buffer overflow present within an ActiveX control shipped with several of their products including Norton Internet Security 2008,8 a product that normally provides protection against these type of attacks. Successful exploitation of this vulnerability could result in arbitrary code execution. Earlier in this chapter, we looked at drive-by-download attacks. These attacks were carried against technologies such as ActiveX that automatically download and execute
92 CHAPTER 3 Application Security
without user interaction. Prior to 2006, ActiveX controls could have been loaded in a user’s Web browser without them knowing about it. However, IE6.0 on Windows XP SP2 or Windows Server 2003 SP1 implemented controls requiring users to click on ActiveX controls before they are downloaded. Users may, however, simply click the prompt to allow the ActiveX control to execute and thereby permit the attack to complete. The amount of control provided to the user on the actions that are occurring in the background with the Web site they are visiting is controlled through zones in IE. A zone is a named collection of Web sites (from the Internet or a local intranet) that can be assigned a specific security level. IE uses zones to define the threat level a specific Web site poses to the system. IE offers four security zone options: ■■ ■■
■■
■■
Internet It contains all sites not assigned to other zones. Local Intranet It contains all sites within the local intranet or on the local system. The OS maintains this zone automatically. Trusted Sites It contains only sites manually added to this zone. Users should add only fully trusted sites to this zone. Restricted Sites It contains only sites manually added to this zone. Users should add any sites that are specifically not trusted or that are known to be malicious to this zone.
Each zone is assigned a predefined security level or a custom level can be created. The predefined security levels are offered on a slide controller with up to five settings with a description of the content that will be downloaded under particular conditions. The possible settings are: ■■
■■
■■
■■
■■
Low This provides the least security and allows all active content to run, and most other content to be downloaded and run without prompts. With this setting, there is minimal security for users, so it should only be used with sites that are explicitly trusted. Medium-Low This is the default setting for the local intranet zone and provides the same security as the medium level except that users aren’t prompted. Medium This is the default level for trusted sites and the lowest setting available for the Internet zone. Unsigned ActiveX content isn’t downloaded, and the user is prompted before downloading potentially unsafe content. Medium-High This is the default setting for the Internet zone, as it is suitable for most Web sites. Unsigned ActiveX content isn’t downloaded, and the user is prompted before downloading potentially unsafe content. High This is not only the default level for restricted sites but also is the only level available for that zone. It is the most restrictive setting and has a minimum number of security features enabled.
Zones are defined on the Tools | Internet Options | Security tab as seen within Figure 3.4.
Application Security Threats 93
Figure 3.4 Internet Explorer Security Zone Administration Tab
Custom security levels can be defined to fit the specific security restrictions of an environment. Within a custom security level there are numerous individual security controls related to how ActiveX, downloads, Java, data management, data handling, scripting, and logon are handled. The most secure configuration is to set all zones to the high security level. However, keep in mind that increased security means less functionality and capability. When vulnerabilities are exploited within ActiveX controls they primarily place the user’s local computer at grave risk. To help minimize this risk, there are some steps users can take to safeguard their machines against ActiveX exploitation. ■■
Ensure your computer is up-to-date with security patches Because of the sheer number of ActiveX controls published on the Internet and the frequency that vulnerabilities are found within these controls, it’s imperative that
94 CHAPTER 3 Application Security
c omputers run the latest security patches which will update known vulnerabilities within these ActiveX controls and related components. To obtain the latest patches for Microsoft developed ActiveX controls and related components, you can visit http://windowsupdate.microsoft.com. Because ActiveX controls are developed by numerous third parties, you will also need to make sure that other installed controls possibly from other installed applications or which have been downloaded from Web sites are updated with the latest patches. To obtain a listing of downloaded ActiveX controls within IE7 or IE8 you can click on the Tools | Manage Add-ons | Enable or Disable Add-ons menu item. In doing so, you will see a dialog box similar to that shown in Figure 3.5,
Figure 3.5 Manage Add-ons Dialog Box in IE7
Application Security Threats 95
which lists the ActiveX controls loaded and used by IE, downloaded from the Internet, and ones that can run without permission. ■■
■■
Don’t click on suspicious links or navigate to Web sites you are not familiar with User vigilance is an important element of ActiveX security. Avoiding sites and links you are not familiar with can be an effective way to avoid the execution of malicious code. Utilize browser-based security zones Granular ActiveX restrictions should be implemented using zones. Focus should be placed not only on unsigned controls but also on making you aware of what is happening in the background while you are connected to a Web site.
Exam Warning ActiveX-related vulnerabilities will be covered in the exam. In preparation, you should ensure that you are familiar with IE security zones, default permissions, and how to add or remove sites from zones.
Damage and Defense Many security professionals have had significant struggles with securing ActiveX. Some, including the US Computer Emergency Response Team (US-CERT), are now formally recommending that it be disabled altogether.9
Exercise 1 Configuring Security Zones Properly setting security zones can dramatically reduce the potential vulnerability to ActiveX controls. There are five security zones: ■■
Local intranet zone
■■
Trusted sites zone
■■
Restricted sites zone
■■
Internet zone
■■
My computer zone
The last zone, My Computer, is only available through the Internet Explorer dministration Kit (IEAK) as opposed to the browser interface. The IEAK is a A Microsoft-developed application that can be used to define and dynamically manage ActiveX controls. The IEAK can be downloaded from Microsoft’s Web site.
96 CHAPTER 3 Application Security
If you do not have access to the IEAK, you can also access the security zone settings through the [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones] Registry key. The appropriate settings for this key are shown in Table 3.1. Complete the following steps to modify the security zone settings through IE7: 1.
From the Tools menu, select Internet Options. The Internet Options dialog box appears (Figure 3.6).
2.
Select the Security tab.The Security Options panel appears (Figure 3.7).
Table 3.1 Security Zone Settings in IE, Outlook, and Outlook Express Registry Key Setting
Security Zone
0
My computer zone
1
Local intranet zone
2
Trusted sites zone
3
Internet zone
4
Restricted sites zone
Figure 3.6
Figure 3.7
The Internet Options Dialog Box
The Security Tab of the Internet Options Dialog Box
Application Security Threats 97
Figure 3.9 Viewing a Warning about Zone Settings
Figure 3.8 Security Settings Panel
3.
Select the zone you wish to change. For most users, this is the Internet zone, but depending on your circumstances, you may need to repeat these steps for the Local Intranet zone as well.
4.
Click the Custom Level button. The Security Settings panel appears (Figure 3.8).
5.
Change one or more of the following settings for your desired level of security: ■■ Set Run ActiveX controls and plug-ins to administrator approved, disable, or prompt. ■■ Set Script ActiveX controls marked safe for scripting to disable or prompt.
6.
Click OK to accept these changes. A dialog box appears asking if you are sure you want to make these changes (Figure 3.9).
7.
Click Yes.
8.
Click OK to close the Internet Options dialog box and save your settings.
End users should exercise extreme caution when prompted to download or run an ActiveX control. They should also make sure that they disable ActiveX controls and other scripting languages in their e-mail applications, which is a measure that is often overlooked. A lot of people think that if they do not use a Microsoft e-mail application, they are safe. But if an e-mail client is capable of displaying HTML pages (for example, Eudora), chances are that they are just as vulnerable as using Outlook Express. Developers have the most important responsibility. They control the first line of defense against ActiveX vulnerability. They must stay current on the tools available
98 CHAPTER 3 Application Security
to assist in securing the software. They must always consider the risks involved in writing mobile code and follow good software engineering practices and be extra careful to avoid common coding problems and easily exploited coding mistakes. But most importantly, they must use good judgment and common sense and perform repeated tests before releasing the code to the public. Remember, after signing it and releasing it, it is fair game. Note Hackers can usually create some creative way to trick a user into clicking on a seemingly safe link or opening e-mail with a title like, “In response to your comments.” Once a Web page is loaded in the browser, or an e-mail is opened or previewed in the e-mail software, scripts, components, and applets in the HTML document can be downloaded, loaded into memory, and run. If the code is malicious, and designed to exploit vulnerability, any number of issues (including running remote code) may occur. It is important to be wary of e-mail from unknown users or Web pages that seem to be legitimate. It is even more important to have the latest service packs and patches installed to resolve vulnerability issues and to make sure that security software on the computer (including antivirus software) is up-to-date.
Head of the Class One of the most important aspects of using a browser securely is to practice safe surfing habits. Common sense should determine what users do, both online and offline. Visiting Web sites of questionable design is the virtual equivalent of putting yourself in harm’s way in a dark alley, but Internet users do it all the time. Here are some guidelines that should be followed to ensure safe surfing: ■■ ■■
■■ ■■
■■
Download software only from original vendor Web sites. Always attempt to verify the origin or ownership of a Web site before downloading materials from it. Never assume anything presented online is 100 percent accurate. Avoid visiting suspect Web sites—especially those that offer cracking tools, pirated programs, or pornography—from a system that needs to remain secure. Always reject certificates or other dialog box prompts by clicking No, Cancel, or Close when prompted by Web sites or vendors with which you are unfamiliar.
To help address ActiveX security concerns, Microsoft, within IE7 and IE8, secured several of the default ActiveX controls and disabled many others that were deemed high risk. This security feature was called ActiveX-option and more information can be obtained at http://msdn.microsoft.com/en-us/library/bb250471.aspx. Windows
Application Security Threats 99
IE8 provides further security by restricting ActiveX controls to specific user profiles as opposed to Web sites. Another popular browser add-in is Java. Java is considered by many to be similar to ActiveX; however, there are some core differences which according to many make it more secure when compared to ActiveX. Exam Warning For the Security+ exam, you will not be expected to know how to set specific settings on your Web browser, but you will be expected to know what will be exploited if you do not set such settings.
Java Java is a programming language, developed by Sun Microsystems, which is used to make small applications (applets) for the Internet as well as stand-alone programs. Similar to ActiveX, the purpose of Java applets is to reuse the code existing on the local machines of visiting Web site users. In some cases, this bypasses programming limitations associated with HTML and allows developers to create feature-rich applications. Applets are embedded into the Web page and are run when the user’s browser loads it into memory. Many operating systems, including Windows, Unix, and Mac OS X, use embedded interpreters to recognize and interpret Java bytecode within the applets. Arguably, the interpreter of choice is the Java Runtime Environment (JRE) developed by Sun. A core component of the JRE is the Java Virtual Machine (JVM), which is a collection of programs that execute applications and scripts. The JVM supports a computer intermediate language referred to as Java bytecode. Each operating system has a JVM that serves as an abstraction layer between the operating system and the executing Java bytecode, which allows for a Java applet to be written once and run on many different operating systems. In addition to providing an abstraction layer, the JVM also incorporates security features such as the bytecode verifier, which verifies the code for a list of predetermined insecurities and sandboxing that isolates executing code in a reserved area of memory to limit the damage potentially malicious code could inflict on the user’s machine. We will look at these two security features a little later after we look at how developers can secure their Java applets.
Notes from the Field Java Vulnerabilities Despite integrated security features such as the bytecode verifier and code isolation, Java is not immune to vulnerabilities that place end users at risk. An example of this is documented within US Cert Technical Cyber Security Alert TA08-340A.10 This alert contains 13 vulnerabilities discovered within JRE with the worst carrying a payload of remote code execution.
100 CHAPTER 3 Application Security
Developing Secure Java Applets Developers who write Java applets can help secure their code by implementing code signing. Code signing, as we reviewed earlier in this chapter, involves digitally signing an object which proves to users that it was issued by the advertised individual or organization and that the code has not been tampered with since development. Similar to ActiveX, a signed Java applet does not guarantee that it is clear of the security vulnerabilities that can place users at risks. The JVM uses sandboxing to restrict the damage a Java applet can inflict on a user’s computer; however, when a control is digitally signed, it is allowed to leave the sandbox and obtain access to client resources that can result in a security issue. The level of access signed Java applets will have on a user’s computer is dictated by the security policies set on the local client. Similar to ActiveX, the two practices a developer can implement to raise the level of security within their Java applets are as follows: ■■
■■
Follow secure coding practices Adhering to secure coding practices will minimize the number of vulnerabilities within Java applets. Guidelines on developing secure controls can be obtained from Sun’s Web site.11 Sign Java applets Signing Java applets with a certificate issued from a trusted CA will ensure that the applets are not tampered with after it is published on the Internet.
Let’s now look at the steps a user can take to further secure the execution of potentially malicious Java applets.
Securing the Execution of Java Applets A key security component within the JVM is a built-in Security Manager, which controls the level of restrictions placed on executing Java bytecode. This includes what code must run within a sandbox. We talked about the security added by sandbox functionality, which is great for security; however, developers complained the restrictions affected the capabilities and usefulness of the technology. Therefore, there was a workaround introduced and digitally signed Java applets (similar to Authenticode within ActiveX) were then allowed to escape the sandbox for a greater level of access to client system resources. These restrictions are controlled by the user through security policies. Security policies are similar to zones in IE as we reviewed earlier. To secure the execution of Java applets on local clients, the following recommendations can be followed: ■■
Ensure systems are regularly patched Java applets like other browserbased technologies are developed by numerous third-party organizations and you will need to be vigilant in ensuring the latest security patches have been applied to correct vulnerabilities. To obtain patches related to the JRE- and Sun-developed applets, you can view Sun’s online database of bugs at www. bugs.sun.com. For Java applets developed by third parties you will need to ensure that the updates are received from the issuing vendor.
Application Security Threats 101
■■
■■
Use Java security policies Local security policies can be used to restrict the level of privileges downloaded Java applets (including signed applets) have on your local computer. Don’t click on suspicious links or navigate to Web sites you are not familiar with User vigilance is an important element of Java security. Avoiding sites and links that you are not familiar with can be an effective way to avoid the execution of malicious code.
Test Day Tip Both Authenticode and signed applets are methods of object signing ActiveX and Java applets. This code signing allows granular security policies to be placed on ActiveX and Java code.
Exam Warning Remember that an applet is a program that has the capability of performing malicious activities on your system. The known security vulnerabilities in Java and ActiveX can be fixed by downloading security-based hot fixes from the browser creators’ Web site.
Scripting Another popular development technology widely in use on the Internet and corporate intranets is scripting. Contrary to ActiveX and Java applets which were developed in actual programming languages, lightweight scripting was released by Microsoft and Netscape to allow people with no formal programming experience to develop flexible Web pages. However, similar to ActiveX and Java applets, these scripts could be exploited resulting in many attacks including the drive-by-download which we discussed earlier. The Internet today is dominated by a handful of scripting languages, such as JavaScript, Active Scripting, VBScript, and Jscript.
JavaScript In 1995, Netscape launched a new language, Javascript (not to be confused with Java), to perform client-side Web development and to reuse functionality within other Web objects. Javascript was designed to look like Java but it is a much simpler language to grasp, making it a favorite for people without much Java-specific programming experience. Unfortunately, in addition to looking like Java, JavaScript carried the same type of vulnerabilities as its big brother Java. JavaScript scripts carried additional restrictions over and above what was placed on Java. JavaScripts are downloaded and run inside a sandbox that prevents execution of privileged tasks, such as reading and writing files on the local computer or accessing additional information.
102 CHAPTER 3 Application Security
Notes from the Field Java Script Vulnerabilities Despite these restrictions, JavaScript contains similar vulnerabilities to that of Java including vulnerabilities within applets written by countless software vendors. An example vulnerability is detailed in US-CERT Vulnerability Note VU#788019.12 In this advisory, a vulnerability in a piece of JavaScript code written by Adobe Systems could be exploited granting an attacker the ability to execute remote code on vulnerable systems.
Active Scripting Active Scripting is a Microsoft-developed scripting language similar to ActiveX that enables software components to share information and interact with each other. It’s used commonly today to support animation and dynamic content within Web pages and/or e-mail clients. Microsoft released active scripting in 1996 within their IE3.0 Web browser under the name of ActiveX scripting. This name formally changed a little later to Active Scripting which is widely used today. Test Day Tip You will not be expected to understand how to program or review code snippets in the exam. You should focus your studying on understanding the common browser-based programming and scripting languages, vulnerabilities, and countermeasures.
VBScript and Jscript VBScript is a scripting language developed by Microsoft to compete with Netscape’s JavaScript. It was regarded by many as even easier to use than Java, which, at the time, was regarded by many as the easiest language to use for development. However, after seeing the widespread adoption and success Netscape achieved with JavaScript, Microsoft developed Jscript in 1996 as a comparable language for Microsoft systems. VBScript and Jscript scripts are tiny pieces of code that are similar to active scripting and allow developers to extend and reuse Web functionality. When a user connects to a Web server the scripts are downloaded and executed on the user’s machine depending on the security zone the site resides within on recent editions of the IE.
Vulnerabilities with JavaScript, Active Scripting, VBScript, and Jscript JavaScript, Active Scripting, VBScript, and Jscript all suffer from similar vulnerabilities as do ActiveX and Java applets, poorly written code can be exploited by attackers, as can the scripting engine which processes the downloaded scripts. An example of a vulnerability affecting the VBScript and Jscript engines is MS08-022.13 This vulnerability occurs when the scripting engine processes malicious code making it possible for an attacker to obtain full control over the vulnerable system. Looking back at our drive-by-download example, we note that if malicious VBScript was placed on a site,
Application Security Threats 103
when a user visited that site the default configuration of IE would have downloaded that script and executed it, thereby granting full control of the vulnerable system to the attacker at the same privilege level as the user. Depending on the user’s browser settings, all of this could occur without prompting the user.
Securing the Execution of Client-Side Scripts To secure browsers against active scripting vulnerabilities, you can follow similar recommendations to those we looked at to secure ActiveX and Java:
1. Ensure application updates are downloaded regularly There have been numerous vulnerabilities identified within scripts that are routinely fixed by vendors, and program updates should be downloaded to ensure the latest script updates are received.
2. Use browser security zones Browser controls such as security zones should be used to restrict the level of privileges granted to executing client-side scripts.
3. Don’t click on suspicious links or navigate to Web sites you are not familiar with User vigilance is an important element of Java security.Avoiding sites and links that you are not familiar with can be an effective way to avoid the execution of malicious code. Exam Warning Remember that the exploitation of browser-based vulnerabilities within ctiveX, Java, and scripting only directly impacts the client computers. However, it is possible A for a compromise of credentials stored or typed into a client computer to result in unauthorized access to the very Web application that issued the vulnerable code.
As we conclude our review of browser-based code and scripting vulnerabilities, it is important to look at some security risks associated with cookies that are heavily utilized by these programming and scripting languages.
Cookies Cookies are small text files downloaded and locally stored by a user’s browser. Cookies typically contain information about the user’s session and preferences. Occasionally, Web sites also store authentication-related information such as usernames and passwords. Each time the user visits the Web site, the cookie is retrieved by the site’s Web application and data from the cookie is processed. Storing this information within client-side cookies prevents Web sites from having to store and maintain information about all user sessions and preferences. There are three main cookie types: session, persistent, and tracking.
Session Cookies Session cookies are used by Web applications to store information and when a user closes their Web browser session the cookie is deleted. Session cookies can often
104 CHAPTER 3 Application Security
contain authentication-related information about the user’s session such as display preferences and in some cases session identifiers or user names and passwords.
Persistent Cookies Persistent cookies are also used by Web applications to store information about the user connection. Persistent cookies are typically used to store user preferences about a Web site that is nonsensitive; therefore, there is less of a concern with it persistently stored on a user’s hard drive. These cookies however are not deleted when the user closes their Web browser (session). Instead, the cookies have a timeout value set by the application and the cookies are downloaded by a user’s Web browser and stored up until expiation of the timeout value.
Tracking Cookies When a user connects to certain Web sites, a tracking cookie may be downloaded in the background. As their name suggests these cookies are used to record user’s Web activity such as the type and specific sites they visit. Many sites may use the same form of tracking cookie. If the same tracking cookie is used by multiple sites, these sites can all read and write to the contents of it. Access to cookies will differ depending on the type of Web browser in use. In IE, cookies can be accessed by navigating to Tools | Internet Options | Settings | View Files. For simplicity you can arrange the files by type and look for text documents. Cookies are normally prefixed with the name cookie. An example of the cookie store of an IE7 browser is shown in Figure 3.10. By double-clicking on a cookie it can be viewed within notepad. An example of cookie contents stored by the blogs.msdn.com site is shown in Figure 3.11.
Cookie Vulnerabilities Applications use cookies as files to store data for processing. Anytime when there are data inputs into an application there are potential security risks; cookies are no
Figure 3.10 Screenshot of Cookies within IE7 Browser
Figure 3.11 Screenshot of a Cookie’s Contents
Application Security Threats 105
different. Cookies, small and seamless, present a large security concern and are the target of many types of attacks. We’ll now discuss some common cookie vulnerabilities and learn how to prevent them from exploitation.
Cookie Hijacking Cookies containing sensitive information such as usernames, passwords, or session identifiers can be a target for hackers. Attackers can sniff network traffic and capture a cookie downloaded from a site to a Web browser or gain access to a computer and view a cookie stored on the local hard drive. By capturing cookies, it’s possible for an attacker to initiate another session to the same Web site and submit your cookie to bypass site authentication and perform actions within your account without your knowledge.
Notes from the Field A common countermeasure to cookie hijacking attacks is to send cookies over encrypted channels. This prevents cookies from being intercepted and replayed or disclosed. However, a recent tool named Cookie Monster showed how easy it really is to hijack cookies even sent over encrypted channels. Cookie Monster is an advanced cookie hijacking tool that was debuted in 2008 at DefCon 16, a popular hacking security conference. There, a demonstration of how Cookie Monster will monitor network traffic and filter for Hypertext Transfer Protocols (HTTPs) connections was provided. Cookie Monster stores information about the connection that it will later use to replay to the Web site the next time the user uses the Internet to trick the Web site into sending the authentication cookie over HTTP, a nonencrypted channel. Cookies are harvested and can be used by an attacker to masquerade as a legitimate user and gain unauthorized access to many popular Web sites. Additional information can be found on the http://defcon.org Web site.
Cookie Poisoning Some cookies used by popular Web sites store authentication data such as session identifiers, user names, and passwords using cookies stored on users’ computers. Cookie poisoning involves the modification of the data stored within a cookie. When the cookie containing the modified contents is used by the application, the values entered by the attacker are processed by the application which may allow an attacker to gain access to sensitive information about the Web site, a user, or even impersonate the user’s session. Example: A user uses an online banking application and makes a payment to an account number stored within a cookie. By tampering with the cookie and changing the account number to your own, the payment made by the user during the session would be made to the account of the hacker as opposed to the user’s account as intended.
106 CHAPTER 3 Application Security
Cookie Leaking Cookie leaking occurs when sensitive information such as user names and passwords and account numbers are stored within cookies and then the information is obtained by unauthorized users. In some cases browsing habits recorded by session cookies may also be considered sensitive. By gaining access to this information via cookies, unauthorized users may use this knowledge to launch other attacks.
Preventing Against Cookie Attacks The following steps can be used to prevent or minimize the impact of cookie-related attacks for Web developers: ■■
■■
■■
■■
Enable the secure-bit setting on cookies, which will prevent the application from transmitting cookies over unencrypted channels such as HTTP. Always initiate SSL connections to supported sites to help prevent the network interception of cookies. Web site developers should avoid using cookies to hold sensitive information. If absolutely necessary, the data values should be encrypted. The following steps can be used to prevent or minimize the impact of cookierelated attacks for users: Block third-party cookies. Third-party cookies are any cookie that 