Computer Security Workshop

Day 1 – The Basics

Local security concepts

Introduction to networking

Day 2 – Know the enemy

Common attacks

Common tools

Day 3 – Secure your computer

Tools for you

Local Security

Local Security is the idea of being able to give a process running on a computer access to certain files and resources on that computer, but not access to all files and resources on that computer.

An example

When I run openoffice I want it to be able to open and edit files I have created. My brother may use openoffice on the same computer. However I may not want my brother to be able to open and edit the same files.

The Unix Way

Local security is handled in Unix using permissions. Devices under Unix are treated like files allowing for the same method to be used for both files and devices. With Unix permissions you have three different ways of classifying access.

Permissions

User:	A single account on the computer. Every	process and file must belong to a user.

Groups: Every account must belong to at least one	group. Groups can include multiple	accounts, and accounts can be in multiple	groups.

Other:	Everybody.

Networking Basics

Layers of networking

Server/client relations

starting servers

inetd

dameons

encryption

Layers of Networking

Each level has it's own vulnerabilities

most of the security focus is in the application level

Server/Client Relations

Servers are generally

always running, waiting for a client to connect

sending data

apache is a web server

Clients are generally

run by a user

receiving data

mozilla firefox is a web client

Servers

Servers are usually run at boot time, often by a special account

Unix has a special server called inetd that is used to launch other servers

Servers can be ran by users on non-privileged ports

What the Arp?

address resolution protocol

arp maps mac addresses to ip addresses

/usr/sbin/arp -a

encryption

private key

Server has one very large number. This number is transferred to the client in a secure method then used to both encode and decode the data.

public key

The server has two very large numbers. The server gives the first number to any client that tries to connect. The client then uses this number it encode anything it sends to the server. The server than uses the second number to decode the data that was sent.

Know The Enemy

Why

How

weak authentication security

ethereal/tcpdump

ettercap

buggy software

nmap

smashing the stack for fun and profit

Why

To attack others

Store warez/porn

Because they can

Weak Authentication

ethereal/tcpdump presentation

plain text

weak passwords

man in the middle attack

ettercap presentation – how it works

tools

nmap presentation

ethereal

nexus

ettercap

dnsiff

macof

arpspoof

Smashing the Stack
for Fun and Profit

Samples

2004-12-29T10:08:19