TheHa ckerNews Oct ober2011,I ssue05
Edi tori al De a rRe a de r s ,
Wehe r ea tT heHa c k e rNe wswe r ev e r y humbl e dt obeg i v e nt heoppor t uni t yt oc e l e br a t ea10mi l l i on t ot a lhi t st ot hewe bs i t e .Wow!Wea r es ov e r yg r a t e f ulf or y ours uppor ta nda sI t ol dy oul a s tmont h, I don' tt hi nkHa c k i ngi sg oi nga ny whe r ea ndne i t he ra r ewe ! ! Y ourf e e dba c ki sv e r yi mpor t a ntt ous .F e e lf r e et os e ndus y ourt houg ht sa ndde s i r e sf orHa c k i ngne ws .I fy ouwa ntt o wr i t ea ne di t or i a l ,l e tusk now.We ' dl ov et oi nc l udei tne x t mont h. F ornow, wewi l l s e ey oui nourda i l ya ndbe s twi s he s f orag r e a tmont h. Mohi tKuma r , F ounde r-T heHa c k e rNe ws www. t he ha c k e r ne ws . c om
T ea m Member s P a Ga l l e Pr i y a ns huS a ha y Ki s l a yBha r dwa j
LI NUX
me ansf r e e down
L i nuxi sac omput e rope r angs y s t e m whi c hi sba s e donf r e ea ndope ns our c e s o wa r e . Al t houg hma nydi e r e ntv a r i ee sofL i nuxe x i s t , a l l a r eUni x l i k ea nd ba s e dont heL i nuxk e r ne l , a nope r angs y s t e mk e r ne l ďŹ r s tr e l e a s e dOc t obe r5, 1991byL i nusT or v a l ds .L i nuxi sa nope r angs y s t e mf ory ourc omput e r .L i k e t heMa ca ndWi ndowss y s t e ms ,i tpr ov i de st heba s i cc omput e rs e r v i c e s ne e de df ors ome onet odot hi ng swi t hac omput e r .I ti st hemi ddl el a y e rbe t we e nt hec omput e rha r dwa r ea ndt hes o wa r ea ppl i c aonsy our un.L i nux wa sde v e l ope dbyL i nusT or v a l dsa ndaba ndofpr og r a mme r swhov ol unt a r i l y de v e l ope dt hec or epr og r a moft hes y s t e m( a k a , t hek e r ne l ) .
L i nuxHi s t or yT i mel i ne:
Apr i l 1991:F r om hi sdor mr oom a tt heUni v e r s i t yofHe l s i nk i ,c ol l e g es t ude nt L i nusT or v a l dsbe g i nswor k i ngonhi sownope r angs y s t e mk e r ne l , mos t l yj us t t os e ei fhec oul ddoi t . Ashewa sdoi nghi se a r l yde v e l opme nti naUni xc l one c a l l e dMi ni x ,hepos t e danot et oaMi ni xne ws g r oupt ha ts a i d," I ' m doi nga ( f r e e )ope r angs y s t e m( j us tahobby ,won' tbebi ga ndpr of e s s i ona ll i k eg nu) f or386( 486)ATc l one s . "T or v a l dswa swr ongi nhi sa s s e s s me ntofhi sc r e aon' s pot e na l . 1THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Ma y1992: J us tov e ray e a ra e rT or v a l dsbe g a nwor k i ngonhi spe tpr oj e c t , t he fir s tc ompr e he ns i v edi s t r i bu onofL i nux , S ol a ndi ngL i nuxS y s t e m, s hi ppe dt o us e r s . S L Ss t oodoutf ori t si nc or por aonofT CP / I Pa ndXWi ndows . J ul y1993:S l a c k wa r eL i nux ,de v e l ope dbyP a t r i c kVol k e r di ng ,l a unc he sa st he fir s tc omme r c i a l L i nuxdi s t r i bu on.I ti sc ur r e nt l yt heol de s tL i nuxdi s t r i bu on sl l unde rde v e l opme nt . Ma r c h1994:L i nusT or v a l dsr e l e a s e sL i nux1. 0,c ons i sngof176, 250l i ne sof c ode .
Apr i l 1995: L i nuxg e t si t sownt r a dec onf e r e nc e , L i nuxE x po, c r e a t e dbyDonni e Ba r ne sa tNor t hCa r ol i naS t a t eUni v e r s i t y . Ba r ne swe ntont owor kf orRe dHa t , whi c hl a t e rt ookov e rt hee x po. Nov ember1998:I nt hemi ds tofaf e de r a l a nt r us tl a ws ui t , Mi c r os ol a wy e r s pr e s e ntaboxofRe dHa tL i nuxa se v i de nc et ha tWi ndowsdi dnotr e pr e s e nta monopol yont heOSma r k e t . Nov ember1999:VAS y s t e msl a unc he sS our c e F or g e , whi c hbe c ome sal e a di ng r e pos i t or yofope ns our c epr oj e c t sf orL i nuxa ndot he rpl a or ms . Oc t ober2004:Ca noni c a lr e l e a s e sUbunt u4. 1,a k a" Wa r t yWa r t hog , "whi c h r a i s e dt heba rf orc ommuni t y de v e l ope dL i nuxdi s t r i bu onswi t has i x mont h r e l e a s ec y c l ea ndaf oc usonus e re x pe r i e nc e .
J a nua r y2007:S e v e r a ll e a di ngmobi l et e c hnol og yc ompa ni e s ,i nc l udi ngMot or ol a , NE C, S a ms ung , NTTDoCoMo, P a na s oni c , a ndVoda f onef or mt heL i Mo F oundaont oc ol l a bor a t eonL i nux ba s e ds ma r t phone s .T hi sr e pr e s e nt sa ma j ors hi i nt hedi r e conofL i nuxde v i c e s , a ndpr e s a g e st hea r r i v a l ofGoog l e Andr oi d. Nov ember2007:T heOpe nHa nds e tAl l i a nc e ,whi c hi nc l ude sGoog l e ,I nt e l , S ony , HT C, Mot or ol a , a nd78ot he rc ompa ni e s , a nnounc e si t spr e s e nc ewi t ha pr e v i e wofAndr oi d. Onewe e kl a t e r , t heOHAr e l e a s e daS DKt ode v e l ope r s . Oc t ober2008:T hefir s tc omme r c i a l Andr oi dphone , t heT Mobi l eG1, s hi pst o c ons ume r s , ma r k i ngt hee me r g e nc eofL i nuxont oma i ns t r e a mc ons ume rc ompu ngde v i c e s .Onmobi l ephone s ,Andr oi dha sg oneont oc ompe t emi g hl y wi t hAppl e ' si OS , pu ngL i nuxs qua r e l yi nt hef or e f r ontoft oda y ' sho e s tpl a t f or mwa r . 2THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Weha v ec ol l ec t eds omer ea l l yi nt er esngf a c t sa boutt heL i nuxk er nel .S oi f y oua r eaL i nuxf a n–Rea don: 1.A21y e a r ol dF i nni s hc ol l e g es t ude ntc r e a t e dt heL i nuxk e r ne la sahobby . ( Doy ouk nowhi m? ) 2. Ana s t e r oi dwa sna me da e rt hec r e a t oroft heL i nuxk e r ne l . 3.T hous a ndsofde v e l ope r s / pr og r a mme r ss c ae r e da l la r oundt hewor l da r e c on nuous l yc ont r i bu ngt ot hede v e l opme ntoft heL i nuxk e r ne l . 4. T heL i nuxk e r ne l ' soffic i a l ma s c oti sape ng ui nna me dT ux . 5.Ac c or di ngt oas t udyf unde dbyt heE ur ope a nUni on,t hee sma t e dc os tt o r e de v e l opt hemos tr e c e ntk e r ne l v e r s i onswoul dbea t$1. 14bi l l i onUS D. 6. Asoft oda y , onl y2%oft heL i nuxk e r ne l ha sbe e nwr ie nbyL i nusT or v a l ds . 7. T heL i nuxk e r ne l i swr ie ni nt hev e r s i onoft heCpr og r a mmi ngl a ng ua g e . 8.L i nuxi snowoneoft hemos twi de l ypor t e dope r angs y s t e mk e r ne l s ,r unni ngonadi v e r s er a ng eofs y s t e msf r om ha ndhe l dc omput e r st oma i nf r a me s e r v e r s . 9. L i nuxk e r ne l 1. 0. 0wa sr e l e a s e dwi t h176, 250l i ne sofc ode . T hel a t e s tL i nux k e r ne l ha sov e r10mi l l i onl i ne sofc ode . 10. Mi c r os o Wi ndowsa ndt heL i nuxk e r ne l c a nr uns i mul t a ne ous l yi npa r a l l e l ont hes a mema c hi neus i ngas o wa r ec a l l e dCoope r av eL i nux( c oL i nux ) . 11. Atfir s t , T or v a l dswa nt e dt oc a l l t hek e r ne l hede v e l ope dF r e a x( ac ombi na onof" f r e e " , " f r e a k " , a ndt hel ee rXt oi ndi c a t et ha ti ti saUni x l i k es y s t e m) , buthi sf r i e ndAr i L e mmk e , whoa dmi ni s t e r e dt heF T Ps e r v e rwhe r et hek e r ne l wa sfir s thos t e df ordownl oa di ng , na me dT or v a l ds ' di r e c t or yl i nux . 12. Ag uyna meWi l l i a mDe l l aCr oc e , J r . t r a de ma r k e dt hena meL i nuxa nde v e nt ua l l yde ma nde dr oy a le sf ori t sus e . Hel a t e ra g r e e dt oa s s i g nt het r a de ma r k t oT or v a l ds . 13. T heL i nuxk e r ne l c a nbef oundonmor et ha n87%ofs y s t e msont hewor l d' s T op500s upe r c omput e r s . 14.A" v a ni l l ak e r ne l "i snota ni c ec r e a m fla v orbuta nunmodi fie dv e r s i onof t heL i nuxk e r ne l . 15. T heL i nuxKe r ne l i snoti na nywa yr e l a t e dt ot hea r myr a nkc a l l e d‘ Col one l ’ . S our c e:h p: / / g oo. g l / Kf wpQ
3THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Howt oMak eMyLi nuxSe r v e rSe c ur e?
AL i nuxs e r v e rc a nbemor es e c ur ea ndpowe r f ult ha naWi ndowss e r v e r ,but y ouc a nnotf or g e te v e nt hes ma l l e s tde t a i l ory ouc a nbel et ot a l l yuns e c ur e . S e c ur i t ypr of e s s i ona l sma k ei tha r de rf orha c k e r sora a c k e r s ,i ft he yus ea n unpa t c he dL i nuxs e r v e r . Ana dmi ni s t r a t ors houl di mpl e me ntt heg oods e c ur i t y a g a i ns tha c k e r s( c r a c k e r s ) .T he r ei sadi ffe r e ntl e v e lofs e c ur i t yr e qui r e df or we ba ppl i c aons e c ur i t ywhe nus e dwi t hS QL I nj e con, XS S . Appl i c aons e c ur i t y , howe v e r , i snott hema i npoi ntof t hi sa rc l e ; wea r eg oi ng t ol i mi tourdi s c us s i ont oL i nuxs e r v e rs e c ur i t y . S t r ongPa s s wor dsS houl dBeUs ed Wek nowt hei mpor t a nc eofus i ng pa s s wor dst opr ot e c ta g a i ns tpa s s wor d ba s e d aa c k sl i k e br ut e f or c e ,di cona r ya a c ka ndma ny mor e .S o,y ous houl da l wa y sus ea s t r ongpa s s wor dc ombi naon of l owe rc a s euppe ra l pha be t ,numbe r sa nds pe c i a lc ha r a c t e r s ;don’ t us ebi r t hda t e , c a rl i c e ns enumbe r , ory ourna mea sapa s s wor d.One t r i c ky ouc a nus ei st os ubst ut e‘ 4’ i npl a c eof‘ A’ ,‘ 3’i npl a c eof‘ E ’ ,‘ 5’ i npl a c eof‘ S ’ , a nds oon. Us eCr y pt og r a phy Cr y pt og r a phyi st hea r tofs e c ur e c ommuni c aon.Al lt heda t at ha t g oe st hr oug h ne t wor k ma y be s ni ffe d,s o us ee nc r y p on t e c hni que st os e c ur ey ourda t a .Y ou c a nus el i g ht we i g htS S LVPN;or us eS CP ,S S H,RS Y NC,orS F T Pf or fil et r a ns f e r . 4THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Av oi dRemot eL og i nsI fPos s i bl e Aswek now,da t at ha tt r a v e l sne t wor kt one t wor kmi g htbec a pt ur e dbya t t a c k e r . S e r v i c e sl i k eF T P , T e l ne t , a nddi ffe r e ntF T P’ sma ybec ompr omi s e d. S o, i f pos s i bl e ,a v oi dus i ngt he s es e r v i c e sf r om ar e mot el oc aon.I fy ouc a nnot us i ngt he s es e r v i c e s , t he nus eS S LorF T PS . Pa t c hedMa na g ement T he r ea r ema nyf r e eoppor t unie sa v a i l a bl eont hema r k e tf ordi ffe r e nts owa r ea nds e r v i c e s .S o,t hes y s t e ma dmi ni s t r a t orha st obes ur et of ol l owt he pr ope rpa t c hma na g e me nts t r a t e g yt ok e e py ourL i nuxk e r ne l upda t e dwhe ne v e rane wpa t c hi sr e l e a s e d. And, a l l s o wa r ea nds e r v i c e swhi c ha r er unni ng ont ha ts e r v e rs houl dbeupt oda t et oma i nt a i nt hes e c ur i t yofy ourL i nux s e r v e r . Us eI nt r us i onDe t econS y s t emsorI nt r us i onpr e v en onS y s t ems F i r e wa l l sha v el i mi t aons . S o, i fpos s i bl e , us ei nt r us i onde t e cons y s t e ms( I DS ) ori nt r us i onde t e cons y s t e ms( I PS ) .Y oumus tc onfig ur ebot hne t wor kI DS ( NI DS )a ndhos tI DS( HI DS )t opr ot e c tt hea a c k sl i k eDOS , por ts c a nni ng , MAC s c a nni ng , buffe rov e rflowa a c ke t c . L i nuxS ec ur i t yE x t ens i ons S e c ur i ngt heL i nuxk e r ne l i st hek e yt os e c ur et heL i nuxs e r v e r .T he r ea r ev a r i ouss e c ur i t ypa c k a g e sa v a i l a bl et opr ov i det hea ddiona ls e c ur i t yt oL i nux k e r ne l . T r yt ous es o wa r el i k eS E L i nux , AppAr mororGRS e c ur i t y . Us eL ogMa na g ement Us eas t r ongl ogma na g e me ntpol i c yt ok e e pa ne y eont hee a c hc ha ng ea nd e r r or . Be s i de st heL i nuxbui l t i nl ogma na g e me ntfil e s , t he r ea r edi ffe r e nts owa r epa c k a g e sa v a i l a bl ef ora udinga ndl ogma na g e me nt . T hi sa rc l ewi l lpr ov i det heus e rora dmi ni s t r a t orwi t ht heba s i ck nowl e dg e ne e de dt oi mpr ov et hes e c ur i t yofaL i nuxs e r v e r .Ba s i cs y s t e ms e c ur i t y( e . g . , ha v i ngar e g ul a rba c k ups t r a t e g y ,us i ngs t r onga ndung ue s s a bl epa s s wor ds , a ndr e mov i ngunne c e s s a r ys e r v i c e sr unni ngons e r v e r )i se s s e na l a dmi ni s t r a onr e qui r e dt os e c ur ey ourda t a . 5THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
T hi spr ov i de sba s i cs e c ur i t ya g a i ns tha c k e rorc r a c k e r s .Y oune e dt os t udya nd t r yt ol e a r ns e c ur i t ya smuc ha spos s i bl ea ndk e e py oure y eonl a t e s ta a c k“ 0” da y ,ne w orr e ne we da e mpt e da a c k s .Us ey ourde v i c es e r v i c e spr ope r l y ( i . e . ,fir e wa l l ,I DS ,a ndI PS ) .Mi s c onfig ur aonbyt hea dmi ni s t r a t ori st hema i n r e a s ons e r v e r sbe c omev ul ne r a bl et oa a c k .S omeoft het ool sme n one d be l owc a nbeus e df orne t wor kmoni t or i ng ,por ts c a nni ng ,a ndv ul ne r a bi l i t y s c a nni ng , e t c . Al l oft he s et ool sa r ef r e e wa r ea v a i l a bl eunde rGe ne r a l Publ i cL i c e ns e . Downl oa dt he s et ool sonl yf r omt r us t e ds i t e s . Ne t wor kMoni t or i ng NS AT : Ne t wor kS e c ur i t yAna l y s i sT ool S ni ffDe t : Re mot eS ni ffe rDe t e conT ool / L i br a r y T c pdump: Ne t wor kde bug g i ngt ool Ne t wor kT r a fficAna l y z er Ds ni ff: Col l e conoft ool sf orne t wor ka udinga ndpe ne t r aont e sng Wi r e s ha r k : Ne t wor kpr ot oc ol a na l y z e r Por t s c a nner Ang r yI PS c a nne r : F a s ta ndf r i e ndl yne t wor ks c a nne r Vul ner a bi l i t yS c a nner Ne s s us : Compr e he ns i v ev ul ne r a bi l i t ys c a nni ngs o wa r e L ogF i l eAna l y z er s AWS t a t s: Adv a nc e dwe b, s t r e a mi ng , porma i l s e r v e rs t asc s , g r a phi c a l l y T c pt r a c e : Ana l y z eT CPdumpfil e s Pa s s wor dMa na g ement Ke e P a s s X: L i g ht we i g hta nde a s y t ous epa s s wor dma na g e r Ope nVPN: F ul l f e a t ur e dS S LVPNs ol u on _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ S ubmiedby:J a nJ a i n(I NF ORMAT I ONS E CURI T YCONS UL T ANT) Cont a c t: j anj a i n23@y a hoo. c om
6THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
[ H a c k a t h o n] S e pt e mbe rs houl dbeoffic i a l l yde c l a r e da st he“ Ha c k e r s ’mont h. ”Andwhy s houl dn’ ti tbe ?Goi ngbyt henumbe rofha c k a t honsor g a ni z e dwi t hi nt hi sone mont h, i twoul dn’ tbes ur pr i s i ngi ft hi sdoe sha ppe n.
Ha c k a t honi sa ne v e ntt ha ts pa nsov e raf e wda y sa l l owi ngt hede v e l ope rc ommuni t yt oc onv e r g ea ndc r e a t es o wa r ea nda ppl i c aonsbo omup.T hede s i r e de ndg oa l ma ybepr e de fine dorma ybel et ot hede v e l ope r ’ sdi s c r e on. I nc ep on: I ta l l s t a r t e di n1999wi t hOpe nBS Da ndS UNus i ngt het e r m“ Ha c k a t hon”i nde pe nde nt l y ,a l t houg h,f ordi ffe r e ntr e a s ons .Ope nBS D’ se mpha s i s wa sonc r y pt og r a phi cde v e l opme ntwhi l eS UNwa nt e dt obui l dj a v apr og r a ms f orape r s ona l di g i t a l a s s i s t a nt .E v e rs i nc e ,Ope nBS Dha sor g a ni z e dt hi se v e nt a tl e a s tonc eay e a rpr i ma r i l yf orf a s t e rde v e l opme ntofOpe nBS D.A e nde e s ha v ec omebyi nv i t aononl yunl i k eS UN’ s“ J a v a OneConf e r e nc e ”whi c hi sope n t oa l lde v e l ope r s .T hemode lf ol l owe dbyS UNi snow c ommonpl a c ea mong ot he ror g a ni z e r s . Ov e r me , t henumbe rofHa c k a t honsha si nc r e a s e dc ons i de r a bl y . Onec a ng e t ag oodi de aa boutt hi ss i mpl ybyGoog l i ngt het e r m.Y ou’ l lno c ehowe v e r y ot he rc ompa nyt he s eda y si sus i ngt hi si de at oor g a ni z eoneofi t sown.A e r a l l , i tbe ne fit sa l l pa re si nv ol v e di nmor ewa y st ha none .
Ha c k a t honst hi sy ea r :F a c e bookwa sa mongt hefir s tone st oa nnounc et he “ 2011Ha c k e r sCup”i nDe c e mbe rl a s ty e a r , wa ya he a dofot he r s . I nt hi sa nnua l pr og r a mmi ngc ompe on, e ng i ne e r swor l dwi depa rc i pa t e di namulr ound c ont e s ta nds ol v e da l g or i t hmi c ba s e dpr obl e ms .T he ypr oc e e de df or wa r d ba s e dont hea c c ur a c ya nds pe e doft he i rs ol u on. 7THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
F our s qua r e , t hel oc aonba s e dc ompa ny , hos t e di t sv e r yfir s tg l oba l Ha c k a t hon onS e pt e mbe r1718,2011.I nt hec a s eofbot ht he s ec ompa ni e s ,wi nne r sg ot mone t a r yr e wa r dsa swe l l a soppor t unie st ome e tt hebi g wi g si nt heI Ta nd bus i ne s si ndus t r y . T e c hCr unc hor g a ni z e di t sa nnua lDi s r uptHa c k a t hon.Anumbe rofs pons or s a l s ooffe r e dhi g hv a l uer e wa r dst ot hewi nne r s .Bui l di nga ppsf ort hev a r i ous s pons or sl i k eF or d,Br i dg e wa t e r ,a ndot he r swa st heobj e cv eoft hee v e nt .I t wa sc onc e i v e dt a r g e ngt heg r owi ngs ma r t phonef oot pr i nta ndt hee x pl odi ng a ppsi ndus t r y .
And, t hi swa sj us tt he poft hei c e be r g . I nt hel a s twe e kofS e pt e mbe r2011r , RI Ma nnounc e dOc t obe r67,2011a st heda t ef ori t sa nnua l“ BBM Apps Ha c k a t hons ”i nT or ont o,Ca na da .T hepur pos eoft hi se v e nti st ohe l pa ppl i c a onde v e l ope r s ’wor kwi t ht heBl a c k Be r r yMe s s e ng e rs oc i a lpl a or m,whi c h wa sa nnounc e dl a s tS e pt e mbe ra ti t sa nnua lde v e l ope rc onf e r e nc e .Nok i a di dn’ ts t a ybe hi nde i t he r . T heN9Ha c k a t honi sbe i nghe l di nVi e nnai nOc t obe r 78, 2011. Nopr i z e sf org ue s s i ngt ha tt hef oc uswi l l beonbui l di nga ppsf ort he Nok i aN9. HPdr e wont hee nr ede v e l ope rc ommuni t yt og a r ne rs uppor tf ori t s“ Ha c k i ng Au s m”e v e ntonOc t obe r11,2011f orhuma ni t a r i a npur pos e s .Appsbui l t dur i ngt hi se v e ntwi l l bea v a i l a bl ef orf r e et ohe l pa u scc hi l dr e n. Andt he nt he r ei st heI ndi aHa c k a t honi nMumba i onNov e mbe r19– 20,2011 whe r et het he mei s“ L a ng ua g e , Mobi l e&Offli ne ” .Or g a ni z e df ort hev e r yfir s t me , i ti se x pe c t e dt oa r a c tal otoft a l e ntf r omt heAs i a ns ubc on ne nt .
Whobene fit s : I ti si nt e r e sngt oobs e r v et ha tmos toft he s ee v e nt st ur noutt o beas uc c e s s . Wha twa si nia l l ys t a r t e dbyhobby i s tpr og r a mme r sa same di um t og e tt og e t he ra ndme e tl i k e mi nde dpe opl e ,ha st oda yt ur ne di nt oame g a , hundr e dsoft hous a ndsofdol l a r swor t hya ffa i r .
Howe v e r ,i nmyopi ni on,e v e r y ones t a ndst og a i nf r om t hi swi dea c c e pt a nc e . Compa ni e sr e a l i z et hei mpor t a nc eoft hi spl a or mt oa r a c tma j ort a l e nta nd g e ts omei nc r e di bl ewor kdonei nar e l av e l ys hor tpe r i odof me .A e ra l l , t he yowne v e r ya ppa nds o wa r ec r e a t e ddur i ngt hee v e nt . 8THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
De v e l ope r sg a t he ri na“ s ma l l s c a l ewa r r oom” ,a ndg e tt obea mongt hefir s t one st opl a ywi t ht heAPI sofs omene wf e a t ur e soffe r e dbyc ompa ni e s , s ome oft he my e tt ober e l e a s e dt ot heout s i dewor l d.T he s eAPI sa r ee i t he rk e pt r e l av e l yope nora r ea l l owe dt obeha c k e dbyt hede v e l ope r s ,a ddi ngt ot he e x i sngc ha l l e ng e soft hes l e e pde pr i v e de ng i ne e r s .
I ti st hee x pe r i e nc e ,none t he l e s s ,whi c hi sc ons i de r e di nv a l ua bl e .F ors e v e r a l ae nde e s , t he i rfir s tHa c k a t honwa snot hi ngs hor tofal i f et ur ni nge v e nt . T he y g ott ome e tt he i ri dol si npe r s on, ma yha v ee v e nc ol l a bor a t e dwi t ht he m, a nd pa rc i pa t e di nat hr i l l i ng , mi ndnumbi nge x pe r i e nc e . T hee v e nti t s e l fe l e v a t e d t he i rs pi r i t sa ndg a v eane wme a ni ngt ot he i ri de nt y . T hepr e pa r aona ss uc h t a k e ss e v e r a l mont hsofe ffor t s . L i k ea nyot he rma r a t hon, i tt a k e sc ons i de r a bl e pr e pa r aonwor ki nc l udi ngt e a mbui l di ng , pl a nni ng , a nde x e c u ng . De s pi t ea l l t heha r dwor k , t heda yoft hec ompe on, i sunl i k ea nyot he rda y . P a rc i pa nt s c hoos et owor knons t oport a k et ur ns , r e g ul a r l yf e e di ngt he ms e l v e sonRe dbul l , be e r , pi z z as l i c e sa ndc a ffe i ne . T hek e yt owi nni ngi st ok e e pone s ’ c ool a nd c ons t a nt l yf oc usonr e a c hi ngt hefini s hl i ne . Ae ra l l , al otc a nbea ts t a k e . S ubs t a na l pr i z emone y ,whi c hc a ng oupt ot hous a ndsofdol l a r s ,onc ei nal i f e mepr os pe c tofwor k i ngont hene x tbi gt hi ngi nt hei ndus t r y ,i nv i t aonst o ma j ori ndus t r yc onf e r e nc e s-a l le x pe ns epa i d,a ndahug eoppor t uni t yt og i nt ot hehe a dsoft e c hnol og i s t sa ndbus i ne s spe opl e .Andnott of or g e t ,t he pr i deg a i ne da e rwi nni ngapr e sg i ousc ompe on, s ome t hi ngt ha ts t a y sf or e v e r . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
AboutAut hor : Ni dhi Ra s t og i i saCy be r s e c ur i t ypr of e s s i ona l ba s e di nNe wY or k . S heha sov e r7y e a r sofe x pe r i e nc ei nav a r i e t yofr ol e si nc l udi ngwi r e l e s ss e c ur i t y ,mobi l ede v i c e s ,a nda ppl i c aonde v e l opme nta tc ompa ni e sl i k eVe r i z on Wi r e l e s s , GEE ne r g y , a ndL T I . Ni dhi i sag r a dua t eofUni v e r s i t yofCi nc i nna a nd c a nbec ont a c t e da tni dhi . g upt a @g ma i l . c om
9THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
I nsi derThreat svs.Hackers Ne wsa boutc y be rs e c ur i t y ,Anony mous ,a ndL ul z s e ca r ec ons t a nt l yma k i ng he a dl i ne st he s eda y s , a swe l l t he ys houl d.I ts e e mst ha tAnony mousi sha c k i ng i nt oc onfide na l i nf or maonona na l mos twe e k l yba s i s .Y e t , de s pi t et hi st a l k ofe x t e r na l r i s k s , t her e a l t hr e a tt obus i ne s s e so e nc ome sf r omwi t hi n, i nt he f or mofi ns i de rt hr e a t s . Al t houg ht hei nt e ntofaha c k e ri sg e ne r a l l ymor ei ns i di ous ,t hei ns i de rt hr e a t i smor epr e v a l e nts i mpl yduet oa ne mpl oy e e ’ sa c c e s st oc ompa nyda t a .I ns i de r so e nha v ea c c e s st os e ns iv eda t awi t houtha v i ngt oc i r c umv e nts e c ur i t y me a s ur e sde s i g ne dt ok e e poute x t e r na l t hr e a t s . Butwhi c hi sr e a l l yabi g g e rt hr e a tt oy ouror g a ni z aon?Ama l i c i ousha c k e ror adi s g r unt l e de mpl oy e ewi t ha c c e s st ot hec ompa ny ’ sc onfide na l da t a ? 10THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Ar e c e nts ur v e y ,“ 2011Cy be r S e c ur i t yWa t c hS ur v e y ”f oundt ha t ,a l t houg h t he r ea r emor ei ns t a nc e sofc y be rt hr e a t s , t he i rov e r a l l c os ti sl e s st ha nt ha tof a ni ns i de rc a us e dda t abr e a c h.T hes ur v e yc onc l ude dt ha t“ mor ea a c k s( 58%) a r ec a us e dbyout s i de r s( t hos ewi t houta ut hor i z e da c c e s st one t wor ks y s t e ms a ndda t a )v e r s us21%ofa a c k sc a us e dbyi ns i de r s( e mpl oy e e sorc ont r a c t or s wi t ha ut hor i z e da c c e s s ) …howe v e r33% v i e wt hei ns i de ra a c k st obemor e c os t l y ”
E s s e na l l y ,a l t houg he x t e r na lt hr e a t ss uc ha sha c k e r sma ybemor ef r e que nt , t he i re ffe c ti sg e ne r a l l yl e s ss ubs t a na la ndc os t l yt ha nt ha tofa ni ns i de r t hr e a t .Ar e c e nte x a mpl eoft hi soc c ur r e di nMa ywhe na ne x e c uv ea tBos t on Ba nka ndT r us tCo.r e s i g ne da nda bs c onde dwi t hpr opr i e t a r yba nki nf or ma on, t a k i ngt r a des e c r e t swi t hhi mt ohi sne we mpl oy e r , F i r s tRe publ i cBa nk . T hef a c toft hema e ri st ha tc ompa ni e sne e dt obec onc e r ne dwi t hBOT He x t e r na l c y be ra a c k sa swe l l a st het hr e a tpos e dbyi ns i de r swhoha v ea c c e s st o t he i rs e ns iv eda t a .Oneme t hodoft a c k l i ngt he s et hr e a t si st hr oug ht heus e ofDa t aL os sPr e v e n on( DL P)s o wa r e .DL Pg e ne r a l l yr e f e r st os y s t e mst ha t i de nf y , moni t or , a ndpr ot e c tda t ai nus e , da t ai nmo on, a ndda t aa tr e s t . DL Ps o wa r eu l i z i nga udings y s t e msa nde ndpoi nts e c ur i t ya r ea v a i l a bl ei na wi der a ng eofc onfig ur aonsa ndpr i c e s .F r om s i mpl eUS Bde v i c ec ont r olt o f ul l s y s t e mc ont r ol , t hec hoi c ewi l l de pe ndonbudg e ta ndne e ds . T heus eofDL Pa nde ndpoi nts e c ur i t ya l l owsa dmi ni s t r a t or st oma na g ewho a ndwha tc a na c c e s st he i rne t wor ka ndda t awhi l ea na udings y s t e mwi l l k e e p a na udi tl ogofwhi c hfil e sa r ea c c e s s e dordownl oa de d.I na ddiont oe ndpoi nts e c ur i t y , s omev e ndor soffe rr e mot ema na g e me ntc a pa bi l ie sf ormobi l e de v i c e s .I fy ouha v ear og ueorl os tfla s hdr i v e , s ma r t phoneort a bl e t , y ouc a n r e mot e l ye r a s ei t , ne g anga nypos s i bl eda t abr e a c h. Bes ur et oi nv e sg a t et heop onsoutt he r e . Aboutt hea ut hor :E mme J or g e ns e nha swor k e di nI Ta ndI nf os e cf orov e r10 y e a r s .Hewor k sf orKa ng ur uS ol u ons( www. k a ng ur u. c om) , ama nuf a c t ur e rof s e c ur epor t a bl es t or a g es ol u ons .Ka ng ur us pe c i a l i z e si nF I PSVa l i da t e d,e nc r y pt e dfla s hdr i v e s , r e mot ema na g e me nta ndUS Bde v i c ec ont r ol . 1 1THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Li nux:Howt oSer i es By:Al okSr i v ast av a
1. )F i ndbi g g es tfil es/di r ec t or i es :S ome mei ti sne c e s s a r yt ofindoutwha t fil e ( s )ordi r e c t or i e si se angupa l l di s ks pa c e .F ur t he ri tma ybene c e s s a r yt o findouti ta tpa rc ul a rl oc aons uc ha s/ t mpor/ v a ror/ homee t c . S T E P# 1–Us et he“ du”c omma ndwi t ht he s eop ons dua/ v a r|s or tnr|he a dn10 Wher e: a: I nc l udea l l fil e s , notj us tdi r e c t or i e s( duc omma nd) h: Huma nr e a da bl ef or ma t n: Nume r i cs or t( s or tc omma nd) r: Re v e r s et her e s ul tofc ompa r i s ons( s or tc omma nd) n10: Di s pl a y10l a r g e s tfil e . I fy ouwa nt20l a r g e s tfil er e pl a c e10wi t h20.
2. )E x ec ut eComma ndi nS S Hwi t houtopeni ngS hel l :Ge ne r a l l ywhe ne v e rwe i nt e ndt or uns omec omma ndonr e mot ema c hi ne ,wefir s tdoas s ha ndt he n t y pet hec omma ndt obee x e c ut e d.He r ei sav e r ys ma l l " t r i c k "t obes ma r t e r . L e t ss a yy ouwa ntt or un" t op"c omma ndont hema c hi nex . x . x . xus i ngS S H. F i r s tfindoutt hepa t hoft het opc omma ndus i ng-wher ei st op S e c ond, onc ey oug e tt hepa t h. Nowj us tt y pet hi s s s hXus e r @x . x . x . x/ pa t h/ t o/ t he / c omma nd 12THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
3. )Cha ng eMT Us i z e:Ong i g a bi tne t wor k s , l a r g ema x i mumt r a ns mi s s i onuni t s ( MT U)s i z e s( J umboF r a me s )c a npr ov i debe e rne t wor kpe r f or ma nc ef orour HPCe nv i r onme nt .I fy ouwa ntt ot r a ns f e rl a r g ea mount sofda t aa tg i g a bi t s pe e ds ,i nc r e a s i ngt hede f a ul tMT Us i z e .Ca npr ov i des i g ni fic a ntpe r f or ma nc e g a i ns S T E P# 1–Cha ng eMT Us i z ewi t h“ i f c onfig”c omma nd: f c onfige t h0mt u9000up S T E P# 2–T oma k et hi sMT Us i z epe r ma ne nt . Puti tunde rt hei nt e r f a c ec onfig ur aonfil ei . e . / e t c / s y s c onfig/ ne t wor k s c r i pt s / i f c f g e t h0. v i/ e t c / s y s c onfig/ ne t wor k s c r i pt s / i f c f g e t h0 a dd. . . MT U= ” 9000” S T E P# 3–Re me mbe rt or e s t a r tt hene t wor ks e r v i c e : s e r v i c ene t wor kr e s t a r t 3. )Col l a bor a t eS c r eens :S uppos ey ouwa ntt os howy oury ourf r i e ndhowt o s ol v eapr obl e m, buty oua r eonar e mot el oc aon. S ol u oni st os ha r et hec ol l a bor a t et hes c r e e n. S T E P# 1S houl dha v e" s c r e e n"pa c k a g ei ns t a l l e donma c hi ne s ,us i ngy um or r pm, t he n: s s hy our us e r na me @r e mot e ma c hi ne S T E P# 2Onc ey oua r et he r er un: s c r e e nSa ny na me S T E P# 3T he nt e l l y ourf r i e ndt or unt hi sc omma nd: s c r e e nxa ny na me
T hi swi l lma k ey oura ndy ourf r i e nd' ss e s s i onsj oi ne dt og e t he ri nt heL i nux s he l l . T hebe ne fiti st ha ty ourf r i e ndc a nwa t c hy ourt r oubl e s hoo ngs k i l l sa nd s e ee x a c t l yhowy ous ol v epr obl e ms .T heonec a v e a tt ot hi st r i c ki st ha ty ou bot hne e dt obel og g e di na st hes a meus e r . T ode t a c hf r omi ta ndl e a v ei tope n, t y pe :Ct r l A+ D.Y ouc a nt he nr e aa c hbyr unni ngt hes c r e e nxa ny na mec omma nda g a i n. 13THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
5. )Howt oc r a c kwea kpa s s wor dsi ny ours er v erus i ngJ OHNT HE RI PPE R S T E P# 1–I ns t a l l “ J ohnt he r i ppe r ”f r om t hel i nkg i v e nbe l owa ndi ns t a l l us i ng r pm: h p: / / da g . wi e e r s . c om/ r pm/ pa c k a g e s / j ohn/ S T E P# 2 – Us e“ uns ha dow” c omma nd t oc ombi ne / e t c / pa s s wd a nd / e t c / s ha dowfil e s , s ot ha tj ohnt he r i ppe rc a nus ei t / us r / bi n/ uns ha dow / e t c / pa s s wd / e t c / s ha dow >/ t mp/ my fil e . db t hi sc omma ndc ombi ne s/ e t c / pa s s wda nd/ e t c / s ha dowfil et obeus e d. S T E P# 3–Us e“ j ohnt he r i ppe r ”t os e et hec r a c k e dpa s s wor s :j ohn s how / t mp/ my fil e . db u1: a bc 123: 505: 505: : / home / u1: / bi n/ ba s h u2: di di 123: 506: 506: : / home / u2: / bi n/ ba s h s howsus e ru1ha sapa s s wor dofa bc 123a ndu2ha sapa s s wor dofdi di 123 6. )Chec kl og i na cv i t y :I mpor t a nti s s uef ora dmi ni s t r a t or .Howt oc hec kt he l og i na cv i t y ? CAS E# 1–Che c k i ng“ PHY S I CAL ”l og i na cv i t y . Us et he s ec omma nds l a s t ( f orc he c k i ngs uc c e s s f ul l og i na e mpt s ) l a s t b ( f orc he c k i nguns uc c e s s f ul l og i na e mpt s ) CAS E# 2–Che c k i ngt heRE MOT El og i na cv i t y . c a t/ v a r / l og/ s e c ur e *|g r e p ia c c e pt e d c ol or *i st or e a df r omt heba c k upl og sa l s oomi ti fy oudon' twa ntt os e et hos e . T hi swi l l s howAL Ls uc c e s s f ul r e mot el og i na e mpt s . c a t/ v a r / l og/ s e c ur e|g r e p is s hdc ol or T hi swi l l s howa l l s uc c e s s f ul r e mot el og i na e mpt sus i ngS S H. S ubmiedby:Al okS r i v as t av a, i st hef ounde rme mbe rofNe t wor kNUT S . He hol dMCP ,MCS E ,MCS A,MCDBA,MCT ,CCNA,CCNP ,RHCE&RHCS Sc e rfic a ons . Pr oba bl y , hei st hemos te x pe r i e nc e dt r a i ne ri nI ndi a . Hei sa l s oa na cv e bl og g e ra ndl i k e st os ha r ehi sk nowl e dg ewi t he v e r y one ; y ouc a nr e a dhi spos t s unde rf or um s e conofwww. ne t wor k nut s . ne t.Unde rhi sl e a de r s hi pa nd t e c hni c a l g ui da nc eNe t wor kNUT Si s# 1i nAs i aP a c i ficf ort her e dha te x a mpa s s pe r c e nt a g e . 14THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
WI NDOW S8 Toucht heFut ure
Wi ndows8,whi c hwasf ul l yunv e i l e datt heWi ndowsBui l dConf e r e nc e i nAnahe i m,Cal i f or ni a,i she r e ,andi tl ooksmuc h,muc hdi f f e r e ntf r om Wi ndows7. Sur e , i thast hes t ar t bar andi c on“ De s kt op”l ookt hatWi ndowsus e r sar ef ami l i arwi t h,buti tal s ohasane w,t ouc hs c r e e nopt i mi z e di nt e r f ac ec al l e d‘ Me t r o, ’whi c hl ooksmor el i ket heWi ndows Phoneope r at i ngs y s t e m andwhi c hl ooksl i ket hef ut ur eofMi c r os of t Wi ndowsf r om he r eonout .
Somei mpor t antKe yf e at ur e sofWi ndows8: 1 . Suppor tf orbot hx86PCsandARM t abl e t s :Wi ndows8i st hef i r s te di t i onofWi ndowst oope r at eonbot hARMbas e dt abl e t sandt r adi t i onal x86PCsbas e donARM pr oc e s s or sf r om I nt e landAMD. 2. Booti nl e s st han20s e c onds :Mi c r os of tde v e l ope dane w“ Hy br i dBoot Mode ” whi c h dr as t i c al l y r e duc e s boot t i me t o l e s st han 20 s e c onds . ” Hy br i dBootMode ”i sac ombi nat i onof“ LogOf f ”and“ Hi be r nat e ” -whi c hme ans ,whe naus e rc l i c ksons hut down,i tc l os e sal lappl i c at i onsandl ogof ft he ngoe st ohi be r nat emode . 3.Wi ndowsSt or e :Thi si st henameoft heapps t or eofMi c r os of t .I t al l owsy out obr ows et hr oughc at e gor i e s ,maki ngapppur c has e s ,r at e apps ,downl oadt r ai l sands oon. 15THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
4. Aut omat i cMai nt e nanc e :Mi c r os of tWi ndows8c ome swi t hane wf e at ur e“ Aut omat i cMai nt e nanc e ”whi c haut omat i c al l yde f r agy ourhar d di s ks ,r unst he. Ne topt i mi z at i ons e r v i c e sandc he c ksf ors ol ut i onst o pr obl e ms .Thi sf e at ur edr as t i c al l yi mpr ov e st hepe r f or manc eofy our s y s t e m. 5.Touc hc e nt r i c ,Ti l e s bas e dUs e rI nt e r f ac e( UI ) :Mi c r os of ti sac t ual l y l ay e r i ngane wani mat i one nabl e dus e ri nt e r f ac e( UI )ont opofanonl y s ome whatupgr ade d Wi ndows7.The[ Me t r o]appsar ef ul l s c r e e n. The y ’ r ebe aut i f ul .The y ’ r ede s i gne df ort ouc h,butofc our s e ,t he ywor k gr e atwi t hamous eandke y boar daswe l li ft hat ’ swhaty ouhav e . 6. SnapMul t i t as ki ng:‘ Snapmul t i t as ki ng”i sde s i gne dt omakei te as yt o r unt woappsi nWi ndows8s i de by s i de ,t or e s i z et he m,andt os wi t c h be t we e nt he m. Ont her i ght hands i deoft hes c r e e n, y ouc ans napanapp i nt opl ac e . 7. Bui l t i nant i v i r uspr ot e c t i on:I namov et hati sl i ke l yt oange rt heant i v i r usi ndus t r y , Mi c r os of ti saddi ngs e c ur i t yf e at ur e sf r om i t sSe c ur i t yEs s e nt i al spr ogr am t oWi ndows8. 8. Bui l t i nHy pe r V:Thec l i e ntv e r s i onofWi ndows8wi l l i nc l udev i r t ual mac hi nec apabi l i t y–Hy pe r Vt e c hnol ogyt hatpr e v i ous l ywasonl yi nc l ude di nt heSe r v e re di t i onsofWi ndowsandnowwi l lbepar tWi ndows 8c l i e nt .Hy pe r Vi sani mpor t antpi e c eoft e c hnol ogyt hatmake spos s i bl ev i r t ual i z at i on,al l owi ngus e r st or un mor et han oneope r at i ng s y s t e m,e i t he r32bi tor64bi t ,att hes amet i meont hes amec omput e r . 9.Se c ur eBoot :Wi ndows8i sgoi ngt os c r e wLi nuxbypr e v e nt i ngLi nux dualboot sandi ns t al l s .Uni f i e dExt e ns i bl eFi r mwar eI nt e r f ac e( UEFI ) f i r mwar es pe c i f i c at i onswoul dme anPCswoul donl ybootf r om adi gi t al l ys i gne di magede r i v e df r om ake y c hai nr oot e di nke y sbui l ti nt ot he PC.Mi c r os of ti spus hi ngt omaket hi smandat or yi namov et hatc oul d notbeov e r r i dde nbyus e r s Ther e s ul ti sas l i c kOSt hat ’ sasf as tasi OSandMacOSXLi on.Mos t pe opl ewi l lbes ur pr i s e dbyhow qui c kl yWi ndows8s t ar t suporr uns apps .Wec e r t ai nl ywe r es ur pr i s e d.
16THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
TheSe c ur i t yMode lof‘ Wi ndows8Se r v e r ’
Whe ni tc ome st ot heMi c r os of tope r at i ngs y s t e ml i ne ,y ouar eal way s goi ngt oge ts omegoodands omebad.Lat e l yi ts e e mst hatwi t ht he i r l at e s tr e l e as e st hegoodhasbe e nout we i ghi ngt hebadbyal ot . TheWi ndows8ope r at i ngs y s t e m pr e v i e whasbe e ngar ni s hi ngr av er e v i e wsf r om t het e c hpr e s s .The yl i ket hewayt hati tf e at ur e sane ws e c ur ewayof c omput i ng.The yal s ol i ket hef ac tt hati thasbe e nopt i mi z e df orbot h nor malPC’ sandt abl e t satt hes amet i me .The r ei sgoi ngt oc omeat i me whe nt he s et wowor l dswi l lbeoneandwi t hWi ndows8y ouar eal r e ady al mos tt he r e . Butwi t hal l oft hi st al kofWi ndows8f orc ons ume r st he r ei sanot he rv e r s i onoft heope r at i ngs y s t e mt hati sbe i ngf or got t e n.I tonl ymake ss e ns e s i nc et hi sv e r s i onoft heope r at i ngs y s t e m wor ksbe hi ndt hes c e ne sand onl yaf e wme mbe r soft hepubl i cwi l le v e rwor kwi t hi t .Thev e r s i onof Wi ndows8t hatIam t al ki ngabouti st heWi ndows8s e r v e rv e r s i on. The Wi ndows8s e r v e rv e r s i oni spr omi s i ngal otofs ur pr i s e sunde ri t shood, e s pe c i al l ywhe ni tc ome st os e c ur i t y . 17THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Andt hati swhatwear egoi ngt ot al kabouti nt hi sar t i c l e .I ti sagood t hi ngt hatMi c r os of thasde c i de dt omakes omanyi mpr ov e me nt st oi t s s e r v e rmode l .The yar er e al l yf al l i ngbe hi ndt os omeoft heot he rope n s our c eopt i onss uc hasApac heandNgi nxwhi c har ev e r ypopul aront he ope nmar ke t .
TheW i ndows8server
The r ear es omepe opl ewhoar er e adi ngt hi sar t i c l et hatmi ghtnotknow whatas e r v e ri s .Thi si snotahar dt hi ngt ode s c r i be .As e r v e ri st hes of t war et hatal l owsy out os e r v ewe bpage st ov i s i t or sont hewe b. Whe ny ou t y peanamei nt headdr e s sbary ouar ebe i ngr e di r e c t e dt oas e r v e r . We b page sar enott heonl yt hi ngt hatas e r v e rc anbr i ngt oy ourc omput e r . Youc anal s or e c e i v ev i de o, i mage s , andabunc hofdi f f e r e ntdi gi t al i t e ms f r om as e r v e r . Sonowt haty ouknowwhatas e r v e ri s , l e t ’ st al kaboutt he Wi ndows8s e r v e rs e c ur i t ymode l . Fi r s tofal l ,y ous t i l lhav eal otoft heol ds e c ur i t ypr ot e c t i onswhe ni t c ome st oWi ndows8s e r v e r . I fy ouwe r eus e dt ous i ngt hatol dpar adi gm y ouwi l lnotbel e f ti nt hedar kwi t ht hene wv e r s i on.Theonl yc hange s he r ear et headdi t i onst os omeofy ourol df av or i t e s . Themai nf e at ur et hati sbe i ngt out e dbyMi c r os of twhe ni tc ome st ot he Wi ndows8s e r v e re di t i oni sal s opr obabl yt heonet hatwi l lke e py ou mos ts e c ur easwe l l .Thi sf e at ur ei st hene w andi mpr ov e dv i r t ualmac hi nes e tupoft heope r at i ngs y s t e m.Mi c r os of ti shopi ngt hatmor eand mor eI Tadmi nswi l lge ti nt omaki ngt he i rs e tupmor eofav i r t uals t r uc t ur e .Thi swi l lpr ov i det heabi l i t yt omakei te as i e rt oj e t t i s onanypar tof t hes e r v e rt hati snotwor ki ng. Vi r t ualmac hi net e c hnol ogyhasc omeal ongwayi nt hel as tc oupl eof y e ar sand r e c e nt l yi thasbe e n Mi c r os of tt hathasbe e nl e adi ngt he c har ge .Notonl ydot he yhav et he i rownv i r t uals of t war ef ory out ous e ont hes e r v e r ,butt he yhav eal s omadei te as i e rt ous et he i rc ompe t i t or ’ s pr oduc t saswe l l .I fy oudonotknow,v i r t ualmac hi net e c hnol ogyal l ows y out or uns e par at eope r at i ngs y s t e msov e rt opoft hemai nope r at i ng s y s t e mt haty ouar er unni ng. 18THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Be i ng abl et or un s e r v e r si n t he s es e par at eope r at i ngs y s t e msal l owsy out oe as i e rc ont r olmul t i pl e we bs i t e st hat mi ghtbehos t e donones e r v e r . Thi sme anst hati sy ouhav ea we bs i t et hatne e dsv e r yhi gh s e c ur i t yt he ny ou c an e as i l y pl ac ei ti n av i r t uali ns t anc e andadj us ti tt owhat e v e ry our ne e dsar e .Thi sal l owst opl ac e e ac hwe bs i t es e c ur i t yne e dsi n l i newi t honeanot he r . Anot he rpi e c eoft hene wope r at i ngs y s t e mt hathast odowi t hs e c ur i t yi s t hewayt hatmanage me nti sr unont hene wmac hi ne s . I ti ss e tups ot hat y ouc ane as i l ywat c hmul t i pl ev i r t uali ns t anc e saswe l lasac t ualmac hi ne i ns t anc e satonet i me .I nt hepas ti twasdi f f i c ul tt os e ts ome t hi ngl i ke t hi sup.Now wi t hWi ndows8s e r v e rt hati snol onge rt hec as e .Be i ng abl et omoni t ory ours y s t e me as i l yi st hef i r s ts t e pi nmaki ngs ur et hati t i ss e c ur e . The r ear emanymor eaddi t i onst ot hene w Wi ndows8s e r v e rl i net hat wi l lhe l py ouwi t hs e c ur i t y .Wehav ej us tde c i de dt ohi ghl i ghtt het wo bi gge s tc hange st hatwi l lhe l py ou.
19THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Mi crosof tSecuri t y Devel opment Li f ecycl e Wi t ht hegr owt hofi nt e r ne tandt e c hnol ogy ,t hebi gge s tc hal l e ngef ort heI T i ndus t r yt odayi st ode v e l op as e c ur e s of t war eappl i c at i on.Unt i lr e c e nt l y ,s e c ur i t ywasj us tanaf t e r t houghtf ort he de v e l ope r sast hef oc ust y pi c al l ywason f unc t i onal i t y ;i mpl e me nt i ng s e c ur i t y wasonl y att hee nd ofde v e l opme nt phas e ,whi c h hasbe e n pr ov e n di s as t r ousandar emor epr onet os e c ur i t yat t ac ks . I nr e s pons et ot hi sgr owi ngne e d,Mi c r os of thasi mpl e me nt e das t r i nge nt Se c ur i t yDe v e l opme ntLi f e c y c l e( SDL)whi c hi sahol i s t i cappr oac ht o i nt e gr at es e c ur i t yandpr i v ac yi nt ot hes of t war ede v e l opme ntl i f e c y c l e . I ti snotac as ewhe r ewehav es e par at ede v e l opme ntandSDLpr oc e s s , SDL i si nt e gr at e dwi t ht her e gul arSof t war eDe v e l opme ntLi f e c y c l e . I mpl e me nt i ngas e c ur ede v e l opme ntl i f ec y c l ehaspr ov e nt oe nhanc e t hes e c ur i t yoft hepr oduc tashav i ngonl yne t wor ks e c ur i t yi npl ac ei sno l onge rs uf f i c i e ntt os e c ur eanappl i c at i on.Se c ur i t yne e dst obeapar tof t hee nt i r ede v e l opme ntpr oc e s s . Mi c r os oS DLOv er v i e w I nt hepa s ts e v e r a l y e a r s , s e v e r a l s e c ur i t ypr oc e s smode l sha v ee me r g e dwhi c h a i mt omig a t et hepr oc e s swe a k ne s s e sa nda r ef r e que nt l yt hec ul pr i t sbe hi nd s e c ur i t ybr e a c he s . T heMi c r os o S DLi sas e c ur i t ya s s ur a nc epr oc e s swhi c hi sf oc us e dons owa r ede v e l opme nta ndoe r soneoft hemos tc ompr e he ns i v ea ndwe l l de s i g ne dS DL Csi nt hei ndus t r y . I twa sc r e a t e da sar e s ul tofnume r oushi g h 20THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
pr i or i t ys e c ur i t ybr e ac he si nv ol v i ngMi c r os of tt e c hnol ogi e spr ompt i ng t hi sI Tgi antt ode v e l opSDLi n2002,whi c hhasbe e namandat or ypr oc e s satMi c r os of ts i nc e2004. Mi c r os of tde f i ne dac ompr e he ns i v eSD3+Cpr oc e s sC( Se c ur ebyDe s i gn, Se c ur ebyDe f aul t ,Se c ur ei nDe pl oy me nt ,andCommuni c at i ons )t ode t e r mi newhe r et hes e c ur i t yandpr i v ac ye f f or t swoul dber e qui r e d.The i de nt i f i e dpr i nc i pl e sf orSD3+Car e : SecurebyDesi gn Se c ur ear c hi t e c t ur e ,de s i gn,ands t r uc t ur e :De t ai l e dde s i gnsandar c hi t e c t ur es houl dber e v i e we df orpos s i bl es e c ur i t yi s s ue sandmi t i gat i onss houl dbei de nt i f i e df oral lt hr e at s . Thr e atmode l i ngandmi t i gat i on:Thr e atmode l i ngs houl dbec ar r i e d outi nde s i gnphas e El i mi nat i onofv ul ne r abi l i t i e s :Coder e v i e wwhi c hi nc l ude st heus eof anal y s i sandt e s t i ngt ool ss houl dbec ar r i e doutt oe l i mi nat ev ul ne r abi l i t i e s . I mpr ov e me nt si ns e c ur i t y :As e c ur eal t e r nat i v e sc ons i s t e ntwi t hi ndus t r ys t andar dss houl dbepr ov i de d. SecurebyDef aul t Le as tpr i v i l e ge :Ens ur et hatal lc ompone nt sr unwi t ht hel e as tpos s i bl epe r mi s s i ons . Cons e r v at i v ede f aul ts e t t i ngs :Mi ni mi z et heat t ac ks ur f ac ei nde f aul t c onf i gur at i ons . Le s sc ommonl yus e ds e r v i c e sof fbyde f aul t :Ens ur et hatf e at ur e s whi c har enotof t e nus e dar enotac t i v at e dbyde f aul t . Securei nDepl oyment De pl oy me ntgui de s :Out l i net hes e c ur ede pl oy me ntgui de l i ne . Anal y s i sandmanage me ntt ool s :Tool swhi c he nabl eadmi ni s t r at or s t oc onf i gur eandde t e r mi net heopt i mals e c ur i t yl e v e lf oras of t war er e l e as es houl dt obepr ov i de d. Pat c hde pl oy me ntt ool s :Tool swhi c hai di npat c hde pl oy me nts houl d bepr ov i de d. 21THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Communi cat i ons Se c ur i t yr e s pons e :Ens ur et hatt het e am r e s pondspr ompt l yt ot he i de nt i f i e ds e c ur i t yi s s ue s . Communi t ye ngage me nt :Te am pr oac t i v e l ye ngage si nc ommuni t y di s c us s i onsons e c ur i t yupdat e s ,v ul ne r abi l i t i e sandf ut ur emi l e s t one s . Se c ur es of t war ede v e l opme ntpr oc e s smode lwasde v e l ope dbyaddi ng SD3+Cc onc e ptt oal le l e me nt sofde v e l opme ntpr oc e s s .SDLc ombi ne s bot hhol i s t i candpr ac t i c alappr oac ht oi mpl e me nts e c ur i t yandpr i v ac y i nal lt hephas e st hr oughoutt hede v e l opme ntpr oc e s sandhasbe e n Mi c r os of t ’ sf oundat i on ofs e c ur i t ygui danc ef oral li nt e r nalde v e l opme nt . Mi c r os of tSDLc ans uppor tv ar i e t yofl anguage s ,di f f e r e nts of t war ede v e l opme ntpl at f or msl i keWat e r f al l ,s pi r alorAgi l eandal s oope r at i ng s y s t e msagnos t i c . SDLProcess Mi c r os of tSDLPr oc e s si sas e tofmandat or ys e c ur i t yac t i v i t i e swhi c har e gr oupe d byt het r adi t i onals of t war ede v e l opme ntl i f ec y c l e( SDLC) phas e s .The s es e c ur i t yac t i v i t i e ss houl dbear e pe t i t i v epr oc e s si nor de r t ogai nagr e at e rs e c ur i t y ,howe v e rs omeoft heac t i v i t i e sc anal s obe i mpl e me nt e donas t andal onebas i s .SDLSe c ur i t yac t i v i t i e sar edi v i de d i nt os e v e nphas e sass hownbe l ow:
I nOr de rt obui l danys e c ur eappl i c at i on,t hede v e l opme ntt e am s houl d beawar eandbeabl et oanal y z et hepr oduc thav i ngt hr e at si nmi ndand s houl dbeawar eoft ool sandt e c hni que st omi t i gat et he m.The r e f or e e duc at i ngt hede v e l ope r sbe c ome sc r i t i c al . He nc eAspar toft heSDL,Mi c r os of tof f e r sac ont i nuousf or mals e c ur i t y t r ai ni ngpr ogr am t ot hepr oduc tde v e l opme ntt e am t ode v e l op and r e f i nes e c ur i t yi nf or mat i on. 22THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Thec our s e sc ov e r e daspar toft hi sphas ear e I nt r ot ot heSDL Se c ur i t yDe s i gn Se c ur i t yCodi ng Se c ur i t yTe s t i ng Se c ur i t yBugsi nDe t ai l–Vul ne r abi l i t i e sandExpl oi t s Se c ur i t yRe s pons e Pr i v ac y Mi c r os of tbe l i e v e st hatj us tf or malt r ai ni ngs e r v e sonl yas mal lpor t i on oft hee f f or tt hati sr e qui r e dt obui l ds e c ur eAppl i c at i on.A70201 0de l i v e r ymode lappr oac hi sf ol l owe d,whi c hs ay s70% ofy ourl e ar ni ng c ome sf r om ont he j ob t r ai ni ng/ l e ar ni ngby doi ng,20% f r om s e l f s t udy ,andonl y1 0% f r om f or malt r ai ni ngs . PhaseOne:Requi rement s Thef undame nt alas pe c tofs e c ur eappl i c at i onde v e l opme nti st oc ons i de rs e c ur i t yandpr i v ac y“ Upf r ont ” .Se c ur i t yr e qui r e me nt ss houl dbe de f i ne di nt hei ni t i alpl anni ngphas e .Thi sgi v e sanoppor t uni t yt oc ons i de rhow s e c ur i t ywoul dbei nt e gr at e di nt ot hede v e l opme ntpr oc e s s andal s oi de nt i f yke ys e c ur i t yobj e c t i v e s ,mi l e s t one sandde l i v e r abl e s Dur i ngt hi sphas ebugbar sandqual i t ygat e swhi c happl yt ot hee nt i r e s of t war ede v e l opme ntpr oj e c ts houl d beus e dt ode f i net hes e v e r i t y t hr e s hol dsofs e c ur i t yi s s ue s . De f i ni ngt he s ec r i t e r i aatane ar l yphas ei mpr ov e st heunde r s t andi ngof r i s ksas s oc i at e dwi t hs e c ur i t yi s s ue se nabl i ngt oi de nt i f yandf i xt hei s s ue dur i ngde v e l opme ntphas e .As e c ur i t yr i s kas s e s s me nt( SRA)andpr i v ac yr i s kas s e s s me nt s( PRA)s houl dbeamandat or ye xe r c i s ei nor de rt o i de nt i f yt hef unc t i onalas pe c t soft heappl i c at i on whi c hmayr e qui r e de e ps e c ur i t yr e v i e w. PhaseTwo:Desi gn Func t i onalde s i gns pe c i f i c at i onss houl dde s c r i bet hes e c ur i t yandpr i v ac yf e at ur e se xpos e dt ous e r s ,s uc hasus e raut he nt i c at i ont oac c e s s s pe c i f i cs e ns i t i v edat aandi naddi t i onal s ode s c r i behowt hef unc t i onal i t ywoul dbei mpl e me nt e ds e c ur e l y . 23THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
I ti si mpor t antf ort het e am t ounde r s t andt hedi f f e r e nc ebe t we e n“ s e c ur i t yf e at ur e s ”and“ s e c ur ef e at ur e s ” .Se c ur ef e at ur e sar ef e at ur e swhos e f unc t i onal i t yi se ngi ne e r e di nt e r msofs e c ur i t yand v al i dat e dt hor oughl y ,whe r easas e c ur i t yf e at ur ei nf ac tc oul dbei ns e c ur e . Thebe s tappr oac ht oi nf l ue nc et hes e c ur i t yde s i gnofapr oduc ti st o makeus eoft hr e atmode l i ngt ool .I ti sapr ac t i c ewhi c hal l owst oi de nt i f y ,mi t i gat eanddoc ume ntt heappl i c at i ont hr e at s . PhaseThree:I mpl ement at i on Thi si st hephas ewhe r ede v e l opme ntbe s tpr ac t i c e sar ee s t abl i s he dt o i de nt i f yandmi t i gat et hes e c ur i t yi s s ue sase ar l yi nde v e l opme ntc y c l e . A numbe roft ool sandpr oc e s sar eav ai l abl ei nor de rt oac c ompl i s ht hi s goal .Thede v e l opme ntt e am s houl de nf or c eandmandat ebe s tpr ac t i c e s i de nt i f i e di nr e qui r e me ntphas eandf ol l owt he mt hr oughoutt hede v e l opme ntc y c l e . Al i s tappr ov e dt ool sal ongwi t ht he i ras s oc i at e ds e c ur i t yc he c ks ;de pr e c at e dAPI swhi c har ede t e r mi ne dt obeuns af es houl dbede f i ne d. St at i cs our c ec odeanal y s i ss houl dbepe r f or me dt opr ov i deas c al abl ec apabi l i t yf ors e c ur i t yc oder e v i e wt oe ns ur et hats e c ur ec odi ngbe s tpol i c i e sar ef ol l owe d.Mi c r os of tr e l i e she av i l yonc odeanal y s i st oolt oi de nt i f ys e c ur i t yi s s ue s ,al t houghs e c ur i t yc oder e v i e ws houl dbeac ombi nat i onofbot haut omat e dt ool andmanual c oder e v i e w. I nv e s t i ngt i meand e f f or tatane ar l ys t agewi l lhe l py oue l i mi nat et hes e c ur i t yi s s ue sand av oi dhav i ngt or e s pondt ode f e c t satal at e rphas e . PhaseFour:Veri f i cat i on Func t i onal i t yoft heappl i c at i on s houl d bev e r i f i e dt oe ns ur et hati t wor ksasde s i gne d.Tool st hatmoni t orappl i c at i onbe hav i orf ori s s ue s s uc h asme mor yLe akage ,us e rpr i v i l e ge ,and ot he rc r i t i c als e c ur i t y pr obl e mss houl dbeus e d.Mi c r os of tSDLpr oc e s ss ugge s t sus i ngr unt i met ool sl i keAppVe r i f i e r ,al ongwi t hot he rt e c hni que ss uc hasf uz z t e s t i ng,ady nami cf or m ofanal y s i sus e dt oi nduc er andom dat aorpr ogr am f ai l ur ei nt ot heappl i c at i onandobs e r v ehow t heappl i c at i onwi l l c ons umet hi sdat at oac hi e v ede s i r e dl e v e l sofs e c ur i t y . 24THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Mi c r os of ts ugge s t ss e c ur i t yt e s t i ngt oe ns ur et hatt heappl i c at i onme e t s t hes e c ur i t yandpr i v ac ye s t abl i s he ddur i ngt hepr e v i ousphas e sar eme t . PhaseFi ve:Rel ease Be f or et heappl i c at i oni sr e adyf orr e l e as eMi c r os of ts ugge s t sc ar r y i nga pl anofac t i onf orv ul ne r abi l i t i e st obedi s c ov e r e di ny ourappl i c at i onr e l e as e .Af i nals e c ur i t yandpr i v ac yr e v i e wwhi c hi sade l i be r at ee xami nat i onofal l s e c ur i t yac t i v i t i e ss houl dbepe r f or me dpr i ort ot heappl i c at i on r e l e as e . Post SDLRequi rement :Response Aspar tofpos tr e l e as ephas et hede v e l opme ntt e am mus tbeav ai l abl et o r e s pondt ot hes e c ur i t yi s s ue sf oundaf t e rt her e l e as eoft heappl i c at i on. Pos tSDLac t i v i t i e sl i ker e s pons eandmai nt e nanc ec oul dbemos te xpe ns i v epar tofs of t war el i f e c y c l e .The r ear et wopar t st ot hi sphas e ,onei n r e s pondi ngt ot hes e c ur i t yde f e c t sandanot he ri st ol e ar nf r om pr e v i ous mi s t ake s . SDLI mpl ement at i on
25THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Mi c r os of tSDLr e c omme ndsc e r t ai ns e c ur i t yt ool saspar toft hede v e l opme ntphas ewhi c hi sf r e e l yav ai l abl ef ordownl oadandus e , ands uppor t s av ar i e t yofl anguage s ,pl at f or ms ,andde v e l opme ntme t hodol ogi e s .I ti s i mpor t antt ounde r s t andwhi c ht ool sar eappr opr i at ef orv ar i ousdi f f e r e ntphas e soft hede v e l opme ntl i f e c y c l e . Fi gur e2abov ehe l pst oi de nt i f yhowe ac hoft he s et ool sf i t si nt ot heSDL Se c ur i t yDe v e l opme ntLi f e c y c l et e mpl at e sar eav ai l abl et oe as et he i mpl e me nt at i onofSe c ur i t yDe v e l opme ntLi f e c y c l e . ProcessTempl at es: Mi c r os of ts ugge s t smaki ngus eoft heSDLPr oc e s sTe mpl at ef orVSTSt o i nt e gr at epol i c y , pr oc e s sandt ool saut omat i c al l yi nt oal l phas e sofde v e l opme ntf orpr oj e c t swhi c hadhe r et os pi r alorwat e r f al lde v e l opme nt me t hodol ogy . MSFAgi l eSDLpr oc e s st e mpl at e sar es i mi l art oSDLPr oc e s sTe mpl at ebutar es ui t abl ef orAgi l ede v e l opme ntme t hodol ogy . Desi gnPhase: Thr e atmode l i ngt ooli st hebe s tappr oac ht oi nf l ue nc et hes e c ur i t y de s i gnoft hepr oduc t .Mi c r os of tt hr e atmode l i ngpr oc e s sofi de nt i f i e s t hr e at st obus i ne s swhi c hi si nhe r i t e dbyt hes of t war eappl i c at i ont hati s bui l t ,atav e r ye ar l ys t ageofSDLC.Se c ur i t ys ubj e c tmat t e re xpe r t i s ei s notr e qui r e di nor de rt oc r e at eaf e at ur er i c ht hr e atmode l . I mpl ement at i onsPhase: Anumbe rofs e c ur i t yt ool sar el e v e r age ddur i ngi mpl e me nt at i onphas e , s omeofwhi c hi sme nt i one dbe l ow. banne d. hhe ade rf i l el i s t sandr e mov e sal lbanne df unc t i ons/API s f r om c ode . Si t e l Loc kAc t i v eTe mpl at eLi br ar y( ATL)i sus e dt or e s t r i c tt heus eof Ac t i v e Xc ont r olt ol i s tofpr e de f i ne ddomai nname sl i mi t i ngot he rWe bPage st or e us eAc t i v e Xc ont r ol . FxCopi sus e dt oanal y z emanage dc odeas s e mbl i e sf ors e c ur i t y ,pe r f or manc e ,andde s i gni s s ue s . CodeAnal y s i sf orC/ C++i sy e tanot he rs t at i canal y z e rwhi c hhe l ps de t e c tandmi t i gat ec odee r r or s . 26THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Ant i XSSLi br ar yi sane nc odi ngl i br ar yde s i gne dt ohe l pde v e l ope r s pr ot e c twe bappl i c at i onagai ns tCr os sSi t eSc r i pt i ng( XSS) . CAT. NETi sabi nar ys t at i cc odeanal y z e rl i keFxCop,butt oi de nt i f y onl ys e c ur i t yv ul ne r abi l i t i e sl i keSQLI nj e c t i on,LDAPI nj e c t i on,Cr os s Si t eSc r i pt i ng,XPATH I nj e c t i onandEr r orHandl i ng. Veri f i cat i onPhase: Func t i onal i t i e soft heappl i c at i onsar ev e r i f i e dus i ngs omeoft het ool s me nt i one dbe l owbe f or et her e l e as eoft hepr oduc t . Bi nSc opei sav e r i f i c at i ont ool whi c hanal y z e sbi nar i e st oe ns ur ec ompl i anc et oSDLr e qui r e me nt s . Mi ni Fuz zi sus e dasat e s t i ngt ools pe c i f i c al l yf orf i l ehandl i ng. SDLRe ge xi sav e r i f i c at i ont ool f orr e gul are xpr e s s i onsagai ns tDe ni al ofSe r v i c e( DOS)at t ac ks . AppVe r i f i e ri sar unt i meappl i c at i on v e r i f y i ngt oolus e dt of i nd me mor yr e l at e di s s ue s . Benef i t sofSDL Mi c r os of tSDLc oul dbeappl i e dt oanypl at f or m, anyde v e l opme ntme t hodol ogy ,andanyl ar ge ,me di um,s mal ls of t war ede v e l opme ntor gani z at i onasi ti sv e r s at i l ee nought oal l owaddi t i onofot he rpol i c i e s ,t he r e by c r e at i ngauni ques of t war ede v e l opme ntpr oc e s sf ori ndi v i dualor gani z at i on. Ar e s e ar c he xe c ut e dbyNat i onalI ns t i t ut eofSt andar dsandTe c hnol ogy ( NI ST)e s t i mat e st hatt hec os tofc odef i xe spe r f or me daf t e rt her e l e as e c anr e s ul ti n30 t i me st hec os toff i xe spe r f or me ddur i ngt hei ni t i al phas e swhe nade f i ne dpr oc e s sl i keSDLi sf ol l owe d. Tome as ur et hee xt e ntt owhi c hMi c r os of tSDLr e duc e ss e c ur i t yi s s ue s , a c as es t udyof“ Pr e -SDL”and“ Pos t SDL”v e r s i onofs amepr oduc twas c onduc t e dbys e c ur i t ye xpe r t sov e rape r i odoft i meaf t e rr e l e as e
27THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Summary I ti sv e r yc l e art hatt hene e df orhav i ngas e c ur es of t war ede v e l opme nt wi l lne v e rc e as e . Adhocpr oc e s swi l lonl yi nc r e as et her i s kofs e c ur i t yat t ac ks ;as y s t e mi cSDLappr oac hof f e r st hebe s tme anst oi nt e gr at es e c ur i t yi nt heSof t war eDe v e l opme ntLi f e c y c l e .Mi t i gat i ngs e c ur i t yi s s ue sat ane ar l ys t agei sl e s se xpe ns i v ec ompar e dt opos tpr oduc t i on.Pr oj e c t t e amss houl dr e f r ai nf r om “ bol t i ngon”s e c ur i t yf e at ur e st ot hee ndde v e l opme nt . Mi c r os of thase me r ge dasal e ade ri ns e c ur i t yde v e l opme ntwi t hy e ar sof de v e l opme ntandr e f i ne me nt .Mi c r os of tc ont i nue st oi nv e s tont ool st o i mpr ov et heSDLaspar toft he i rongoi nge f f or t .Wi t ht heMi c r os of tappr oac h,de v e l ope r sne e dnott obeas e c ur i t ye xpe r ti nor de rt oi de nt i f y andmi t i gat et hr e at s .Mi c r os of t ’ sgl obalt e am e ns ur e st oke e pSDLand t ool supt odat ewhi c h hasr e s ul t e di n ade mons t r abl er e duc t i on i n numbe rofs e c ur i t yi s s ue s . Ref erences ht t p: / / ms dn. mi c r os of t . c om/ e nus / l i br ar y / ms 995349. as px ht t p: / / www. mi c r os of t . c om/ s e c ur i t y / s dl / di s c ov e r / de f aul t . as px AboutTheAut hor Shr ut hiPr as adGVi saCe r t i f i e dEt hi c alHac ke r ,wor ki ngasaTe c hnol ogyCons ul t antwi t hHe wl e t tPac kar ds i nc eJul y ,201 0.Pr i ort owhi c h s hewor ke dasas e c ur i t yc ons ul t antwi t hI nf os y sTe c hnol ogi e sLTD, Bangal or e .Youc anr e ac hhe rats hr uu. p@gmai l . c om
28THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
S ept emberCy berA a c k s
He r ea r et heS e pt e mbe r11’ Cy be rA a c k s . I ta ppe a r st ha tt hewa v eof Anony mousa a c k st ha tc ha r a c t e r i z e dAug us tha ss t oppe d. T he r ewe r es e v e r a l i s ol a t e de pi s ode sbut , t he i ri mpa c twa ss l i g ht l yl owe rt ha nt hepr e v i ousmont hs . Pr oba bl yt hemos ti mpor t a nts e c ur i t yi nc i de ntf ort hi smont hwa st heDi g i not a rHa c k , notonl ybe c a us et heDut c hCe rfic aonAut hor i t yha sbe e nba nne d f or e v e rbyt hema i nbr ows e r sa ndOS ’ sbuta l s obe c a us et hee nr ea ut he nc aonmode l ba s e donCA’ si sunde rdi s c us s i on. Mor e ov e ronc ea g a i nac y be r aa c kha sbe e nus e da same a nofr e pr e s s i on. F ort hefir s t menote v e nt heL i nuxOpe r angS y s t e m( a nope nwor l d)wa s i mmunef r om ha c k e r s :bot ht heL i nuxKe r ne l a ndt heL i nuxF oundaonWe b S i t e swe r eha c k e ddur i ngt hi smont h,t woe pi s ode st ha tP e ng ui nL ov e r swi l l r e me mbe rf oral ong me . E a s i l ypr e di c t a bl e , a na a c kr e c a l l i ng9/ 11c a r r i e d ona g a i ns tt heT wie rAc c ountofNBCNe wswa sa l s or e por t e d. T heBE AS Ta a c konS S Lpunc he dt heI nf os e cCommuni t yi ni t sg uta ndl a s t butnotl e a s tama s s i v ede f a c e me ntof700, 000s i t e shos t e dbyI nmo on. Ke r ne l . or g( S e pt e mbe r1, 2011) :T hes i t eofKe r ne l . or gs uffe r e das e c ur i t y br e a c hwhi c hc a us e dt hes e r v e rt ober oot e da nd448c r e de na lc ompr omi s e d. Al t houg hi ti sbe l i e v e dt ha tt hei nia l i nf e cons t a r t e donAug us tt he 12t h, i twa snotde t e c t e df ora not he r12da y s .
Her ei st heQui c kT i mel i neofA a c k s :
Appl e,S y ma nt ec ,F a c ebook ,Mi c r os o ,e t c( S ept ember1, 2011) :T heS r i L a nk a nbr a nc hofAnony mousc l a i mst oha v eha c k e di nt ot heDNSs e r v e r sof S y ma nt e c , Appl e , F a c e book , Mi c r os o, a nds e v e r a l ot he rl a r g eor g a ni z aons ov e rt hepa s tf e wda y s ,posngt hene wsa ndr e c or dsofi t se x pl oi t sonP a s t e bi n. T e x a sPol i c eChi e f sAs s oc i a on( S ept ember2, 2011) :Asus ua lha ppe nson F r i da dy , T e x a sP ol i c eChi e f sAs s oc i aonWe bs i t ei sha c k e dbyAnony mousf or An s e cOpe r aon.Ha c k e rde f a c e dt he i rwe bs i t ea ndpos t e d3GBofda t ai n r e t a l i aonf ort hea r r e s t sofdoz e nsofa l l e g e dAnony mouss us pe c t s . 29THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
E AGa meBa l e fiel dHer oes( S ept ember2, 2011) :Oneoft hemos tf a mous g a me sov e rt hewor l dBa l e fie l dHe r oe sde v e l ope dbyE AGa me si sha c k e dby aha c k e rna me d“ WhyS oS e r i ous ? ”whol e a k st heUs e rL og i npa s s wor dson pa s t e bi n.
Popul a rWebs i t es :Da i l yT e l e g r a ph,T heRe g i s t e r ,UPS ,Voda f one( S e pt e mbe r 4, 2011) :P opul a rwe bs i t e si nc l udi ngT heRe g i s t e r ,T heDa i l yT e l e g r a ph,UPS , a ndot he r sf a l lv i cm t oaDNSha c kt ha tha sr e s ul t e di nv i s i t or sbe i ngr e di r e c t e dt ot hi r dpa r t ywe bpa g e s . T hea ut hor sof t heha c k , aT ur k i s hg r oupc a l l e d T ur k g uv e nl i g i ,a r enotne wt os i mi l a ra consa ndl e a v eame s s a g ede c l a r i ng t hi sda ya sWor l dHa c k e r s ’ Da y . E ur opea nUni onI nst ut eF orE ner g ya ndT r a ns por t( S ept ember5, 2011) : One oft heS ubdoma i nofE ur ope a nUni on( I nst ut ef orE ne r g y )i sha c k e da ndDe f a c e dbyI nj 3c t 0r .Ha c k e r sde f a c et hewe bpa g e ,r e l e a s es omei nt e r na l de t a i l s a ndl e a v eame s s a g ea g a i ns tVi ol e nc ei nL y bi aa ndRus s i a ni nflue nc ei n Uk r a i ne .
Uni t edNa onsS ubDoma i nofS wa z i l a nd( S ept ember5, 2011) :Uni t e dNa onsS ubDoma i nofS wa z i l a ndi sha c k e da ndde f a c e dbyCoc a i nT e a mHa c k e r s .
Di g i not a r( S ept ember6, 2011) :T her e a le x t e ntoft heDi g i not a rbr e a c hbe c ome sc l e a r :531bog usc e rfic a t e si s s ue di nc l udi ngGoog l e , CI A, Mos s a d, T or . Me a nwhi l ei napa s t e bi nme s s a g eComodoHa c k e rs t a t e sheownf ourmor e CAs ,a mongwhi c hGl oba l S i g nwhi c hpr e c a u ona l l ys us pe ndsi s s ua nc eofc e r fic a t e s .
Gl oba l S i g n( S ept ember9, 2011) :A e rs us pe ndi ngi s s ui ngc e rfic a t e s ,Gl oba l S i g nfindse v i de nc eofabr e a c ht ot hewe bs e r v e rhosngt hewwwwe bs i t e . T hebr e a c he dwe bs e r v e rha sa l wa y sbe e ni s ol a t e df r om a l lot he ri nf r a s t r uc t ur ea ndi sus e donl yt os e r v et hewww. g l oba l s i g n. c omwe bs i t e . Goog l e( S ept ember9, 2011) :Asc ons e que nc e oft he i nf a mousDi g i not a r Br e a c hGoog l ea dv i s e si t sus e r si nI r a nt oc ha ng et he i rGma i lpa s s wor ds ,a nd c he c kt ha tt he i rGoog l ea c c ount sha v enotbe e nc ompr omi s e d. Goog l ea l s oi ndi c a t e st ha ti ti sdi r e c t l yc ont a cngus e r si nI r a nwhoma yha v ebe e nhi tbya ma ni nt he mi ddl ea a c k . 30THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
NBCNe ws( S ept ember9, 2011) :T heNBCNe wsT wie ra c c ounti sha c k e da nd s t a r t st ot we e tf a l s er e por t sofapl a nea a c kong r oundz e r o.T hea c c ounti s s us pe nde da ndr e s t or e da e rf e wmi nut e s .
S a ms ungCa r d( S ept ember9, 2011) :Da t aofupt o800, 000S a ms ungCa r dc l i e nt sma yha v ebe e nc ompr omi s e da e ra ne mpl oy e ea l l e g e dl ye x t r a c t e dt he i r pe r s ona l i nf or maon.T heBr e a c hwa sdi s c ov e r e donAug .25a ndr e por t e dt o pol i c eonAug .30.I ti snotc l e a rwha tk i ndofi nf or maonha sbe e nl e a k e d, ma y bet hefir s tt wodi g i t sofr e s i de nc enumbe r s ,t hena me s ,c ompa ni e sa nd mobi l e phone numbe r swe r ee x pos e d.E sma t e dc os toft he br e a c hi s $171, 200. 000.
L i nuxF ounda on( S ept ember9, 2011) :F e wwe e k sa e rt hek e r ne l . or gL i nux a r c hi v es i t es uffe r e daha c k e ra a c k , t heL i nuxF oundaonha spul l e di t swe bs i t e sf r om t hewe bt oc l e a nupf r om as e c ur i t ybr e a c h. Ano c epos t e dont he L i nuxF oundaons a i dt hee nr ei nf r a s t r uc t ur ei nc l udi ngL i nux F oundaon. or g , L i nux . c om, a ndt he i rs ubdoma i nsa r edownf orma i nt e na nc eduet oas e c ur i t y br e a c ht ha twa sdi s c ov e r e donS e pt e mbe r8, 2011. Ni g er i a nGov er nmentWebs i t e( S ept ember12, 2011) :Ni g e r i a nGov e r nme nt We bs i t ei sha c k e da ndde f a c e dbyBr a z i l i a nHa c k e r st ha tl e a v eame s s a g ei nt he ma i npa g e . Pa ndaS ec ur i t y( S ept ember12, 2011) :Anot he rS e c ur i t yCompa nyHa c k e d:a ha c k e rg oi ngbyt hena meofX Ne r dha c k sa ndde f a c e st heP a k i s t a nS e r v e rof av e r ywe l l k nowns e c ur i t ys o wa r ewe bs i t e :P a ndaS e c ur i t y . uT or r ent . c om ( S ept ember14, 2011) :T heuT or r e nt . c om We bs e r v e r sha sbe e n c ompr omi s e da ndc ons e que nt l yt hes t a nda r dWi ndowss o wa r edownl oa d wa sr e pl a c e dwi t hat y peoff a k ea nv i r us“ s c a r e wa r e ”pr og r a m.
Webs i t esofs e v er a l Me x i c a ng ov er nmentmi ni s t r i es( S ept ember16, 2011) : As pa r tofOpI ndi pe nde nc i a , we bs i t e sofs e v e r a l Me x i c a ng ov e r nme ntmi ni s t r i e s , i nc l udi ngDe f e ns ea ndPubl i cS e c ur i t y , a r et e a r e ddowni nt hes a meda yoft he s y mbol i cbe g i nni ngofMe x i c o’ si nde pe nde nc ef r omS pa i n. 31THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
Offic i a lWebs i t eofT heUni t edS t a t esNa v y( S ept ember16, 2011) :Anha c k e r c r e wc a l l e dS e cI ndiS e c ur i t yT e a m Ha c k e rupl oa dsac us t om me s s a g eont he s e r v e rt owa r naWe bDa vv ul ne r a bi l i t y . T e x a sPol i c e( S ept ember18, 2011) :Anony mous / An s e cr e l e a s e sadoc ume nt c ont a i ni ngal i s tofa bout3300me mbe r soft heT e x a sP ol i c eAs s oc i aon Ci t yOfRennes( S ept ember19, 2011) :T e a Mp0i s oNt a k e sr e s pons i bl yt oha c k t heoffic i a l we bs i t eofT heCi t yOfRe nne s( F r a nc e )v i aat we e t . T he ya l s opubl i s ht her e a s onofha c kont hede f a c e me ntpa g e . F oxS por t sWebs i t e( S ept ember20, 2011) :F oxS por t swe bs i t e , onoft hemos t v i s i t e dWe bs i t e si nt hewor l d( r a nk590i nAl e x a )g e t sha c k e d.AnHa c k e r na me d“ S ha d0w”r e l e a s e sS QLi nj e conVul ne r a bi l i t yononeoft hes ub doma i nofF oxS por t sa nde x pl oi ti tt oe x t r a c tt heda t a ba s e .L e a k e dda t a ba s e i nf opos t e donpa s t e bi n.Vul ne r a bl el i nki sa l s opos t e dt og e t he ra dmi npa s s wor dha s he s . Cor eS ec ur i t yT ec hnol og i es( S ept ember22, 2011) :Anot he rs e c ur i t yF i r m t a r g e tofha c k i ng :Cor eS e c ur i t yT e c hnol og i e si sha c k e dbya nha c k e rc a l l e d S nc 0pe , whode f a c e ss omewe bs i t e sbe l ong i ngt ot hefir m.
S e v enMa j orS y r i a nCiesa ndGov er nmentWebS i t es( S ept ember25, 2011) : T heAnony mousunl e a s hac ha i nof de f a c e me nta consa g a i ns tt heS y r i a nGov e r nme nt ,ha c k i nga ndde f a c i ngt heoffic i a ls i t e sofs e v e nma j orS y r i a nc ie s , whi c hs t a y e dupi nt he i rde f a c e dv e r s i onf ormor et ha n16hour s . I nmo onHosngS er v er( S ept ember26, 2011) :700, 000we bs i t e shos t e don I nMo onHosngne t wor ka r eha c k e dbyT i GE RM@T E .T heha c k e r sc opi e d ov e rt hei nde x . phpi nma nydi r e c t or i e s( publ i c _ ht ml ,wpa dmi n) ,de l e t e d i ma g e sdi r e c t or ya nda dde di nde x . phpfil e swhe r enotne e de d. US AT oda yT wierAc c ount( S ept ember26, 2011) :T heUS AT oda yT wie ra c c ounti sha c k e da nds t a r t st ot we e tf a l s eme s s a g e sme n oni ngt heot he ra c c ount sha c k e dbyt hea ut hor soft hea con:t heS c r i ptKi ddi e s( a l r e a dyi nt he s pot l i g htf orha c k i ngt heF ox Ne wsT wie rAc c ounta tt heE v eof9/ 11a nni v e r s a r y ) . 32THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05
My S QL . c om ( S ept ember26, 2011) :My S QL . c om we bs i t ei ss t r uc kbyc y be r c r i mi na l s , whoha c k e dt he i rwa yi nt os e r v eupma l i c i ousc odet ov i s ingc omput e r swi t haJ a v ae x pl oi tt ha tdownl oa de da nde x e c ut e dma l i c i ousc odeon v i s ingWi ndowsc omput e r s . Acv i s ta cv i t yha sdi mi ni s he di nS e pt e mbe runl e s sy ouc ons i de rt henume r ousa s s a ul t sonpol i c e / l a we nf or c e me nta g e nc i e sf r om t heUni t e dS t a t e st o Aus t r i a .I si tpos s i bl et ha te x pos ur eofP ol i c e / l a we nf or c e me ntmi s c onduc t a r oundt hewor l dc oul da c t ua l l yc ur bha r a s s me ntofa cv i s t / de mons t r a t or s a ndde l i v e ral e v e l ofv ul ne r a bi l i t y / huma ni t yt ot hos et ha ta r es wor et o“ Pr ot e c ta ndS e r v e ”t he i rc iz e ns ?Coul di tbet ha tt ha tP ol i c eOffic e r si nv ol v e di n I nt e r na lAffa i r si nv e sg aonsa ndt hos epr oc e e di ng smi g htbeal otmor ec i r c ums pe c ti nt hee x e c u onoft he i rdu e si ft he yk nowt he ya r ev ul ne r a bl et o e x pos ur e ?A r e c e nte x a mpl e ;t heha c k e rc ol l e cv eAnony mousi de n fie d NY PDDe put yI ns pe c t orAnt honyBol og naa st hema ns e e npe ppe r s pr a y i ng t wowome nunpr ov ok e da tt heOc c upyWa l l S t r e e tpr ot e s t . I ti sdi ffic ul tnott o v i e wt hi si nc i de nta sapr i mee x a mpl eoft hepol i c epr ot e cngt hepowe r st ha t bea ndwor k i nga g a i ns ta ny onewi l l i ngt ot a k eas t a nda g a i ns toppr e s s i on.No c ount r ys houl dt ol e r a t eac or por as tpol i c es t a t e .
T heDi g na t orHa c kwa sa not he rba l ei nt heS t a nda r dsWa r s . T hes t a t usquo’ s de s i r et or e pr e s si nnov aon a nd pr ot e c ti t s de f a c t o monopol y ov e r s y s t e ms / ne t wor kt e c hnol og yi st obee x pe c t e d.T houg ht hepol ic a l r a mi fic a onsa r ebe ni g na ndobs c ur e dbyt hepot e na l f orhug emone t a r yl os s e s , i ti s ar us et oma x i mi z ec ont r olofaf e wov e rwor l dwi dei nt e r ne ts e r v i c e s .T r ue , c ombi ne dwi t hDNSa a c k s ,poi n ngus e r st oc ount e r f e i ts i t e si snotat r i v i a l ma e r . Howe v e r , i ts houl dbek nownwe e k se a r l i e r , J . P . Mor g a nCha s e ’ sdona onof$4. 6M t ot heNY PDwa snota na c tofc ha r i t a bl eg i v i ngt ot hene e dy , but ar a t he rhe a v yha nde dpa y me ntf orpr ot e cona g a i ns tt her a bbl e .
T he r ea r enoi nnoc e nta c t sofk i ndne s sbyc or por a t ede ni z e ns . F oc us i nge ffor t s on“ T heNe t s ”e s t a bl i s he di nst u ons , ( Mulnaona l ba nk s , Gog g l e , E qui f a x, e t c )t ha tr e s e l l si tus e r sda t at ol a we nf or c e me nt , g ov e r nme nt , mi l i t a r yi ndus t r i a l c ompl e xori nst u onsot he r wi s ev i ol angt hepubl i ct r us ts houl dbet he fir s tor de rofbus i ne s s . Po we rc o n c e d e sn o t h i n gwi t h o u tad e ma n d . I tn e v e rd i da n di tn e v e rwi l l . “ " F r eder i c kDoug l a s s 33THN-Magaz i ne|Oc t ober201 1
www. t hehac k er news . c om |I s s ue05