Introduction: Anatomy of a Hack -- The Rise and Fall of Your Network
One of the great mysteries in security management is the modus operandi of an attacker. What is it that attackers do, and how do they do it? As with all great mysteries, this one generates a lot of interest, accounting for the phenomenal success of books and classes on how to actually attack networks. Although attacking networks can be fun and informative -- not to mention illegal if you do not have all the proper permissions -- the fact
remains that the vast majority of us do not need to know how to do so. Frankly, becoming a good penetration tester (pen tester) takes more than a week-long class. It takes commitment, dedication, intuition, and technical savvy, not to mention a blatant disregard for the rules and the right way to do things. Those are not skills that most security administrators have, or need in many cases. In most cases, it is cheaper and more effective to hire someone to perform penetration tests. Professional penetration testers are going to be much more capable of finding problems, as well as articulating what led to those problems. Then, why is it that books and courses on attacking networks are so popular? Well, frankly, primarily because of the mystique and perceived coolness of it all. There is also some value in a system administrator being able to perform rudimentary penetration tests. The focus in this chapter is a bit different, however. While the narrative is somewhat vague on the specific details of how the attack works, we will be very clear on the operational practices that led to the problem in the first place. This is highly deliberate. The important part here is not to show how to attack something, but to show how attackers take advantage of your mistakes. This will enable you to protect your network by avoiding the pitfalls attackers use.
Before we start, however, let us make one thing absolutely clear: We neither condone nor will we ever aid or defend those who attack networks or systems they do not own or that they have not been asked to attack.
| WARNING: Attacking networks and/or systems you do not own is illegal, immoral, and against the ethical principles of information security professionals. |
Further, this chapter demonstrates the use of a number of different tools. Although some of these tools are freely available on the Internet, most were custom written for the purposes of legitimate penetration testing. Regardless, the same principle applies.
| NOTE: Do not bother looking on the CD for the tools used in this chapter. They are not there. |
This book is about securing networks, not distributing tools to break them. Certain information systems security professionals, namely those who are charged with pen testing, have a legitimate use for these tools. System administrators, generally, do not need the majority of these tools, because their only use is for breaking into networks. Since any competent pen tester (or system administrator) with a need for these types of tools can write them, there is no reason for us to distribute them here. It is also important to understand that both the examples we show and the network we are using to demonstrate the attack methodology are entirely fictional. This network was built specifically for the purpose of this demonstration. Any similarity to a real production network is completely
accidental and unintended.
Click for the next excerpt in this series: What a penetration test will not tell you
Click for the book excerpt series or visit Addison-Wesley to purchase the book.
|
