I think one of the most unclear areas to the up and coming hacker is how to avoid being caught when penetrating systems and networks. I've read and heard many very misinformed myths on this subject, and I've seen more than a few people get in a lot of trouble by making dumb mistakes.
not promoting illegal activities or saying anybody should go out and do anything illegal or damaging. Just wanna let you guys know some facts.
Contents
1 Things you should not do
1.1 Use AOL, MSN, or any small ISP (assuming you're doing this from your home).
1.2 Make any operational changes to the compromised computer(s)
1.3 Leave a calling card
1.4 Use Proxies
1.5 Use automated exploit scanning tools
1.6 Tell anybody about what you're doing or have done
1.7 Attempt unrealistic methods of intrusion
1.8 Give yourself a user account
1.9 Do it from a public computer
1.10 Write things down or print things off
1.11 Respond to any odd communications you get regarding your target
1.12 Use mind altering drugs or hack when you've had a lack of food or sleep
2 Stuff you should do
2.1 Your Environment
2.2 Proxies - Revisited
2.3 Data Protection
2.4 Wireless
2.5 Using Exploits
2.6 Hacking Web Apps
2.7 Dealing with Logs
3 Hiding out on a Linux System
4 Hiding out on a Windows System
There are some things that you should avoid doing at all costs if you don't want to get caught. I think it's important to go over these first because there are a lot of common myths and falsehoods that should probably be cleared up before I go on and explain good ways to protect yourself. Keep in mind, these are things you _shouldn't_ do.
Use AOL, MSN, or any small ISP (assuming you're doing this from your home).[/red\]>br>If you do stuff from home, or even just do research of some kind from home, you should avoid MSN, AOL, and smaller "home-town" type ISP's. AOL and MSN watch their customers very closely for any activity that might indicate you are involved in breaking into a system and may call the cops, turn off your internet, or a multitude of other things. Smaller ISP's tend to do the same kind of thing. Citation needed
Make any operational changes to the compromised computer(s)
When you compromise or probe a system you should not do anything that has a good potential of negatively impacting the performance of that system. People will notice if something stops working right or starts working slower than normal, and will investigate the reason behind it.
Don't leave any sort of calling card that'll tip someone off to your presence. This includes defaced web pages, deleted system logs, logs edited in ways that aren't believable, etc. This is again, because it lets the target know that someone has been messing with things.
Use Proxies
This mostly applies to the proxies found on public proxy lists, but it should be held as a general rule. Do not use proxies to try to mask where you are connecting from. Most proxies keep logs of who uses them and for what. If your mark realizes something is going on they can probably just get the party responsible for the proxy to release the relevant logs. This isn't to say that proxies should never be used. They just should not be relied on. Ideally, any proxy you use should be one you are sure does not log anything, or one which you can access and delete log entries related to you.
Use automated exploit scanning tools
Don't use programs like X-Scan, Nessus, Saint, SuperScan, Languard, or anything else like that to get info about targets. These programs tend to check for every possible thing which could be wrong with a given system, which will generate a lot of error messages on your target's system and fill their logs, which is a pretty good indication to them that someone is attacking them. Such programs also tend to trigger intrusion detection systems like Snort.
Tell anybody about what you're doing or have done
The fewer people who know, the better, because then there are less people who can rat you out or let it slip. Avoid working in groups if possible
Don't try to do stuff like use IIS exploits against Apache, or IA32 shellcode on a computer with a PPC processor in it. These are sure-fire tip offs to someone that something is going on, and will also trigger most IDS devices. Along with this, you should avoid using automated password guessing programs because they'll cause you the same kind of trouble, and you probably won't gain anything.
Give yourself a user account
Avoid giving yourself a user account on a target system. If you can, use an existing account or access the system using a method that doesn't require authentication.
Do it from a public computer
Although it might be tempting, you shouldn't use public computers for any kind of hacking. While it does grant you relative anonymity, you can't be sure that someone won't walk past and see what you're doing, that there are no cameras around, or that the machine doesn't log what you use it for.
Write things down or print things off
Keep stuff on computer where you can encrypt it and hide it from prying eyes. Don't write stuff down or print it off because then someone might find it laying around. Plus, papers found with you can be used as evidence while most text-based computer documents can't be.
Respond to any odd communications you get regarding your target
This might sound obvious, but don't respond to any communications you get from anyone regarding your target. If someone contacts you about your target then cease all activity right away.
Use mind altering drugs or hack when you've had a lack of food or sleep
All of these can cause you to make stupid, stupid mistakes.
Enough with things you should avoid doing, and on to things you should do. This section is broken up into little segments about different topics.
Your Environment
Something that is a lot more important than you would think is the environment in which you work. Make sure you are relaxed, have access to some place comfortable to sit, and are not rushed. Avoid recurring distractions like the telephone, and turn off things like the TV or the radio. Music is good, but don't listen to music that makes you feel particularly rushed, excited, or tense. Turn off any messaging programs or anything like that.
Yeah, I said not to use proxies. That's because it's easier to tell someone not to do something than to explain to them the right way to do it. So, this is the "right way". When it comes to proxies your best source of them is yourself. You should use proxies you have set up on other people's machines. There are many pieces of software available online which will act as a SOCKS proxy if you install it on someone's computer.
Register an account with a free dynamic DNS service like dyndns.org and then install proxies on home machines, and use the dynamic DNS services so you can always find the machines you've made into proxies. The advantage of this approach is that individual home users are a lot less likely to monitor their computers (many home PC's are part of a bot net anyway), and you don't have to worry about logs.
It's best to use proxies which support encryption so the traffic sent between the proxy and your machine can't be sniffed by anyone in between.
Also, on the topic of proxies, it should be noted that any program can be used through a proxy if you take the correct measures. Two pieces of software you should look into are tsocks and proxychains. Both of them can take all of the TCP I/O of a program and send it through a chain of proxies. You can even use them to do anonymous portscanning and the like. About the only thing they don't work well with is FTP, due to the way FTP connections work.
Protect the data on your computer(s) from prying eyes. Don't use some kind of stupid method like a commercial crypto-disk software which probably has a backdoor in it. There are better ways. One of the best ways I have seen is to use the cryptodisk function found in the Linux kernel. Basically, you can make a image file which can be mounted as a file system (with the correct password). When it's not mounted the data is encrypted using any algorithm you like (anything from 3DES to AES or Twofish). There's a good tutorial on how to set this up here: http://www.tldp.org/HOWTO/Cryptoloop-HOW
If you're not able to take that route, using PGP/GPG is a good idea. GPG is an open source encryption program that uses a public key architecture and is pretty much the de-facto standard for encrypting documents. It's a good idea to encrypt any saved logs or data using it. If you're using a system with it installed (any *NIX) open a command prompt, run gpg --gen-key and follow the directions. It's a very useful piece of software.
Also, it's not a horrible idea to have some kind of plan in place to destroy all of your data very quickly in the event of a raid or something like that. Granted, you probably won't ever have to actually use the plan, but it's like hacking insurance. Better safe than sorry. It's best to dispose of magnetic disks like floppies and hard drives using very strong magnets or very high heat. Heat is best, since the media will warp and expand. One thing I used to do was keep a coffee can with a magnet taped to the lid, and keep floppies in the can. That way knocking over the can would erase the disks.
Hiding your data somewhere no one will look is a good idea as well. Some HP network printers use a version of DOS which will allow you to store files on the flash drive in the printer, for example. Who is going to look for your stored files on a printer? All the better if they're encrypted too.
Wireless
The spread of wireless internet access has made it a lot easier to hide one's identity on the internet. If an attack is made from a network with an attached wireless AP, it's almost impossible to know who did it. However, if you choose to go this route you need to take special precautions.
Using Exploits
Probably one of the most effective ways into a system is to exploit a vulnerability in a piece of software installed on that system. It could be an exploit for anything from an anti-virus program, to a web server, to something as odd as a word processor. Such exploits are plentiful, available all over the internet, and most systems have at least one piece of software installed which is vulnerable to an exploit. All of this makes using known exploits very attractive. Well, before you happily go and use someone else's exploit code there are some precautions you should take.
Also, the best practice as far as exploits go is to use or find one that not many people know about at all. If an exploit isn't public knowledge then most people will not know what to look for, and most IDS devices won't flag the usage of it.
======================================
Hacking Web Apps
Dealing with Logs
How to deal with system log files is a hotly debated subject. Generally, you should never just delete all the logs on a system. Missing log files are a huge tip off that something is wrong. Also, you should always check to see if the logs on a system are being saved somewhere other than the usual place. On a Linux or UNIX system you'll probably want to take a look at /etc/syslog.conf and look to see if logs are being logged to any remote hosts. Windows doesn't have a built in way of logging to a remote computer (at least, not that I am aware of), so it's harder to tell if something like that is set up on a Windows box.
Hiding out on a Linux System
If you break into a Linux system there are some things you should check for before you poke around too much. You should probably check to see what modules are loaded (lsmod) and look for anything odd which might indicate you're inside a virtual machine (might be a honeypot). Another good way to check for that is to cat /proc/cpuinfo. If it's vmware cpuinfo will say so.
There are also a lot of more obscure ways of gaining access, including programs which send command over ACK packets, ICMP, or HTTP. Such programs are very useful since a firewall won't normally think anything of them. Also, of note here are netcat and the GNU version of awk, both of which can be used to make a remote shell you can connect to. These are nice because both of them are usually installed on most Linux systems.
Windows is a lot easier to hide on. There are plenty of good programs which will dodge antivirus software and disable logging of your connections. Also, if the target system uses NTFS you can use NTFS file streaming to hide files on the system (the book Hacking Exposed talks about how to do this).
As far as backdoors and the like go, you should avoid using traditional trojan horses. They are easy to detect and usually have a lot of functionality issues. Installing something like tightvnc, turning on Remote Desktop/Terminal Services, or something like that is the way to go. Most Windows servers do not have the logging facilities to notice a change like that, and it's easy to hide such changes or software installs if you use a rootkit like the one that comes on those CD's Sony is distributing right now (hides any file where the name starts with $sys). People tend to expect a little oddness and quirkiness out of Windows, so you have more leeway for installing backdoors.
Honestly though, there aren't many reasons to want to break into a Windows system. They do make excellent members of a list of a proxies.
=======================================
0 comments: