____________________________________________________________
GUIDE TO (mostly) HARMLESS HACKING
Vol. 3 No. 9, Part 2
War Tools! Scan, Sniff, Spoof and Hijack
____________________________________________________________
Note: This Guide is excerpted from the upcoming Second Edition of “The
Happy Hacker” book, available Sept. 31, 1998.
So now that we know it’s time to fight intruders, let’s start with free
anti-crime tools that are great not only for sysadmins, but also for casual
users who just want to have fun.
Twinsen (hacker handle) has written Port Dumper, which is a good program
for Unix type computers which will deal with snoopers like me. He says “I
use this to play with my friends. This program is used to listen to a port
(any port), after it is connected with others, you can type something and
Port Dumper will send it. It is quite useful when you want to fake a
service, such http, smtp, etc... or even telnet (Evil Genius Tips: You know
it!) It is in my homepage, Channel X Security Information
(http://home.netvigator.com/~jcatchan/). I may write a guide on using it to
do a specified mission (such as faking as an http server...) later. Hope
you'll enjoy using it! Use at your own risk.. I’m not responsible for the
use of this stupid shell script....
Richard Thomas (Humble) has written RotoRouter., “a program for logging and
faking the standard Unix udp-based traceroute... . When someone is about to
do a DOS (denial of service attack), it is commonplace for them to
traceroute to the target, launch the attack, and traceroute again to see the
effect..., secure in the belief that their traceroute will never be noticed.
They commonly trace from their home machines (99% of packet warriors have
28.8k modems and bandwidth envy, right :P), or ... from the hacked machine
they are attacking with.”
RotoRouter is a great way to fake out those losers who think attacking
other people’s networks is fun. It sends fake Time Exceeded and Destination
Unreachable messages. In Humble’s words, other ways his program can fake
out people include:
· Lead those stupid smurf kiddies away from your vulnerable routers
· Lie to customers about your bandwidth...
· Scare your ... friends with odd routes, watch their heads explode
· Make the final hop reverse to "this.traceroute.has.been.logged.com"
However, to run RotoRouter, you must install it on a Unix type computer --
as root. This is another reason to run Linux on your home computer. If you
have what it takes to run RotoRouter and want to fake out people and fool
attackers, you can get it at http://www.bitchx.com/~humble/.
If you really want to have fun, and if you suspect someone has broken into
your system, there is a free program for Unix computers called TTY-Watcher
It is available from http://www.engarde.com. TTY-Watcher lets you see
exactly what anyone is typing on their keyboard while they are logged on to
your computer. You can even record their keystrokes and play them back at
the same speed the intruder typed them -- or play them back faster, if that
d00d is a slow typist.
You can also download a free trial of the more advanced Windows version of
this program, T-sight, from the En Garde Systems web site.
I’ve seen some playbacks. They make fabulous party entertainment. On one,
someone had broken into a computer at Los Alamos Laboratories that actually
was a “bait” computer used to practice fighting computer criminals -- using
real unsuspecting computer criminals.
This particular criminal was trying to send email from this computer
bragging of his (hah, hah) feat and demanding that Kevin Mitnick be released
from prison. What was fascinating was that Mr. Computer Criminal kept on
entering MS-DOS commands on the hacked computer, which didn’t work because
it was running Unix. After about 20 tries he finally managed to send out
his email boast. Then he tried to destroy the evidence of his crime by
erasing the entire hard disk. However, he found this hard to do. He kept
on giving various erase commands, then listing the directories, and the
stuff didn’t seem to be disappearing. You could almost feel his rising panic.
TTY-Watcher is ideal for when you and your friends are playing hacker
wargames where the attacker starts from a shell account on the victim
computer. By seeing exactly what other people are doing to leverage
unprivileged shell access into root access, you can learn a lot about how to
detect and fight attacks. You also can also better understand why it is so
hard nowadays to get a shell account on an ISP.
TTY-Watcher is outstandingly good at one thing: it allows you to control
your victim intruder. I watched this happen once on a friendly hacker
wargame. The guy running TTY-Watcher felt sorry for the other player, took
over the poor guy’s session and fixed his commands. If your intruder is
hostile, and you wanted to mess up his commands instead, you could make his
day profoundly bad.
The only weakness of TTY-Watcher is that it only runs on one machine. It
isn’t set up to defend an entire network.
If you just need a free program to watch what is flowing on your local
Ethernet, try Sniffit, available for free from http://www.rootshell.com.
It’s boring compared to some of the above programs, but valuable for more
sophisticated users who need to understand the technical details of how an
intruder got in. Its description, “A very flexible network sniffer that
has many interesting features (like curses)” suggests that it may be used by
your intruders to sniff your network. Computer criminals love Sniffit. If
you can become intimately familiar with its features, it will be easier for
you to find a hidden Sniffit in operation.
Another program for watching criminals at work on Windows computers is
TCPview. It is available for free from http://www.sysinternals.com/. It is
a GUI (graphical user interface) utility that tells you at any time what
connections are open to your box, and what is going on with each connection.
If you are brave, or perhaps foolhardy, you could always try running Back
Orifice on your Windows computer. The promotional material for this free
program make it sound useful for being able to keep your computer out of
trouble when you are away from it by logging into it from the Internet.
However, it is quite difficult to uninstall Back Orifice. Also, it was
written by a member of the Cult of the Dead Cow, a gang notorious for an
excessive sense of humor. Many computer security experts warn that Back
Orifice is a Trojan that will make it easy for strangers to get into your
computer. I don’t recommend ever installing Back Orifice. If you have
installed it and want to get rid of it, removal instructions are in the
chapter “How to Break into Windows 95/98 Computers.”
Suppose you want to see whether someone is port scanning you or trying to
break into a port. One useful utility is Nukenabber, available from
http://www.winfiles.com, in the Winsock area. It watches up to 50 ports
simultaneously. Yes, it is a Windows program, and it’s free.
Industrial Strength War Programs
Now -- let’s say you are responsible for a large LAN or an entire ISP.
Especially if you are responsible for a commercial Web site, this is a job
that calls for much more than the programs above can do. According to an
International Computer Security Association report of April, 1997, about a
half of US Web sites are attacked or probed each month. True, most of these
are probes from the clueless, but even the clueless get lucky sometimes.
You may well need security products that can handle a broad spectrum of
computer crime problems, that work across a network, and that can spot the
most sophisticated attacks. Most important, you need the power to fight back.
Since I don’t like to take a company’s word for the quality of their
security products, I will only discuss the two that I have tested:
EtherPeek 3.5 for MacOS, from AG Group at http://www.aggroup.com; and
IP-Watcher for Unix from En Garde Systems, http://www.engarde.com. I picked
those two because they promised exceptional powers to detect attack, and in
the case of IP-Watcher, to fight back when under attack. EtherPeek in
particular also gets high recommendations from sysadmins I know at the AGIS
Internet backbone, and Rt66 Internet, the largest ISP in New Mexico. Both
AGIS and Rt66 have had more than their share of attacks by computer
criminals, so they have had real life experience with EtherPeek.
Another plus for EtherPeek and IP-Watcher is that they are both ideal for
testing other security products such as firewalls, router packet filters,
and wrappers, and to track down and gather the evidence needed to put
computer criminals behind bars.
Let’s begin with EtherPeek. Besides the Mac version, there is a version
that runs on Windows NT, and even Windows 95/98. However, I recommend the
Mac version because not many hackers know how to compromise, disable or
crash Macs. Windows, by contrast, is vulnerable to the many denial of
service attacks that kode kiddies think are 31337 (elite). While you can
protect your Windows boxes from attacks from the Internet with a
well-configured router and firewall, what if the intruder is inside your LAN?
**********************************************
Wizard tip: If you have a cable modem, try EtherPeek on it. You will
probably discover your cable modem is a node on an Ethernet -- and you can
see what everyone else on your cable system is doing! That means, of
course, that the other guys can see you. Even without EtherPeek, it could
be a great playground to test your ability to figure out the details of all
the hardware on your cable modem network.
**********************************************
**********************************************
You can get punched in the nose warning: It probably won’t be a good idea
to exploit what EtherPeek tells you to tease your next door neighbor about
his visit last night to bianca’s Smut Shack.
**********************************************
EtherPeek is good for evaluating your security setup. For example,
EtherPeek can be used to check the way people login to computers on your
network to find out whether these boxes are correctly configured to only
send encrypted passwords over your Ethernet. This is necessary because,
amazingly enough, many network file servers, mail systems, and databases
automatically install in such a way that they send clear text passwords over
the network. Once an attacker breaks into one box on a network like that,
he or she can install a program such as Sniffit and soon capture every password.
Here’s an important note. If your network uses Microsoft Point-to-Point
Tunneling Protocol (PPTP) to encrypt passwords, and if you have a Solaris
box on your LAN, you are nevertheless heading for trouble. There is a free
sniffer at http://www.l0pht.com/l0phtcrack which that runs on Solaris and
captures encrypted PPTP passwords. Another free program at this site cracks
them. By the time you read this, there may be versions of this sniffer
that run on other operating systems, too. For a cryptographic analysis of
why it is easy to crack PPTP, see http://www.counterpane.com/pptp.html
However, back to EtherPeek. It has a “Tools” menu that allows you to test
firewalls and routers. For example, you can check to make sure the firewall
is blocking the computers on your LAN from replying with valuable
information to a port scan from someone on the outside.
The creator of EtherPeek and president of AG Group, Mahboud Zabetian, also
explains that his software can collect “messages looking for passwords.”
EtherPeek has a “File Transfer Protocol (ftp) application in the TCP/IP
suite has a PASSWORD embedded command in the command stream channel that is
ideal for filter writing. By setting up EtherPeek with a filter for PASSWORD
commands embedded in FTP, the security person can quickly examine why
systems are failing password connections or where high connection count
password attempts are coming from when trying to find the source of random
login hacking.”
OK, I agree with you, the kind of cracker who repeatedly attempts to get
into an ftp server by guessing at passwords is seriously lame. However,
even lame hackers sometimes get lucky. You would be surprised at how many
users choose a password that is the same as their user name, or even choose
to have no password at all (just hit “enter”). The best way to deal with
this problem is to run a program that forces users to choose secure
passwords. Alec Muffet’s cracklib will do this. It’s available for free at
http://www.nmrc.org/files/sunix/index.html.
Zabetian also has advice for how to spot the sophisticated break-in artist
at work. “By looking for what ‘does not belong’ on the network connections
as well as what does...” one may spot “potential security issues before they
become problems. For instance, if there are a lot of connection attempts
from a specific address external to the authorized group, it’s time to pay a
visit to the offender and find out what’s going on before it gets serious.”
Yes, that’s right, a hacker really can get punched in the nose, er, paid a
“visit,” if he or she does too much port scanning and poking around
someone’s network.
For best results, EtherPeek (or any good computer crime fighting software)
should be set up on one computer outside the firewall (you do have a
firewall, right?) and another inside to deal with the intruders who manage
to get inside anyhow. Besides, almost half of all computer crime is
committed by people who are already users on the local area networks they
attack.
EtherPeek is shipped with a companion program, AGNetTools, which can port
scan your network while EtherPeek records its results. As mentioned above,
one of the warning signs that you have an unexpected visitor is unauthorized
ports showing up. Also, sometimes someone gets careless and accidentally
opens a Web or ftp port that has little or no security -- and opens the door
to invaders.
EtherPeek is a great hacker research tool, too. It can detect the
corrupted packets of exploits such as Land and Teardrop that disable
vulnerable computers. It can save these packets for you to resend against a
test computer so you can learn how they do their dirty work. Besides,
sometimes there is a hardware glitch that accidentally manufactures
destructively corrupt packets. One time when Rt66 Internet was suffering
from corrupt packets, EtherPeek helped a sysadmin find the offending
hardware within minutes.
Occasionally you may be attacked by a truly sophisticated opponent. For
example, one trick is to run a denial of service attack such as syn flood in
which each packet has a different origination IP address. This will trick
many router and firewall defenses into not realizing they are under an
attack which will soon shut them down. EtherPeek, however, can analyze (but
not deflect) this attack.
As mentioned above, EtherPeek easily identifies the sender of so-called
stealth port scans. It also detects the true IP address of someone setting
up a spoofed IP connection. The attacker is sitting there sending messages
to the victim computer thinking that the identity of his computer is hidden.
Yet on the other end a sysadmin is looking on the screen of his Mac G3 at
the IP address, laughing as he unleashes a Teardrop attack to crash the
attacker’s computer.
Sorry, EtherPeek doesn’t strike back. You have to go to a site such as
http://www.rootshell.com to get denial of service software such as Teardrop
to strike back at the bad guys.
*******************************
You can go to jail warning: What if the attacker is on a hacked account of
an innocent victim? You might get into trouble if you retaliate with a
denial of service attack.
*******************************
*******************************
Wizard tip: If you can determine that your attacker is on a dynamically
assigned IP address, you might be able to fight back with impunity. A good
way to see whether an IP address is dynamically assigned is the command
“nslookup hostname” where you substitute the attacking IP address for
“hostname”. If you get back an answer “Non-existent host/domain,” it may be
time to fight back! However, if this gets you in trouble anyhow -- remember
I warned you.
*******************************
So what do you do when the bad guys attack? EtherPeek can set off a pager
when it detects suspicious activity. When the day comes that you are under
serious attack, you need to be physically at the network, even if it means
being rousted out of bed. Sometimes the only thing you can do to halt your
attacker is to physically disconnect your network from the Internet. If you
have modem access to your network, you also have to make certain you know
where all the modems are, and disable dial-ins. (Use a wardialer to check
for secret modem connections to your LAN.)
EtherPeek is also useful for logging the evidence you need to put your
attackers behind bars.
IP-Watcher, written by Mike Neuman, president of En Garde Systems
(http://www.engarde.com) is in some ways an even more powerful tool for
putting computer criminals behind bars. Neuman has worked closely with
several customers to get arrests and convictions of these destructive
intruders. This gives him the real-world experience needed to design a tool
that will gather evidence that will stand up in court. While gathering
evidence, IP-Watcher has the power to protect your network by letting you
hijack the attacker’s IP session. You can secretly divert the attacker into
a “jail” computer where he or she will think they are still at the IP
address of the computer they originally broke into. If it turns out this is
a malicious intruder, you can record his or her activities in order to prove
criminal intent, while not risking anything outside the jail computer.
This software was written, according to Neuman, with “our philosophy of
manual intrusion detection ... based on the fact that an intruder must
establish connections with other computers to accomplish his or her goal.
These connections are an intruder's footprints, and the best way to catch the
intruder is to have an advanced visualization of those footprints.”
The Windows version of IP-Watcher, T-sight, is, according to Neuman, even
more advanced than IP-Watcher.
Like EtherPeek, Neuman’s products have an option to page you when they
detect that someone has broken in.
IP-Watcher would be a deadly tool in the hands of criminals. In order to
prevent its abuse, En Garde Systems will only sell your copy of the software
pre-compiled for your particular network on which you plan to run it, and
enabled to only sniff and control IP sessions on your LAN. Neuman points
out a number of ways IP-Watcher can be abused:
· IP-Watcher can create network traffic with spoofed source and destination
addresses. This makes it possible to kill any user’s connection. While
this is essential for stopping attackers, it also could be used to deny
access to a legitimate user.
· When IP-Watcher terminates a user’s connection while trying to log in, it
looks to the user like the network merely had a fault. Normally the user
will try to log in again, at which point IP-Watcher can divert his
connection so that it steals the user’s password.
· If a sysadmin uses the “su” command to enter a root account, IP-Watcher
will sniff the cleartext password through its ability to log keystrokes.
· This software also can be set to log what it sniffs in many small files.
This is useful because it makes it hard for an intruder to edit log files.
However, if IP-Watcher is in the hands of an attacker, this feature prevents
the sysadmin from discovering a hidden sniffer by the technique of looking
for unexplained large files.
· Even one-time password systems are vulnerable to IP-Watcher. It can be
used to hijack a connection by a trusted user. While the user is going
about his or her business, the intruder can be secretly using the same
connection to install back doors.
**********************************
You can go to jail warning: Computer criminals may be tempted to attempt to
break into the En Garde Systems’ LAN in hopes of stealing the source code
for T-sight and IP-Watcher. This is probably the best place to go if one
sincerely wants to get convicted of a computer crime.
**********************************
Conclusion
Self defense against computer criminals is a topic hat has long been
neglected. This is because you have to think like an attacker and be
intimately familiar with his or her tools and tactics. However, many
systems administrators rely solely on commercial computer security products
to keep the bad guys out. The problem is: no firewall is perfect!
By contrast, if you use some of the software and techniques of this chapter
to watch for and battle intruders, you have a fighting chance even if your
firewall fails to stop the bad guys. Also, it can be fun to detect and
fight your attackers. Be sure to save those TTY-Watcher logs so you can
play back your latest hacker battle at parties!
# # #
Guess what? “The Happy Hacker Book” has almost sold out its First Edition,
published March 31, 1998. So American Eagle Publications is putting out a
Second Edition, due to come off the presses Sept. 31, 1998. It has several
all-new chapters as well as updates to cover Windows 98 and the major
changes that are happening in email forging and spam fighting.
How’s that -- only six months between editions? This is partly because
people were so quick to buy out he First Edition -- and partly because the
hacking scene is changing so fast. So instead of going to a second
printing, the publisher agreed to spend the extra money to create a Second
Edition so we could keep you as up to date as possible.
If you want to buy one of the few remaining copies of the First Edition of
“The Happy Hacker” (soon to be a collector’s item), you can order it from me
($34.95 for Priority mail shipping in the US; $35.95 airmail in Canada and
Mexico; email me for quotes outside the US) by sending a check or money
order to PO Box 1520, Cedar Crest NM 87008. Since I only have a few left
today, if your order comes in too late, be sure to tell me whether I should
just return your money or if you want me to hold on to it and be among the
first to get a Second Edition. Oh, yes, I autograph all books bought
directly from me.
_______________________________________________________________________
Where are those back issues of GTMHHs and Happy Hacker Digests? Check out
the official Happy Hacker Web page at http://www.happyhacker.org.
We are against computer crime. We support good, old-fashioned hacking of the
kind that led to the creation of the Internet and a new era of freedom of
information. So don’t email us about any crimes you have committed! And
don’t expect us to come to your rescue if you crash 100 million computers
with some new Java virus you just unleashed.
To subscribe to Happy Hacker and receive the Guides to (mostly) Harmless
Hacking, please email hacker@techbroker.com with message "subscribe
happy-hacker" in the body of your message.
Copyright 1998 Carolyn Meinel. You may forward, print out or post this
GUIDE TO (mostly) HARMLESS HACKING on your Web site as long as you leave
this notice at the end.
_________________________________________________________
Carolyn Meinel
M/B Research -- The Technology Brokers
http://techbroker.com
Receive all the latest articles by email!
Get all articles delivered directly to your mailbox as and when they are released on WindowSecurity.com! Choose between receiving instant updates with the Real-Time Article Update, or a monthly summary with the Monthly Article Update.
