Linux Operating System Vulnerabilities

Hands-On Ethical Hacking and Network Defense Chapter 9 Linux Operating System Vulnerabilities

Objectives Describe the fundamentals of the Linux operating system Describe the vulnerabilities of the Linux operating system Describe Linux remote attacks Explain countermeasures for protecting the Linux operating system

Review of Linux Fundamentals Linux is a version of UNIX Usually available free Red Hat Includes documentation and support for a fee Linux creates default directories

Linux Exploration Demo See link Ch 9b

Linux File System Provides directory structure Establishes a file-naming convention Includes utilities to compress or encrypt files Provides for both file and data integrity Enables error recovery Stores information about files and folders *NIX systems store information about files in information nodes (inodes)

inodes Information stored in an inode An inode number Owner of the file Group the file belongs to Size of the file Date the file was created Date the file was last modified or read There is a fixed number of inodes By default, one inode per 4 KB of disk space

Mounting In Windows, each device has a letter A: for floppy, C: for hard disk, and so on *NIX mounts a file system (usually a drive) as a subfile system of the root file system / mount command is used to mount file systems or to display currently mounted file systems df command displays disk usage of mounted file systems

*NIX File System History Minix file system Max. size 64 MB, Max. file name 14 chars Extended File System (Ext) Max. size 2 GB, Max. file name 256 chars Second Extended File System (Ext2fs) Max. size 4 TB, better performance and stability Third Extended File System (Ext3fs) Journaling—recovers from crashes better

Getting Help Many of these commands have multiple parameters and additional functionality Use these commands to get help. (Replace command with the command you want help with, such as ifconfig ) command --help man command

Linux OS Vulnerabilities UNIX has been around for quite some time Attackers have had plenty of time to discover vulnerabilities in *NIX systems Enumeration tools can also be used against Linux systems Nessus can be used to enumerate Linux systems

Nessus Scanning a Linux Server

Linux OS Vulnerabilities (continued) Nessus can be used to Discover vulnerabilities related to SMB and NetBIOS Discover other vulnerabilities Enumerate shared resources

Linux OS Vulnerabilities (continued) Test Linux computer against common known vulnerabilities Review the CVE and CAN information See links Ch 9m, n, o

Remote Access Attacks on Linux Systems Differentiate between local attacks and remote attacks Remote attacks are harder to perform Attacking a network remotely requires Knowing what system a remote user is operating The attacked system’s password and login accounts

Footprinting an Attacked System Footprinting techniques Used to find out information about a target system Determining the OS version the attacked computer is running Check newsgroups for details on posted messages Knowing a company’s e-mail address makes the search easier

Other Footprinting Tools Whois databases DNS zone transfers Nessus Port scanning tools

Using Social Engineering to Attack Remote Linux Systems Goal To get OS information from company employees Common techniques Urgency Quid pro quo Status quo Kindness Position Train your employees about social engineering techniques

Trojans Trojan programs spread as E-mail attachments Fake patches or security fixes that can be downloaded from the Internet Trojan program functions Allow for remote administration Create a FTP server on attacked machine Steal passwords Log all keys a user enters, and e-mail results to the attacker

Trojans Trojan programs can use legitimate outbound ports Firewalls and IDSs cannot identify this traffic as malicious Example: Sheepshank uses HTTP GETs It is easier to protect systems from already identified Trojan programs See links Ch 9e, f, g

Installing Trojan Programs (continued) Rootkits Contain Trojan binary programs ready to be installed by an intruder with root access to the system Replace legitimate commands with Trojan programs Hides the tools used for later attacks Example: LRK5

Rootkit Detectors Security testers should check their Linux systems for rootkits Rootkit Hunter (Link Ch 9l) Chkrootkit (Link Ch 9l) Rootkit Profiler (Link Ch 9k)

Demonstration of rkhunter sudo apt-get install rkhunter sudo rkhunter -c

Creating Buffer Overflow Programs Buffer overflows write code to the OS’s memory Then run some type of program Can elevate the attacker’s permissions to the level of the owner Security testers should know what a buffer overflow program looks like

Creating Buffer Overflow Programs (continued) A C program that causes a buffer overflow

Creating Buffer Overflow Programs (continued) The program compiles, but returns the following error

Creating Buffer Overflow Programs (continued) A C code snippet that fills the stack with shell code

Avoiding Buffer Overflows Write code that avoids functions known to have buffer overflow vulnerabilities strcpy() strcat() sprintf() gets() Configure OS to not allow code in the stack to run any other executable code in the stack Some compilers like gcc warn programmers when dangerous functions are used

Using Sniffers to Gain Access to Remote Linux Systems Sniffers work by setting a network card adapter in promiscuous mode NIC accepts all packets that traverse the network cable Attacker can analyze packets and learn user names and passwords Avoid using protocols such as Telnet, HTTP, and FTP that send data in clear text Sniffers Tcpdump, Ethereal (now Wireshark)

Countermeasures Against Linux Remote Attacks Measures include User awareness training Keeping current on new kernel releases and security updates

User Awareness Training Social Engineering Users must be told not to reveal information to outsiders Make customers aware that many exploits can be downloaded from Web sites Teach users to be suspicious of people asking questions about the system they are using Verify caller’s identity Call back technique

Keeping Current Never-ending battle New vulnerabilities are discovered daily New patches are issued to fix new vulnerabilities Installing these fixes is essential to protecting your system Many OSs are shipped with automated tools for updating your systems

Linux Operating System Vulnerabilities

Recommended

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to Linux Operating System Vulnerabilities (20)

More from Information Technology (20)

Recently uploaded (20)

Linux Operating System Vulnerabilities