Hakin9.Org Paradox” Is? Read the First Artcile and You Will Know The

04/2012 (52) PRACTICAL PROTECTION IT SECURITY MAGAZINE Dear all, I hope you are all good. This issue is about Cyberwarfare. Let’s have a look what’s inside! First article „What is Cyber War?”. Keith DeBus is talking team about basic information on Cyberwarfare. Why it is so hard to Editor in Chief: Grzegorz Tabaka define cyber warfare? What the „Cyber Warfare Asymmetric [email protected] Paradox” is? Read the first artcile and you will know the Managing Editor: Marta Jabłońska answer for those and many more questions. [email protected] Would you like to learn how to develop an understand Editorial Advisory Board: Keith DeBus, Benjamin different types of attackers and methods to protect your Vanheuverzwijn, Pierre-Marc Bureau, Christopher Pedersen, network from inside and outside intruders? If yes, then you Yury Chemerkin, Daniel Lohin, Daniel Dieterle, Gary S. Milefsky, Julian Evans, Aby Rao have to read Christopher’s Pedersen article entilted „Cyber Warfare - Computer Network Defense”. DTP: Ireneusz Pogroszewski Art Director: Ireneusz Pogroszewski Cyberwar is all the rage now. Just turn on the news and you [email protected] will hear terms like cyber espionage, power grid vulnerabilities, SCADA systems and cyber-attacks. But what does all this mean? What can be and what has been done with electronic Proofreaders: Donald Iverson, Michael Munt, Elliott Bujan, Bob Folden, Steve Hodge, Jonathan Edwards, Steven Atcheson cyber-attacks? Daniel Dieterle will answer these questionsin his „Cyber Warfare Network Attacks” article. Top Betatesters: Ivan Burke, John Webb, Nick Baronian, Felipe Martins, Alexandre Lacan, Rodrigo Rubira Branco Also Drake in his (IL)Legal column talks about Pirates Special Thanks to the Beta testers and Proofreaders who helped and Cyber Marines. Very interesting piece of work, we highly us with this issue. Without their assistance there would not be a recommend it! Hakin9 magazine. Our long contributor, Yury Chemerkin wrote an article „Social Senior Consultant/Publisher: Paweł Marciniak Network Privacy Guide”. So if you have basic knowledge how CEO: Ewa Dudzic to find and setup security setting on social networks and you [email protected] have clear understanding of your goal when you start to use a Production Director: Andrzej Kuca new social network, go on to page 22 and read! [email protected] At the end of the magazine you will find special report from Publisher: Software Press Sp. z o.o. SK RSA Conference. 02-682 Warszawa, ul. Bokserska 1 Phone: 1 917 338 3631 We wish you good reading! www.hakin9.org/en Marta & Hakin9 Team Whilst every effort has been made to ensure the high quality of the magazine, the editors make no warranty, express or implied, concerning the results of content usage. All trade marks presented in the magazine were used only for informative purposes. All rights to trade marks presented in the magazine are reserved by the companies which own them. To create graphs and diagrams we used program by Mathematical formulas created by Design Science MathType™ DISCLAIMER! The techniques described in our articles may only be used in private, local networks. The editors hold no responsibility for misuse of the presented techniques or consequent data loss. 4 04/2012 �� 5 � CONTENTS BASICS its own section of a building. To enter the room would require multiple smart cards, pass-codes, and Biometrics, 8 What is Cyber War? such as hand scanners, retinal scanners, weight scales, by Keith DeBus and height measurement. Within these walls the most In just a brief fifteen years, our communication, advanced technology is being created to overtake commercial and social lives have been dramatically altered world markets. Just as the company thinks they have it by the development and growth of the Internet. With the all figured out, a press release comes out stating their convenience and bounty of this medium, has also come competition is releasing the very same product that they a dark side. Just as the famous bank robber, Willy Sutton, have had in secret development for months. Sounds like once said when asked why he robbed banks, „That’s where a good plot from a book or movie doesn’t it? In fact, it the money is”, crime has migrated to the Internet following could be a real situation. These situations happen all the the money. As e-commerce has growth, so has e-crime. In time around the world with companies in every aspect a few short years, cyber crime has become a leading crime of business: Agriculture, IT, Retail, the list goes on. This category in the wired world, costing the global economy scenario describes a case of cyber warfare; they thought $338 billion in 2011. This is approximately equivalent to the that they had their security locked down, but they get entire GDP of Austria, the world’s 27th largest economy. hacked. How could this have happened? Now, a new, darker frontier in the history of the Internet is being breached and its impact is likely to even larger than cyber crime on the global economy and global geo- DEFENSE politics, cyber warfare. This short article will attempt to 22 Social Network Privacy Guide define and elaborate on what cyber war is and the key by Yury Chemerkin issues all nations state must address before responding Social networking services are kind of online service that and retaliating to a cyber war attack. focuses on building social relations among people shared their information about themselves. This information 12 Reverse Engineering C++, a case study filled their profiles makes users possible to search and with the Win32/Kelihos malware family extract necessary information. It means the search will by Benjamin Vanheuverzwijn, Pierre-Marc Bureau analyze only the actual contents you want (images, video, The C++ programming language is a popular one. It text, calendar events). Such representation is often based is also gaining in popularity among malware writers. on each user profile as set of social links, interests, The object-oriented programming paradigm can make public data, and other linked services. Current trend has binary disassembly more difficult to understand when fast been growing to control mechanism unification for a performing analysis through reverse engineering. In long time. Each of these social services meets with users this paper, we go over the basic principles needed by a desires to less inputting about them. That’s why you are reverse engineer to analyze C++ binary files. Furthermore, allowed to be sign up/in by Facebook button or Twitter we show how we applied this knowledge when analyzing button following which you can start to organization the Win32/Kelihos malware family, a peer-to-peer botnet your own networks groups by involving others friends believed to be the successor of the Storm Worm (…) via email, social address book or switching your profile When analyzing a binary file and trying to understand into public zone indexed by search engines like Google, C++ disassembly, one is faced with some interesting Yahoo or Bing. This is so-called individual-centered characteristics that are very different from standard C service whereas online community services are group- compiled code. In this section, we go over some of these centered based on user abilities to share ideas, activities, features that need to be understood to properly analyze a events, and interests within their individual networks. C++ compiled program. 40 What is PAM and why do I care? 18 Cyber Warfare – Computer Network by Daniel Lohin Defense Pluggable Authentication Modules (PAM) is the main by Christopher Pedersen mechanism for Linux (as well as other Unix systems) that Imagine this scenario: A company’s best kept secret, performs the authentication of the user every time they a new technology that will redefine the IT business log in. PAM can be configured in a number of ways in worldwide, has been in secret development with some of order to authenticate the user in a variety of means such the best security measures in place. The secret computer as using passwords, SSH keys, smart cards, etc. PAM can system is cut off from the outside world, with firewalls be used to authenticate users not only when logging on and other authentication methods built-in, all located in to the system from the traditional logon screen, but also 6 04/2012 www.hakin9.org/en CONTENTS through services such as FTP, HTTP, SAMBA and other services can use the PAM. If an attacker is able to modify the integrity of the PAM system, then they are given the ability to modify the method for PAM to authenticate users which is a perfect situation for creating a back door that will be used to establish a path with which they can access systems again. This article will detail how a simple PAM module can be created that could be placed on a system to allow an attacker to access a system in the future. This would be useful if an attacker has already gained root access to a system and wants to ensure that they are able to access again if their original path in is corrected. This article will also be useful for anyone in charge of defending systems as it will give the reader an understanding of what to monitor on their systems to detect compromise as well as help in investigations. 44 Cyber Warfare Network Attacks by Daniel Dieterle Internet connected devices like SCADA systems are also vulnerable to cyber-attack. Public utilities use SCADA systems to control power generation devices, pumps, gates and motors. This is where a lot of media attention has focused on when you hear about cyber-war in the news.

Load more