PacketFocus Attacks Overview - Ethical Hacking, IT RIsk assessment, GLBA ISO HIPPA NIST Assessment

Attack Definitions and Scenarios:. PacketFocus is known in the industry for identifying, and applying old attacks to new technology. We feel that although the technology is new, it does not mean that old attacks will not work. This also applies with our penetration testing services. Once we identify available services, we attempt to perform various attacks to identify real-world risk. In certain scenarios, we find new or un-reported vulnerabilities and work with our client and vendor to remediate this issue. The table below will provide some detail on a few modern attacks. We will also add new attacks as they are tested.

Name of threat/attack	Description	Resources Required:	Security Controls:
Phishing Attack	Phishing attacks use email as the attack vector. In most cases, Phishing Attacks are used in Identify Theft. The attacker will collect e-mail addresses that are input into the phishing script. Depending on the target and motivation of the attack the number and type of email address will vary. Once the attacker has a list of valid email addresses, they will send out an email attempting to cause a favorable reaction by the users. Most often, this is clicking on a link, or running an executable file. A simple technique to obtain passwords is to host a fake email site and have users attempt to login. If implemented correctly, the attacker may be able to intercept and use token authentication supplied by the user.	Valid Email addresses Capability to send spoofed emails Phishing Template/Script Compromised Server to host the phishing website	Ensure security policy and user policy minimize the use of company email addresses for non-business use Understand how many company email addresses are on the internet Implement AV system to filter inbound attacks on multiple layers Control client side handling of urls and other phishing attempts in email Implement controls to handle file extensions in email Security Awareness training on known phishing attacks and how to identify them Incident Response program used to react on known events.
Spear-Phishing	Same as "phishing attack" above, with the expectation that the email addresses are harvested from a single organization. This attack is VERY effective in obtaining internal usernames and passwords.	See above Knowledge of the target company Email addresses from the target company Sample of target company site to be replicated	Ensure security policy and user policy minimize the use of company email addresses for non-business use Understand how many company email addresses are on the internet Implement AV system to filter inbound attacks on multiple layers Control client side handling of urls and other phishing attempts in email Implement controls to handle file extensions in email Security Awareness training on known phishing attacks and how to identify them Incident Response program used to react on known events.
Social-Engineering (Onsite)	Social Engineering is the attempt to compromise Human Security. This may be through deception, false-information, false-identification, stealth, and similar techniques. Depending on the engagement, the attack may be fully dressed in a false-uniform and present himself to employees as a "FDIC Auditor" looking for cameras. Skilled attackers will go through great lengths to understand target companies and provide false-information. A sample attack would be to walk directly into the target and enter an unattended office. Once inside, obtain available files and information, then walk out of the building unnoticed. Once outside, the target contact is to be notified and inventory taken of the assets. This is repeated through all of the branch units.	Understanding of the target building(s) Understanding of the target business List of employee names for reference List of phone numbers False-identification False-information such as target company documents	CCTV Physical access Controls (RFID) Biometrics Security Awareness Training Scheduled 3rd party testing Defined Visitor Program Locking unattended offices Locking all file cabinets enforcing file classification and associated protection procedures
Social-Engineering (Offsite)	Remote Social Engineering usually involves attacks via phone or email. Referencing the "phishing attack" above- Social Engineering is used to generate a planned action by the target user. Example, the email is crafted so that the user click on the link and login. This same theory applies to using the telephone as an attack vector. The attacker would attempt to extract a known set of passwords or other information from the target.	Understanding of target List of names associated with target Validated information used to gain trust with target List of phone numbers or email addresses Plan to obtain a targeted type of information	Security Awareness to train users to identify these type of attacks. Incident Response to react if an attack was identified. Ability to ID callers on phone systems Appropriate email security measures to minimize phishing attacks Regular testing to verify control systems are working as expected
Exploiting Internet facing software and operating systems	Remote exploitation of software and operating systems has somewhat decreased with the usage of the modern firewall and application layer protection. Not saying that it does not happen, because it does every day. It is just not used as much to attack corporate networks as it once was. PacketFocus has noticed that attacks are moving higher up the OSI model. The majority of today's attacks target applications and social engineering through identify theft attacks. To exploit a system remotely, the attacker would first understand the target system. Next, would be to identify the open services, route, and potential upstream access control. Once the attacker understands the current state of the target and available services, an exploit would be matched up if available. If no exploit existed, one may be created or the attacker may move up the OSI model to the application or authentication attacks.	IP Address/range Urls Understanding of the target business Knowledge of the IP block owners, DNS,Email,BGP Understanding of route into the target network(s) Identification of ACL's Identification of IDS Understanding of route out of network Access to reliable exploits Identification of remote OS Verification of remote services Ability to deploy attacks from compromised machine with public IP address	Working Security Policy Effective Patch Management Hardening Procedures Audits of devices, network, and strategy Security Awareness Training Strict firewall rules Outbound firewall rules network and host based IDS hosting services located at 3rd party networks layered firewall approach
More to Come

OWASP Top 10 Application Vulnerabilities 2007

A1	Cross-Site Scripting ( XSS )	XSS flaws occur whenever an application takes user supplied data and sends it to a web browser without first validating or encoding that content. XSS allows attackers to execute script in the victim's browser which can hijack user sessions, deface web sites, possibly introduce worms, etc.
A2	Injection Flaws	Injection flaws, particularly SQL injection, are common in web applications. Injection occurs when user-supplied data is sent to an interpreter as part of a command or query. The attacker's hostile data tricks the interpreter into executing unintended commands or changing data.
A3	Malicious File Execution	Code vulnerable to remote file inclusion (RFI) allows attackers to include hostile code and data, resulting in devastating attacks, such as total server compromise. Malicious file execution attacks affect PHP, XML and any framework which accepts filenames or files from users.
A4	Insecure Direct Object Reference	A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, database record, or key, as a URL or form parameter. Attackers can manipulate those references to access other objects without authorization.
A5	Cross-Site Request Forgery (CSRF)	A CSRF attack forces a logged-on victim's browser to send a pre-authenticated request to a vulnerable web application, which then forces the victim's browser to perform a hostile action to the benefit of the attacker. CSRF can be as powerful as the web application that it attacks.
A6	Information Leakage and Improper Error Handling	Applications can unintentionally leak information about their configuration, internal workings, or violate privacy through a variety of application problems. Attackers use this weakness to steal sensitive data, or conduct more serious attacks.
A7	Broken Authentication and Session Management	Account credentials and session tokens are often not properly protected. Attackers compromise passwords, keys, or authentication tokens to assume other users' identities.
A8	Insecure Cryptographic Storage	Web applications rarely use cryptographic functions properly to protect data and credentials. Attackers use weakly protected data to conduct identity theft and other crimes, such as credit card fraud.
A9	Insecure Communications	Applications frequently fail to encrypt network traffic when it is necessary to protect sensitive communications.
A10	Failure to Restrict URL Access	Frequently, an application only protects sensitive functionality by preventing the display of links or URLs to unauthorized users. Attackers can use this weakness to access and perform unauthorized operations by accessing those URLs directly.
	Review the OWASP top 10 for complete information.	http://www.owasp.org/index.php/Top_10_2007

Attacks Explained!.
Visit our Attack Scenario page to find in-depth information on current attacks.
read more

Our tools are used worldwide, Security testers around the world use the LiveCD we developed for OWASP.
read more