Networking Chapter 8 Passwords And Authentication Explain Why Comprehensive Password Policy Critical Describe The Aspects

Hands-On Ethical Hacking and Network Defense, Third Edition 8-1

Chapter 8

Desktop and Server OS Vulnerabilities

At a Glance

Instructor’s Manual Table of Contents

• Overview

• Objectives

• Teaching Tips

• Quick Quizzes

Hands-On Ethical Hacking and Network Defense, Third Edition 8-2

Lecture Notes

Overview

This chapter examines how security testing is used to analyze operating system vulnerabilities

and correct them. It reviews how to discover and fix these vulnerabilities on Windows, as well

as Linux operating systems. Students will learn about the available assessment tools, in

addition to several countermeasures for making these operating systems less vulnerable to

common problems.

Chapter Objectives

After reading this chapter and completing the exercises, the student will be able to:

• Describe vulnerabilities of the Windows and Linux operating systems

• Identify specific vulnerabilities and explain ways to fix them

• Explain techniques to harden Windows and Linux systems

Teaching Tips

Windows OS Vulnerabilities

1. Explain that this section describes several tools used to discover vulnerabilities on

2. Explain to students that they can check the CVE and CERT Web sites to determine

vulnerabilities for any OS.

4. Remind students that exploits against these vulnerabilities should only be used in

specific cases, as a security tester and with prior approval.

5. Point out that tools like Nessus and OpenVAS will help to automate some of the

Windows File Systems

1. Describe the purpose of a file system. Regardless of the OS, the purpose of a file system

3. Explain the New Technology File System (NTFS). First released as a high-end file

Remote Procedure Call (RPC)

1. Describe RPC as an interprocess communication mechanism that allows a program

2. Explain how to use MBSA to determine if a system is vulnerable to an RPC-related

issue.

Security

Tip

Read http://www.microsoft.com/technet/security/bulletin/MS03-026.mspx and

http://www.microsoft.com/technet/security/bulletin/MS04-012.mspx for more

examples of RPC-related issues.

NetBIOS

1. Mention that NetBIOS has already been introduced in Chapter 6. Emphasize the fact

2. Describe NetBEUI as a fast, efficient network protocol that allows NetBIOS packets to

be transmitted over TCP/IP.

3. Explain that systems running newer Windows OSs can share files and resources without

using NetBIOS; however, NetBIOS is still used for backward compatibility, which is

Server Message Block

2. Mention that hacking tools for SMB include L0phtcrack’s SMB Packet Capture utility

Common Internet File System (CIFS)

1. Explain the Common Internet File System (CIFS), which is an enhanced version of

2. Describe the main characteristics of CIFS as explained in this chapter. In particular,

3. Discuss the two methods for server security an administrator can select:

Null Sessions

1. Describe null sessions as anonymous connections established without credentials.

Web Services

1. Explain the main problems of having a Web server installed on your network and

provide some recommendations to better secure it.

3. Explain that although IIS 6.0 (Windows Server 2003) through IIS 10.0 (Windows

4. Emphasize that regardless of the IIS version a system runs, keeping systems patched is

MS SQL Server

1. Describe the most common critical SQL vulnerability, the null SA password.

Hands-On Ethical Hacking and Network Defense, Third Edition 8-5

Teaching

Tip

Visit http://www.sqlsecurity.com/, a Web site dedicated to explain Microsoft

SQL Server security issues.

Buffer Overflows

1. Describe the various buffer overflow problems. A buffer overflow occurs when data is

Passwords and Authentication

1. Explain why a comprehensive password policy is critical.

2. Describe the aspects that a password policy should include. Here are some examples:

a. Change password regularly

b. Require passwords length of at least six characters

3. Give some recommendations about configuring domain controllers. A good security or

network administrator should enforce password age, length, and complexity at the

domain controller. Also, the administrator should specify the account lockout threshold

and duration.

Teaching

Tip

Read http://www.techrepublic.com/article/lock-it-down-make-a-password-

policy-part-of-your-security-plan/ for an article on how to create a password

policy.

Tools for Identifying Vulnerabilities in Windows

1. Explain that many tools are available for discovering Windows vulnerabilities. Using

Hands-On Ethical Hacking and Network Defense, Third Edition 8-6

Built-in Windows Tools

2. Using Table 8-2, summarize MBSA’s scanning capabilities.

3. Discuss the minimum system requirements for MBSA provided in Table 8-3.

Hands-On Ethical Hacking and Network Defense, Third Edition 8-7

Disable Unused Services and Filtering Ports

2. Explain how filtering out unnecessary ports can protect systems from attack. Discuss

some of the ports frequently subject to attack.

Other Security Best Practices

1. Mention other security best practices, including the following steps:

a. Minimize the number of users with administrative rights

b. Implement software to prevent sensitive data from leaving the network

c. Use network segmentation

d. Restrict number of applications allowed to execute

Quick Quiz 1

1. True or False: The purpose of any file system, regardless of the OS, is to store and

manage information.

2. An interprocess communication mechanism that allows a program running on one host

to run code on a remote host is known as which of the following?

A. CIFS

B. MBSA

C. RPC

D. NetBIOS

3. True or False: Network resources are identified with 24-byte NetBIOS names.

4. True or False: NetBIOS is a network protocol.

5. Which protocol replaced SMB for Windows 2000 Server and later?

A. CIFS

B. RPC

C. NetBIOS

D. MBSA

Linux OS Vulnerabilities

1. Explain that like any OS, Linux can be made more secure if users are aware of its

vulnerabilities and keep current on new releases and fixes.

2. Mention that a typical Linux distribution has thousands of packages developed by many

contributors around the world. With such diverse sources of code, it’s inevitable that

flaws will happen.

Teaching

Tip

Visit http://www.linuxsecurity.com for recent news topics and articles regarding

Linux security.

Samba

1. Introduce Samba as an open-source implementation of CIFS. It was created in 1992 by

3. Describe how to configure and use Samba in mixed Windows and *nix environments to

allow both OSs to share files and printers.

Teaching

Tip

For more information, visit http://www.samba.org, the official Samba Web site.

Hands-On Ethical Hacking and Network Defense, Third Edition 8-9

Tools for Identifying Linux Vulnerabilities

1. Mention that visiting the CVE Web site is a good first step in discovering possible

avenues attackers might take to break into a Linux system.

3. Explain what a security tester using enumeration tools can do:

a. Identify a computer on the network by using port scanning and zone transfers

4. Demonstrate how to use OpenVAS using Figures 8-4 through 8-12.

5. Explain how Trojan programs are used to carry out attacks. Most Trojan programs

perform one or more of the following functions:

a. Allow remote administration of the attacked system.

6. Mention that even more dangerous are rootkits containing Trojan binary programs

ready to be installed by an intruder who has gained root access to a system.

Security

Tip

Check out http://nvd.nist.gov/nvd.cfm?cvename=CVE-2004-0075 for an

example of a Linux vulnerability.

More Countermeasures Against Linux Attacks

1. Explain the most critical tasks for protecting against attacks. They include:

a. User awareness training

Hands-On Ethical Hacking and Network Defense, Third Edition 8-10

Teaching

Tip

The following link contains a quick reference guide for Linux security:

http://tldp.org/REF/ls_quickref/QuickRefCard.pdf.

Quick Quiz 2

1. True or False: A typical Linux distribution has thousands of packages developed by

many contributors around the world.

2. To address the issue of interoperability, what was created as an open-source

implementation of CIFS?

A. Ubuntu

B. Samba

C. Debian

D. Red Hat Package Manager

3. True or False: OpenVAS can only be used to enumerate Windows OSs.

4. Which of the following is a dangerous vulnerability containing Trojan binary programs

ready to be installed by an intruder who has gained root access to a system?

A. Bash bug

B. Shellshock

C. rootkit

D. zone transfer

5. What feature is an OS security mechanism that enforces access rules based on

privileges for interactions between processes, files, and users?

Class Discussion Topics

1. Many argue that Windows systems only appear to be the most vulnerable systems

because they have more of the market share. Do you agree or disagree with this

statement? Why?

2. What are the problems with using blank passwords? Why do you think Windows insists

on using a blank password for the SA account when you install SQL Server?

Hands-On Ethical Hacking and Network Defense, Third Edition 8-11

Additional Projects

1. Ask your students to investigate the pros and cons of Microsoft Baseline Security

2. The problem with weak passwords is that they can easily be guessed using automated

tools. In this project, you will follow a two-step approach to uncover Windows

passwords. First download, install, and run a tool called PWDump to obtain an

encrypted list of all user names and passwords. Second, download and run John the

Additional Resources

2. Microsoft Baseline Security Analyzer:

3. SANS Institute CIS Critical Security Controls:

5. Extended Stored Procedures: Intro And 10 Cool Examples:

Key Terms

See Glossary for definitions for Key Terms.

➢ attack surface

Hands-On Ethical Hacking and Network Defense, Third Edition 8-12

➢ domain controller

➢ Mandatory Access Control (MAC)

➢ NetBIOS Extended User Interface (NetBEUI)

Technical Notes for Activities

Activity 8-1: This activity requires a computer running Windows, an Internet connection,

and a Web browser.

Activity 8-2: This activity requires a computer running Windows with MBSA already