The CIA triangle or triad comprises the three fundamental pillars of security. These include:

Transcription

1

2 Exam Maual CEH Ethics ad Legality Nothig cotaied i this Exam Maual is iteded to teach or ecourage the use of security tools or methodologies for illegal or uethical purposes. Always act i a resposible maer. Make sure you have writte permissio from the proper idividuals before you use ay of the tools or techiques described i this exam maual. What is a Exploit? Accordig to the Jargo Dictioary, a exploit is defied as, a vulerability i software that is used for breakig security. Hackers rely o exploits to gai access to, or to escalate their privileged status o, targeted systems. The Security Fuctioality Triagle The CIA triagle or triad comprises the three fudametal pillars of security. These iclude: Cofidetiality Isures that the iformatio is kept private ad is oly available to those that should have legitimate access to it. Threats to cofidetiality iclude etwork siffig ad iterceptio of passwords. Itegrity Isures that iformatio ad resources have ot bee improperly chaged or altered. Threats to itegrity iclude worms ad viruses. Availability Isures that the resources are available whe eeded by a legitimate user. Threats to availability iclude Deial of Service (DoS) attacks. The Attacker s Process Attackers follow a fixed methodology. The steps ivolved i attacks are show below ad each will be discussed throughout this exam maual. Footpritig Scaig Eumeratio Peetratio (Idividuals that are usuccessful at this step may opt for a Deial of Service attack) Escalatio of Privilege Cover Tracks Backdoors Exam Mauals

3 Exam Maual CEH Recoaissace Recoaissace is oe of the most importat steps of the hackig process. Before a actual vulerability ca be exploited it must be discovered. Discovery of potetial vulerabilities is aided by idetificatio of the techologies used, operatig systems istalled, ad services/applicatios that are preset. Recoaissace ca broadly be classified ito two categories: passive ad active. Passive Recoaissace This form of iformatio gatherig is the most covert as there is little to o way the target orgaizatio ca discover the hacker s activity. A example of passive recoaissace is that of scaig the help wated ads to fid out more about what types of techology ad equipmet the target orgaizatio uses. Active Recoaissace This form of iformatio is more overt as there is a chace that the target orgaizatio may otice the hacker s activities. A example of active recoaissace is that of ruig a port scaer or usig telet to grab baers from the target orgaizatio s computers. Types of Attacks There are several ways i which hackers ca attack your etwork. No matter which path of opportuity they choose, their goal is typically the same: cotrol ad use of your etwork ad its resources. LAN Attack This mode of attack is carried out over a Local Area Network WAN Attack This mode of attack is attempted through remote services, i.e., via the Iteret Physical Etry This mode of attack is attempted through the lack of physical cotrol of resources. Oce a hacker has physical access, there is o remaiig security Stole Equipmet This mode of attack occurs whe equipmet is stole ad data, passwords, ad cofiguratios are recovered by the hacker Usecured Wireless Access This mode of attack ca bypass firewalls ad result i LAN access Dialup Attack This mode of attack ca be carried out if there are usecured modems used by employees or routers that may have dialup capability that ca be used for out-of-bad maagemet Categories of Exploits A exploit is the act of takig advatage of a kow vulerability. Whe ethical hackers discover ew vulerabilities, they usually iform the product vedor before goig public with their fidigs. This gives the vedor some time to develop solutios before the vulerability ca be exploited. Some of the most commo types of exploits ivolve: Program bugs Buffer overflows Viruses Exam Mauals

4 Exam Maual CEH Worms Troja Horses Deial of Service Social Egieerig Goals Attackers Try to Achieve While the type of attack may vary, the hacker will typically follow a set methodology. This icludes: 1. Recoaissace - Passive ad active 2. Gaiig Access The first phase of actual cotrol 3. Maitaiig Access Platig back doors, crackig all of the systems passwords, ad addig accouts 4. Coverig Tracks Attemptig to remove all traces of their activity, such as turig off loggig ad clearig the log files Ethical Hackers ad Crackers Historically, the word hacker was ot viewed i a egative maer. It was someoe that ejoyed explorig the uaces of programs, applicatios, ad operatig systems. The term cracker actually refers to a crimial hacker. This is a perso that uses his skills for malicious itet. Hackig for a Cause (Hacktivism) These are idividuals that perform crimial hacks for a cause. Regardless of their stated good itetios ( self proclaimed ethical hackers ), the act of gaiig uauthorized access to someoe s computer or system is oetheless a crime. Categories of Ethical Hackers Ethical hackers ca be separated ito several categories: White Hat Hackers These idividuals perform ethical hackig to help secure compaies ad orgaizatios. Their belief is that you must examie your etwork i the same fashio a crimial hacker would to better uderstad its vulerabilities. Reformed Black Hat Hackers These idividuals ofte claim to have chaged their ways ad that they ca brig special isight ito the ethical hackig methodology. Skills Required for Ethical Hackig Ethical hackers must possess a i-depth kowledge of etworkig, operatig systems, ad techologies used i the computer field. They also eed good writte ad verbal skills because their fidigs must be reported to idividuals that rage from help desk employees to the CEO. These idividuals must also uderstad the legal eviromet i which they operate. This is ofte referred to as the rules of egagemet. These skills help esure that ethical hackers are successful i their jobs. Exam Mauals

5 Exam Maual CEH Ethical Hacker Job Duties Ethical Hackers typically perform peetratio tests. These tests may be cofigured i such way that the ethical hackers have full kowledge or o kowledge of the target of evaluatio. White Box Testig The ethical hacker has full kowledge of the etwork. This type of peetratio test is the cheapest of the methods listed here. Black Box Testig This type of peetratio test offers the ethical hacker very little iitial iformatio. It takes loger to perform, cost more moey, but may ucover ukow vulerabilities. Security Evaluatio Pla The most importat step that the ethical hacker must perform is that of obtaiig a security evaluatio pla. This eeds to be compiled i documet form ad should clearly defie the actios allowed durig a ethical hack. This documet is sometimes referred to as rules of egagemet. It will clearly state what actios are allowed ad deied. This documet eeds approval by the proper authorities withi the orgaizatio that the security assessmet is beig performed o. The security assessmet will be oe of several commo types. Testig Types The three most commo types of tests are detailed below. These tests may require idividuals o the team to attempt physical etry of the premises or maipulatio of targeted employees through social egieerig. Iteral Evaluatios Performed o the iteral etwork to determie what resources ad iformatio employees ca access. Exteral Evaluatios Examiatio of the exteral etwork; i.e., review of web, , ad publicly accessible services to determie their vulerabilities. Stole Equipmet Evaluatios This type of assessmet is performed to determie what type of iformatio leakage would result from equipmet that was stole or pilfered. Ethical Hackig Report There are three parts to the ethical hackig report. These iclude: Preparatio This part of the report outlies the what, whe, who, ad where of the ethical hack. What s importat here is that it is clearly stated what is ad is ot allowed, what the time schedule is ad what resources are available to the ethical hacker. The documet eeds to be siged by the proper idividuals ad should be reviewed by the legal departmet. Fidigs This portio of the report details what was foud durig the test. Coclusio This portio of the report details what corrective actios should take place ad the total cost of these activities. Exam Mauals

6 Exam Maual CEH Computer Crime The Uited States Departmet of Justice defies computer crime as ay violatio of crimial law that ivolved the kowledge of computer techology for its perpetratio, ivestigatio, or prosecutio. Statistics idicate that computers are used i the commissio of a crime as much as 92% of the time. This meas the computer could be used for research, , plaig, or as a aid to avoid capture or detectio. While there are may laws that ca be applied to crimial offeces, the oes listed below focus o computer crimes. Overview of US Federal Laws Typically, illegal computer activity breaks federal law whe oe or more of the followig coditios are met: 1. The illegal activity ivolves a computer owed by a US govermet departmet or agecy 2. The activity ivolves atioal defese or other restricted govermet iformatio 3. Bakig, savigs ad loa, or other fiacial istitutios have bee accessed 4. The activity uses computers located i other states or coutries 5. Iterstate commuicatio is ivolved So, as you ca see, it is very easy for a hacker to break federal law if he has used the Iteret for ay of his activities. While most computer crime is categorized uder 18 U.S.C ad 1030, there are may other laws the hacker ca ru afoul of. These iclude: 18 U.S.C Fraud ad related activity i coectio with access devices 18 U.S.C Fraud ad related activity i coectio with computers 18 U.S.C Fraud by wire, radio, or televisio 18 U.S.C Ijury to Govermet Property 18 U.S.C Commuicatio lies, statios or systems 18 U.S.C Ecoomic Espioage Act 18 U.S.C Trade Secrets Act Pealties for these laws ca rage from 5 to 20 years per offese. As these are federal offeses, the total amout of jail time is typically stacked. This meas that two 20 year offeses would result i a 40 year jail term. Cyber Security Ehacemet Act of 2002 What is most importat to kow about the Cyber Security Ehacemet Act of 2002 is that is specifies life seteces for hackers that edager lives. It also allows the govermet to gather iformatio, such as IP addresses, URL s, ad without a warrat if they believe atioal security is edagered. Before 9-11, govermet agecies were required to obtai a warrat to access a idividual s voic , , attachmets or other electroic data. With the passage of the Cyber Security Ehacemet Act, law eforcemet may request the service providers (ISP s) supply this iformatio upo demad. Groups cocered with idividual freedom have complaied about the passage of this law, as o search warrat is required. Exam Mauals