This book outlines a fictional plot to "own the box" by compromising an entire continent's network infrastructure. It combines a set of stories with real technology to show readers the danger that lurks in the shadows of the information security industry.
Table of Contents
Stealing the Network”How to Own a Continent
Foreword
Chapter 1
-
Control Yourself
Chapter 2
-
The Lagos Creeper Box
Chapter 3
-
Product of Fate: The Evolution of a Hacker
Chapter 4
-
A Real Gullible Genius
Chapter 5
-
For Whom Ma Bell Tolls
Chapter 6
-
Return on Investment
Chapter 7
-
h3X and The Big Picture
Chapter 8
-
The Story of Dex
Chapter 9
-
Automatic Terror Machine
Chapter 10
-
Get Out Quick
Appendix
-
The Making of STC
List of Figures
List of Code
Back Cover
The first Stealing book focused on the individual hacker. This book shows you what a group can do! what if you were part of a
group
, and didn t even know it? What if you made
friends
with someone online, and the two of you worked on a project together, not knowing the other person was using you to their aims? Now things get interesting!
Stealing the Network ”How to Own a
Continent
131ah
Russ Rogers
Jay Beale
Joe Grand
Fyodor
FX
Paul Craig
Timothy Mullen (Thor)
Tom Parker
Ryan Russell Technical Editor
Kevin D. Mitnick Technical Reviewer
Syngress Publishing, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively Makers ) of this book ( the Work ) do not guarantee or
warrant
the results to be obtained from the Work.
There is no guarantee of any kind,
expressed
or
implied
, regarding the Work or its contents. The Work is sold AS IS and WITHOUT WARRANTY. You may have other legal rights, which vary from state to state.
In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you.
You should always use reasonable care, including backup and other appropriate
precautions
, when working with computers, networks, data, and files.
Syngress Media , Syngress , Career Advancement Through Skill Enhancement , Ask the Author UPDATE , and Hack Proofing , are registered trademarks of Syngress Publishing, Inc. Syngress: The Definition of a Serious Security Library ¢, Mission Critical ¢, and The Only Way to Stop a Hacker is to Think Like One ¢ are trademarks of Syngress Publishing, Inc. Brands and product
names
mentioned in this book are trademarks or service marks of their respective companies.
KEY
SERIAL NUMBER
001
HJ764GCV68
002
PO98892SCR
003
82AJSDCD43
004
UUUNBNVC69
005
CVP23FGHNX
006
VBPXC425T5
007
HJD3E4887N
008
298MKCXZAA
009
629MPJT678
010
IM6TGG6529
PUBLISHED BY
Syngress Publishing, Inc.
800 Hingham Street
Rockland, MA 02370
Copyright 2004 by Syngress Publishing, Inc. All rights reserved. Printed in the United States of America. Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication.
Printed in the United States of America
1 2 3 4 5 6 7 8 9 0
ISBN: 1-931836-05-1
Acquisitions Editor:
Christine Kloiber
Cover Designer:
Michael Kavish
Technical Editor:
Ryan Russell
Copy Editor:
Adrienne Rebello
Technical Reviewer:
Kevin D. Mitnick
Page Layout and Art:
Patricia Lupien
Distributed by O Reilly & Associates in the United States and Canada.
Acknowledgments
We would like to
acknowledge
the following people for their kindness and support in making this book possible.
Jeff Moss and Ping Look from Black Hat, Inc. You have been good
friends
to Syngress and great colleagues to work with. Thank you!
Thanks to the contributors of
Stealing the Network: How to Own the Box
, the first book in the Stealing series. You paved the way for this computer book
genre
: Dan Kaminsky, Ken Pfeil, Mark Burnett, and Ido Dubrawsky.
Syngress books are now distributed in the United States and Canada by O Reilly & Associates, Inc. The
enthusiasm
and work
ethic
at ORA is incredible and we would like to thank everyone there for their time and efforts to bring Syngress books to market: Tim O Reilly, Laura Baldwin, Mark Brokering, Mike Leonard, Donna Selenko, Bonnie Sheehan, Cindy Davis, Grant Kikkert, Opol Matsutaro, Lynn Schwartz, Steve Hazelwood, Mark Wilson, Rick Brown, Leslie Becker, Jill Lothrop, Tim Hinton, Kyle Hart, Sara Winge, C. J. Rayhill, Peter Pardo, Leslie Crandell, Valerie Dow, Regina Aggio, Pascal Honscher, Preston Paull, Susan Thompson, Bruce Stewart, Laura Schmier, Sue Willing, Mark Jacobsen, Betsy Waliszewski, Dawn Mann, Kathryn Barrett, John Chodacki, and Rob Bullington.
The incredibly hard working team at Elsevier Science, including Jonathan Bunkell, Ian Seager, Duncan Enright, David Burton, Rosanna Ramacciotti, Robert Fairbrother, Miguel Sanchez, Klaus Beran, Emma Wyatt, Rosie Moss, Chris Hossack, and Krista Leppiko, for making certain that our vision remains worldwide in scope.
David Buckland, Daniel Loh, Marie Chieng, Lucy Chong, Leslie Lim, Audrey Gan, Pang Ai Hua, and Joseph Chan of STP Distributors for the enthusiasm with which they receive our books.
Kwon Sung June at Acorn Publishing for his support.
David Scott, Tricia Wilden, Marilla Burgess, Annette Scott, Geoff Ebbs, Hedley Partis, Bec Lowe, and Mark Langley of Woodslane for distributing our books throughout Australia, New Zealand, Papua New Guinea, Fiji Tonga, Solomon Islands, and the Cook Islands.
Winston Lim of Global Publishing for his help and support with distribution of Syngress books in the Philippines.
Technical Editor and
Contributor
Ryan Russell (aka Blue Boar)
has worked in the IT field for over 13
years
, focusing on information security for the last seven. He was the lead author of
Hack Proofing Your Network, Second Edition
(Syngress, ISBN: 1-928994-70-9), contributing author and technical editor of
Stealing the Network: How to Own the Box
(Syngress, ISBN: 1-931836-87-6), and is a frequent technical editor for the Hack Proofing series of books from Syngress. Ryan was also a technical advisor on
Snort 2.0 Intrusion Detection
(Syngress, ISBN: 1-931836-74-4). Ryan founded the vuln-dev mailing list, and
moderated
it for three years under the alias Blue Boar. He is a frequent lecturer at security conferences, and can often be found participating in security mailing lists and website discussions. Ryan is the QA Manager at BigFix, Inc.
131ah
is the technical director and a founding member of an IT security analysis company. After completing his degree in electronic engineering he worked for four years at a software engineering company
specializing
in encryption devices and firewalls. After
numerous
typos and finger trouble, which led to the malignant growth of his personnel file, he started his own company along with some of the country s
leaders
in IT security. Here 131ah heads the Internet Security Analysis Team, and in his spare time plays with (what he considers to be) interesting
Contributors
concepts such as footprint and web application automation, worm propagation techniques, covert channels/Trojans and cyber
warfare
. 131ah is a regular speaker at international conferences including Black Hat Briefings, DEFCON, RSA, FIRST and Summercon. He gets his kicks from innovative thoughts, tea, dreaming, lots of bandwidth, learning cool new stuff, Camels, UNIX, fine food, 3 A.M. creativity and big screens. 131ah dislikes conformists, papaya,
suits
, animal cruelty,
arrogance
, and dishonest people or programs.
Russ Rogers
(CISSP, CISM, IAM) is a Co-Founder, Chief Executive Officer, Chief Technology Officer, and Principle Security Consultant for Security Horizon, Inc; a Colorado-based professional security services and training provider. Russ is a key contributor to Security Horizon s technology efforts and leads the technical security practice and the services business development efforts. Russ is a United States Air Force Veteran and has
served
in military and contract support for the National Security Agency and the Defense Information Systems Agency. Russ is also the editor-in-chief of ˜The Security Journal and
occasional
staff member for the Black Hat Briefings. Russ holds an associate s degree in Applied Communications Technology from the Community College of the Air Force, a bachelor s degree from the University of Maryland in computer information systems, and a master s degree from the University of Maryland in computer systems management. Russ is a member of the Information System Security Association (ISSA), the Information System Audit and Control Association (ISACA), and the Association of Certified Fraud Examiners (ACFE). He is also an Associate Professor at the University of Advancing Technology (uat.edu), just outside of Phoenix, Arizona. Russ has
contributed
to many books including
WarDriving, Drive, Detect, Defend: A Guide to Wireless Security
(Syngress, ISBN: 1-931836-03-5) and
SSCP Study Guide and DVD Training System
(Syngress, ISBN: 1-931846-80-9).
Jay Beale
is a security specialist focused on host
lockdown
and security
audits
. He is the Lead Developer of the Bastille project, which creates a hardening script for Linux, HP-UX, and Mac OS X, a member of the Honeynet Project, and the Linux technical lead in the Center for Internet Security. A frequent conference speaker and trainer, Jay speaks and trains at the Black Hat Briefings and LinuxWorld conferences, among others. Jay is a columnist with Information Security Magazine, and is Series Editor of
Jay Beale s Open Source Security Series
, from Syngress Publishing. Jay is also
co-author
of the international best seller
Snort 2.0 Intrusion Detection
(Syngress, ISBN: 1-931836-74-4) and
Snort 2.1 Intrusion Detection Second Edition
(Syngress 1-931836-04-3). A senior research scientist with the George Washington University Cyber Security Policy and Research Institute, Jay makes his living as a security consultant through the MD-based firm Intelguardians, LLC.
Jay would like to thank Visigoth for his plot critique and HD Moore for sharing the benefits of his cluster computation experience. Jay would also like to thank Neal Israel, Pat Proft, Peter Torokvei and Dave Marvit, from the wonderful movie Real Genius, without which Chapter 4 would have been far less interesting. He would also like to thank Derek Atkins and Terry Smith for background inormation. Jay dedicates his chapter to his wife, Cindy, who supported him in the chain of all night tools that made this project possible.
Joe Grand
is the President and CEO of Grand Idea Studio, a product development and intellectual property licensing firm. A nationally recognized
name
in computer security, Joe s pioneering research on mobile devices, digital forensics, and embedded security analysis is published in various industry journals. He is a co-author of
Stealing the Network: How to Own the Box
(Syngress, ISBN: 1-931836-87-6), the author of
Hardware Hacking: Have Fun While Voiding Your Warranty
(Syngress, ISBN: 1-932266-83-6), and is a frequent contributor to other
texts
.
As an electrical engineer, Joe specializes in the invention and design of
breakthrough
concepts and technologies. Many of his creations, including consumer electronics, medical products, video
games
and toys, are licensed worldwide. Joe s recent developments include the Emic Text-to-Speech Module and the Stelladaptor Atari 2600 Controller-to-USB Interface.
Joe has testified before the United States Senate Governmental Affairs Committee and is a former member of the legendary hacker think-tank L0pht Heavy Industries. He has presented his work at numerous academic, industry, and private forums, including the United States Air Force Office of Special Investigations and the IBM Thomas J. Watson Research Center. Joe holds a BSCE from Boston University.
Fyodor
authored
the popular Nmap Security Scanner, which was named security tool of the year by Linux Journal,
Info
World, LinuxQuestions.Org, and the Codetalker Digest. It was also featured in the hit movie Matrix Reloaded as well as by the BBC, CNet, Wired, Slashdot, Securityfocus, and more. He also maintains the Insecure.Org and Seclists.Org security resource sites and has authored seminal papers detailing techniques for stealth port scanning, remote operating system detection via TCP/IP stack fingerprinting, version detection, and the IPID Idle Scan. He is a member of the Honeynet project and a co-author of the book
Know Your Enemy: Honeynets
.
FX
of Phenoelit has spent the better part of the last few years becoming familiar with the security issues faced by the foundation of the Internet, including protocol based attacks and exploitation of Cisco routers. He has presented the results of his work at several conferences including DEFCON, Black Hat Briefings, and the Chaos Communication Congress. In his professional life, FX is currently employed as a Security Solutions Consultant at n.runs GmbH, performing various security audits for major customers in Europe. His specialty lies in security evaluation and testing of custom applications and black box devices. FX loves to hack and hang out with his friends in Phenoelit and wouldn t be able to do the things he does without the continuing support and understanding of his mother, his friends, and
especially
his young lady, Bine, with her infinite patience and love. FX was a co-author of the first edition of
Stealing the Network: How to Own the Box
(Syngress, ISBN: 1-931836-87-6).
Paul Craig
is currently working in New Zealand for a major television
broadcaster
, and is also the lead security consultant at security company Pimp Industries. Paul specializes in reverse engineering technologies and cutting edge application auditing practices. Paul has contributed to many books including the first edition of
Stealing the Network: How to Own the Box
(Syngress, ISBN: 1-931836-87-6). If you would like to contact Paul for any nature of reason email: headpimp@pimp-industries.com
Timothy Mullen
(aka Thor)
began
his career in application development and network integration in 1984, and is now CIO and Chief Software architect for AnchorIS.Com, a developer of secure enterprise-based accounting solutions. Mullen has developed and implemented network and security solutions for institutions such as the US Air Force, Microsoft, the US Federal Court systems, regional power generation facilities, and international banking and financial institutions. He has developed applications
ranging
from military aircraft statistics interfaces and biological aqua-culture management, to
nuclear
power-plant effect monitoring for a myriad of private, government, and military entities.
Tim is also a columnist for Security Focus Microsoft section, and a regular contributor of InFocus technical articles. Also known as Thor, he is the founder of the Hammer of God security
co-op
group
. Mullen s writings appear in multiple
publications
such as
Stealing the Network: How to Own the Box
(Syngress, ISBN: 1-931836-87-6) and
Hacker s Challenge
, technical edits in
Windows XP Security
, with security tools and techniques features in publications such as the
Hacking Exposed
series and
New Scientist
magazine.
Tom Parker
is one of Britain s most highly prolific security
consultants
. Along side his work for some of the
worlds
largest organizations, providing integral security services, Mr. Parker is also widely known for his vulnerability research on a wide range of platforms and commercial products. His more recent technical work includes the development of an embedded operating system, media management system and cryptographic code for use on digital video
band
(DVB) routers, deployed on the networks of hundreds of large organizations around the globe. In 1999, Tom helped form Global InterSec LLC, playing a leading role in developing key relationships between GIS and the public and private sector security companies. Tom has spent much of the last few years
researching
methodologies aimed at characterizing adversarial capabilities and motivations against live, mission critical assets and providing methodologies to aid in adversarial attribution in the unfortunate times when incidents do occur. Currently working as a security consultant for Netsec, a provider of managed and professional security services; Tom continues his research into finding practical ways for large organizations, to manage the ever growing cost of security, through the identification where the real threats lay there by defining what really matters. Tom is also co-author of
Cyber Adversary Characterization: Auditing the Hacker Mind
(Syngress, ISBN: 1-931836-11-6).
Jeff Moss (aka The Dark Tangent)
CEO of Black Hat Inc. and founder of DEFCON, is a computer security scientist most well known for his forums bringing together a unique mix in security: the best minds from government agencies and global corporations with the
underground
s best hackers. Jeff s forums have
gained
him exposure and respect from each side of the information security battle, enabling him to continuously be aware of new security defense and penetration techniques and trends. Jeff
brings
this information to three continents, North America, Europe and Asia, through his Black Hat Briefings, DEFCON, and Meet the Enemy sessions.
Jeff speaks to the media regularly about computer security, privacy and technology and has appeared in such media as Business Week, CNN, Forbes, Fortune, New York Times, NPR, National Law Journal, and Wired Magazine. Jeff is a regular presenter at conferences including Comdex, CSI, Forbes CIO Technology Symposium, Fortune Magazine s CTO Conference, The National Information System Security Convention, and PC Expo.
Prior to Black Hat, Jeff was a director at Secure Computing Corporation, and helped form and grow their Professional Services Department in the United States, Taipei, Tokyo, Singapore, Sydney, and Hong Kong. Prior to Secure Computing Corporation, Jeff worked for Ernst & Young, LLP in their Information System Security division.
Jeff
graduated
with a BA in Criminal Justice, and halfway through law school, he went back to his first love, computers, and started his first IT consulting business in 1995. He is CISSP certified, and a member of the American Society of Law Enforcement Trainers.
Technical Reviewer
Kevin Mitnick
is a security consultant to corporations worldwide and a cofounder of Defensive Thinking, a Los Angeles-based consulting firm (www.defensivethinking.com). He has testified before the Senate Committee on Governmental Affairs on the need for legislation to ensure the security of the government s information systems. His articles have appeared in major news magazines and trade journals, and he has appeared on Court TV,
Good Morning America
,
60 Minutes
, CNN s
Burden of Proof
and
Headline News
, and has been a keynote speaker at numerous industry events. He has also hosted a weekly radio show on KFI AM 640, Los Angeles. Kevin is author of the best-selling book,
The Art of Deception: Controlling the Human Element of Security
.
Technical Advisors
SensePost
is an independent and objective organisation specialising in IT Security consultation, training and assessment services. The company is situated in South Africa from where it provides services to more than 70 large and very large
clients
in Australia, South Africa, Germany, Switzerland, Belgium, The Netherlands, United Kingdom, Malaysia, United States of America, and various African
countries
. More than 20 of these clients are in the financial services industry, where information security is an essential part of their
core
competency.
SensePost analysts are regular
speakers
at international conferences including Black Hat Briefings, DEFCON and Summercon. The analysts also have been training two different classes at the Black Hat Briefings for the last 2 years. Here they meet all sorts of interesting people and make good friends. SensePost personnel typically think different thoughts, have
inquisitive
minds, never give up and are
generally
good looking...
For more information, or just to hang out with us, visit:
www.sensepost.com
.
