Module 2: Footprinting

Overview

Scenario

Adam is furious. He had applied for the network engineer job at targetcompany.com He believes that he was rejected unfairly. He has a good track record, but the economic slowdown has seen many layoffs including his. He is frustrated - he needs a job and feels he has been wronged. Late in the evening he decides that he will prove his mettle.

• What do you think Adam would do?

• Where would he start and how would he go about it?

• Are there any tools that can help him in his effort?

• Can he cause harm to targetcompany.com?

• As a security professional, where can you lay checkpoints and how can you deploy countermeasures?

 

Prelude

"If you're a good hacker, everyone knows your name . If you're a great hacker, no one knows who you are"

The significance of this quote in the present context is that there is no sure way of predicting the ways of a hacker. Throughout this course, we will use the term 'cracker' or 'attacker' to refer to a hacker with malicious intent. The term 'hacker' as used here, will be generic.

Here is an interesting description of a hacker drawn from the Internet.

"The hacker is an interesting entity. Hackers seek knowledge and are not afraid of solving problems or tapping into their brain power. Hackers are sometimes stubborn, always clever, curious and intelligent , and constantly learning. They are thinkers who like to be challenged. Most often good hackers are also good programmers... never use exploits unless they know exactly what the code they're executing is doing. Most of the time they only use exploits which they have written themselves ..."

We have seen the activity phases of a cracker in the previous module. Beginning with this module we will detail these phases and deal with the various domains involved. This module addresses the footprinting sub phase of the reconnaissance phase.

This module discusses a scenario for the purpose of concept correlation. This scenario has been based on several real life situations. The icon legend used in the module is given below.

Tools	Concept	Threat
Attack Methods	Note	Countermeasure

We begin with a scenario description. The CSI/FBI 2002 survey noted that 75% of attacks could be sourced to disgruntled employees . In this scenario we follow the actions of 'Adam', a disgruntled applicant who feels he has been denied a job on unfair grounds.

The recession had taken its toll and Adam found himself laid off from his job. Several rejected applications later, he came across a job opening for a network engineer in his city. He had eight years of experience in the field and had worked on several technologies. However, this firm presented him with the opportunity to work on one of the leading technologies, which he was very much interested in.

Unlike his previous applications, Adam took care to read about the company and its activities. He tailored his resume to fit their requirement profile. It seemed a perfect match to him. Adam's hard work paid off when he was called for an interview. Again, unlike the previous interviews he had attended, Adam took care to prepare for this interview extensively. He met up with current employees at the local coffee shop and made some friends as well.

When he reached their interview venue , he realized that there were just too many applicants - much like all the other interviews he had attended. However, he was confident he would make it. He exchanged small talk with some of the other attendees while waiting for his turn and noted that few had similar experience as his.

The interview went well and Adam expected to hear from them regarding the offer soon. Contrary to his expectations, he received an email that informed him about the company's regret in not being able to accommodate him and stating that it hoped that he would make it some other time. Adam was dejected.

He happened to meet one of the employees in the same coffee shop a few days later and found out that the new recruit was known to him. Adam was convinced that his application was rejected on unfair grounds. He felt that he was a better match for the job... and this he would prove. He would test the recruit on his home ground.

The battle call was a subtle one - Adam began by checking out the company website. The company would have to accommodate him now and he was going to make it this time.

The battle had begun... but, who would win the war?

Note to readers:

The purpose of the scenario description is not to advocate a single means of information gathering, but rather to give the perspective of a cracker. Not all crackers need to behave similarly. The hacker community takes pride in their ingenuity to seek ways of accessing a system not thought about previously or popularly.

There are various levels of sophistication among hackers. The hacker lexicon terms them as lamer, script kiddies, uberhacker etc. The original hackers do not consider themselves to be of dubious repute, and take pride in following a code of ethics. We are focusing on those who use their talent towards destructive or harmful means. The illustration here is meant to be for what it states -"illustration".

The purpose of revisiting Adam at various points in this module is to highlight some easily overlooked aspects of security that can be addressed proactively. The point to moot is that information can be easily available if sought. What information should be available publicly and what measures you can advocate to safeguard this information is our discussion here.

Module Objectives

• Overview of the Reconnaissance Phase

• Introducing Footprinting

• Understanding the information gathering methodology of hackers

• Comprehending the Implications

• Learning some of the tools used for reconnaissance phase

• Deploying countermeasures