Reconnaissance 101

Reconnaissance - A mission undertaken to obtain, by visual observation or other detection methods, information about the activities and resources [of a target].

Just a brief introduction to some of the extremely easy types of reconnaissance techniques used by hackers, keep in mind all of this information is used to further your own knowledge so you may better protect yourself.   Absolutely do not attempt to publish or use any of this information with malicious intent.  I will not be liable for your stupidity.

Google Fu - Search engine recon performed by utilizing well-crafted queries and query tools to discover information about a target
Maltego - Open source web-scouring software used to aggregate and link personally identifiable information
Spokeo - A web-based white pages type tool that also works to gather as much public information about a target as possible

Google-Fu

Google-Fu is a coined term used in "googling" a particular subject or person.  There is tons of information openly available and billions of webpages out there to meet your return on results for vague or generic queries.  Many hackers now and days will use a search engine as a hacking tool making sure to ask the right questions. Here are some useful search directives and operators below.


site:[domain]
Limits the results to those within the provided [domain]. This can be generic, such as “.edu”, or specific, like www.cnn.com

link:[web page]
Shows all sites that link to the given web page, which is useful for determining business relationships

Literal matches (“   ”)
Preserves the order of the words in the query, which helps in finding titles or specific files

Not ( - )
Filters out web pages that contain the given term

Try Googling some of these and see where they lead you:

- filetype:.mysql_history username [this is a query that will show SQL server history with the word "username" in the results, of course you can look up username and password also, but I will let your imagination do that]
- intitle:"active webcam page" site:edu [self explanatory, active webcam pages in schools]
- filetype:sql "MySQL dump" (pass|password|passwd|pwd) [sql dump with variations of the word password in the results]
- intitle:"hp laserjet" inurl:info_configuration.htm [configuration information about a particular printer, sometimes if you look hard enough and get access you may be able to send/print messages to the admin]

Maltego

Maltego is used to determine the relationships and real-world links between people, companies, networks, and websites.  Through these relationships, you can strive to provide a clear “threat picture” of the environment in which an organization resides.  I will demonstrate this tool on an individual, but think about how it would be even more effective against your organization.

Positives

- Social Engineering attacks
- Enable physically locating a target in some cases (enabling attacker to befriend or threaten)
- Improved Dictionary attack
- Most people include something about themselves in their passwords
- Connect unrelated data
- No one search would have returned all of this assorted information, let alone graphed it for you

Negatives

- Overabundance of information makes locating pertinent pieces difficult

- High risk of false positives

- “Zipperer” is not a common last name in the US, but it found six incorrect phone numbers searching on me

- Free version does not contain full functionality\

- It’s much more effective when used against an organization than an individual!

Spokeo

I have got to say this website is awesome.  It is a social network and open source aggrigator which queries 40 sites to compile information about a particular user.  What is even more surprising is the fact that it only uses publically available information and information available via credentials you input.  You would be extremely surprised just how much you can dig up on someone using this.  The paid version of Spokeo will pull email contacts and profile them!

Imagine if a hacker had used a bunch of company emails.  You would be able to quickly profile an entire company to identify easy social engineering targets and provide access to social engineering attack vectors via “common interests” like Pandora playlists, web site postings, Picasa pictures, names, addresses, phone numbers you get the idea.

Securing yourself
After reading all this you may say how do I stop it all?  Well keep in mind everything you put on the internet will leave a footprint and will be stored by someone somewhere.  There are however, a few mitigations you can use to help combat this.

- Avoid storing personal or employee information online, even if it’s in a hidden location or file on your server.
- Be exceedingly wary of any information posted to social sites – assume that anything there is public knowledge!
- Remember that just because a web page has been deleted doesn’t mean it’s gone… Google caches everything (but you may request that they delete it)

Be careful out there!

Password Complexity – How to Keep Your Crap Safe

Came across this article from http://www.deathvalleymag.com thought it would be beneficial for some people at a very high level.

This seems pretty intuitive for some, but for others not so much, so I will take some time to explain about passwords.   Back in the day, you were lucky to have to remember one or two user id’s and pw combos.  Currently I’ve got at least 60-70 user id’s and passwords to remember between personal and work (and I’m sure I’m being conservative on the number there).  So what do I do?

Here are your options:

•    Use the same user id and password
•    Use the same user id and different password
•    Use the same password and different user id
•    Use different user id’s and passwords
•    Use easy user id’s and passwords
•    Use complex user id’s and passwords

Let’s take a look at a few of these.

Use the same user id and password:  What can I say about this one?  It’s just plain stupid unless you’re looking to lose everything you own and land yourself in jail.  This is just plain stupidity.  If someone is able to get one of your accounts, they’re most likely going to try and use the same user id and password on every other account you have.  They do this because people are lazy.  They don’t want to have to worry about keeping multiple user id’s and/or passwords because it’s too hard, or they just can’t remember them.  Well, if they do this, they’re asking for trouble.

Use the same user id and different password: This one is only slightly better than the last one.  Using the same user id across multiple accounts gives someone one part of the puzzle.  Granted, it’s the easier portion, but it gives them one less thing they’ve got to try and ‘crack’ to get into your system.

Use the same password and a different user id: This one is almost as bad as the same user id and password.  I’d rather see people using the same user id across accounts as opposed to the same password.  Again, it’s one less piece of the puzzle and there’s a good chance that the user name either isn’t encrypted or not to the same level that the password would be.  User id’s are also easier to ‘guess’ than passwords.

Use different user id’s and passwords: This is one of the best ways to handle your accounts.  Unfortunately, we sometimes don’t have the option to choose our user id. We are forced to use our e-mail address or worse yet, it’s generated for us.  But for those times when you can choose both user id and password, it’s a good idea to choose one you haven’t used yet.

Use easy user id’s and passwords: Ok, this one is just plain stupid.  If you’re name is Joe Simpleton and you use joesimp as your user id, chances are your password is going to be something like jsimpleton.  This is almost as bad as not using a password.

Use complex user id’s and passwords: This is suggested as even if you mix in one number and one special character among the letters, you’re increasing your odds of surviving someone cracking the password.

Now, the last two pieces of the puzzle are in addition to the first four mentions.  They are ‘supporting’ members on the team, not just primary members themselves.

There are quite a few ways of obtaining the password to someone’s account.  They include but are not limited to:

•    wiretapping
•    phishing
•    key logging
•    social engineering
•    vulnerabilities

But we won’t be covering that today as they are subjects all in their own.

Let’s take a look at some of the methods hackers use to crack passwords:

Dictionary: This is more of a lucky guess type of cracking.  They use a table and go through every possible word in the dictionary to crack the password.  It also has a ‘dictionary’ of known passwords that are used most frequently.

What are some of the most frequently used passwords you ask?  Here they are a few of the top 500 (courtesy of Whats My Pass @ www.whatsmypass.com):

•    123456
•    god
•    12345678
•    1234
•    diamond
•    12345
•    dragon
•    qwerty
•    696969
•    letmein

Again, this is only 10 of the top 500 and you can already see a pattern. Some people will use things that pertain to their job for their work related passwords:

•    admin
•    email
•    login
•    password

Any of these look familiar?  There’s just no shortage of easy passwords.  There are entire terabytes of tables out there made just for the purpose of breaking passwords and even a few ‘rainbow’ books to help people with encrypted password hashes.  It takes every known possible password and encrypts it, then provides the actual encrypted hash.  All you do is match the hash that you have to what’s in the book and bingo, you’ve got the password.

Guessing or Educated Guessing:
Knowing things about the target and using those things to get the password such as child’s name, spouses name, ‘lovers’ name, pet names, favorite teams, locations, etc.

Brute Force Attack:
Basically it’s a last resort attack.  It tries every possible password.  If there’s no limit to the number of attempts to login, this one will work as long as there’s no limit to the amount of time needed.  It’s guaranteed as long as the password doesn’t change, there are no login attempts restricted and there’s limitless time.  Again, it’s the last resort for a reason.

These are only a few of the ways that passwords can be cracked.  There’s also several applications out there that assist in cracking the passwords once you have an encrypted password.  Some of those are:

•    Cain and Abel
•    John the Ripper
•    Hydra
•    ElcomSoft
•    LastBit
•    Crack
•    L0phtCrack
•    Ophcrack
•    RainbowCrack
•    SAMInside
•    DSniff

I have used several of these successfully as well as several of them unsuccessful.  It all depends on the strength and amount of time that is available.

Now, let’s take a look at how long it takes to crack a few passwords.

For ease of reference, I am re-producing the information found at Lockdown (www.lockdown.co.uk):

They use 6 ‘Classes’

A – 10,000  – typical recovery of MS Office on a Pentium 100
B – 100,000 – Typical recovery of Windows password cache on a Pentium 100
C – 1,000,000 – typical recovery of .ZIP or .ZRJ passwords on a Pentium 100
D – 10,000,000 – fast pc, dual processor
E – 100,000,000 – workstation or multiple pc’s working together (distributed computing)
F – 1,000,000,000 – medium to large scan distributed computing or supercomputers

Class A      Class B     Class C     Class D    Class E    Class F
darren                             8.5 H            51.5 M         5 M              30 S           3 S              Instant
Land3rz                          11 Y              1 Y                41 D             4 D             10 H           58 M
B33r&Mug                     22,875 Y    2,287 Y      229 Y         23 Y           2.5 Y        83.5 D

As you can see, the more complex the password, the longer it takes. Even with 8 characters, upper and lower case letters and special characters, it could still be beaten in less than 100 days.  With the availability of computing power today?  It’s not surprising that kids sitting in their mom’s basement can crack passwords at the drop of a hat.

So what can you do?  Well, you can do one of several things.

Do nothing.  You’re bound to get hacked eventually, why wait, make it easy for them (sarcasm here)

Follow these simple rules for passwords:

Minimum 10 characters (or less if the individual application won’t allow ten)
Minimum 2 upper case letters
Minimum 2 lower case letters
Minimum 2 numbers
Minimum 2 special characters
No recognizable words
No PII (personal identifiable information)
No phone numbers
No addresses
No pet names
No spouse names
Change the password every 30-45 days minimum
Never share passwords
Never give your password to anyone no matter what the situation
Never write down your password no matter what

I’ve given you an example of easy passwords now let’s see an example of how using the above listed guidelines will give you a good password:

G%5tgH^6yhJ&7ujK*8ik
Z#z3X$x4C%c5V^v6
1qaz@WSX3edc$RFV

Yes, all of these passwords will meet most complexity requirements down to and including the Fed Gov requirements.

Yes, all of these passwords are hard as hell to remember.  Yes, it’s more likely that someone will get your password via a backdoor program or keystroke logging than to be able to crack the password.  But isn’t a little peace of mind worth it?


Now, you ask, how do I remember the passwords if they’re 15 characters and all jumbled like that?



Easy; give yourself a system.  Either it is a rhythm, a song, an anagram, a keyboard algorithm, something.  Yes, I know it’s a pain in the butt, but would you rather have to worry about something like this than having to go and reset ALL of your 60 passwords every time someone hacks your Facebook account?

There ARE other ways to remember them.  Writing them down is one.  Yes, I know, I said never write them down.  Well, there are exceptions to every rule.  You can write them down in a specific location (small notepad) and keep it in a secure location (safe, lockbox, etc).  You can use a password keeper application on your computer, phone, etc.  I would recommend using KeePass - http://www.keepass.com.

In the mean time, try and think of how many user id’s and passwords you actually have.  Do you use any of the methods I discuss here?  Do you have the remember feature turned on in your browser or on your phone?  How about writing them down?  Is your password on a sticky note under your keyboard, mouse, chair or on your monitor?

Just a few things to think about.