Vu tuananh

  • View
    77

  • Download
    0

Embed Size (px)

DESCRIPTION

 

Transcript

  • 1. M U Theo thng k ca cng ty Bkav, t u nm 2013 n nay, ti Vit Nam c 2.405 website ca cc c quan, doanh nghip b xm nhp, trung bnh mi thng c khong 300 website b tn cng. ng V Ngc Sn, Ph ch tch ph trch Nghin cu pht trin ca Bkav cho bit, cc c quan doanh nghip b tn cng gn nh l y , t t nghim trng n nghim trng v rt nghim trng (nhm nh cp cc ti liu mt) v cc m c ny nhm c vo B Cng An, B Quc phng, ngn hng, cc c quan n v nghin cu, cc doanh nghip Theo nhn nhn ca Bkav, c nhng chin dch tn cng, pht tn m c c ch ch vo Vit Nam. Trong , bn thn cc v tn cng trn mng v cc v xm nhp h thng cng ngh thng tin l nhm do thm, trc li, ph hoi d liu, n cp ti sn, cnh tranh khng lnh mnh v mt s v mt an ton thng tin s khc ang gia tng mc bo ng v s lng, a dng v hnh thc, tinh vi hn v cng ngh. Trc tnh hnh , song song vic ban hnh ch th 897/CT-TTg, Th Tng ch o cc B, ngnh, a phng tng cng gii php m bo an ton thng tin s. Th tng Chnh ph cng nu r, trong thi gian qua, tnh hnh mt an ton thng tin s nc ta din bin phc tp, xut hin nhiu nguy c e da nghim trng n vic ng dng cng ngh thng tin phc v pht trin kinh t - x hi v m bo quc phng, an ninh. Bi bo co ny s gii thiu tng qut v cc phng php m Hacker s dng tn cng xm nhp v khai thc vo cc phin bn h iu hnh Windows, h iu hnh ph bin nht hin nay ti Vit Nam, t gip chng ta nm r cch thc m Hacker s dng v a ra cc gii php gip cho mi ngi dng c an ton thng tin, bo mt trong thi i Internet ngy nay. V Tun Anh.
  • 2. LI CM N thc hin v hon thnh ti ny, trc ht ti xin cm n n cc thy, ging vin hng dn sinh vin thc tp ti Trung tm o to qun tr mng v an ninh mng quc t ATHENA, tn tnh ch bo trong thi gian va qua. Ti cng xin gi li cm n n cc anh ch, bn b truyn t kinh nghim v to iu kin cho ti hon thnh ti ny. Trong qu trnh thc hin ti khng th khng c nhng sai st, mong thy c ti trung tm ATHENA v cc bn thng thn gp ti rt kinh nghim trong cc cng trnh tm hiu, pht trin sau ny. V Tun Anh.
  • 3. PHN 1: GII THIU 1.1 System Hacking v Tnh hnh an ninh mng Vit Nam System hacking bao gm nhng k thut ly username, password da vo phn mm ci trn h thng hoc tnh d ci t v chy cc dch v t xa ca h iu hnh Windows. Nng quyn trong h thng, s dng keyloger ly thng tin, xa nhng log file h thng. Mt khi xm nhp vo h thng, Hacker c th thc hin mi th trn my tnh , gy ra nhng hu qu v cng nghim trng cho cc c nhn, t chc. 1.2 Cc l hng thng khai thc trong h iu hnh Windows Phn mm my tnh ngy nay v cng phc tp, bao gm hng ngn dng m. Phn mm c vit ra bi con ngi, nn cng chng c g l khi trong c cha nhng li lp trnh, c bit n vi tn gi l hng. Nhng l hng ny c Hacker s dng xm nhp vo h thng, cng nh c tc gi ca cc an m c dng khi ng chng trnh ca h mt cch t ng trn my tnh ca bn. Hin nay cc l hng bo mt c pht hin cng nhiu trong cc h iu hnh, cc Web Server hay cc phn mm khc, ... V cc hng sn xut lun cp nht cc l hng v a ra cc phin bn mi sau khi v li cc l hng ca cc phin bn trc. Do , ngi s dng phi lun cp nht thng tin v nng cp phin bn c m mnh ang s dng nu khng cc Hacker s li dng iu ny tn cng vo h thng. Thng thng, cc forum ca cc hng ni ting lun cp nht cc l hng bo mt v vic khai thc cc l hng nh th no th ty tng ngi. Microsoft lun c nhng ci tin an ninh vt tri qua mi phin bn mi ca h iu hnh Windows. Tuy nhin, mt s tht l cc mi e da mng vn ang ngy cng pht trin nhanh hn so vi chu trnh cp nht v i mi h iu hnh ca Microsoft. Ti phm mng thng s dng cc l hng trong cc m chng trnh truy cp vo cc d liu v ti nguyn trn my tnh b li bo mt. Cc chng trnh c hi c thit k c bit khai thc cc l hng ny, c gi l k thut exploit, ang ngy cng ph bin nhanh chng.
  • 4. Nhng sn phm ca Microsoft thng gp phi cc l hng bo mt nh HH Windows, Internet Explorer, Windows Server, Microsoft Exchange v .NetFramework. 1.3 Qu trnh tn cng vo mt h thng Trc tin ta s tm hiu tng qut mt qu trnh tn cng h thng. Mc tiu pha trc ca chng ta l mt h thng my tnh. Cc bc tn cng, nh sp n, c th c lit k nh hnh v bn cnh. N gm 6 cng on nh sau: Enumerate (lit k): Trch ra tt c nhng thng tin c th v user trong h thng. S dng phng php thm d SNMP c c nhng thng tin hu ch, chnh xc hn. Crack: Cng on ny c l hp dn nhiu Hackernht. Bc ny yu cu chng ta b kha mt khu ng nhp ca user. Hoc bng mt cch no khc, mc tiu phi t ti l quyn truy cp vo h thng.
  • 5. Escalste (leo thang): Ni cho d hiu l chuyn i gii hn truy cp t user binh thng ln admin hoc user c quyn cao hn cho chng ta tn cng. Execute (thc thi): Thc thi ng dng trn h thng my ch. Chun b trc malware, keylogger, rootkit chy n trn my tnh tn cng. Hide (n file): Nhng file thc thi, file soucecode chy chng trnh Cn phi c lm n i, trnh b mc tiu pht hin tiu dit. Tracks (du vt): Tt nhin khng phi l li du vt. Nhng thng tin c lin quan n bn cn phi b xa sch, khng li bt c th g. Nu khng kh nng bn b pht hin l k t nhp l rt cao. Tm li, qu trnh tn cng h thng (System hacking) l bc tip theo sau qu trnh kho st, thu thp thng tin ca mc tiu cn tn cng bng nhng k thut nh Footprinting, Social engineering, Enumeration, Google Hacking c p dng cho mc ch truy tm thng tin. Khi h thng mc tiu c xc nh, chng ta bt u i vo qu trnh tn cng h thng tht s. Ta phi tin hnh nhng k thut khc nhau lm sao vo c trong h thng , thc hin nhng vic m mnh mong mun, nh xa d liu, chy chng trnh trojan, keylogger
  • 6. PHN 2: S DNG BACKTRACK KHAI THC XM NHP TRONG MNG LAN 2.1 H iu hnh Backtrack 5 R3 Backtrack l mt bn phn phi dng Live DVD ca Linux, c pht trin th nghim xm nhp. Backtrack l s hp nht gia 3 bn phn phi khc nhau ca Linux v thm nhp th nghim IWHAX, WHOPPIX, v Auditor. Trong phin bn hin ti ca n (5), Backtrack c da trn phin bn phn phi Linux Ubuntu 11.10. Cng c Backtrack c lch s pht trin kh lu qua nhiu bn linux khc nhau. Phin bn hin nay s dng bn phn phi Slackware linux (Tomas M.(www.slax.org)). Backtrack lin tc cp nht cc cng c, drivers,... Hin ti Backtrack c trn 300 cng c phc v cho vic nghin cu bo mt. Backtrack l s kt hp gia 2 b cng c kim th bo mt rt ni ting l Whax v Auditor. Backtrack 5 cha mt s cng c c th c s dng trong qu trnh th nghim thm nhp ca chng ta. Cc cng c kim tra thm nhp trong Backtrack 5 c th c phn loi nh sau: Information gathering: loi ny c cha mt s cng c c th c s dng c c thng tin lin quan n mt mc tiu DNS, nh tuyn, a ch e-mail, trang web, my ch mail, v nh vy. Thng tin ny c th u thp t cc thng tin c sn trn Internet, m khng cn chm vo mi trng mc tiu. Network mapping: loi ny cha cc cng c c th c s dng kim tra cc host ang tn ti, thng tin v OS, ng dng c s dng bi mc tiu, v cng lm portscanning. Vulnerability identification: Trong th loi ny, chng ta c th tm thy cc cng c qut cc l hng (tng hp) v trong cc thit b Cisco. N cng cha cc cng c thc hin v phn tch Server Message Block (SMB) v Simple Network Management Protocol (SNMP).
  • 7. Web application analysis: loi ny cha cc cng c c th c s dng trong theo di, gim st cc ng dng web. Radio network analysis: kim tra mng khng dy, bluetooth v nhn dng tn s v tuyn (RFID), chng ta c th s dng cc cng c trong th loi ny. Penetration: loi ny cha cc cng c c th c s dng khai thc cc l hng tm thy trong cc my tnh mc tiu. Privilege escalation: Sau khi khai thc cc l hng v c truy cp vo cc my tnh mc tiu, chng ta c th s dng cc cng c trong loi ny nng cao c quyn ca chng ta cho cc c quyn cao nht. Maintaining access: Cng c trong loi ny s c th gip chng ta trong vic duy tr quyn truy cp vo cc my tnh mc tiu. Chng ta c th cn c c nhng c quyn cao nht trc khi cc chng ta c th ci t cng c duy tr quyn truy cp. Voice Over IP (VOIP): phn tch VOIP chng ta c th s dng cc cng c trong th loi ny. Digital forensics: Trong loi ny, chng ta c th tm thy mt s cng c c th c s dng lm phn tch k thut nh c c hnh nh a cng, cu trc cc tp tin, v phn tch hnh nh a cng. s dng cc cng c cung cp trong th loi ny, chng ta c th chn Start Backtrack Forensics trong trnh n khi ng. i khi s i hi chng ta phi gn kt ni b a cng v cc tp tin trao i trong ch ch c bo tn tnh ton vn. Reverse engineering: Th loi ny cha cc cng c c th c s dng g ri chng trnh mt hoc tho ri mt tp tin thc thi. Chng ta c th ti bn Backtrack 5 ti a ch: www.backtracklinux.org/downloads/
  • 8. 2.2 Phn mm Metasploit Metasploit l mt d n bo mt my tnh cung cp cc thng tin v vn l hng bo mt cng nh gip v kim tra thm nhp v pht trin h thng pht hin tn cng mng. Metasploit Framework l mt mi trng dng kim tra, tn cng v khai thc li ca cc service. Metasploit c xy dng t ngn ng hng i tng Perl, vi nhng components c vit bng C, assembler, v Python. Metasploit c th chy trn hu ht cc h iu hnh: Linux, Windows, MacOS. Chng ta c th download chng trnh ti www.metasploit.com. Metasploit h tr nhiu giao din vi ngi dng: Console interface: dng lnh msfconsole. Msfconsole interface s dng cc dng lnh cu hnh, kim tra nn nhanh hn v mm do hn. Web interface: dng msfweb, giao tip vi ngi dng thng qua giao din Web. Command line interface: dng msfcli. Metasploit Enviroment: Global Enviroment: c thc thi thng qua 2 cu lnh setg v unsetg, nhng options c gn y s mang tnh ton cc, c a vo tt c cc module exploits. Temporary Enviroment: c thc thi thng qua 2 cu lnh set v unset, enviroment ny ch c a vo module exploit ang load hin ti,