␡
- Missing the Obvious
- Enough Theory! How About an Example?
- Conclusion
Like this article? We recommend
Enough Theory! How About an Example?
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Enough Theory! How About an Example?
Let's dig deeper into a possible chain of exploits for attacking that website. There are countless approaches to take to attack a website; the purpose here is to show one example of chaining together multiple exploits, rather than providing the one definitive way that it might be done. For this example, we'll call our attacker Phoenix.
- First, Phoenix performs a DNS lookup to find out who is the technical contact for the domain he intends to attack. Among other things, the DNS lookup for a domain lists the technical contact. Often, the technical contact is the company's systems or network administrator who has administrative access. Phoenix knows that if he can log into the network with this person's account, he'll own the network.
- Phoenix searches for the technical contact on social networking sites such as Facebook or MySpace. After finding a picture of this person, he looks for his or her home address in the phone book. If no home address is listed, Phoenix can use the photo to stake out the company and follow the contact person home to obtain his or her home address.
- Now that he has the contact's home address, Phoenix breaks into the house when the contact is away, probably sometime around mid-morning to minimize the chances of getting caught.
- Once inside, Phoenix looks for a computer. Finding a desktop computer, he attaches a hardware keylogger to the back of the computer to log all keystrokes. System and network administrators often log in to work systems remotely. If Phoenix can discover how the administrator is connecting remotely, he can use the same approach and get access to the network.
- After a week of logging keystrokes, Phoenix retrieves the keylogger, attaches it to his own computer, and retrieves the logs. Then he searches for any hint as to how the administrator is logging in to work remotely. After a thorough search, he unearths a log of the administrator signing into a server remotely. Phoenix now possesses the IP address of the remote host, the username, and the password as typed by the administrator.
- Phoenix connects to the remote host. He does it at night, to give the impression that the administrator is working from home. He works from a free Wi-Fi hotspot at a busy late-night coffee shop. This trick helps to minimize the chances of being caught.
- Now that Phoenix is connected to a server on the company's network, he searches until he finds the web server. Then he modifies every page of the website to include a message that's harmful to the company (use your imagination).
- At this point, Phoenix could call his attack finished, but he wants to make it difficult for the company to restore the original site from backup. He goes into the Windows registry on the web server and deletes entries related to the backup client software. With the entries deleted, the backup software won't work. It will still be installed, though, so the administrator will attempt to troubleshoot the client software, rather than trying to reinstall it. This wasted time means that the defaced site will be on the Internet longer.
- Phoenix makes a simple script to copy the defaced site from another directory to the root web directory. He schedules this script to run every 30 minutes. This way, even if the administrator is able to restore the original site, a backup of the defaced site will overwrite the restored version every 30 minutes.
- Phoenix explores the network to find development, quality assurance, or quality control servers that host copies of the original website. He wants to prevent the company from copying from one of these servers to the main website, so he deletes a few of the critical files from each of these servers. By deleting just a few files here and there, he makes it harder for an administrator to determine what's wrong with the software, thus leading that administrator to waste time troubleshooting.
- Phoenix takes a screenshot of the defaced site and posts it anonymously on message boards across the Internet. This way, even if the site is restored, there are plenty of copies of the defaced site for people to see.
- Spoofing the email address of the company's main competitor, Phoenix emails the screenshot of the defaced site to local reporters. Now the media will be under the impression that a competitor may have defaced the site, stirring up controversy and media attention.
- As one final act of exposure, Phoenix crawls websites and newsgroups to collect thousands of email addresses. He then sends out messages to these email addresses, attaching a screenshot of the defaced page.
Phoenix may be able to use a bump key to gain access to the house. A bump key is a specially designed key for opening common pin-tumbler locks. Bumping the key causes pins to jump to the right place to open the lock.
Phoenix has successfully chained together exploits not only to deface a website, but to make sure that as many people as possible know about the damage.