book

Security Warrior

by Cyrus Peikari, Anton Chuvakin

January 2004

Intermediate to advanced

552 pages

16h 56m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Security Warrior
Dedication
A Note Regarding Supplemental Files
Preface
Organization of This BookPart I: Software CrackingPart II: Network StalkingPart III: Platform AttacksPart IV: Advanced DefensePart V: AppendixConventions Used in This BookUsing Code ExamplesComments and QuestionsAcknowledgments
I. Software Cracking
1. Assembly Language
1.1. Registers1.1.1. Understanding the Stack1.1.2. Addressing1.2. ASM Opcodes1.3. References
2. Windows Reverse Engineering
2.1. History of RCE2.2. Reversing Tools2.2.1. Hex Editors2.2.2. Disassemblers2.2.3. Debuggers2.2.4. System Monitors2.2.5. Unpackers2.2.5.1. The PE file format2.2.5.2. ProcDump2.2.6. Personal Firewalls2.2.7. Install Managers2.3. Reverse Engineering Examples2.3.1. Example 1: A Sample Crackme2.3.2. Example 2: Reversing Malicious Code2.4. References
3. Linux Reverse Engineering
3.1. Basic Tools and Techniques3.1.1. Overview of the Target3.1.2. Debugging3.1.3. Runtime Monitoring3.1.4. Disassembly3.1.5. Hex Dumps3.2. A Good Disassembly3.2.1. Identifying Functions3.2.2. Intermediate Code Generation3.2.3. Program Control Flow3.3. Problem Areas3.3.1. Antidebugging3.3.2. Antidisassembly3.4. Writing New Tools3.4.1. The ELF File Format3.4.1.1. Sample ELF reader3.4.2. Debugging with ptrace3.4.3. The GNU BFD Library3.4.4. Disassembling with libopcodes3.5. References
4. Windows CE Reverse Engineering
4.1. Windows CE Architecture4.1.1. Processors4.1.2. Kernel, Processes, and Threads4.1.3. Memory Architecture4.1.4. Graphics, Windowing, and Event Subsystem (GWES)4.2. CE Reverse Engineering Fundamentals4.2.1. The ARM Processor4.2.2. ARM Opcodes4.2.2.1. Branch (B)4.2.2.2. Branch with Link (BL)4.2.2.3. Move (MOV)4.2.2.4. Compare (CMP)4.2.2.5. Load/Store (LDR/STR)4.2.2.6. Shifting4.3. Practical CE Reverse Engineering4.3.1. Hello, World!4.3.2. CE Cracking Techniques4.3.2.1. Predictable system calls4.3.2.2. strlen and wcslen4.3.2.3. strcmp and CMP4.3.2.4. NOP sliding4.3.3. Disassembling a CE Program4.3.3.1. Loading the file4.3.4. Microsoft’s eMbedded Visual Tools4.3.5. Using the MVT4.3.6. Experiencing the MVC Environment4.3.7. Reverse Engineering test.exe4.4. Reverse Engineering serial.exe4.4.1. Overview4.4.1.1. Loading the target4.4.1.2. Debugging serial.exe4.4.2. Step-Through Investigation4.4.3. Abusing the System4.4.4. The Cracks4.4.4.1. Crack 1: Sleight of hand4.4.4.2. Crack 2: The NOP slide4.4.4.3. Crack 3: Preventive maintenance4.5. References
5. Overflow Attacks
5.1. Buffer Overflows5.1.1. A Sample Overflow5.2. Understanding Buffers5.3. Smashing the Stack5.4. Heap Overflows5.5. Preventing Buffer Overflows5.5.1. Automated Source-Code Checking5.5.2. Compiler Add-Ons5.5.3. Miscellaneous Protection Methods5.6. A Live Challenge5.7. References

II. Network Stalking
6. TCP/IP Analysis
6.1. A Brief History of TCP/IP6.2. Encapsulation6.3. TCP6.3.1. TCP Features6.3.2. TCP Packet Field Descriptions6.4. IP6.4.1. IP Packet Format6.5. UDP6.6. ICMP6.7. ARP6.8. RARP6.9. BOOTP6.10. DHCP6.11. TCP/IP Handshaking6.12. Covert Channels6.13. IPv66.13.1. Features of IPv66.13.2. IPv6 Addressing6.13.3. Security Aspects of IPv66.14. Ethereal6.15. Packet Analysis6.16. Fragmentation6.16.1. Fragmentation Variables6.16.2. Exploiting Fragments6.16.3. Fragmenting with Nmap6.16.4. hping6.16.5. Fragroute6.17. References
7. Social Engineering
7.1. Background7.1.1. Less Elite, More Effective7.1.2. Common Misconceptions7.2. Performing the Attacks7.2.1. Active and Passive Attacks7.2.1.1. Sample 1: Impersonation7.2.1.2. Sample 2: Impersonation and authority7.2.1.3. Sample 3: Blackmail7.2.1.4. Sample 4: Sympathy7.2.2. Preparing for an Attack7.2.3. Social Engineering Action Plan7.2.4. Social Engineering Information Collection Template7.3. Advanced Social Engineering7.4. References
8. Reconnaissance
8.1. Online Reconnaissance8.1.1. Passive Reconnaissance8.1.1.1. Utilities8.1.1.2. Web reconnaissance8.1.2. Active Reconnaissance8.1.2.1. Email8.1.2.2. Web site analysis8.1.2.3. FTP8.1.2.4. A word on stealth8.1.2.5. Human reconnaissance8.2. Conclusion8.3. References
9. OS Fingerprinting
9.1. Telnet Session Negotiation9.2. TCP Stack Fingerprinting9.2.1. Nmap Test9.2.2. Nmap Techniques9.2.3. Defeating Nmap9.3. Special-Purpose Tools9.4. Passive Fingerprinting9.5. Fuzzy Operating System Fingerprinting9.5.1. Obstacles to Fingerprinting9.5.2. Fuzzy Solution to Operating System Fingerprinting9.6. TCP/IP Timeout Detection9.7. References
10. Hiding the Tracks
10.1. From Whom Are You Hiding?10.2. Postattack Cleanup10.2.1. System Logs10.2.1.1. The exploit attempt itself10.2.1.2. The attacker’s accesses before the exploit10.2.1.3. Erasing logfiles10.2.2. Application Logs10.2.3. Unix Shell History10.2.4. Unix Binary Logs10.2.5. Other Records10.3. Forensic Tracks10.3.1. File Traces10.3.2. Timestamps10.3.2.1. Countermeasures10.4. Maintaining Covert Access10.4.1. Hiding10.4.2. Hidden Access10.5. References
III. Platform Attacks
11. Unix Defense
11.1. Unix Passwords11.2. File Permissions11.2.1. Attributes and Capabilities11.3. System Logging11.4. Network Access in Unix11.4.1. TCP Wrappers11.4.2. NFS/NIS11.4.3. Backups11.4.4. X Window System11.5. Unix Hardening11.5.1. Hardening Areas11.5.1.1. Checking installed software11.5.1.2. Patching the system11.5.1.3. Filesystem permissions11.5.1.4. Login security11.5.1.5. User security11.5.1.6. Physical security11.5.1.7. Network security11.5.1.8. Daemon security11.5.1.9. System logging and accounting11.5.2. Automated Hardening via Scripts11.5.2.1. Linux Bastille11.5.2.2. Kernel-level hardening11.5.2.3. Pitbull11.5.2.4. Openwall kernel patch11.5.2.5. LIDS11.5.2.6. “Secure Unix”11.5.2.7. Encrypted filesystems11.6. Unix Network Defense11.6.1. Advanced TCP Wrappers11.6.1.1. tcpd11.6.1.2. libwrap11.6.2. Application-Specific Access Controls11.6.2.1. BIND (DNS daemon)11.6.2.2. sendmail (some versions)11.6.2.3. SSH daemon (sshd)11.6.2.4. Apache web server11.6.3. System Configuration Changes11.6.3.1. Security from eavesdropping11.6.3.2. Secure Shell11.6.4. Host-Based Firewalls11.6.4.1. Linux iptables and ipchains11.7. References
12. Unix Attacks
12.1. Local Attacks12.1.1. Physical Abuses12.1.2. Boot Prompt Attacks12.1.3. Boot Interrupt12.1.4. Screensaver Attacks12.1.5. Path Abuse12.1.6. Password Attacks12.1.7. SUID Abuse12.1.8. /tmp and Symlink/Hardlink Abuse12.1.9. Breaking Out of chroot Jail12.2. Remote Attacks12.2.1. TCP12.2.2. UDP12.2.3. Top Unix Vulnerabilities12.3. Unix Denial-of-Service Attacks12.3.1. Local Attacks12.3.1.1. Destruction of resources12.3.1.2. Resource exhaustion12.3.1.3. Filling kernel data structures12.3.2. Network Attacks12.3.3. Distributed Denial-of-Service Attacks12.3.3.1. Coordinated and reflexive denial-of-service attacks12.3.3.2. Application-level denial-of-service attacks12.4. References
13. Windows Client Attacks
13.1. Denial-of-Service Attacks13.1.1. SMB Attack13.1.2. Universal Plug and Play Attack13.1.3. Help Center Attack13.2. Remote Attacks13.3. Remote Desktop/Remote Assistance13.3.1. Abusing the Remote Desktop13.3.1.1. tscrack13.3.2. Abusing Remote Assistance13.4. References
14. Windows Server Attacks
14.1. Release History14.2. Kerberos Authentication Attacks14.3. Kerberos Authentication Review14.3.1. Accessing Cross-Domain Network Resources14.3.2. Weaknesses in the Kerberos Protocol14.3.2.1. Vulnerability14.3.2.2. Obtaining the password-verification material14.3.2.3. Decrypting the timestamp14.4. Defeating Buffer Overflow Prevention14.5. Active Directory Weaknesses14.6. Hacking PKI14.7. Smart Card Hacking14.7.1. Smart Card Advantages14.7.2. Hardware Reverse Engineering14.7.3. EEPROM Trapping14.7.4. Power Consumption Analysis14.8. Encrypting File System Changes14.8.1. Background14.8.2. User Interaction14.8.3. Data Recovery on Standalone Machines14.9. Third-Party Encryption14.9.1. Summary of Functionality14.9.2. One-Time Password14.9.3. Local and Corporate Administrator Recovery14.9.4. Authenti-Check Self-Service Password Reset Tool14.9.5. User Program Configuration Options14.9.6. Network Installation and Updating of User Programs14.9.7. Single Sign-On14.10. References
15. SOAP XML Web Services Security
15.1. XML Encryption15.2. XML Signatures15.3. Reference
16. SQL Injection
16.1. Introduction to SQL16.1.1. SQL Commands16.1.2. Use of SQL16.2. SQL Injection Attacks16.2.1. Attack Types16.2.1.1. Unauthorized data access16.2.1.2. Authentication bypass16.2.1.3. Database modification16.2.1.4. Escape from a database16.2.2. Looking for Errors16.3. SQL Injection Defenses16.3.1. Obfuscation Defenses16.3.2. External Defenses16.3.3. Coding Defenses16.3.4. Conclusion16.4. PHP-Nuke Examples16.4.1. Installing PHP-Nuke16.4.2. Attacks16.4.3. Defenses16.5. References
17. Wireless Security
17.1. Reducing Signal Drift17.2. Problems with WEP17.3. Cracking WEP17.3.1. Data Analysis17.3.2. Wireless Sniffing17.3.2.1. Extracting the keystream17.3.3. IV Collision17.4. Practical WEP Cracking17.5. VPNs17.5.1. RADIUS17.6. TKIP17.7. SSL17.8. Airborne Viruses17.8.1. Embedded Malware Countermeasures17.9. References
IV. Advanced Defense
18. Audit Trail Analysis
18.1. Log Analysis Basics18.2. Log Examples18.2.1. Unix18.2.1.1. Analysis of Unix logging18.2.2. Windows18.2.3. Remote Covert Logging18.2.4. Other Logging Variations18.3. Logging States18.4. When to Look at the Logs18.5. Log Overflow and Aggregation18.6. Challenge of Log Analysis18.7. Security Information Management18.8. Global Log Aggregation18.9. References
19. Intrusion Detection Systems
19.1. IDS Examples19.1.1. Host IDSs19.1.1.1. Logfile monitors19.1.1.2. Integrity monitors19.1.2. Network IDSs19.1.2.1. Signature matchers19.1.2.2. Anomaly detectors19.2. Bayesian Analysis19.2.1. Sensitivity Versus Specificity19.2.1.1. Sensitivity19.2.1.2. Specificity19.2.1.3. Accuracy19.2.2. Positive and Negative Predictive Values19.2.3. Likelihood Ratios19.3. Hacking Through IDSs19.3.1. Fragmentation19.3.2. Spoofing19.3.3. Protocol Mutation19.3.4. Attacking Integrity Checkers19.4. The Future of IDSs19.4.1. Embedded IDS19.4.2. Strict Anomaly Detection19.4.3. Host- Versus Network-Based IDSs19.4.4. Visual Display of Data19.5. Snort IDS Case Study19.5.1. System Setup19.5.2. Alert Viewing Setup19.5.3. IDS Rule Tuning19.6. IDS Deployment Issues19.7. References
20. Honeypots
20.1. Motivation20.2. Building the Infrastructure20.2.1. Procedure20.2.1.1. Preparation20.2.1.2. Infrastructure systems installation20.2.1.3. Victim machine installation20.2.1.4. Final steps20.3. Capturing Attacks20.4. References
21. Incident Response
21.1. Case Study: Worm Mayhem21.2. Definitions21.3. Incident Response Framework21.3.1. Preparation21.3.2. Identification21.3.3. Containment21.3.4. Eradication21.3.5. Recovery21.3.6. Follow-Up21.3.6.1. Benefits of the SANS framework21.4. Small Networks21.5. Medium-Sized Networks21.6. Large Networks21.6.1. Incident Identification21.6.2. Aggressive Response21.6.3. Recovery21.7. References
22. Forensics and Antiforensics
22.1. Hardware Review22.1.1. Hard Drives22.1.2. RAM22.2. Information Detritus22.3. Forensics Tools22.3.1. WinHex22.4. Bootable Forensics CD-ROMs22.4.1. Biatchux/FIRE22.4.2. ForensiX22.5. Evidence Eliminator22.5.1. Swap Files22.5.2. Temporary Files22.5.3. Windows Registry Streams22.5.4. Clipboard22.5.5. Chat Logs22.5.6. Browser Garbage (Internet Explorer)22.5.7. Options for Netscape Navigator Users22.5.7.1. Setting up Netscape paths22.6. Forensics Case Study: FTP Attack22.6.1. Introduction22.6.2. The Investigation22.7. References
V. Appendix
A. Useful SoftICE Commands and Breakpoints
A.1. SoftICE CommandsA.2. BreakpointsA.2.1. GeneralA.2.1.1. Time-relatedA.2.1.2. Disk accessA.2.1.3. File-relatedA.2.1.4. INI files-relatedA.2.1.5. Registry-related
About the Authors
Colophon
Copyright

Content preview from Security Warrior

Chapter 4. Windows CE Reverse Engineering

In the previous chapters, we covered reverse engineering on traditional platforms such as Win32 and Linux. However, what about the little guys? Can you reverse engineer software on embedded operating systems? Why would you want to?

Many embedded operating systems are stripped-down microversions of their big brothers. An embedded operating system brings the power of a complete OS to small devices such as mobile phones or watches, which suffer from severely restricted processing and memory resources. However, as embedded devices continue to increase in sophistication, their vulnerability to attack increases as well. Already the first computer viruses have hit embedded platforms, as we describe in Chapter 17. Corporate spyware will likely follow soon. With hundreds of millions of “smart” consumer appliances on the horizon, the potential for abuse keeps increasing.

Embedded RCE is still in its infancy. In this chapter, we introduce embedded OS architecture and how to crack the applications that run on it. For our example, we have chosen Windows CE, which powers many Windows Mobile OS flavors such as PocketPC and Smartphone. Windows CE is a semi-open, scalable, 32-bit, true-multitasking operating system that has been designed to run with maximum power on minimum resources. This OS is actually a miniature version of Windows 2000/XP that can run on appliances as small as a watch.

Why have we chosen Windows CE for our reverse engineering research, ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 0596005458Errata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Security Warrior

by Cyrus Peikari, Anton Chuvakin

Chapter 4. Windows CE Reverse Engineering

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.