Extreme Exploits: Advanced Defenses Against Hardcore Hacks

785 Pages·2005·4.29 MB·English

by  Victor Oppleman

Extreme Exploits:
Advanced Defenses
Against Hardcore Hacks
by Victor Oppleman, Oliver
Friedrichs and Brett
Watson.
McGraw-Hill/Osborne Š
2005 (448 pages)
ISBN:0072259558
Protect your network and
web site from malicious
attacks! Packed with
advanced security
techniques and
instructions, this cutting-
edge guide explains how
to defend against
devastating vulnerabilities
in software and network
infrastructures.

Table of Contents
Extreme Exploits—Advanced Defenses Against Hardcore Hacks
Foreword
Introduction
Part I - Core Internet Infrastructure for Security Professionals
Chapter 1 - Internet Infrastructure for Security Professionals
Chapter 2 - ISP Security Practices—Separating Fact from Fiction
Chapter 3 - Securing the Domain Name System
Part II - Defending Your Perimeter and Critical Internet
Infrastructure
Chapter 4 - Reliable Connectivity
Chapter 5 - Securing the Perimeter
Chapter 6 - Redefining the DMZ—Securing Critical Systems
Chapter 7 - Intrusion Detection and Prevention
Chapter 8 - E-mail Gateways, Filtering, and Redundancy
Chapter 9 - Data Leaks—Exploiting Egress
Chapter 10 - Sinkholes and Backscatter
Chapter 11 - Securing Wireless Networks
Part III - Network Vulnerability Assessments
Chapter 12 - Vulnerability and Patch Management
Chapter 13 - A Winning Methodology for Vulnerability Assessments
Chapter 14 - Performing the Assessment, Part I
Chapter 15 - Performing the Assessment, Part II
Part IV - Designing Countermeasures for Tomorrow's Threats
Chapter 16 - Exploiting Digital Forensics
Chapter 17 - Viruses, Worms, Trojans, and Other Malicious Code
Chapter 18 - Exploiting Software
List of Figures
List of Tables
Extreme Exploits: Advanced Defenses Against
Hardcore Hacks
by Victor Oppleman, Oliver Friedrichs and Brett Watson
McGraw-Hill/Osborne © 2005 (448 pages)
ISBN:0072259558
Protect
your network and web site from malicious attacks! Packed
with advanced security techniques and instructions, this
cutting-edge guide explains how to defend against
devastating vulnerabilities in software and network
infrastructures.
Back Cover
Protect your network and web sites from malicious attacks with help
from this cutting-edge guide. Extreme Exploits is packed with never-
before-published advanced security techniques and concise
instructions that explain how to defend against devastating
vulnerabilities in software and network infrastructure. This book gives
you detailed analyses of modern threats and their solutions along with
checklists for developing defenses. You’ll also be introduced to a
winning methodology for custom vulnerability assessments including
attack profiling and the theatre of war concept. Through in-depth
explanations of underlying technologies, you’ll learn to prepare your
network and software from threats that don’t yet exist. This is a must-
read volume for anyone responsible for network security.
Secure your critical domain name system (DNS) infrastructure
Ensure reliable Internet connectivity amidst a myriad of attacks
Implement effective intrusion detection and prevention
technologies
Prevent e-mail abuse using advanced filtering, encryption, and
other methods
Stop data theft and egress exploitation by altering packet filtering
rules
Defend against viruses, worms, bots, Trojans, and other malicious
code
Use IP sinkholes and backscatter analysis to trap and gain
knowledge from scanning and infiltration attempts
Secure wireless networks using a variety of technologies
Create a customized vulnerability assessment methodology for
your organization
Use proven digital forensics techniques to investigate attacks
Learn to protect your software from little-known vulnerabilities
About the Authors
Victor Oppleman Victor Oppleman is an accomplished author, speaker,
and teacher in the field of network security and a specialized
consultant to some of the world's most admired companies. Mr.
Oppleman's open source software has been distributed to hundreds of
thousands of computers worldwide and some is used in graduate-level
college curricula to demonstrate advanced networking techniques.
Early in his career as an engineer, Mr. Oppleman developed portions
of the backbone systems infrastructure for Genuity, the first Internet
data center company. Later, as a senior architect for BBN and GTE
Internetworking, Mr. Oppleman developed security-related products
and services centered on public key infrastructure (PKI). A great deal
of Mr. Oppleman's professional career has been dedicated to tactical
engineering and consulting for global telecom operators and critical
infrastructure organizations in industries such as power and water,
financial services, and defense. Some of the largest global companies
frequently call upon Mr. Oppleman to perform advanced vulnerability
assessments, provide expert counsel, and navigate complex
regulatory issues concerning information security. An accomplished
executive and engineer in network security, data hosting services, and
software development, Mr. Oppleman also holds U.S. intellectual
property patents in distributed adaptive routing and wireless consumer
applications.
Oliver Friedrichs Oliver Friedrichs is a Senior Manager in Symantec
Security Response, the organization responsible for the delivery of
antivirus definitions, intrusion detection updates, and early warning
technologies within Symantec. He served as co-founder and Director
of Engineering at SecurityFocus until the company's acquisition by
Symantec in 2002. At SecurityFocus Mr. Friedrichs managed the
development of the industry's first early warning technology for Internet
attacks, the DeepSight Threat Management System. Mr.
Friedrichs also created and grew the DeepSight Threat Analyst team,
providing thorough analysis of emerging Internet threats.
Mr. Friedrichs has over 13 years of expertise in security technologies,
including network assessment, intrusion detection systems, firewalls,
penetration testing, and honeypots. As a frequent speaker, he has
shared his expertise with many of the world's most powerful
organizations, including the Department of Homeland Security, U.S.
Secret Service, the IRS, the DOD, NASA, AFOSI, and the Canadian
DND.
Brett Watson Brett Watson has 17 years experience in network
architecture and security, including large-scale IP networking, optical
networking, and security and vulnerability assessments. Mr. Watson
currently works for Internet Systems Consortium's DNS Operations,
Analysis, and Research Center (DNS OARC) doing macroscopic
analysis of global DNS behavior. Prior to joining ISC, Mr. Watson
helped deploy and maintain the original MCI and Genuity IP
backbones, and designed the first metropolitan IP-over-Gigibit
Ethernet product for Metromedia Fiber Networks. Mr. Watson has
spent the last several years performing custom network and
vulnerability assessments, and consulting on information security
issues for some of the largest healthcare, water, and power industries
in the United States. In addition, Mr. Watson holds a patent for one of
the first large-scale, content distribution platforms known as
Hopscotch.

Extreme Exploits—Advanced Defenses
Against Hardcore Hacks
Victor Oppleman
Oliver Friedrichs
Brett Watson
McGraw-Hill/Osborne
2100 Powell Street, 10th Floor
Emeryville, California 94608
U.S.A.
To arrange bulk purchase discounts for sales promotions, premiums,
or fund-raisers, please contact McGraw-Hill/Osborne at the above
address. For information on translations or book distributors outside
the U.S.A., please see the International Contact Information page
immediately following the index of this book.
Extreme Exploits: Advanced Defenses Against Hardcore Hacks
© 2005 The McGraw-Hill Companies.
All rights reserved. Except as permitted under the Copyright Act of
1976, no part of this publication may be reproduced or distributed in
any form or by any means, or stored in a database or retrieval system,
without the prior written permission of publisher, with the exception
that the program listings may be entered, stored, and executed in a
computer system, but they may not be reproduced for publication.
234567890 FGR FGR 0198765
0-07-225955-8
Executive Editor Jane K. Brownlow
Project Editor Claire Splan
Acquisitions Coordinator Jennifer Housh
Technical Editor Jim Lippard
Proofreader Paul Tyler
Composition & Illustration Apollo Publishing Services
Series Design Roberta Steele
Cover Design Dean Cook
This book was composed with Corel VENTURA™ Publisher.
Information has been obtained by McGraw-Hill/Osborne from sources
believed to be reliable. However, because of the possibility of human
or mechanical error by our sources, McGraw-Hill/Osborne, or others,
McGraw-Hill/Osborne does not guarantee the accuracy, adequacy, or
completeness of any information and is not responsible for any errors
or omissions or the results obtained from the use of such information.
To my beloved wife, Sasha, and my sons, Chandler and Carter,
who bring happiness to my life and inspire me to dream. To my
sister, Caroline, and my parents, whose wisdom and virtue have
strengthened my character and cultivated my ambition.
—Victor
To my loving wife, Karin, who provided neverending
encouragement. To my mother-in-law, Janice, who never fails to
support my imagination.
—Oliver
To God for giving me the skills to do this work, and to my
wonderful family, who put up with me locked behind my office
door for days on end.
—Brett
About the Authors
Victor Oppleman Victor Oppleman is an accomplished author,
speaker, and teacher in the field of network security and a specialized
consultant to some of the world's most admired companies. Mr.
Oppleman's open source software has been distributed to hundreds
of thousands of computers worldwide and some is used in graduate-
level college curricula to demonstrate advanced networking
techniques. Early in his career as an engineer, Mr. Oppleman
developed portions of the backbone systems infrastructure for
Genuity, the first Internet data center company. Later, as a senior
architect for BBN and GTE Internetworking, Mr. Oppleman developed
security-related products and services centered on public key
infrastructure (PKI). A great deal of Mr. Oppleman's professional
career has been dedicated to tactical engineering and consulting for
global telecom operators and critical infrastructure organizations in
industries such as power and water, financial services, and defense.
Some of the largest global companies frequently call upon Mr.
Oppleman to perform advanced vulnerability assessments, provide
expert counsel, and navigate complex regulatory issues concerning
information security. An accomplished executive and engineer in
network security, data hosting services, and software development,
Mr. Oppleman also holds U.S. intellectual property patents in
distributed adaptive routing and wireless consumer applications.
Oliver Friedrichs Oliver Friedrichs is a Senior Manager in Symantec
Security Response, the organization responsible for the delivery of
antivirus definitions, intrusion detection updates, and early warning
technologies within Symantec.
Mr. Friedrichs served as co-founder and Director of Engineering at
SecurityFocus until the company's acquisition by Symantec in 2002.
At SecurityFocus Mr. Friedrichs managed the development of the
industry's first early warning technology for Internet attacks, the
DeepSight Threat Management System. Mr. Friedrichs also created
and grew the DeepSight Threat Analyst team, providing thorough
analysis of emerging Internet threats.
Prior to SecurityFocus, he served as co-founder and Vice President of
Engineering at Secure Networks, Inc., which was acquired by Network
Associates in 1998. At Secure Networks, Mr. Friedrichs architected
and managed the development of Ballista network security auditing
software, later rebranded CyberCop Scanner by Network Associates.
At Network Associates Mr. Friedrichs also founded COVERT
(Computer Vulnerability Exploitation Research Team) with the
exclusive goal of researching and discovering new security
vulnerabilities.
Mr. Friedrichs also architected and developed a prototype of the
industry's first commercial penetration testing product, CORE Impact,
developed and sold by CORE Security Technologies.