Ninja Hacking: Unconventional Penetration Testing Tactics and Techniques

314 Pages·2010·4.674 MB·English

by  Thomas Wilhelm, Jason Andress

Ninja Hacking
Ninja Hacking
Unconventional Penetration
Testing Tactics and Techniques
Thomas Wilhelm
Jason Andress
Bryan Garner
Ninjutsu Consultant
Joshua Abraham
Technical Editor
AMSTERDAM • BOSTON • HEIDELBERG • LONDON
NEW YORK • OXFORD • PARIS • SAN DIEGO
SAN FRANCISCO • SINGAPORE • SYDNEY • TOKYO
Syngress is an imprint of Elsevier
Acquiring Editor: Rachel Roumeliotis
Development Editor: Matthew Cater
Project Manager: Laura Smith
Designer: Alisa Andreola
Syngress is an imprint of Elsevier
30 Corporate Drive, Suite 400, Burlington, MA 01803, USA
© 2011 Elsevier, Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by any means, electronic
or mechanical, including photocopying, recording, or any information storage and retrieval system,
without permission in writing from the publisher. Details on how to seek permission, further informa-
tion about the Publisher’s permissions policies and our arrangements with organizations such as the
Copyright Clearance Center and the Copyright Licensing Agency, can be found at our website:
www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under copyright by the
Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As new research and experience
broaden our understanding, changes in research methods or professional practices, may become neces-
sary. Practitioners and researchers must always rely on their own experience and knowledge in evaluat-
ing and using any information or methods described herein. In using such information or methods they
should be mindful of their own safety and the safety of others, including parties for whom they have a
professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors, contributors, or editors, assume
any liability for any injury and/or damage to persons or property as a matter of products liability,
negligence or otherwise, or from any use or operation of any methods, products, instructions, or ideas
contained in the material herein.
Library of Congress Cataloging-in-Publication Data
Application submitted
British Library Cataloguing-in-Publication Data
A catalogue record for this book is available from the British Library.
ISBN: 978-1-59749-588-2
Printed in the United States of America
11 12 13 14 15 10 9 8 7 6 5 4 3 2 1
Typeset by: diacriTech, India
For information on all Syngress publications visit our website at www.syngress.com
About the Authors
Thomas Wilhelm has been involved in Information Security since 1990, where
he served in the U.S. Army for 8 years as a Signals Intelligence Analyst/Russian
Linguist/Cryptanalyst. A speaker at security conferences across the United States,
including DefCon, HOPE, and CSI, he has been employed by Fortune 100 compa-
nies to conduct risk assessments, participate and lead in external and internal pen-
etration testing efforts, and manage Information Systems Security projects.
Thomas is also an Information Technology Doctoral student who holds Mas-
ters degrees in both Computer Science and Management. Additionally, he dedicates
some of his time as an Associate Professor at Colorado Technical University and has
contributed to multiple publications, including both magazines and books. Thomas
currently performs security training courses for both civilian and government person-
nel through Heorot.net, and maintains the following security certifications: ISSMP,
CISSP, SCSECA, and SCNA.
Jason Andress (ISSAP, CISSP, GISP, GSEC, CEH, Security+) is a seasoned
security professional with a depth of experience in both the academic and business
worlds. He is presently employed by a major software company, providing global
information security oversight, and performing penetration testing, risk assessment,
and compliance functions to ensure that the company’s assets are protected.
Jason has taught undergraduate and graduate security courses since 2005 and
holds a Doctorate in Computer Science. His research is in the area of data protec-
tion, and he has contributed to several publications, writing on topics including data
security, network security, and digital forensics.
xiii
About the Ninjutsu Consultant
Bryan R. Garner (CHT, fifth-degree black belt in Bujinkan Budo Taijutsu/N injutsu,
Security Specialist) holds a Shidoshi level teaching license in the Bujinkan Martial
Arts system and has trained in Ninjutsu for more than 10 years. He has been involved
in martial arts since he was 5 years old, receiving two Shodan ranks previously
in other martial art styles. Sensei Garner has trained in Japan, as well as attended
many seminars throughout the United States to further his training. He currently runs
his own Ninjutsu Martial arts school in Colorado Springs and works as a full-time
Security Specialist for a large corporation.
xv
About the Technical Editor
Joshua Abraham (aka Jabra) joined Rapid7 in 2006 as a Security Consultant. Josh
has extensive IT Security and Auditing experience and has worked as an enterprise
risk assessment analyst for Hasbro Corporation. Josh specializes in penetration test-
ing, web application security assessments, wireless security assessments, and custom
code development. He has spoken at Black Hat, DefCon, ShmooCon, Infosec World,
CSI, OWASP Conferences, LinuxWorld, and the SANS Pentest Summit. In his spare
time, he contributes code to open source security projects such as the BackTrack
LiveCD, BeEF, Nikto, Fierce, and PBNJ.
xvi
Introduction
Book overview and key Learning Points
This work is not what most people would expect to read when they pick up a “hack-
ing” book. Rather than showing the reader how to perform traditional penetration test
attacks against networks and systems, we will be taking an unusual journey, intended
to expand the mind of the reader and force them to see system and network security
from a completely different perspective.
Ninja Hacking provides the reader with a unique perspective of how to conduct
unorthodox attacks against computing networks using disguise, espionage, stealth,
and concealment. Many books on hacking discuss traditional methods used to gather
information from corporate networks and systems. However, there are many infiltra-
tion techniques that are unconventional, which can yield greater access into a target
network. By blending ancient practices of the Japanese ninja with current hacking
methodologies, additional attack vectors can be realized.
Ninja Hacking explores historical Ninjutsu techniques and relates them to real-
world penetration tests and hacking efforts in a manner that expands the mindset,
tools, and methods of information of security experts who are intent on covertly
assaulting a target network.
Book audience
This book will provide a valuable resource to penetration testers and security profes-
sionals, as well as to network and systems administrators. The information provided
on unconventional attacks can be used to develop better and more specific defenses
against such attacks, as well as to provide new angles for penetration testing.
Those in management positions will find this information useful as well, from the
standpoint of developing better overall defensive strategies for their organizations.
The concepts discussed in this book can be used to drive security projects and poli-
cies, in order to mitigate some of the larger issues discussed.
xvii
xviii Introduction
How tHis Book is organized
This book is composed of 17 chapters, in six major sections:
• Ninjas and hacking – Chapters 1 and 2
• Tactics – Chapters 3 and 4
• Disguise and impersonation – Chapters 5, 6, and 7
• Stealth and entering methods – Chapters 8, 9, 10, and 11
• Espionage – Chapters 12, 13, 14, 15, and 16
• Escaping and concealment – Chapter 17
Because of the content and organization of the topics in this book, it is not neces-
sary to read it from front to back or even in any particular order at all. In the areas
where we refer to information located in other chapters in the book, we have endeav-
ored to point out where the information can be found. The following descriptions
will provide you with an overview of the content of each chapter.
chapter 1: the Historical ninja
In this chapter, we take a look at parallels between the historical ninja and modern
hackers. By understanding the pressures of war and society at the time, we can better
understand how ninja culture and their skills were shaped. We also contrast the ninja
against the samurai, and compare the ethics between both groups. By the end of the
chapter, we will be able to identify similarities and differences between modern-day
white hats who perform more traditional attacks and those people working in special
units who conduct unorthodox attacks.
chapter 2: the Modern ninja
Once we understand the historical ninja, we can extrapolate the skills necessary to
perform modern-day unorthodox attacks using the ninja philosophy as a framework.
We examine the differences between white hat versus black hat hackers, and identify
functional gaps between these two groups – gaps that can be filled with ninja hackers,
whom we refer to as Zukin. Once we identify these gaps, we examine ethical ques-
tions about the role of Zukin and merge ancient teaching about war and conflict with
today’s virtual world.
chapter 3: strategies and tactics
Sun Tzu’s “The Art of War” provides us with a wealth of knowledge that can be
applied to a ninja hacking project, which can be augmented with both historical ninja
strategies and tactics, and modern-day studies of war and conflict. The strategies
discussed in this chapter include some important topics, such as laying plans, waging
war, maneuvering, and the use of spies. We also examine briefly how female ninjas
were used in ancient Japan.
How This Book Is Organized xix
chapter 4: exploitation of current events
In this chapter, we will examine psychological operations to a greater extent and
build on what the ninja were experts at – playing on people’s fears. When combined,
the strategies used by the ninja in feudal Japan, espoused by Sun Tzu, and methods
of psychological warfare published by the U.S. military, can provide an effective
base of knowledge, in which to conduct devastating attacks against target systems,
all without being detected.
chapter 5: disguise
In this chapter, we examine the ways that the ninja, modern attackers, and penetra-
tion testers have used people’s predisposition to trust authority to their advantage. By
following their examples, and most importantly creating our own ways of disguising
ourselves, we can acquire a heightened level of trust by using uniforms and badges
to gain elevated access, posing as vendors, or presenting ourselves as someone that
the target might normally do business with.
chapter 6: impersonation
In this chapter, we cover the use of impersonation in penetration testing. This may
appear to be a simple thing – assume a disguise and play a role; however, if we need
to avoid detection at all costs, impersonation becomes a much more complicated
endeavor. If we decide to conduct an attack using pretexting, we need to make
sure that our disguise is perfect, and that our knowledge, language, understanding
of geography, and understanding of human psychology is exceptional for the task
at hand.
chapter 7: infiltration
In this chapter, we cover various infiltration tactics. We discuss topics such as bypass-
ing locks without leaving direct physical evidence and working around some of the
more common biometric systems such as fingerprints or voice recognition systems.
We also delve into the use of trusted networks in order to ease the penetration or
attack of logical systems.
chapter 8: use of timing to enter an area
In this chapter, we cover the use of timing in attacks. When entering a location,
whether from a physical or logical standpoint, timing is a key component to the
attack. Timing can allow us to pass completely unnoticed, walking into a building
with a crowd, or sending a cache of covertly collected data out over the network.
Timing attacks such as tailgating can allow us to enter a facility or network behind a
legitimate user, avoiding the notice of security systems and physical access controls.