|
||
|
Aggressive Network Self-Defense |
||
![]() By Neil R. Wyler Published by Syngress ISBN: 1931836205 Buy Now! Published:February, 2005 Pages:448 |
|
|
Watching the Watcher
David Jenkins was in a pretty good mood. Frankly, he was usually in a good mood because there was really nothing for him to be stressed about. He had a nice house, a beautiful wife, two kids who loved him, a cat, and a job he didn't mind waking up for.
David drove west on the Long Island Expressway, in light traffic, on a perfect day. He got off at Exit 55, took a right onto the Motor Parkway, and slowly pulled into his office parking lot. Today, he found a space close to the entrance, parked his car, and strolled inside.
"Hi, Cathy," David called to the receptionist as he walked into the lobby.
"Good morning, David," she said cheerfully.
"Isn't it?" he said.
He continued down the hall, smiling and waving at his coworkers as he went. He walked into his office, which he shared with the rest of the IT Department, Bryan Anderson. Bryan wasn't in yet; he never was. In the three years that they had worked together Bryan had arrived before David approximately six times, and on those occasions it had been because Bryan had fallen asleep at, or under, his desk while working on a particularly interesting project. David didn't mind, though; Bryan was a lot more reliable than most 23-year-olds ever were, and twice as intelligent.
The office wasn't large, but it didn't have to be for just the two of them. It had two desks, and two bookshelves loaded with technical books and company policy manuals. The only other life in the office consisted of a plant and a small fish tank. They were fortunate to be one of the few offices with a window, which faced west and overlooked the rest of the business park. It let in enough light in the morning to be pleasant, and reminded them they should go home when they saw that the sun was setting. Although it was not the most enchanting view, it was significantly better than the guy who spent his days in cubicle 42.
David sat down at his computer and checked his e-mail. He had been sent a reminder about a meeting that afternoon, three messages from users needing help with their machines, and one from Bryan's home account congratulating him on Manchester United's win that Saturday. Well, that is if congratulations are given with expletives and the questioning of your sexual preference. Bryan was an Arsenal fan, so that made him natural rivals with David, at least when it came to soccer. The only time they ever cheered for the same team was from April to October, when they watched, or occasionally attended, a Major League Soccer match and cheered for the N.Y./N.J. MetroStars. They liked to give each other a hard time, but to be completely honest, both of them were just pleased that in the last country to accept soccer for the beautiful game that it is, they had someone to talk to about it.
"Good morning, sunshine," Bryan said as he strolled into the office. "Ronaldo to Van Nistelrooy! Van Nistelrooy slams it into the back of the net! Goal!" David yelled.
"Blah, blah, blah. I saw the match; I don't need a play by play."
"Hey, you don't see me complaining about Arsenal's win."
"Yeah, but we played Newcastle. That's like beating up the handicapped, and that's wrong, Dave."
"Suit yourself," David said.
Bryan dropped down into his chair and started going through his e-mail, munched on a donut and quietly sipped his morning coffee. There wasn't a lot to do today, usually never was. When you ran an office, and a department, the way they were supposed to be run, the computers tend to take care of themselves. You slave away in the beginning, but if you can find that balance, then you have only the little fires to put out.
"I'm going to head over to Aaron's office and find out what's wrong with his machine; apparently it's slow again," David said as he headed toward the door.
"Oooh, I'm sure he has a virus," chuckled Bryan
"Well, of course. I swear that guy's the hypochondriac of the computer world. We should block sarc.com at the router so he can't see what he's going to have next."
"He called his wife last time; told her to scan their home machine again. I swear she did it. I could feel her panic over the phone."
Bryan's voice trailed off as David left the room. He headed slowly down the hall, stopped in on Aaron, whose machine was, as always, infection free. He passed Human Resources and changed a fan on Jared's computer, since it had been screaming at him all afternoon Friday. He finally poked his head in Jay's office and showed him how to stream music from the Internet. Sure it wasted some bandwidth, but they had plenty, and Jay owned the company after all.
David looked at his watch; it was 10:15 a.m. He'd been there a little over two hours, and the work was done. The only drawback to running such a tight ship was that you sometimes found yourself bored.
David walked slowly back to the office.
"Hey, Dave, what do you think of honeypots?" Bryan asked David as he entered the office.
"I haven't played with them," David replied.
"We should set one up. It'll be fun."
"Security is your thing. Plus, either they're expensive, or a royal pain to set up."
"No man, I've been looking at different ones that are cheap and easy to deploy."
"Well, I was just thinking how boring today was going to be, and we do have time. Sure, might as well give it a go."
"Sweet, I'll send you a few links, read up on the technology, and let me know which one you like."
David sifted through the massive amounts of information about the different types of honeypots available, both free and commercial. He checked reviews and even went through the honeypot mailing list archives on securityfocus.com. After burning up two hours he turned his chair toward Bryan.
"PatriotBox," he said.
"What?" Bryan asked.
"PatriotBox, that's the one."
"Okay, why?"
"It works with Windows, so we can use it with that XP machine sitting in the closet, and more important, it's cheap. If we're going to be playing with something we have no experience with, we should at least make it cheap to start."
"So how cheap?"
"Less than a hundred bucks."
"Oooh, that is cheap. Well go get it."
"Can't right now; I have to head to the meeting. I'll get it as soon as I'm back."
"All right, well I'm going to lunch then."
"Hot dogs?" David asked, already knowing the answer.
"Dirty Water Dogs, man! Get it right, and, of course."
"You know those trucks are nasty; you're going to end up catching something."
"Hey! Two Sabrett's and a Chocolate Cow never hurt anybody."
"No, but I'm pretty sure two a day would kill a rhino."
"Good thing I'm not a rhino then, isn't it?"
"Whatever, I'll see you after the meeting. Get out of here."
"Already gone."
Note
PatriotBox is a Windows-based honeypot server created by Alkasis Software. It has the ability to emulate eight different operating systems, including FreeBSD, Linux, and various versions of Windows from 98 to 2003. It can emulate numerous services, as well as an open mail relay and computers infected with Sub-7 or BO2K. It also supports the use of honeyd (http://honeyd.org/) scripts and its latest version contains MySQL and MSSQL support. It can be found at http://www.alkasis.com.
After the meeting David went back to his office, ordered PatriotBox, and sent out the e-mail for the activation key. He looked over at Bryan, who was diligently playing solitaire.
"Don't you ever get tired of that?" David asked.
"I'm an MCSE man; I never get tired of this," Bryan replied.
"MCSE?"
Minesweeper Champion and Solitaire Expert," Bryan said with a grin.
"You have problems; you know that?"
"An addictive personality, I know. If I could change that then maybe I could get away from these ridiculous machines. But seriously what fun would that be?"
David waited about an hour for his activation key to arrive and then activated the software. The program was rather impressive. He selected the operating system that he wanted to emulate from a drop-down list, and right-clicked on the desired services to enable them. Was that it? Was this thing working?
"I think it's working," David said.
"You think?" Bryan asked.
"Well it was really easy, like I didn't really do anything. I just clicked a few places."
"Well, leave it running. The day's over for us; let's get out of here and maybe we'll know in the morning."
"Sounds good to me."
"See ya tomorrow."
"Tomorrow."
David walked out to his car happy to be only a short drive from his family. He drove home to his nice house, made dinner with his beautiful wife, and played with his kids, who loved him. They watched a movie as a family; he tucked the kids in for bed, and turned in for the night. A few miles away, in a building, in a closet, a light was softly pulsing on the back of a network card.
About the author
|
Neil R. Wyler (aka Grifter) is an Information Security Engineer and Researcher currently located on the Wasatch Front in Utah. He is a staff member of the Black Hat Security Briefings, Def Con hacker conference, ApacheCon, and Gnomedex. He has spoken at numerous security conferences and been the subject of various online, print, film, and television interviews regarding different areas of information security. He is highly involved in the hacker community and helps organize and support many of the local hacker meetings, including DC801 and 2600SLC. He also serves on the advisory board for a local technical college. Neil was born and raised on Long Island, NY, before entering military service with the U.S. Air Force. He is currently the co-owner of a Utah-based consulting firm with clients worldwide. His Web site can be found at http://rootcompromise.org. Many thanks go to my beautiful wife, for putting up with me not only during the production of this book but also for the last seven years. To my family, who didn't know I was writing this book until they held it in their hands. And to my friends, for their insight and continued patience with me. To my coauthors and everyone at Syngress for making this book happen. Thanks also to Jeff and Ping Moss for the Black Hat Briefings, Def Con, and their continued friendship; the zZq guys, 2600SLC, DC801, and all the Utah hackers. I also want to thank my many friends from Def Con, Russ Rogers and securitytribe, Barkode and Ninja Networks, Freaky and Irvine Underground, Caezar and the Ghetto Hackers, Pyr0 and the 303, and everyone from the Def Con Forums. And last but certainly not least, to all the hackers of the world, whether White Hat, Black Hat, or Gray Hat; you keep life interesting, and always fun. |

