Contents

Introduction

Chapter 1 Get Your Free Credit Cards Here

Setting the Stage

The Approach

The Chained Exploit

Enumerating the PDXO Web Site

Enumerating the Credit Card Database

Stealing Credit Card Information from the Web Site

Selling the Credit Card Information on the Underground Market

Defacing the PDXO Web Site

Chained Exploit Summary

Countermeasures

Change the Default HTTP Response Header

Do Not Have Public Access to Developer Sites

Do Not Install SQL Server on the Same Machine as IIS

Sanitize Input on Web Forms

Do Not Install IIS in the Default Location

Make Your Web Site Read-Only

Remove Unnecessary Stored Procedures from Your SQL Database

Do Not Use the Default Username and Password for Your Database

Countermeasures for Customers

Conclusion

Chapter 2 Discover What Your Boss Is Looking At

Setting the Stage

The Approach

For More Information

The Chained Exploit

Phishing Scam

Installing Executables

Setting Up the Phishing Site

Sending Mr. Minutia an E-mail

Finding the Boss’s Computer

Connecting to the Boss’s Computer

WinPcap

Analyzing the Packet Capture

Reassembling the Graphics

Other Possibilities

Chained Exploit Summary

Countermeasures

Countermeasures for Phishing Scams

Countermeasures for Trojan Horse Applications

Countermeasures for Packet-Capturing Software

Conclusion

Chapter 3 Take Down Your Competitor’s Web Site

Setting the Stage

The Approach

For More Information

The Chained Exploit

Attack #1: The Test

Attack #2: The One That Worked

Getting Access to the Pawn Web site

Lab-Testing the Hack

Modifying the Pawn Web Site

Other Possibilities

Chained Exploit Summary

Countermeasures

Countermeasures for Hackers Passively Finding Information about Your Company

Countermeasures for DDoS Attacks via ICMP

Countermeasures for DDoS Attacks via HTTP and Other Protocols

Countermeasures for Unauthorized Web Site Modification

Countermeasures for Compromise of Internal Employees

Conclusion

Chapter 4 Corporate Espionage

Setting the Stage

The Approach

The Chained Exploit

Reconnaissance

Getting Physical Access

Executing the Hacks

Bringing Down the Hospital

Other Possibilities

Chained Exploit Summary

Countermeasures

Countermeasures for Physical Security Breaches and Access Systems Compromise

Countermeasures for Scanning Attacks

Countermeasures for Social Engineering

Countermeasures for Operating System Attacks

Countermeasures for Data Theft

Conclusion

Chapter 5 Chained Corporations

Setting the Stage

The Approach

The Chained Exploit

Reconnaissance

Social Engineering Attack

More and Yet More Recon

Aggressive Active Recon

Building the Exploit Infrastructure

Testing the Exploit

Executing the Hack

Constructing the Rootkit

Game Over—The End Result

Other Possibilities

Chained Exploit Summary

Countermeasures

Countermeasures for Hackers Passively Finding Information about Your Company

Countermeasures for Social Engineering Attack on Visual IQ

Countermeasures for Recon on the Visual IQ Software

Countermeasures for Wi-Fi Attack on Quizzi Home Network

Countermeasures for the Keylogger Attack

Conclusion

Chapter 6 Gain Physical Access to Healthcare Records

Setting the Stage

The Approach

For More Information

The Chained Exploit

Social Engineering and Piggybacking

Gaining Physical Access

Booting into Windows with Knoppix

Modifying Personally Identifiable Information or Protected Medical Information

Chained Exploit Summary

Countermeasures

Social Engineering and Piggybacking

Lock Picking

Defeating Biometrics

Compromising a PC

Conclusion

Chapter 7 Attacking Social Networking Sites

Setting the Stage

The Approach

The Chained Exploit

Creating a Fake MySpace Web Site

Creating the Redirection Web Site

Creating a MySpace Page

Sending a Comment

Compromising the Account

Logging In to the Hacked Account

The Results

Chained Exploit Summary

Countermeasures

Avoid Using Social Networking Sites

Use a Private Profile

Be Careful about Clicking on Links

Require Last Name / E-mail Address to Be a Friend

Do Not Post Too Much Information

Be Careful When Entering Your Username/Password

Use a Strong Password

Change Your Password Frequently

Use Anti-Phishing Tools

Conclusion

Chapter 8 Wreaking Havoc from the Parking Lot

Setting the Stage

The Approach

For More Information

Accessing Networks Through Access Points

The Chained Exploit

Connecting to an Access Point

Performing the Microsoft Kerberos Preauthentication Attack

Cracking Passwords with RainbowCrack

Pilfering the Country Club Data

Chained Exploit Summary

Countermeasures

Secure Access Points

Configure Active Directory Properly

Use an Intrusion Prevention System or Intrusion Detection System

Update Anti-Virus Software Regularly

Computer Network Security Checklist

Conclusion

Index