Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

STEALING INFORMATION FROM THE U.S. INDUSTRIAL-MILITARY COMPLEX: TITAN RAINCyber Reconnaissance: Footprinting, Scanning, and EnumerationCyber reconnaissance is often carried out through three basic steps: footprinting, scanning,and enumeration. 28 Footprinting is the process of examining the structure of an organization’scomputer network. The information the hacker wishes to determine at this stage pertains tothe electronic traces users with the targeted organization leave, such as the range of IP addresses,the addresses of key network equipment such as routers, the availability of remoteaccess to the network, and the presence of network-level security devices such as intrusiondetection systems and firewalls. If we liken the targeting of information using cyber espionagewith the targeting of a fugitive using conventional means, footprinting would be analogousto determining the neighborhood where the fugitive lives. This type of reconnaissancecan be performed with varying levels of intensity. On the low end, reconnaissance can be inthe form of simple lookups of system information—for example, using a domain name server(DNS) to identify the IP address associated with a URL. On the other end of the spectrum,specialized software can be used for this step as well.Often, such footprinting can be accomplished without being detected at all. For instance,even on the low end, this task can be accomplished without queries made to the targets systems.In particular, queries to DNS servers and IP address registries can be made without theknowledge of the targeted organization. More intense footprinting reconnaissance could requireaccessing the target system (i.e., visiting Web pages maintained and written by the organization).However, information about the organization could also be found on Web pagesnot operated by the target institute, i.e., looking for employees talking about the company’snetwork infrastructure on Web forums.Scanning is examining a computer network at the next level of granularity. If we return toour analogy with the fugitive, we have identified the neighborhood where the fugitive livesand now wants information on potential hideouts. Likewise, with scanning, using the informationabout the computer network we gained in footprinting, the hacker now examines theindividual systems of interest. Here, the intruder is interested in determining details of thesystems such as what operating system is being used, what are the open ports on the system,and the configuration of the firewall. Earlier, less sophisticated and secure technologyallowed the hacker to simply “ping” the targeted system—essentially sending a messageto the system—to see if it was connected to the Internet. However, this rudimentary techniquequickly became blocked. Further, hackers are able to obtain much more of the desired informationusing specialized pieces of software. This software tends to run in an automated fashion.The hacker normally enters a range of IP addresses and the software runs overnight. Thenext day, the hacker checks the results of the scan, which is presented to him in the form of anoutput file from the software. With the proper information of the specific systems identified,the hacker then proceeds to the next step of reconnaissance.This next step is called Enumeration and involves the interrogation of specific systems.Returning to our fugitive example, we are now examining specific possible hideouts for certainvulnerabilities—i.e., determining the lock used on the door, determining if the fugitivehas a guard dog, etc. With enumeration, the hacker often attempts to log into a system withthe goal of finding specific data. The primary goal of this step is to determine the vulnerabilitiesof the system that may allow the intruder to obtain access. This process can be done manually,but again there are numerous pieces of specialized software that allow the hacker to125