Stolen Laptops Providing Gateway To Hackers

Lost or stolen laptops which fall into the wrong hands can be
used to launch an attack on the corporate LAN using tools obtained online or
from auction websites.

In a recent demonstration showing network
vulnerability, a sample laptop with commonly used password security
was used to carry out a series of hack attacks to show how these mobile devices
can act as a gateway to data housed on internal systems.

Local user
passwords were compromised allowing data residing on the hard drive to be
harvested and attacks were launched on the device’s associated network
connections.

The first step to compromise the laptop entailed
hacking the BIOS before the Windows operating system had launched. A BIOS
reset connector, typically used by manufacturers to deactivate and reset the
laptop BIOS password during repair, can easily be made or purchased from
Ebay and allows complete access to data housed on the hard disk.

Alternatively, the hacker can remove the hard drive from the
laptop entirely and install this in another device without a BIOS password,
again allowing access to data on the drive.

Compromising Windows
passwords was equally as simple. Backtrack, a Linux tool on CD-ROM, was booted
on to the device, providing access to the Windows file system before the
operating system had even launched.

Software hacking programmes
such as GetSyskey and Gethashes were downloaded from the internet and used to
access the Windows encrypted passwords. In addition, Rainbow Crack, a
software tool which creates Rainbow Tables was used to compute the various
password hashes used by the LM password algorithm.

Using a precomputed
table of over 60GB of hashes, the administrator password was cracked in
under two minutes. Moreover, encrypted WEP passwords and remote desktop log-in
details from the Windows registry file were discerned using password recovery
software.

Having cracked these passwords, the desktop could be browsed
at leisure and files and documents on the laptop could be identified, even those
which the user had deleted from the hard drive. Disk Investigator, a
downloadable software tool, was used to recover deleted files from the
file system, as well as locating deleted files from flash media such as USB pen
drives.

Finally, a fictitious corporate LAN was broken in to using a
remote access client. An installed Cisco VPN client was used, and cached login
credentials stored locally in a .pcf file were located, enabling access. Cain
and Abel, a tool readily available online, was then used to crack the
Cisco VPN encrypted client passwords, decoding these into clear text.

Once inside the network, an enumeration attack was carried out to
browse named hosts. These PCs and servers, often given away by telltale names
ranging from the obvious, such as ‘Payroll’, to old techie favourites such as
Star Wars or Lord of the Rings characters, planets or Greek Gods, were easily
identified.

Having selected a target client, a free, open-source exploit
tool called Metasploit, which provides a simple graphical user interface, was
then used to gain administrative access. The hacker was now free to
export data from the internal host or carry out corporate sabotage or espionage.

The risk of attack to the corporate LAN has increased along with
the popularity of mobile working and hotdesking. FBI Computer Crime and Security
Survey claims around 50 per cent of organisations reported mobile device
theft in 2005 and it’s a problem that affects both the private and public
sector.

Over the last twelve months in the UK 21 laptops have been
stolen from Department of Trade and Industry (DTI) buildings and five
laptops have been misappropriated from the Office of the Deputy Prime
Minister. Any of these devices could have been used to compromise the core
networks of business or government using these simple tools and techniques.

Here are recommendations to organisations with mobile workers to help
combat information theft:

• At the very least, encrypt your sensitive files with freely available
  software.
  
• Set a BIOS password, even if they can be reset.
  
• Don’t allow users to boot from USB keys, floppy disks, CD ROMs or from a
  network.
  
• Use a secure VPN technology.
  
• Don’t allow the caching of passwords or user names in RAS clients.
  
• Educate your staff. All too often credentials can be found in notepad files
  on the desktop.
  
• Incorporate biometric logon devices.
  
• Consider full disk encryption.
  
• PIN lock GPRS or 3G SIM cards.
  
• Encourage staff to report laptop or mobile device theft immediately
  on discovery and ensure you have a 24-hour process to enable this.
  
• Consider using passwords which use UK-specific character sets, as
  most RainbowTables currently available are computed from American keyboard
  codepages.

Article courtesy of Security Park