COMP40741: Ethical Hacking Quiz

Ethical Hacking and Penetration Testing Lecture 1

• This module, COMP40741, covers ethical hacking and penetration testing
• Module leader is Dr. Nemitari Ajienka, Senior Lecturer and Certified Security Testing Associate (7Safe, GCHQ Accredited)
• Lecturer for the module team is Dr. Kwame Assa-Agyei
• Module materials are available in the Learning Room on NOW

Module Overview

• COMP40741: Ethical Hacking and Penetration Testing
• Covers module overview and aims
• Includes module content, delivery methods and schedule
• Provides indicative reading, learning outcomes, and assessment information

Module Aims

• Equip students with knowledge, skills, and ethical considerations for identifying and addressing vulnerabilities in computer systems
• Develop a comprehensive understanding of essential cybersecurity methods in ethical hacking and penetration testing
• Introduce students to ethical hacking principles, methodologies, and tools
• Develop practical skills in identifying and exploiting vulnerabilities
• Assess ethical and legal considerations
• Understand risk assessment and mitigation in cybersecurity

Learning Outcomes

• Knowledge and Understanding (K):
  • Demonstrate an understanding of penetration testing methodologies
  • Demonstrate an understanding of ethical hacking principles and methodologies
  • Evaluate the legal and ethical implications of penetration testing
  • Identify, analyze, and assess vulnerabilities and threats in computer systems
• Skills, Qualities, and Attributes (S):
  • Apply penetration testing techniques to identify and exploit vulnerabilities
  • Develop effective strategies to secure computer systems and networks
  • Communicate security findings and recommendations through comprehensive reports
  • Demonstrate critical thinking in risk assessment and mitigation

Assessments

• Online in-class test (30%): Individual assessment, testing theoretical understanding of penetration testing, ethical hacking, and legal implications
• Report (70%): Individual assessment requiring a hands-on penetration testing project, demonstrating practical vulnerability identification, exploitation, risk mitigation, actionable recommendations, and communication of findings.

Provisional Module Content

• Covering weeks 1-10, the topics include Ethical Hacking and Penetration Testing definitions, ethical considerations, overview of penetration testing methodologies, Information Gathering (passive, active, OSINT), Scanning and Enumeration, Vulnerability assessment, Exploitation techniques and tools, legal and ethical considerations relevant to penetration testing and Reporting, documentation standards, Risk assessment, Mitigation and Social engineering.

Resources or Reference Texts

• Contains lists of suggested texts for reference, including titles like Ethical Hacking, Penetration Testing Essentials, and a Kali Linux Penetration Testing Bible, from authors like Graham, Oriyano, and Khawaja
• Suggests additional learning from international conferences and journals

Web-based Resources and Tools

• Provides links for Immersive Labs, Digital Cyber Academy, VirtualBox, Kali Linux, Metasploitable, Seedubuntu and Ubuntu

Best Security Strategy?

• Defensive: Controls, Auditing, Policies, Standards, Guidelines, Network Architectural Design, Implementation
• Offensive: Pen Testing, Ethical Hacking, Security Assessment, Risk Assessments, Stress Testing

Unfair Security Challenge!

• Attackers can attack from anywhere in the world
• Security analysts must address all vulnerabilities

Who is the Enemy? A Hacker?

• Historically, hacker was a positive term referring to an expert in programming and operating systems
• Hacker, as a term, has become more negative since the 1970s, representing those who use computers without authorization or to commit crimes.

Other names for the enemy

• Crackers: Hackers who use their skills to commit unlawful acts or create mischief
• Script Kiddies: Hackers who use readily available scripts, without fully understanding them, to commit unlawful acts
• Black hat hackers: Hackers who have unethical intentions, and break into computers or networks for their own malicious reasons

What is their motivation?

• Profit: Ransomware, scareware, financial data theft, intellectual property theft
• Fun/Challenge: Hacking for enjoyment or to achieve a specific goal, e.g., Nasa hack
• Information Systems Criminals: Espionage/fraud/abuse for competitive advantage
• Vandals: Those motivated by anger against an individual, organization, etc.
• Political/Ideological: Hacktivists motivated by political or ideological reasons

What is their motivation (continued)?

• Power Assurance: To restore self-confidence or self-worth through seemingly low-aggression methods like cyberstalking
• Anger (retaliatory): Rage towards individuals, groups, institutions, or symbols perceived to represent injustice.
• Sadistic: Deriving gratification from the pain or suffering of others

Goodies or Baddies?

• Black Hats: Break into systems, create and share vulnerabilities, and attack tools
• Grey Hats: Operate in a middle ground between ethical and unethical intentions, often working as security professionals by day and engaging in hacking by night
• White Hats: Work within the security community, find vulnerabilities to help improve security and communicate these findings to vendors.

Ethics Discussion

• The course is for ethical purposes only, lab exercises must only be performed on a testbed.

Permission and Privacy

• Ethical hacking requires permission and understanding of acceptable boundaries
• Gaining permission doesn't justify any unauthorized actions
• Handling of sensitive information, like encryption keys, is crucial, and confidentiality is necessary

Permission and Privacy (continued)

• The name of any target/vulnerabilities must be kept secret during professional cyber security
• Confidentiality is essential, often supported by confidentiality and non-disclosure agreements

Responsible Disclosure

• Responsible disclosure is the process to notify a company of a security vulnerability
• The process involves allowing time for the vulnerability to be patched before publicly releasing the specific details.
• Minimizing risk of exploitation before a patch is released is a key element

Legislations

• International regulations for computer misuse and unauthorized access to computer systems and networks, such as the Computer Misuse Act 1990 (UK), Computer Fraud and Abuse Act 1986 (USA), Criminal Code Act (AUS)

What is Ethical Hacking / Penetration Testing?

• Definition from Engebretson (2013) - legal and authorized attempts to locate and successfully exploit computer systems for the purpose of improving security.
• Includes probing for vulnerabilities, and "proof of concept" attacks, with specific recommendations for addressing and fixing discovered issues.
• The method aims to find weaknesses by using the same techniques as attackers.

Importance of Studying Ethical Hacking/Penetration Testing

• EC-Council Cyber Career Paths and the Vulnerability Assessment and Penetration Testing (VAPT) Career Path

Penetration Testing Framework (ethical hacking)

• Includes planning/pre-engagement, information gathering, target scanning, vulnerability assessment, exploiting weaknesses, gaining access, privilege escalation, exploiting, retaining access, covering tracks, and reporting

Types of Penetration Testing

• Network/infrastructure, database, web, wireless, social engineering, and physical penetration tests

Types of Penetration Tests

• Black-box: No prior information is provided to the tester
• White-box: Tester is given full details of the target system (network and applications)
• Grey-box: Partial details are provided to the tester

Pre-engagement

• Pre-engagement involves discussion with the target to determine specific requirements for the test
• Like most things there are different levels of a penetration test (simple IP addresses, physical location, web application, or full simulation)
• A signed document granting permission to conduct the needed tests is required

Topics for Pre-engagement

• This category covers critical areas like scope, documentation, engagement rules, third-party/cloud environments, success criteria, review of past threats, and interference avoidance with security devices

Defining Scope

• The critical importance of defining testing scope ( what is to be tested )
• Potential issues from neglecting detailed planning, scope creep, dissatisfied customers, and legal issues

Questions - Network, Web, Wireless, Physical Penetration Tests

• Provides lists of important questions related to each test type to clarify requirements
• Specific questions are given for network, web, wireless, and physical penetration testing. These tests focus on various elements like compliance requirements, timing, devices, handling penetrated systems, and more.

Questions - Social Engineering Testing

• Discusses questions regarding social engineering testing, identifying the elements needed for the tests as specified by the customer (e.g., email addresses, phone numbers, individuals to target).

Scope Creep

• Effective methods to avoid scope creep to avoid losing clients/customers

ISP

• Importance of knowing terms of service with ISPs, potential need for notifying MSSPs (Managed Security Service Providers), determining the time response to ensure the integrity of the test

Important note:

These notes are based on the provided images, and should not be used for any specific action without the relevant qualification.