Jesse Varsalone - Defense against the Black Arts: How Hackers Do What They Do and How to Protect against It

CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742

2012 by Taylor & Francis Group, LLC

CRC Press is an imprint of Taylor & Francis Group, an Informa business

No claim to original U.S. Government works
Version Date: 20111024

International Standard Book Number-13: 978-1-4665-0920-7 (eBook - ePub)

This book contains information obtained from authentic and highly regarded sources. Reasonable efforts have been made to publish reliable data and information, but the author and publisher cannot assume responsibility for the validity of all materials or the consequences of their use. The authors and publishers have attempted to trace the copyright holders of all material reproduced in this publication and apologize to copyright holders if permission to publish in this form has not been obtained. If any copyright material has not been acknowledged please write and let us know so we may rectify in any future reprint.

Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented, including photocopying, microfilming, and recording, or in any information storage or retrieval system, without written permission from the publishers.

For permission to photocopy or use material electronically from this work, please access www.copyright.com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses and registration for a variety of users. For organizations that have been granted a photocopy license by the CCC, a separate system of payment has been arranged.

Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identification and explanation without intent to infringe.

Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com

and the CRC Press Web site at
http://www.crcpress.com

Over the years Ive found that people come to computer security from very different technical backgrounds. Some were programmers, some were network administrators, system administrators, or database administrators; they worked at an ISP, they came from law enforcement; some went to college as computer science majors, some didnt, and some were even still in high school. Some came to the field because they just loved hacking; they could tell you about their first programming language at age 14, and the first time they exploited a vulnerable system when they were 16. Some were IT professionals who heard that computer security was where the money wasand they were right.

I become interested in network security after attending a security conference called Def Con (www.defcon.org). It was a great experience and I learned a lot in those 3 days. Soon after Def Con I purchased some security booksOKlet me tell the real story.

I was working as a help desk technician at the time. I had just passed my A+, Network+, MCSE, and CCNA certifications. Although I had no real experience outside of explaining to people how to right click all day while working on the help desk and the certification exams I had recently passed, I really thought I was pretty sharp when it came to computers. My information assurance manager asked me if I was going to Def Con. I had never heard of Def Con, but when I looked it up on the Web I was really excited about the idea of going to a hacker conference. It sounded cool.

Walking around the hotel where it was held back then was interesting. There was really loud techno music everywhere I went and copious amounts of alcohol. Hackers had turned the pool purple, poured cement in several toilets, hacked the ATM machines, and paid strippers to run through the crowds naked with clear plastic wrap around their bodies.

I was completely lost when I attended the presentations given by the Def Con speakers. I had absolutely no idea what anyone was talking about. I had heard of Linux, but had no idea of what it was. I had no idea what OpenBSD was. I found a 17-year-old kid who didnt seem to mind explaining to me what all of this stuff was. He patiently answered my n00b questions (Whats a port scan? Whats a buffer overflow? What is Linux?) He was a participant in the hacking competition that year, and he took me over to his teams table. I sat there in amazementI had absolutely no idea what was going on, but I was drawn to it somehow. No one was using Windows, no one was using a graphical user interface (GUI); everyone was writing code right there on the fly in the middle of the competition. Although I didnt know what was going on, I somehow knew I wanted to be one of these people. I was thoroughly embarrassed because I flat out couldnt play. With all of the certifications that I had, I was absolutely clueless about hacking.

At one point there was guy who wrote a script that changed the ports that attacking teams saw as open every 6 seconds. I said to him, Wow that should buy you guys some time; he said, No, they figure this out pretty quick. I sat back in amazementjust speechless. I didnt know what to say to that. This was just one of the many things I saw these guys do that I had absolutely no idea how to do. I didnt even know where to go to look this stuff up. I mean come on, what do you google to learn how to do something like that?

How are these guys doing this stuff without books, or even without Internet access to look this stuff up? I soon realized that they had heard I had all of those certifications and let me sit there and watch them hack just to embarrass me. Most people with a lot of computer certifications, as they call them, are absolutely clueless when it comes to security, and in my case, they were right. It didnt take me long to put my hurt pride aside. I started buying everyone pizza and drinks so they would let me just sit and watch. As I said, I was drawn to this stuff for some reason. I had no idea what they were doing, but I knew this is what I wanted to do. After the competition was over I started asking the guys who were on the team how I could learn to do what they were doing. They told me to stop using Windows and switch to Linux or BSD, learn to program, then build a network of several different operating systems and hack them.

When I got home from Def Con I bought several books on Linux, programming, and hacking. I rebuilt my home network with installations of Red Hat Linux and FreeBSD without GUIs. I got rid of Windows, and started trying to learn how to program in C. I joined a bunch of security mailing lists, and I just flat out immersed myself in this stuff.

Fast forward to today nearly 10 years later. Im a security consultant and trainer. Now I teach almost every day. Sometimes I miss those early days of learning to hack. The security field is very different nowits grown exponentially, and gone in so many different directions. Even though there are many books, tutorials, conferences, and courses, I think its actually harder to learn now because the field is so big that a lot of beginners have no idea where to start.