Windows XP security test

Both IP's are signed up! No more room left for others! All accounts of verifying it is my IP have been processed (to the point of tinfoil hat verifications), and it is a go. Thanks guys!

Box information

Windows XP Pro SP1 with latest patches
400MB RAM
Pentium III 800mhz Processor
3rd party firewall instead of built in ICF firewall so I can monitor logs.

Note: After this case-study is COMPLETE, I will be conducting another case study using nothing but Windows XP Pro SP2 with latest patches. No 3rd party firewall involved. More details on that later. This way not only can we prove that a good admin can lock up XP tight as a drum, but that the newer default installs of XP with SP2, without 3rd party software, and in the hands of a good admin.. are still going to be tight as a drum.

Greetings,

Recently there have been topics of conversation in regards to the security of Windows, and in particular, Windows XP. I would like to settle this in a proof-of-concept case study. I have an XP box sitting right here. Now, I have gone through the measures of securing it, protecting it, and safeguarding it to my finest degree.

I want it cracked. I want it wide open and hacked. Now mind you this isn't a free for all, but a very serious and monitored case study. Logs will be kept, a whitepaper of your activity is required, and most importantly... you need to ask permission. I will only be allowing two people at a time, and will only disclose the IP of that box via PM (or AIM) to people that I feel qualify as mature and responcible individuals. If you are interested in participating, please respond here with a way for me to contact you, or contact me yourself via PM (or AIM). I do have permission from my ISP, but they are keeping a safe eye on it. If more than two people try to attack (that is saying, one of the two people I am allowing gives it to one of their friends) then that third IP will be logged and considered an illegal and unauthorized attempt of network penetration.

This means if I give you permission after you ask me, keep it to yourself. This is not a game, but a true case study, which I can not stress enough.

regards,
Pooh Sun Tzu

Just curious PST is there anything that people are not allowed to do when trying to break into your system ? DoS ? DDoS ?

Just wondering ....

But overall sounds very interesting. Can't wait to see the results.

There was a really good thread awhile back where a bunch of people from AO got suckered into hacking into a box where thay had no good reason to be (hopefully someone will link to it...I don't remember enough about it to find it again)

Anyway...how do you propose to prove that the box is yours? Because you give out an IP number via PM? If I wanted help hacking into a box, and wanted to keep it low key, I would only tell 2 people at a time.

I really do applaud the effort...I would be interested in the results also...I just don't know how you can difinitively prove you own the box? And how do you prove your ISP is ok with it?

You know, once biten, twice shy...

Quote:

---

Anyway...how do you propose to prove that the box is yours? Because you give out an IP number via PM? If I wanted help hacking into a box, and wanted to keep it low key, I would only tell 2 people at a time.

---

No big deal :) If you don't believe it is me, then no worries and don't apply for it.

Quote:

---

I just don't know how you can difinitively prove you own the box? And how do you prove your ISP is ok with it?

---

Let's see. All of my image hosting that I post on the boards comes from that IP, and moderators could verify that as my posting IP. Now this isn't something I need to prove to you :) You either accept it or you don't. Sound shady? That's fine. But seeing the history of the person asking should give you a very fine idea of how that person acts, and what kind of posts they make.

Don't get me wrong, I'm not attempting to be shady here. But how on earth can I prove it is my IP? I know. Tell you what. If you decide to join, I'll prove it by hosting an image of whatever you ask. I'll change the image numerous times if that pleases you.

Quote:

---

Just curious PST is there anything that people are not allowed to do when trying to break into your system ? DoS ? DDoS ?

---

Anything is allowed, so long as you stick to one IP address. This way I can monitor the logs properly along with the whitepaper release, and so my ISP knows who is parcitipating. That does, by nature, remove DDoS, since it requires multiple IP addresses. DoS itself is fine. One IP, anything goes. The moment you use a 2nd IP, I will block all IP's dealing with you and report it.

PST
You are setting it as a white paper? will you be able to post results here, with possibly concurrent statements ? ie, your M/C, time and your responses, set against the incoming attempts, also timed etc. Ideally so we / I can read it as a form of text book chapter ??
ie
Time 00:23:32 GMT firewall detected first anomaly. Against the attackers log of the same time,
so we could see attack and defence played out. Possibly with comments from either side as to what is happening and what is now expected and why?
I ask as a newcomer to IT, hoping to make sense of what I can, and at present, feeling only that I'm tip toeing in the shallows and already feeling out of my depth.
I'm sorry if this is a bit dumb? or maybe this is a precis of what a white paper report is??
either way I'm interested in this as an exercise.

What services will you be running?

Interesting idea and point of view, so I have realised I. I will be requiring white papers of the two people conducting in the test, and may as well save all log files of my own to compare it against.

So yes, I will be doing that :) Didn't even think about adding my own log information to it.

Prove the box is yours, give me the rules (if any), and I'll throw down. I mean the least I could tell you is that I couldn't get in. For your case to proven however, are you gonna set up a *nix box for the same project?

I'll give you any info on what I do to case the joint, and if success is an end result, I'll tell you how I busted in.

I do strongly suggest not allowing and type of DoS because that is kinda lame.

Any hint on the services, or do we get to figure that one out?

Be safe and stay free

Dopey, sent a PM to you, check your box please.

OK, I'll bite. Considering that I've spoken to PST in IRC, I trust that this box is legit. Give me your IP and I'll see what I can do.

Cheers,
cgkanchi

EDIT: Are spoofed IP's/proxies etc. allowed? Also, is the XP box running a firewall?

EDIT2: Could you put some kind of script or something up to say how many IP's are currently attacking the box? Like HTTP or something?

We may already have our 2nd person participating, so I'm going to have to hold off on allowing you to test. But I can answer your questions:

1. Spoofed IP's are perfectly fine, so long as you use that spoofed IP the ENTIRE TIME. To be honest, I don't see the reason for using the spoofed IP, since I will already know it is you. But hey, whatever makes you happy. The moment you use your real IP or switch to another spoofed IP, is when we have problems.

2. No, no script to show currently attacking IP's for two reasons:

a. To keep the attackers anonymous
b. No way in hell I'm creating a non nessessary script during a case-study on security

3. Firewall? Services? That's for you to figure out.

Take my word for it or not. I have run down a few things I can think of to prove it is his box. I'll just say this, if he is in fact somehow spoofing the results. He doesn't need our help to own any box, and secondly he already owns it. To each his own. I am pretty sure he is legit.

Be safe and stay free

is this a true windows test or is it a test of third party softwear that you have installed. I know you are beta testing sp2 just was wondering if that was the box in question?

3rd party software will be used of course. I said a secure XP box :) Would you dare run a *nix workstation without the proper security 3rd party tools that are essential? Nmap? Tripwire? ipchains? Softwall? I didn't think so.

This isn't about testing a default install, it is about testing the security of Windows XP in the hand of someone that fully understands the OS and is an admin of it.

This will be proving the point, and hopefully ending the argument, that XP is insecure. Why? Because I'm going to prove that in the right hands of someone who actually too the time to learn it.... it can be just as secure as OBSD running tripwire, ipchains, softwall, and the NSA kernel installed.

I applaud you pooh sun for doing this. Finally there will something to point to when a linux centric user starts a "Linux is more secure than Windows." I can't wait for the results and when all is said and done, I would like to know what all you did to secure the box. A nice tutorial perhaps.

pooh sun tzu: Is this already over? If not, let me get the IP of your computer and have at it a little bit. :)

Jehnx, it is already over. Ended last night as a matter of fact.

Here are the basic stats, and I will be printing a total whitepaper soon:


Intrustions: 0
Successful DoS's: 0
Firewall Breaches: 0


There simply isn't a way in guys, sorry :) You can not break into a server that only has one open door, and when that door is the latest version as well as being configured to optimum security,

We may not always get along, but this is nothing short of applause worthy. We need more people doing this.

Maybe one of these days I'll put one of my boxes in the DMZ and let people have a crack at it....Pun intended.

For anyone who has ever done this before, they know it's cool, but for the people who have no idea why anyone would do this; Well,can YOU think of a better way to test your security than letting people do it for you?


PST; What about Windows server 2003? Any chance of you doing the same with that?


Also, you should really promote these results, around here, I know of a few places that won't use XP because of the security myth around it.

gore, I know we used to hate each other in the past, but it seems both of us have overcome some unseen barrier and would much rather hug(?).

As for doing a similar event for Windows 2003, it is a possibility. I don't know if you have seen my recent Windows XP Security guide yet, but I'm in the process of writing how to secure Windows XP from the bottom up, starting from the Installation beginning to the final 3rd party program. After I finish that series, I may give 2003 a chance (however, by that time I may be in such a crave for just touching the nix OS that I could plug on fedora for a good month or two)

And yes, I will be posting the whitepaper/results so that people know the heavy amount of testing preformed by a number of very talented people. Thanks for your nod of encouragement, and next time I damn well expect you to take part in this :)

Interesting concept, but what does this really prove? How do we know that the people you picked to "hack" your server really have any intrustion testing abilities? How do we know that they choose not to use their uber-3l1t3 h4cks on you so that they wouldn't give away the secret???

If you were trying to prove that a windows OS based on NT can be secured, was there really a need? Unfortunately, if someone doesn't believe that a windows OS can be secured, what you have presented here isn't really going to change their opinion. They already don't agree with what educational and government testing of the products have proven. Why expect a non-scientific test to prove anything?

I could go on and quote all of the major sources that say that the "hack this website" for $100k contests don't prove anything, but we have all read those stories. I think the same arguement applies here.

The fact is that most hacks are from vulnerable services running and social engineering, the latter is totally excluded by this methodology and were the services realistic? , web with cgi , database , dns ,smtp ,ssh.... Targetting many times occurs due to what services you are runing already which was also excluded in this test. Anyone can put any updated firewalled box with no vulnerable services running up and no one will hack it unless they are very leet or have friends who are. From a purely scientific pov All this proves is that pooh can run windows update and configure a firewall properly, probably as far as i can see so.

Yup, apache was running with CGI, etc etc. You tend to forget that a server or computer does not have to have 40000000 services running. You run what is needed. The point of this exersize was to prove that a good firewall and an OS in the hands of a good admin, is unpenetrable. If you think you can do better, take a crack at it. But know that you won't be getting in. I'll make double sure my IDS autobans any scanning computers this time.

Yes, that's right, windows IDS ;) So both of you can either continue whining aind complaining about "this doesn't prove anything wahhhh". Or take a shot at it.


properly configured firewall + updated services + properly configured services + proper IDS + proper admin observation == an near unpenetrable box

Of course this means a weakness of social eng. could exist, and they would sweet talk information out of me. Then again, would you be able to do it?


If you don't believe that algorithm, then why not let you two being the last ones who crack it. It's a very simple algorithm, and you need to put your keyboard where your mouth is. I know I did, and here I am now hosting this security test that has yet to be penetrated because of that above algorithm. My point was to prove in the proper hands of a knowledge admin, XP is untouchable. Prove me wrong, or don't comaplain about it not proving anything :)

pooh sun tzu: I still disagree with ya mate. Let a few more members, myself included, mess with it. I don't think that anything is completely secure, ever, and I can almost guarantee you that if you put it back up with some of the more proficient seniors that you'll have a different outcome. Though, in the same sense, your point is proven in that the normal person can not break into a server, indeed.

Also, who all participated in this, do you know? I didn't see a list or anything anywhere.

I will not be releasing the names of those who participated in it, unless they request it. But I can assure you, they were not "normal people", but those on AO who had actual skill.

I have sent you a PM, and will allow yet another person to have a shot at it.

Hehe, thank you pooh, and I have replied to your PM. All pings timeout.. pfft. :-p

Pooh- I think you need to go back and re-read my post as you did not understand what I was trying to say. What was the need? If a person has any security knowledge they know that what you are saying is true. Which is exactly what my last post stated.

Quote:

---

If you were trying to prove that a windows OS based on NT can be secured, was there really a need? Unfortunately, if someone doesn't believe that a windows OS can be secured, what you have presented here isn't really going to change their opinion. They already don't agree with what educational and government testing of the products have proven. Why expect a non-scientific test to prove anything?

---

To rephrase it a different way, if somebody doesn't already think that a windows OS can be properly secured, they are going to blow holes all in your testing method to not agree with you regardless of what you do or if anybody gets in or not. I never said I didn't agree with you. Although I really don't think there is such a thing as an inpenetrable system. You just have to make it so difficult that it isn't worth messing with.

Although these kinds of wargames are fun and I enjoy them thoroughly myself, its important to remember that this is a "rigged game" if you will. In this situation the Admin knows who is going to attack what box and gets to make up the rules (hardly a real life scenario), which in this case restrict the attacker to using technical attacks against one hardened machine running services of Pooh's choice so really only a 0-day exploit is likely to succeed,but as everyone knows security is like a chain, in that it is only as strong as the weakest link, meaning in a live situation an attacker is going to choose his own (weak) victim not Pooh's choosen (hardened) victim. Once the attacker has comprised the weakest member of the herd that machine can be used to leverage access within the domain/network to compromise network devices and other more difficult targets. The real question is not whether Windows can be hardened when properly locked down but rather can you maintain this level of security on ALL the machines on your network ALL the time (and fend off other techniques used to gain unauthorized access as well) , and that is where things get interesting. :)


-Maestr0

Whine and complain however you want. 0 breakins, 0 DoS successful attacks, 0 firewall penetrations. Services running? Apache.
This can apply across any network as security and is a very simple thing. My guides of XP security explain exactally how I did it, which is quite easy to do across any network. Don't believe me? Thikg it was rigged? Too bad. A computer is a computer is a computer. I will harden each computer just as much as the next, because that is called 'being a good admin'
Let me also remind you what the rules where: Anything goes save DDoS. That's right. There were no restrictions, no "you can't do that!". I denyed DDoS because there is no defense for it save waiting for them to stop, thus vulnerable. This computer is exactally how my servers and other networked computers are secured, meaning nothing here was rigged. I'm sorry you feel that way. However, those who participated now view Windows security in a much better light (and mind you they are not complaining).
:) So, a normal XP, secured through my normal means, granting the attackers to do WHATEVER they wanted, and not defining firewall rules against their specific IP's. That's pretty damn non-rigged. Shall we even discuss that I turned off the windows IDS? God forbid it catches them port scanning and perma-bans their IP. Understand that I gave them plenty of opprotunuites, but in the end the only weak link in the entire bit was me. And good luck trying to SE me in any situation. Case stands, XP can be secured in a normal security situation to an unpenetrable degree. "Nothing is unpenetrable" is an old adagio formed by old-school scripties. Sorry guys, but I've seen that saying fail far too many times.

OK, so how much stuff do you have running on that web server? How many 3rd party web apps that you do not have the ability to do code audits on? Probably not much of anything. Any successful web attack that I have ever analyzed have usually come about because of one of three things:

1) misconfigured services- you have this base covered.
2) Out of date patches. Which is really addressed if you configure your systems properly anyways. But you have this covered
3) Bad code in web applications. There is no way that you can look through every line of code that exists in a web application. I know a company that tried to do it, Pilot Web Services, and they went out of business about three years ago because they couldn't keep their customers happy. Was their network secure, you bet. But was it usable? Not really. It took way to long to roll out new updates, and they flat out refused to allow some things to be used that the customer absolutely insisted on having. Bottom line, they lost their customers. If you would like to know a little more about Pilot do some research on the security expert Tom Wadlow. He has written a couple of very good books on secure network design, and he was the brains behind the network and IDS that Pilot built. He is an extremely brilliant security expert and someone that I agree wholeheartedly with on many different security topics.

So I ask again how can your test in anyway be compared to a real world environment? If you think you can build an inpenetrable system that can still function in a useful business fashion in every single case, you should take your own advice from another thread and, "Get off your high horse." Also think about the fact that you are not the only user on a normal corporate business system. Securing a home PC with one user, and a web server on it, is a lot different than trying to secure a carrier class network with over 70k users and hundreds of physical locations. If you try to argue this point, I will really begin to wonder if you have any administrative experience in a large corporate environment. I'm not saying that as a personnal attack, or trying to put myself in a higher position. It is just that securing a small network while fundamentally the same as securing a large one, is much different as they each have their own unique challanges and obstacles to overcome.

All you have done is try to argue with people about how good of an administrator you are, when people are trying to agree with you on some of your comments. Your eagerness to argue to no end is really becoming noticable to most of us.

Given the circumstances presented in this test can you build a really secure XP machine? Of course you can. You haven't proven a thing that isn't already known by most of the senior members on this system. Does that mean that you can always build a secure system in all circumstances? No, of course it doesn't. Like I said, the purpose of security isn't to build a inpenetrable system, because it doesn't exist. The purpose is to build something that is so difficult to penetrate that it isn't worth it. And I won't argue that with you. There are plenty of PhD's at AT&T Labs and other places of higher learning that agree with me, and I will continue to agree with them.

Quote:

---

Whine and complain however you want.

---

I see no one here whining or complaining. And again I ask you to take your own advice from some of your other recent posts and realize that this is a discussion. Don't take it so personnal.

And as far as you little score card. I ask again how many people with access to 0day exploits have you let have a whack at your systems? I say that score card would read 0 as well. You have totally neglected to address that fact.

:) "People who always seek to destroy things will find something wrong with everything". I ask you to reread the origonal parent post so you understand what I was proving: "That XP in the hands of a good admin can be locked down as secure as any other OS". That was proven, putting a lot of argments from the past to rest.

Can you not drop this old thread so we can move on and not end up hating one another?

Don't worry. It would take a lot more than this to get me to hate someone. :) I know what the original point was, and I said from the beginning that I agree with you 100%. I have only been trying to get you to see my point that if somebody is of the notion that XP cannot be properly configured and secured, they are going to come up with countless ways to blow holes in your test. So while I'm sure the test was fun to put together, and you may have seen some interesting things, the linux blowhards that just love to hate Windows are going to continue to hate windows regardless of what you did. So I don't really think that the windows can't be secured argument is going to die anytime soon. People just love to hate the big guy, not sure why, but they do.

And yes I know this thread may be a week or two old, but I don't have the luxury of visiting this site everyday like many of you do. When I replied yesterday was the first time I had read your response to my post from a week ago.

If you ask me, this thread will never die, so I agree with mohaugn. If this thread is going to have any leverage in the "equality of the OS giants" argument, it should have more than 4 people test it for security. But then again, I have no clue what kind of time you have on your hands to take on such a project, it would be kind of a hassle, and nobody is paying you.

BTW I could only find evidence of about 4 people testing the server, maybe you have done more outside of the thread. Have you finished a final compilation of the whitepapers, or am I being impatient?

Like gore said, maybe you could continue with 2003 server to add some weight to the experiment, and try some different services, whatever. Maybe mix it up, add some more attackers, maybe at once?

Like I said, as a argument to support Microsoft, this thread will never die, and will be linked to forever. So maybe it would be a good idea to give it as much weight as possible.

Almost Cubbie season-
Soda

I do agree with both of you, but let's be honest here and take it logically

Security is guarenteed in any OS according to 3 principles

1. An IDS is in place to defend against attackers, banning IPs at will.
2. An admin has properly updated and securly configured all running servces (no matter how many there are)
3. Information security policy to at least begin preventing SE.


Note that no matter what OS, if someone gets caught by my IDS get a nice big DROP for their IP since the IDS will ban that IP. I could of course run more services, but if each of my services are updated to the latest patch, secured in the deepest way possible, then they can only rely on 0 day exploits, which takes us back to #1 and #2. If an IDS or admin notices this activity (and 0 day exploits attempts) then it is only nessessary to ban that IP.

So what I am saying is yes, windows-haters will forever find something wrong with this test. But the basic facts of security remain, regardless of if I am running 100 services or 2. By following the base principles of security, an OS can be made secure :) Any OS. So we could do this test for Mac, Nix, etc etc etc... not because of programs/settings, but because we can understand how TCP/IP (and the system in general) works.

I'm trying to get that white paper together, but 3 out of the 4 atttackers have YET to respond to my pms for their logfiles.


edit: I have had some people ask how an IDS can detect 0day exploits without a signature. Here is my responce :

While the attack pattern is what sets off the IDS, an IDS (a good one) still monitors (or the firewall monitors) activity. While it is unknown activity it is still activity. Couple this with the logfiles generated by the service in question and you have a pretty good idea if someone is attempting an attack or not. So, it is more a firewall+IDS+logfile_review marriage than the IDS itself to handle and detect 0 day exploits

Poo- agreed. The other, and what I see as being the biggest issue, is an attack that masks itself as valid data. This is where I was talking about the type of web applications and the ability to do code verification on web applications. If I can get your web server to perform a buffer overflow, and in turn get that problem to execute commands. There is a potential that a very skilled attacker could do everything they want to your box just by passing http traffic. If you have an IDS monitoring a wide range of web applications, it could become very difficult to have an IDS detect those types of attacks. Although the level of sophistication required is high enough that you would probably have data of high value, and it would require more than just owning a web server to get at it. I don't see somebody with that type of skill going after web sites just to deface and shout out to their friends.

Quote:

---

This is where I was talking about the type of web applications and the ability to do code verification on web applications. If I can get your web server to perform a buffer overflow, and in turn get that problem to execute commands.

---

Apache has been installed on a seperate partition meant soley for server programs (See my XP security guide) along as being installed under a seperate user with limited administrative controls. It has very very limited access (the user apache runs under) and this means even more liminted restrictions to what it can call upon. I know there may be a way around that of course, but as you said above... if you make something -that- difficult... :)