What can I do to stop

I've got a Microsoft Infastructure class this semester and need some help with security. We have established a domain of about 25 computers with a variaty of OS(XP pro,2000 pro,NT workstation,NT 4.0,2000 server,2000 advanced and a fedora server and a couple of Fedora workstations) Each person in the class has a diffrent OS and we have learned how to get them to all work together. But now that we have most of the bugs worked out the instructer has a new twist, One member of my class we have no idea who, has been instructed to hack us at will and do as much damage as he can. I am running a 2000 advanced server as a Domain controller with WINS and DNS on it. Last week he pretty much had his way with a couple of peoples machines and I don't want to be next, can anyone give me any ideas? Please remember I'm still new at this. I'm smart enough to know that I know nothing.

Search google and this site for security related terms... that's where you should start... Though I may be inclined to help you since minus the WINS server, that's exactly what my desktop machine is running... don't ask why.

Can you d/l and install stuff, or are you stuck with configuring what you have? I'd assume you can get updates, get all them of course.

If you can, d/l like zone alarm first, then research. Wait for a few more posts, there's alot o' experienced people on here. They'll hook you up with all sorts of stuff.

Do you have to keep all your services operational? if not you can shut off some of them. Though not all since you've made the leap to domain controller already. If someone knows how to shut all that **** off after actually becoming domain controller you'd be helping me as well as him :D

A funny thought just crossed my mind... depending on how mutch he already knows about your network, like your IP address and such (like that can't be changed anyways, screw network policy, DHCP is even better), I, Myself would play with a honeypot. Just to keep him busy for a while. I'd assume he won't spend all his free time trying to hack your box. though you never know. If you could work a honeypot, you could log what he's doing, hopefully buying you at least one class period to send us the logs .. HAHA that would be great.

Though you said you know nothing, I'll see what you have to say on the subject. Wait for a dozen or so more replies to get the whole think tank on board if their interested. You'll need to keep me interested too. See if you can do something about finding the identity of the dude and feeding us some profile info. it may come to something, who knows.

Good luck, hope your next reply isn't -- I've been haxored!!! ---

Hi,

A few more questions to add to those from UpperCell :

1. Do you know how the other two machines were attacked
2. Will he/she have physical access to your machine (when I build a "secure box" I always use removable hard drives, lock the CD and floppy to normal users, boot from HDD first etc).
3. Which OSes were attacked first?
4. I would suggest some security tools, but I am not sure if you are allowed to load them. I guess the EULA is OK as you are using them "privately", albeit in an educational environment? As UpperCell has already pointed out it is important to us to know if you can do this, and any other rules of engagement :)

Good luck

Hrmm.. Sounds like a wargame! :D

I noticed the lack of mention of a firewall and/or an IDS. Are you not allowed to install these? You might want to look at the NSA's Security Guides to see if they may help you lock down your servers better. And perhaps check the tutorials I wrote on Wargames as they may give you a better idea as to how the attacker got in. I suspect that there is no physical access immediately but rather remote access.

Lastly, the most common way that I get into my students machines is due to really poor password policy (e.g., "password", "root", "course#", their email password -- which they access over the clear). You might want to ensure you put in some strong password policies on important machines in particular.

The first two machines he got were another 2000 advanced server and one of the 98 machine. I think he's just picking at random. The only access he is allowed is remote only so that helps. I can download anything but a firewall and all my updates are downloaded so there I'm okay. I have GFI LANguard Network Security Scanner downloaded and I'm going to use it tonight to try and find all the holes in the network. But I really want to beat this guy since the instructer is so sure we will all fail. Thanks for your help.

OK I haven't built the 2Kas machine yet, and I will NOT abuse free for private use by installing it at work. That means I don't know if this stuff will run :(

http://www.diamondcs.com.au

Have a look around the site and get the free (to everybody) RegistryProt.............might as well protect the Windows Registry?

http://www.winpatrol.com

This one may not work with your OS............if it does, it should be a useful damage limitation exercise.

http://digilander.libero.it/zancart

You want WinSonar 2003.................if it runs on your OS it should detect a network connection, if not open an internet connection to "liven it up"............say "yes" to the prompt to block unknown background processes :D

A word about social engineering............it is NOT one of your fellow students...........hell, they know as much, or as little as you?.........it is your instructor who is the "bad guy" :cool:

Find out what you can about his ID, logon etc.

Cheers

Quote:

---

I can download anything but a firewall and all my updates are downloaded so there I'm okay.

---

Actually, you know who you should talk with: Pooh Tzu Sun. He has a Windows box locked down without Firewall or AV. And I've checked it. It's an impressive setup. Send him a quick note on some advice on how to lock your boxes down to prevent remote access but still allowing necessary services. His setup was quite impressive.

Oh yes, if you are required a webserver toss IIS. ;)

The real prize would be the domain server and since you are using 98 machines and possibly samba the DC must answer LM authentication requests, if your 'attacker' is on the LAN with you he may as well go for the DC by sniffing LM hashes and then he will 0wn j00 all. But seriously just some initial precautions I would take would be to tighten your file permissions, disallow anon NB stuff(do you have to have it?), enable auditing,check your local sec policy,remove all un-needed/required services,if you run IIS run IIS lockdown and remove all your extensions, remove SYSTEM execute privileges on commonly exploited binaries (cmd.exe,tftp,etc), change your admin account,enforce strong password policy, then run some tools like baseline security and nessus against yourself (Perhaps a trial/edu version of E-eye Retina?) and see what turns up, then rinse...repeat....
Have fun!

-Maestr0

Check the web logs on the other machines and then go hook the guy in the face.

That should deter him from fuxoring your box.

why would a firewall be against the rules? Please forgive my ignorance but i have never been in a classsroom type waregame.

Firewalls make it really easy to block attackers. And some firewalls do so automatically. The challenge is to properly lock down the boxes without a dependence on a firewall. This is why I suggested talking to Pooh. I've poked his box a few times. I was impressed as to how well it was locked down without a firewall.

Quote:

---

I've poked his box a few times

---

something you two want to tell us ?

nihil: I am trying to test those tools for him as I have the same OS, but only the first link even works for me. The top link doesn't seem to have stuff that would help too mutch. The crypto whatever is obviously for 9x or win2k with FAT32 perhaps.

We really need to know what services you have to keep running. That will help Pooh Tzu Sun as well. Whatever you don't need, you need to figure a way to turn off. No use having extra places to 'poke' your box. At least let us know what your box has to continue doing (Serving web pages, administering a domain, providing terminal services etc...) .

MsMittens brought up a good point above, HUGE HORRIBLE PASSWORDS that should not occur anywhere else in the natural world :p If there's any doubt about the characters you can use, to test I just set the password for one account to ~!@#$%^&*()_+{}|:"<>?`-=[]\;',./ It works just fine(remember, I have the same thing your working with). Don't use that exactly it's predictable in it's own way. Use the most random ass password that you can remember, if you can't remember, write it down somewhere SUPER SECRET. Don't worry about how long it can be either, it can be stupid long if your up for it. Since your in such a class, I'm sure you've heard this half a million times, I don't care, usually nobody listens. Consider this # 500,001. If you have no firewall, he could probably find a way to sneack lopht crack in there (remotely, following the rules), and with enough time he's got you no matter what. So a password of, say, 25 characters that changes each day, while stupid complicated, could be the difference between a hacked box and one standing above the crowd.

If he's using any dirty tricks like keyboard loggers, you may be screwed no matter what. This especially true if their physical loggers, these can be embedded in the keyboard itself. Were I challenged in class to secure my box, I would seriously consider bringing my own keyboard... DON'T DO THAT, you'd look like an uber dork :p He's an instructor and has a certain reputation to uphold, he may resort to such things if your box is otherwise secure.

Hope this helps, more as it randomly crosses my mind,

Jon.

A few more things to look at are:

Services: stop and disable any service that you don't have to have.
IP filtering: Turn on an use IP filtering. Only allow the ports that you absolutely have to.

You may not be able to down load a firewall but that doesn't mean that you can't reduce your attack surface.

Have you changed the NTFS permissions on your hard drives? By default the everyone group has full access to your computer. Just be careful not to be to restrictive here, Since you are a domain controller you will have to leave somethings a little more open. ie replace everyone full with authenticated users read/execute/list

Disable the Guest account.

Rename the administrator account

Disable Anonamous access

Setup account lock out policies

Just to help you know when he has been comming at you setup a dummy Administrator account, remove it from all groups and turn on auditing for this account. That way you can see any attempts to use that account in you logs.

You might try applying the HISECDC.inf in the local security policy. If that one breaks to much then try the SECUREDC.inf and then the BASICDC.inf. Remember that you can alwas go back to the original local security policy by using the "setup security.inf"

Disable the remote registry service!

Just remember that if configured properly a Windows server can be just as secure as any other OS.

Good luck!