m o

c . i Fools your enemy with Mikrotik b o o h a s BY: DIDIET KUSUMADIHARDJA

MIKROTIK USER MEETING (MUM) 2016 JAKARTA, INDONESIA 14 OCTOBER 2016

2

m o

About Me Didiet Kusumadihardja 1.



2.

b o o h a

IT Security Specialist

PT. Mitra Solusi Telematika

c .i

Trainer & IT Consultant 

s

Arch Networks

Didiet Kusumadihardja - [email protected]

MTCNA, MTCINE, MTCWE, MTCUME, MTCTCE, MTCRE

3

m o

PT. Mitra Solusi Telematika Gedung TMT 2. GF Jl. Cilandak KKO Jakarta

b o o h a

s

Didiet Kusumadihardja - [email protected]

c .i

4

b o o h a

Global IT Security Incident

s

Didiet Kusumadihardja - [email protected]

c .i

m o

5

m o

Global IT Security Incident 2014 Entire Network

b o o h a

s

Didiet Kusumadihardja - [email protected]

c .i

Canceled

6

m o

Global IT Security Incident 2015

b o o h a

s

Didiet Kusumadihardja - [email protected]

c .i

3 Tahun di Hack ( 2012 – 2015)

7

m o

Global IT Security Incident 2016

b o o h a

s

Didiet Kusumadihardja - [email protected]

c .i

500 Juta Account 3 Miliar Account ??? Source: Tech Times

8

b o o h a

Indonesia IT Security Incident

s

Didiet Kusumadihardja - [email protected]

c .i

m o

9

b o o h a

c .i

m o

INDONESIA IS SAFE?

s

Didiet Kusumadihardja - [email protected]

Source: Akamai

10

m o

Indonesia IT Security Incident 2013 polri.go.id 2013

b o o h a

s

Deface

Didiet Kusumadihardja - [email protected]

c .i

Motive: Fame?

11

m o

Indonesia IT Security Incident 2016

b o o h a

Teman Ahok

s

c .i

DDoS Attack Didiet Kusumadihardja - [email protected]

Motive: Politics?

12

m o

Indonesia IT Security Incident 2016

b o o h a

Videotron

c .i

Kebayoran Baru Jakarta Selatan

s

Didiet Kusumadihardja - [email protected]

Motive: Curiosity?

13

b o o h a

s

Didiet Kusumadihardja - [email protected]

m o

c .i

IT Security Trends

Gak Perlu Pinter Buat Hacking Source: Carnegie Mellon University

14

m o

Hacking Tools Example

b o o h a

s

Didiet Kusumadihardja - [email protected]

c .i

Cain & Abel Kali Linux

15

b o o h a

s

Didiet Kusumadihardja - [email protected]

m o

c .i

Cybercrime as a Service (CaaS)

Modern Business Source: SCMagazine

16

b o o h a

How Hackers do it?

s

Didiet Kusumadihardja - [email protected]

c .i

m o

17

m o

Hacking Phase

b o o h a

1.Reconnaissance 2.Scanning

c .i

3.Gaining

Access 4.Maintaining Access 5.Clearing Tracks

s

Didiet Kusumadihardja - [email protected]

Source: Ethical Hacking by EC-Council

18

m o

Hacking Phase (Cont’d)

b o o h a

1.Reconnaissance 2.Scanning 3.Gaining

Access 4.Maintaining Access 5.Clearing Tracks

s

Didiet Kusumadihardja - [email protected]

c .i

Information Gathering OS Detail

Application

Open Port

Version

Exploit Vulnerability

Device Type

Vulnerability

Backdoors

Escalate Privilege Data harvesting Delete/overwrite Event/Logs

19

m o

Hacking Phase Analogy

b o o h a

1.Reconnaissance 2.Scanning 3.Gaining

Access 4.Maintaining Access 5.Clearing Tracks

s

Didiet Kusumadihardja - [email protected]

c .i

20

m o

When we fools them?

b o o h a

1.Reconnaissance 2.Scanning 3.Gaining

Access 4.Maintaining Access 5.Clearing Tracks

s

Didiet Kusumadihardja - [email protected]

c .i

21

m o

Why at Scanning Phase?

b o o h a

TELNET

s

Didiet Kusumadihardja - [email protected]

SSH

c .i

22

m o

Scanning Tools SoftPerfect Network Scanner

b o o h a The Dude

s

Didiet Kusumadihardja - [email protected]

c .i

23

b o o h a

How to fools them?

s

Didiet Kusumadihardja - [email protected]

c .i

m o

24

m o

Use a bait

Hacker

b o o h a

s

Didiet Kusumadihardja - [email protected]

c .i

Bait Honey Pot

25

m o

Web Server Example

Web Server

b o = o h a s

c .i

HTTP

Didiet Kusumadihardja - [email protected]

HTTPS

26

m o

Confuse your enemy

b o o h a HTTP

s

Didiet Kusumadihardja - [email protected]

HTTPS

c .i

27

m o

Server Farm Network Example

c .i

SERVER X

b o o h a

s

192.168.1.2  DNS Server 192.168.1.5  Web Server 192.168.1.10  DB Server 192.168.1.15  Mail Server Didiet Kusumadihardja - [email protected]

192.168.1.0/24

28

m o

Confuse your enemy 192.168.1.1  Fake Server 1 192.168.1.2  DNS Server 192.168.1.3  Fake Server 2 192.168.1.4  Fake Server 3 192.168.1.5  Web Server 192.168.1.6  Fake Server 4 192.168.1.7  Fake Server 5 192.168.1.8  Fake Server 6 192.168.1.9  Fake Server 7 192.168.1.10  DB Server 192.168.1.11  Fake Server 8 192.168.1.12  Fake Server 9 192.168.1.13  Fake Server 10 192.168.1.14  Fake Server 11 192.168.1.15  Mail Server

b o o h a

s

Didiet Kusumadihardja - [email protected]

c .i

192.168.1.0/24

29

b o o h a

How we do it with Mikrotik?

s

Didiet Kusumadihardja - [email protected]

c .i

m o

30

b o o h a

c .i

m o

NAT (Network Address Translation)

s

Didiet Kusumadihardja - [email protected]

31

b o o h a Fake NAT

s

Didiet Kusumadihardja - [email protected]

c .i

m o

32

m o

Fake Ports at your Web Server

b o o h a

c .i

HTTP & HTTPS to Legitimate Server

s

Didiet Kusumadihardja - [email protected]

Other Ports to Fake Server

33

m o

Simple NAT for Web Server

c .i

NAT (Port Mapping)

b o o h a

INTERNET

ROUTER

s

WEB SERVER 192.168.2.3

Didiet Kusumadihardja - [email protected]

Chain

Action

34

m o

Add Additional NAT for Bait Chain

Action

b o o h a

s

Didiet Kusumadihardja - [email protected]

c .i

Web Server 192.168.2.3

Fake Server (Honey Pot) 192.168.2.4

35

m o

Fake Server at your Server Farm Network

b o o h a

s

Didiet Kusumadihardja - [email protected]

c .i

Only one legitimate server

Others are Fake Server

36

m o

Another Example Chain

Action

b o o h a

s

Didiet Kusumadihardja - [email protected]

c .i

Web Server 192.168.2.3

Fake Server (Honey Pot) 192.168.2.4

37

m o

Combine with Honey Pot

b o o h a

c .i

s

KFSensor

Didiet Kusumadihardja - [email protected]

Others HoneyPot: Honeyd, Kippo, Dionaea, Nepenthes

38

m o

What Hacker See (NMAP)

b o o h a

Nmap / Zenmap

s

Before

Didiet Kusumadihardja - [email protected]

c .i

After

39

m o

What Hacker See (SoftPerfect NetScan) SoftPerfect Network Scanner

b o o h a

s

Before

Didiet Kusumadihardja - [email protected]

c .i

After

40

m o

I don’t want to use HoneyPot Step 1: Chain

b o o h a

s

Didiet Kusumadihardja - [email protected]

c .i

Step 2: Action

41

m o

What we see, If someone PING

b o o h a

s

Didiet Kusumadihardja - [email protected]

c .i

SRC-MAC ADDRESS SRC-IP ADDRESS

42

m o

What we see, If someone NMAP

b o o h a

s

Didiet Kusumadihardja - [email protected]

c .i

Mikrotik LOG:

43

m o

The Dude, Hotspot & Userman

b o o h a

s

c .i

IP Address  MAC Address  User ID  Person Didiet Kusumadihardja - [email protected]

44

m o

Use Case 1

b o o h a

s

Internet Café (WARNET)

Didiet Kusumadihardja - [email protected]

c .i

University

Insider Threat

Office

45

m o

Use Case 2 http://public.honeynet.id

b o o h a

s

Analytics

(Low Interaction Honeypot) Didiet Kusumadihardja - [email protected]

c .i

Research

For Fun Learn hacking method from hacker / script kiddies (High Interaction Honeypot)

46

m o

DIDIET KUSUMADIHARDJA

Thank you . . Question?

b o o h a

s

Didiet Kusumadihardja - [email protected]

c .i

[email protected] http://didiet.arch.web.id/ https://www.facebook.com/ArchNetID/

01. Cara_Melumpuhkan_Hacker_dengan_Mikrotik_sahoobi.pdf ...

Page 2 of 46. About Me. Didiet Kusumadihardja. 1. IT Security Specialist. PT. Mitra Solusi Telematika. 2. Trainer & IT Consultant. Arch Networks. MTCNA, MTCINE, MTCWE, MTCUME, MTCTCE, MTCRE. Didiet Kusumadihardja - didiet@arch.web.id. 2. sahoobi.com. Page 2 of 46 ...
Download PDF
4MB Sizes 1 Downloads 257 Views
Report

Recommend Documents

1720-01-01
Mar 28, 2017 - (6) All classifications shall be subject to the Eligibility Verification for .... (9) A “covered individual” under the federal Veterans Access, Choice, ...
03 01 01) 01)z 02). 02)z 01 01)z
polymerization reactor using the CMAC neural network for knowledge storage,” Proc. Inst. Elect. ... work was supported by the National Natural Science Foundation of China under. Grants 60304017, 20336040, and ... impossible to propose a universal s
0800-01-01
Apr 1, 2017 - (5) “Employer” means a person engaged in a business who has one or more employees and includes state ..... Chemical Abstract Service Number, the CAS number is for information only. ... 67-64-1. 750. 1800 1000 2400. —.
0800-01-01
Apr 1, 2017 - (5) “Employer” means a person engaged in a business who has one or more employees and includes state ..... Chemical Abstract Service Number, the CAS number is for information only. ... 67-64-1. 750. 1800 1000 2400. —.
0950-01-01
Apr 1, 2017 - TENNESSEE STATE MINERAL TEST HOLE REGULATORY BOARD. CHAPTER 0950-01-01. REPEALED. TABLE OF CONTENTS. 0950-01-01 Repealed. 0950-01-01-.01 REPEALED. Authority: T.C.A. §§ 4-5-201 et seq., 58-1904, and 60-1-501 et seq. Administrative Hist
1720-01-01
Mar 28, 2017 - while in continuous attendance toward the degree for which he or she is currently enrolled, shall not be required to pay out-of-state tuition if his ...
ICE MAGIC-01 (01-01-18 TO 06-01-2018).pdf
1 Jan 2018 - SF,FJ0 ZM04 lT~5TL 5[8=M, 5\5 ;FD[4. :JFlDGFZFI6 D\lNZ 5F;[4 ZFHSM8P 9375701110 / 9328001110. (01/01/2018 to 06/01/2018). [JANUARY 2018]. ;\5FNS o DF{l,S UM\lWIF (Director - ICE). www.iceonline.in 93276-01110 icerajkot. CURRENT AFFAIRS.
MP-06-01-01.pdf
There was a problem previewing this document. Retrying... Download. Connect more apps... Try one of the apps below to open or edit this item. MP-06-01-01.
log horizon 01 01.pdf
Log horizon ep.1 anime first look ãƒã‚. °. ホライã‚. oãƒ3 by. Log horizon original soundtrack 1 mp3. download log horizon. Herbstsaison 2013 review zu log ...
01, BCOA - 001, AMK- 01, ,015.pdf
Bachelor of Business Administration. (BBA) in Retailing. II nd. Year. ASSIGNMENTS. 2013-14. School of Management Studies. Indira Gandhi National Open ...
ICE MAGIC-01 ( 01-01-17 TO 07-01-17).pdf
Page 3 of 7. Page 3 of 7. ICE MAGIC-01 ( 01-01-17 TO 07-01-17).pdf. ICE MAGIC-01 ( 01-01-17 TO 07-01-17).pdf. Open. Extract. Open with. Sign In. Main menu.
ICE MAGIC-01 ( 01-01-17 TO 07-01-17).pdf
Page 3 of 7. Page 3 of 7. ICE MAGIC-01 ( 01-01-17 TO 07-01-17).pdf. ICE MAGIC-01 ( 01-01-17 TO 07-01-17).pdf. Open. Extract. Open with. Sign In. Main menu.
0680-01
Oct 21, 2017 - September and November; provided, however, that the Board may change the location of meetings at its ... knowledge of the construction business in which the persons are licensed to perform. (d) For any .... technological advances in th
0820-01
Oct 25, 2017 - (2) If two (2) or more Board members recommend examination of an applicant for the Practice of. Land Surveying (PS) ... (1) The Tennessee State Specific examination is designed to test the applicant's knowledge of .... services as if f
0200-01
Nov 27, 2017 - Anatomy, physiology and systems structure of the head, face and neck, including ... Required Total: 125 Hours. (b) General: Book Knowledge. Teaching Techniques. Visual Aid Equipment. Classroom Management. Student Motivation ... account
1020-01
Oct 1, 2017 - Any institution or facility defined as such pursuant to state law or the rules ...... Alcohol or drugs. 3. Physical injury or threat of injury to any person. 4. Abuse or neglect of any minor, spouse or the elderly. 5. Fraud or theft. (c
01-Rika (01-06).pdf
learning beliefs, self-efficacy and anxiety. Learning achievement were measured by the MCQ which. Questionnaire. data were taken at the end of the block MBS3, which analyzed using Pearson Product Moment correlation. Results: The correlation between i
MP-04-01-01.pdf
Page 1 of 55. Manual de. Procedimientos. Código: MP-04-01-01. Versión: 4.0. Página: 1 de 55. Fecha de Emisión: Noviembre 2015. Título: GESTION DEL ...
17-01-01 Fausses_bonnes_résolutions.pdf
Jan 1, 2017 - Librement inspiré et adapté de : http://carfree.fr/index.php/2012/09/12/les-effets-indesirables-de-velo/. Note de la rédaction : ne voyez à cette ...
2016 01 01 eFootloose.pdf
Page 1 of 25. 1 | P a g e. Pacesetters Athletic Club. Issue #13: January 2016. Foreword by President. 2015 Reflections & Moving Forward in 2016. Today is New ...
1020-01
Oct 1, 2017 - (d) Correctly answering ninety percent (90%) of the examination questions shall constitute a passing score and successful ..... Petitioner's Mailing Address: Petitioner's E-Mail Address: Telephone Number: Attorney for Petitioner: Attorn
01. Cara_Lemahkan_Serangan_DDOS_dengan_Mikrotik_sahoobi ...
From Malta, located in Dublin, Ireland. WWW.TIKTRAIN.COM 2. Providing professional and specialised ... sahoobi.com WWW.TIKTRAIN.COM 4. Page 4 of 40. 01. Cara_Lemahkan_Serangan_DDOS_dengan_Mikrotik_sahoobi.com.pdf. 01. Cara_Lemahkan_Serangan_DDOS_deng
0440-01
Nov 1, 2017 - (d) Sufficient protective eyewear (glasses) recommended by manufacturer of laser/light devices for each student .... apprenticeship student who is in responsible charge of supervising and accounting for that student's apprenticeship pro
1020-01
Oct 1, 2017 - (c) Habitual intoxication or personal misuse of any drugs or the use of intoxicating liquors, narcotics, controlled substances, or other drugs or ...