The most popular IT Security qualifications - by demand and salary

Some sites track the appearance of certain criteria in job advertisements, and this can be a good guide as to what employers are looking for in terms of qualifications.
 So which are the most popular certifications for IT Security?

Let's look at some data from www.itjobswatch.co.uk and compare 7 IT Security qualifications, and 7 generic IT qualifications:

IT Security qualifications
Description	Rank	Rank Change	Average Salary	% Chg	No.	% of total
GIAC	775	-122	£65,000	18.18%	40	0.04%
CEH	768	-119	£62,500	56.25%	47	0.04%
CISSP	322	-51	£50,000		744	0.67%
CISM	491	-66	£52,500	-4.54%	358	0.32%
CISA	496	-17	£50,000	-4.76%	348	0.31%
CCSP	649	-166	£42,000	-6.66%	166	0.15%
CCSA	664	-104	£42,000	5.00%	151	0.14%

Interesting things include the high average salary but low demand of CEH, the high demand of CISSP, and low demand for Checkpoint and GIAC. Also, no difference in demand or salary between CCSA and CCSP.

General IT  qualifications
Description	Rank	Rank Change	Average Salary	% Chg	No.	% of total
ITIL	338	-59	£45,000	9.75%	676	0.60%
RHCE	636	-81	£40,000	-5.88%	179	0.16%
MCTS	279	34	£40,000	-	907	0.81%
RHCT	754	-126	£39,000	-13.3%	61	0.05%
CCNA	211	-52	£37,500	7.14%	1241	1.11%
MCSE	141	-43	£36,500	12.30%	2056	1.84%
MCP	189	-35	£35,000	16.66%	1422	1.27%

Interesting things here, high average salary for ITIL, relatively equal salaries for RHCT and RHCE, and Microsoft qualifications not demanding salaries that they used to.

Though this does not tell much about the job types involved, it does show some interesting results in salary trends and demand.

The how and why of IT Security - interesting presentations

I've watched a lot of hacker-conference videos recently, and several of them have made a strong impression. I feel that these two together excellently demonstrate current challenges in offensive/defensive IT Security.

Rather than waffle on too much about them I thought I would post links to them together here with a brief introduction.

If you work in IT Security I would suggest it is worth spending a couple of hours to watch these. Take a look.

First the how

Basically, the easiest way to attack most companies is by using social engineering techniques using email and web.

Dave Kennedy (Rel1k) demonstrates how to use the Social Engineering Toolkit

(The back-doored keyboard is interesting, but not so ubiquitous as attacks based around "click here" or "open attachment").

Anyway, it looks to me that employee IT Security training programs are probably the best solution to some of these issues.





Then the why
 
A good exploration of the economic motivations for cybercrime from Beau Woods.

Several really interesting points here, especially around; the motivations of attackers, the "we're outnumbered" situation, and how the market economy drives business to choose cheap solutions to meet regulatory requirements so that they can continue to do business.

In terms of solutions to the "why" I'm not sure that more regulation will really help improve IT Security budgets over the next few years, nor will it deliver real value. (If more solutions are mandated, this will drive down the budget for each solution to the cheapest - and probably worst.)

Why ping does not work very well, and hping "the real ping"

(hping "the real ping"... ha ha, excuse the pun ;o)

I have mentioned to a few people, on occasions, that ping doesn't really tell you much about the availability of services you may be interested in troubleshooting.

When I have explained this in the past, I don't think everyone understood what I was saying (some detailed networking knowledge is required to understand the issues) so here is an attempt to clarify why "ping" doesn't work very well, and offer a better solution.

Ping may (or may not) tell you if there is some level of network connectivity between source and destination, and can be very useful in a LAN environment where there are no firewalls.

However, it is not service-focused and can be very misleading, especially for internet service troubleshooting where firewalls are involved.

1) Just because a host does not respond to ping, does not mean that there is a problem

• ICMP packets (used in by the traditional ping command) are often blocked on firewalls as a recommended security feature. This is used to block malicious network reconnaissance and potential denial-of-service attacks, from ping-flooding and "ping-of-death" for example

2) Just because a host does respond to ping, does not mean that it is working perfectly fine

• Most services run on specific UDP or TCP ports, ICMP is a different protocol, and proves nothing about whether the service you are troubleshooting is available and responding
• Even if the server is up, and the service is running, this does not mean that you have the appropriate network access to connect to the service (a firewall could be blocking the relevant ports/protocols) so how can you test that?

How to use hping

hping3 is far more advanced than the ping command, is available for various platforms http://wiki.hping.org/download and offers many options.

There is quite an extensive set of options in the help

hping3 --help
usage: hping3 host [options]
  -h  --help      show this help
  -v  --version   show version
  -c  --count     packet count
  -i  --interval  wait (uX for X microseconds, for example -i u1000)
      --fast      alias for -i u10000 (10 packets for second)
      --faster    alias for -i u1000 (100 packets for second)
      --flood      sent packets as fast as possible. Don't show replies.
  -n  --numeric   numeric output
  -q  --quiet     quiet
  -I  --interface interface name (otherwise default routing interface)
  -V  --verbose   verbose mode
  -D  --debug     debugging info
  -z  --bind      bind ctrl+z to ttl           (default to dst port)
  -Z  --unbind    unbind ctrl+z
      --beep      beep for every matching packet received
Mode
  default mode     TCP
  -0  --rawip      RAW IP mode
  -1  --icmp       ICMP mode
  -2  --udp        UDP mode
  -8  --scan       SCAN mode.
                   Example: hping --scan 1-30,70-90 -S www.target.host
  -9  --listen     listen mode
IP
  -a  --spoof      spoof source address
  --rand-dest      random destionation address mode. see the man.
  --rand-source    random source address mode. see the man.
  -t  --ttl        ttl (default 64)
  -N  --id         id (default random)
  -W  --winid      use win* id byte ordering
  -r  --rel        relativize id field          (to estimate host traffic)
  -f  --frag       split packets in more frag.  (may pass weak acl)
  -x  --morefrag   set more fragments flag
  -y  --dontfrag   set dont fragment flag
  -g  --fragoff    set the fragment offset
  -m  --mtu        set virtual mtu, implies --frag if packet size > mtu
  -o  --tos        type of service (default 0x00), try --tos help
  -G  --rroute     includes RECORD_ROUTE option and display the route buffer
  --lsrr           loose source routing and record route
  --ssrr           strict source routing and record route
  -H  --ipproto    set the IP protocol field, only in RAW IP mode
ICMP
  -C  --icmptype   icmp type (default echo request)
  -K  --icmpcode   icmp code (default 0)
      --force-icmp send all icmp types (default send only supported types)
      --icmp-gw    set gateway address for ICMP redirect (default 0.0.0.0)
      --icmp-ts    Alias for --icmp --icmptype 13 (ICMP timestamp)
      --icmp-addr  Alias for --icmp --icmptype 17 (ICMP address subnet mask)
      --icmp-help  display help for others icmp options
UDP/TCP
  -s  --baseport   base source port             (default random)
  -p  --destport   [+][+] destination port(default 0) ctrl+z inc/dec
  -k  --keep       keep still source port
  -w  --win        winsize (default 64)
  -O  --tcpoff     set fake tcp data offset     (instead of tcphdrlen / 4)
  -Q  --seqnum     shows only tcp sequence number
  -b  --badcksum   (try to) send packets with a bad IP checksum
                   many systems will fix the IP checksum sending the packet
                   so you'll get bad UDP/TCP checksum instead.
  -M  --setseq     set TCP sequence number
  -L  --setack     set TCP ack
  -F  --fin        set FIN flag
  -S  --syn        set SYN flag
  -R  --rst        set RST flag
  -P  --push       set PUSH flag
  -A  --ack        set ACK flag
  -U  --urg        set URG flag
  -X  --xmas       set X unused flag (0x40)
  -Y  --ymas       set Y unused flag (0x80)
  --tcpexitcode    use last tcp->th_flags as exit code
  --tcp-timestamp  enable the TCP timestamp option to guess the HZ/uptime
Common
  -d  --data       data size                    (default is 0)
  -E  --file       data from file
  -e  --sign       add 'signature'
  -j  --dump       dump packets in hex
  -J  --print      dump printable characters
  -B  --safe       enable 'safe' protocol
  -u  --end        tell you when --file reached EOF and prevent rewind
  -T  --traceroute traceroute mode              (implies --bind and --ttl 1)
  --tr-stop        Exit when receive the first not ICMP in traceroute mode
  --tr-keep-ttl    Keep the source TTL fixed, useful to monitor just one hop
  --tr-no-rtt       Don't calculate/show RTT information in traceroute mode
ARS packet description (new, unstable)
  --apd-send       Send the packet described with APD (see docs/APD.txt)


To show how it works, let's have a look at some simple examples.

1) Suppose you want to check that a webserver is listening on TCP port 80, you can use hping to send a TCP SYN on port 80

hping3 -p 80 -S hostname

2) Similarly with an SMTP server

hping3 -p 25 -S hostname

Let's look at what happens with wireshark:

Basically hping is sending a series of TCP SYN packets, receiving the SYN/ACK (but not fully establishing the threeway handshake with an ACK). So we can see that the server is listening on that port, and willing to accept a TCP connection.

Other uses for hping

hping3 has extensive uses for IT Security testing here is one example; using hping as a port scanner

hping3 -p ++1 -S 192.168.1.254
HPING 192.168.1.254 (wlan0 192.168.1.254): S set, 40 headers + 0 data bytes
len=44 ip=192.168.1.254 ttl=64 id=26293 sport=21 flags=SA seq=20 win=4096 rtt=2.1 ms
len=44 ip=192.168.1.254 ttl=64 id=26308 sport=23 flags=SA seq=22 win=4096 rtt=2.0 ms
len=44 ip=192.168.1.254 ttl=64 id=26654 sport=80 flags=SA seq=79 win=4096 rtt=1.9 ms

Here we can see the ++1 port option, and can see from the result that this system is responding on ports 21, 23, and 80 (FTP, Telnet and HTTP)

More reading is available here http://wiki.hping.org/33

Evilgrade 2.0 released - with a lot more modules for vulnerable update mechanisms

Evilgrade 2.0 is an exploitation framework for attacking systems by hijacking application update services.

Personally I don't even try to count the amount of times I get popups telling me "There is a java update", "There is an adobe update", "There is an xyz update" on my various PCs. There are many mechanisms, for these updates (especially on Windows systems) and as each mechanism is independent, so it is up to the software vendor for each application, how these mechanisms are implemented, and how securely.

Most update mechanisms are fairly basic:

1. System checks periodically at a predefined URL
2. System checks an index file for anything new at that location
3. System downloads updates specified and installs them

With all the updaters that run for applications these days, it was only a matter of time before someone came up with a framework for exploiting these mechanisms for malicious purposes, and infobyte.com.ar have done just that with Evilgrade.

Basically, this set of techniques means that attackers can replace the update process, and rather than provide legitimate updates, can install malware of the attackers' choice at the time they choose.

The basic mechanism is to use network hacking techniques typically used for man-in-the-middle attacks (MITM), to substitute an attackers' host for a legitimate download location. For example using; ARP spoofing, DNS Cache Poisoning, DHCP spoofing, TCP hijacking or WAP impersonation. The attackers' system then provides notifications, and updates, in place of the legitimate update service.

This second release of Evilgrade (2.0), released on 27th October 2010, supports many more application update services, including the following:

- Freerip 3.30 - Jet photo 4.7.2 - Teamviewer 5.1.9385 - ISOpen 4.5.0 - Istat. - Gom 2.1.25.5015 - Atube catcher 1.0.300 - Vidbox 7.5 - Ccleaner 2.30.1130 - Fcleaner 1.2.9.409 - Allmynotes 1.26 - Notepad++ 5.8.2 - Java 1.6.0_22 winxp/win7 - aMSN 0.98.3 - Appleupdate <= 2.1.1.116 ( Safari 5.0.2 7533.18.5, <= Itunes 10.0.1.22, <= Quicktime 7.6.8 1675) - Mirc 7.14 - Windows update (ie6 lastversion, ie7 7.0.5730.13, ie8 8.0.60001.18702, Microsoft works) - Dap 9.5.0.3 - Winscp 4.2.9 - AutoIt Script 3.3.6.1 - Clamwin 0.96.0.1 - AppTapp Installer 3.11 (Iphone/Itunes) - getjar (facebook.com) - Google Analytics Javascript injection - Speedbit Optimizer 3.0 / Video Acceleration 2.2.1.8 - Winamp 5.581 - TechTracker (cnet) 1.3.1 (Build 55) - Nokiasoftware firmware update 2.4.8es - (Windows software) - Nokia firmware v20.2.011 - BSplayer 2.53.1034 - Apt ( < Ubuntu 10.04 LTS) - Ubertwitter 4.6 (0.971) - Blackberry Facebook 1.7.0.22 | Twitter 1.0.0.45 - Cpan 1.9402 - VirtualBox (3.2.8 ) - Express talk - Filezilla - Flashget - Miranda - Orbit - Photoscape. - Panda Antirootkit - Skype - Sunbelt - Superantispyware - Trillian <= 5.0.0.26 - Adium 1.3.10 (Sparkle Framework) - VMware

 ...and I am sure there are many, many more possibilities which could easily be developed on top of this framework.

More information and an installer download of the tools are available from the authors' website at infobyte.com.ar

Take great care when using this application. Use it only for legitimate testing purposes, and do not break the law.

Mitigations

• Limiting the number of applications on corporate laptops to only those required for working
• Deploying software management systems
• Networking protections for typical MTIM attacks