1
00:00:00,090 --> 00:00:01,800
In this lesson, we're going to take a look

2
00:00:01,800 --> 00:00:04,860
at some OS-specific security logs, and specifically,

3
00:00:04,860 --> 00:00:06,600
we're going to be looking at two different examples

4
00:00:06,600 --> 00:00:08,670
so you can determine what kind of password cracking

5
00:00:08,670 --> 00:00:10,770
is being used on that system.

6
00:00:10,770 --> 00:00:14,250
Now, in this example, I'm going to create a very generic log

7
00:00:14,250 --> 00:00:16,890
that is not specific to any specific operating system

8
00:00:16,890 --> 00:00:18,810
like Windows, Mac, or Linux,

9
00:00:18,810 --> 00:00:21,240
but the concepts will be exactly the same.

10
00:00:21,240 --> 00:00:23,250
And on the exam, you'll see something like this

11
00:00:23,250 --> 00:00:25,200
as opposed to a Windows security log

12
00:00:25,200 --> 00:00:27,480
if you get a question about this concept.

13
00:00:27,480 --> 00:00:29,790
Now, when you look at a OS-specific security log,

14
00:00:29,790 --> 00:00:31,590
you're going to be able to look through the security logs

15
00:00:31,590 --> 00:00:33,480
and see what type of things have been happening,

16
00:00:33,480 --> 00:00:36,150
such as failed login attempts, incorrect number of attempts

17
00:00:36,150 --> 00:00:38,760
to log in over multiple times, and in some cases,

18
00:00:38,760 --> 00:00:42,330
even with the password being attempted for that login was.

19
00:00:42,330 --> 00:00:43,830
So that's what we're going to be looking at here.

20
00:00:43,830 --> 00:00:45,030
So we're going to determine two types

21
00:00:45,030 --> 00:00:48,060
of password cracking attempts and distinguish between them.

22
00:00:48,060 --> 00:00:49,920
Now, the first one we're going to look at here

23
00:00:49,920 --> 00:00:51,832
is going to be a very simple log that shows the time,

24
00:00:51,832 --> 00:00:54,450
the user taking the action, the event,

25
00:00:54,450 --> 00:00:57,000
the IP address of the machine trying to log in,

26
00:00:57,000 --> 00:00:58,890
the status, and the details.

27
00:00:58,890 --> 00:01:01,170
When we start looking at this log, we first see the time,

28
00:01:01,170 --> 00:01:04,650
and we see that this happened at 16:45 in the afternoon,

29
00:01:04,650 --> 00:01:07,290
and at 1 second, 3 seconds, 5 seconds,

30
00:01:07,290 --> 00:01:10,080
7 seconds, 9 seconds, and 11 seconds.

31
00:01:10,080 --> 00:01:11,640
So essentially every two seconds,

32
00:01:11,640 --> 00:01:14,880
this user, jdoe, was trying to log into the system.

33
00:01:14,880 --> 00:01:16,740
We see the event was a login attempt.

34
00:01:16,740 --> 00:01:18,540
We see where they were trying to log in from,

35
00:01:18,540 --> 00:01:22,800
in this case, 192.55.233.89,

36
00:01:22,800 --> 00:01:25,350
and the status of failed for all of them.

37
00:01:25,350 --> 00:01:27,390
Then we see the detail, and on this system,

38
00:01:27,390 --> 00:01:30,360
they're actually logging in using a smart card with a pin,

39
00:01:30,360 --> 00:01:33,600
and that pin will be a six-digit unique code to that user.

40
00:01:33,600 --> 00:01:36,090
So somebody may have gotten a hold of this person's

41
00:01:36,090 --> 00:01:38,820
smart card and tried to log in as if they were them

42
00:01:38,820 --> 00:01:40,470
by guessing these pins.

43
00:01:40,470 --> 00:01:42,990
So they started out with 1, 2, 3, 4, 5, 6.

44
00:01:42,990 --> 00:01:45,540
Then they went to 1, 2, 3, 4, 5, 7,

45
00:01:45,540 --> 00:01:47,160
1, 2, 3, 4, 5, 8,

46
00:01:47,160 --> 00:01:48,870
1, 2, 3, 4, 5, 9,

47
00:01:48,870 --> 00:01:52,020
1, 2, 3, 4, 5, 0, and after the fifth attempt,

48
00:01:52,020 --> 00:01:53,700
that account was actually locked out

49
00:01:53,700 --> 00:01:56,880
for failing to log in incorrectly too many times.

50
00:01:56,880 --> 00:01:59,730
Also, we then generate an alert to the admin

51
00:01:59,730 --> 00:02:02,400
to let them know that this user, jdoe,

52
00:02:02,400 --> 00:02:04,410
had their account locked because of

53
00:02:04,410 --> 00:02:06,930
this failed login attempt five times in a row.

54
00:02:06,930 --> 00:02:09,840
So what are we seeing here based on these pins?

55
00:02:09,840 --> 00:02:11,490
What kind of a password cracking attempt

56
00:02:11,490 --> 00:02:12,660
do we think this is?

57
00:02:12,660 --> 00:02:15,000
Well, if you see this, they all were incrementing

58
00:02:15,000 --> 00:02:17,670
one each time, which is really a good indication

59
00:02:17,670 --> 00:02:19,710
of a brute force style attack.

60
00:02:19,710 --> 00:02:22,170
Another indication of a brute force style attack

61
00:02:22,170 --> 00:02:24,300
would be if you see a lot of numbers, letters,

62
00:02:24,300 --> 00:02:26,550
and symbols that just look very random,

63
00:02:26,550 --> 00:02:28,680
because that way the system is just generating things

64
00:02:28,680 --> 00:02:30,750
and throwing it at this password

65
00:02:30,750 --> 00:02:32,580
and trying to see if it can get in.

66
00:02:32,580 --> 00:02:34,860
That's the idea of using a brute force attack.

67
00:02:34,860 --> 00:02:36,570
Let's take a look at the second one.

68
00:02:36,570 --> 00:02:38,850
The second one we have is in a very similar format,

69
00:02:38,850 --> 00:02:40,740
and you'll see we just changed users here.

70
00:02:40,740 --> 00:02:42,540
Now we have msmith trying to log in,

71
00:02:42,540 --> 00:02:44,820
and again, they tried five times in a row

72
00:02:44,820 --> 00:02:49,560
from that same system at 192.55.233.89,

73
00:02:49,560 --> 00:02:51,780
and all five times, they were failed.

74
00:02:51,780 --> 00:02:53,490
When we look at the passwords they tried,

75
00:02:53,490 --> 00:02:56,580
they were using common words like puppy, and baseball,

76
00:02:56,580 --> 00:02:59,130
and cupcake, and companion, and loved,

77
00:02:59,130 --> 00:03:00,750
and after the fifth time wrong,

78
00:03:00,750 --> 00:03:02,520
this ended up locking the account

79
00:03:02,520 --> 00:03:04,350
and then a notice was sent to the administrator

80
00:03:04,350 --> 00:03:05,880
letting them know that this account

81
00:03:05,880 --> 00:03:08,160
for msmith was locked as well.

82
00:03:08,160 --> 00:03:10,110
Now, based on this using common words,

83
00:03:10,110 --> 00:03:12,150
what kind of attack do you think this is?

84
00:03:12,150 --> 00:03:14,790
Well, this is a dictionary-based password attack,

85
00:03:14,790 --> 00:03:17,010
because they're using common dictionary words.

86
00:03:17,010 --> 00:03:19,440
Now, on the exam, you'll see something like this

87
00:03:19,440 --> 00:03:20,610
where they're using common words

88
00:03:20,610 --> 00:03:22,830
or common words with a little bit of flare,

89
00:03:22,830 --> 00:03:25,920
like using something like puppy1 or baseball,

90
00:03:25,920 --> 00:03:28,170
but replacing the A with an at sign

91
00:03:28,170 --> 00:03:30,000
and the S with a dollar sign.

92
00:03:30,000 --> 00:03:32,850
If you see that, this still means it's a dictionary attack

93
00:03:32,850 --> 00:03:34,500
because we're using common dictionary words

94
00:03:34,500 --> 00:03:36,480
or variations of those that we would find

95
00:03:36,480 --> 00:03:38,100
inside of a hacker's dictionary.

96
00:03:38,100 --> 00:03:40,800
So keep that in mind as you're reviewing your security logs.

97
00:03:40,800 --> 00:03:41,970
Most of the time when you're dealing

98
00:03:41,970 --> 00:03:43,860
with a security log on the exam,

99
00:03:43,860 --> 00:03:46,800
it's going to be focused on passwords and password cracking,

100
00:03:46,800 --> 00:03:48,840
and whether you're using a dictionary-based attack,

101
00:03:48,840 --> 00:03:52,140
or a brute force attack, or some kind of hybrid of the two.

102
00:03:52,140 --> 00:03:54,690
But as I said, most of the time it is going to be a dictionary

103
00:03:54,690 --> 00:03:57,640
or a brute force attack, so keep that in mind for exam day.