NetBus, Keylogging and Cain

1
NetBus, Keylogging and Cain

• ByKyle Barry
• Kenny Grabarski
• Justin Gore

2
Introduction

• NetBus, Keylogging, and Cain can all be used for
  as reconnaissance and surveillance tools.
• NetBus uses remote control.
• Keylogging records all keystrokes that are input
  to the keyboard.
• Cain can use Brute Force and Dictionary attacks
  to attempt to crack passwords on a target
  computer.

3
NetBus 2.01 Attacks

• NetBus is a Windows based program that allows for
  remote control on a target computer.
• It consists of a client version (hacker) and a
  server version (target).
• The server version must be installed on the
  target computer in order for the client to
  attack. It can be hidden.
• The server is pictureless and listens for
  connections on port 20034.

4
NetBus Cont.

• Includes many tools such as Keylogging, Program
  Launching, Screen Captures, System Shutdown, CD
  tray open and close, and File Browsing.
• Runs on Windows 95, Windows 98, and Windows NT
  4.0

5
Keylogging Attacks

• Keylogging is a technique used by attackers to
  record all the keystrokes that are input into a
  target keyboard.
• All activities are recorded in a log that can be
  emailed back to the attacker to tell exactly what
  was typed, in what application, and at what time
  it was typed.
• Can be hardware (certain keyboards) or software
  (Family Keylogger) that is installed.

6
Keylogging Cont.

• Businesses use Keylogging programs to watch what
  their employees are doing on company time.
  Parents also use keylogging to see who their
  children are talking to online.
• Keylogging is capable of recording entire AIM
  conversations, Chat room conversations, and any
  e-mails that are written.

7
Cain Password Cracking

• Cain and Able was developed to be used to recover
  passwords on Windows based systems.
• Decoding scrambled passwords, recovering wireless
  network keys.
• It uses Brute Force, Dictionary, and
  Cryptanalysis Attacks.

8
Cain Password Cracking

• There are 4 basic steps in a typical
  cryptanalysis attack
• Determine the language being used
• Determine the system being used this can be a
  time-consuming stage in the process and involves
  counting character frequency, searching for
  repeated patterns and performing statistical
  tests.
• Reconstruct the systems specific keys
• Reconstruction of the plain text this step
  typically takes place at the same time as the
  keys are reconstructed.

9
Cain Password Cracking

• Its main purpose is to simplify in the recovery
  of passwords and credentials from various sources
• The program does not exploit any software
  vulnerabilities or bugs that could not be fixed
  with little effort

10
Cain Password Cracking Cont.

• Simple, easy to use GUI.

11
References

• http//en.wikipedia.org/wiki/Netbus
• http//en.wikipedia.org/wiki/Keylogging
• http//www.oxid.it/cain.html
• http//www.tcp-ip-info.de/trojaner_und_viren/netbu
  s_pro_eng.htm