Hacking Respondus LockDown Browser 2.0

It has been about a year since I've visited this topic, and I've decided that it is indeed worth revisiting. But first, a few reasons that I'm doing this so nobody gets the wrong idea:

• To prove Respondus LockDown Browser does not circumvent cheating
• To encourage anyone left using this technology to change their assessment methodology to other means, such as projects because:
  • They are more effective
  • It is just as easy to determine if a student cheated
  • They test ability to apply instead of memorization (life is open book, what you need to know is how to apply what you know!)
• To boost blog viewership (I write to be read, and Respondus is one of my most read posts)

The Technique

I have devised a better way of "hacking" Respondus that does not involve the use of monitoring system calls, although that would be equally viable and was what I had originally intended to do.
This version works better, is cleaner, and anyone can edit it when it stops working. Essentially, it just modifies Respondus' window and opens other programs with button presses.

How To Run

1. Download the code, and save it to a file on your desktop called Respondus.ahk
2. Download and install Auto Hot Key
3. Close all other windows on your desktop.
4. Right click the Respondus.ahk file and choose "Run As Administrator"

Code tested on Windows 8/XP. You might need to change the first line in 64 bit versions of Windows 7/Vista to reflect another path to LockDown.exe.

Code

Run, C:\Program Files\Respondus LockDown Browser\LockDown.exe

WinWait, Respondus LockDown Browser
WinSet, AlwaysOnTop, Off, Respondus LockDown Browser
WinSet, Enable, , Respondus LockDown Browser


Gui, Add, Button, default, &Show IE
Gui, Add, Button, default, &Hide Respondus
Gui, Add, Button, default, &Show Respondus
Gui, Add, Button, default, &Maximize All
Gui, Show,, Subversion Menu

WinSet, AlwaysOnTop, On, Subversion Menu
return

ButtonShowIE:
Run, IEXPLORE.EXE http://onehourhacks.blogspot.com
WinWait, One Hour Hacks - Windows Internet Explorer
WinMove, One Hour Hacks - Windows Internet Explorer, , (A_ScreenWidth/2), 0, (A_ScreenWidth/2), (A_ScreenHeight),,
return

ButtonHideRespondus:
WinHide, Respondus LockDown Browser
return

ButtonMaximizeAll:
WinGet, WindowList, List
Loop, %WindowList%
    {
    WinMaximize, % "ahk_id " . WindowList%A_Index%
    }

WinHide, Respondus LockDown Browser
return

ButtonShowRespondus:
WinShow, Respondus LockDown Browser
return

ButtonLeftSideRespondus:
WinMove, Respondus LockDown Browser, , 0, 0, (A_ScreenWidth/2), (A_ScreenHeight),,
return

ButtonFullScreenRespondus:
WinMove, Respondus LockDown Browser, , 0, 0, (A_ScreenWidth), (A_ScreenHeight),,
return

GuiClose:
ExitApp

Server Exploits, Week One

Introduction

Some time ago, I started a project that ran Kippo, a medium interaction honeypot on a server I ran to intercept attacks that hackers were making on the system as I wanted a glimpse in to the first few moments of what they do.

In this series of videos, I'll play some of the more interesting logs with commentary as to what (I think) is going on.

The Attack

If you are watching and recognize your work, and want recognition or it to be removed, contact me and I'll be happy to oblige.

Commands Referenced in this Video

• w
• free
• ls 

Transcript Of Attack

sales:~# w
 21:56:41 up 14 days,  3:53,  1 user,  load average: 0.08, 0.02, 0.01
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    000.000.000.000     21:56    0.00s  0.00s  0.00s w
sales:~# ls
sales:~# free -m
bash: free: command not found
sales:~# 

A Primer for Interacting With Hackers

hack-er n.
    An enthusiastic and skillful computer programmer or user.

The Hacker/Maker culture is a strange one; they follow different rules out of necessity.

The culture is sometimes called a subculture. That term too often derogatory in nature for my liking. Imagine them instead as perpetual students. We are a super-culture, comprised of the best ideas stolen from all the nations on Earth.

Hackers are tinkerers by nature, if they find a better way of doing something, they aren't afraid to change what they have in front of them to incorporate it; this includes their culture.

Hackers respect those that prove themselves to be master tinkerers, those capable of whipping out elegant solutions to complex problems under lots of pressure. But above all else, they respect those that put things in action; talk is cheap, the only thing that matters in the real world are real solutions.

With these three facts, you have the foundation on which to understand all of "hacker" culture.

How to Introduce Yourself

Be Formal

Being that you haven't been around long enough to know the tone of the community, it is always best to start out formal.

Speak English to the best of your ability 

English is the universal language for hackers and you'll get a much better response if you try. They're usually very patient people, because they all once stood where you are now.

Give them a way to look you up 

It is nice to put a face to the name, and it is good to show you're a real person rather than a troll.

Give your skill level and set

Solutions a community presents you will differ depending on where your general skill set is. Plus, one of them may ask you for help in an area you have expertise in.

How To Ask Questions

Show that you searched

Don't waste other people's time by asking questions that can be easily found if you searched. If you have searched, tell the community what you found and why it didn't quite answer your question.

Be Open

Context is very important in giving good answers, and if what you were doing was really so secret, you'd be the one giving the answers, not asking the questions.

Don't be pedantic

Hackers are changing the real world, and don't have much time for the theoretical, unless it is part of an elegant solution.

Please and Thank You

They are the magic words!

Don't joke unless it is on topic

Jokes are very culture dependent, and while communicating with people that can be anywhere in the world, they may be interpreted as part of your question, not make sense, or worse, be offensive.
(Acceptable jokes are on topic and should be denoted with an emoticon, e.g. "The install left lots of extra files in my root directory, I already tried sudo rm -rf / to no avail. ;)")

Get to the point

The faster the expert can answer your question and get back to their own work, the more likely it is to be answered.

How to Share Ideas/Suggestions

If you're sharing an idea or suggestion, there are several ways that make it more likely to get that idea or suggestion worked on by the community, listed from most likely to least:

Do it

Put your idea in action, the community gets help, and you get your feature in the main product.

Attempt to do it

If you can't do it totally, do your best, then ask for help, it shows initiative.

Trade

If you can't do it at all, give a good jumping off point for your idea (your notes/research/ideas so far) and do something else the community needs that is in your ability (like updating or proofing their website, mirroring their software,  doing user testing, etc.)

Mock it up

If you can't trade, try to show how your improvement would be useful to lots of people by use cases, and do some work showing how you think the improvement would work.

Pay somebody to do it

Many communities have forums you can pay for your suggestions to be implemented, just remember that you're oftentimes getting someone far cheaper than you would otherwise.

SSH Honeypot Using Kippo

Honeypots are an excellent way to get involved with learning about the computer underground. When implemented properly you can get a clear view of what is happening on your network overall, and some of the tricks attackers attempt to use against vulnerable systems; you may even end up picking up some nifty tricks along the way.

There are three general types of Honeypots:

• Low Interaction
• These generally just log break in attempts; the source, destination, username and password that the attacker attempted to use to get in to the machine.
• Very safe
• Medium Interaction
•  A small program that runs on a server that provides a very limited contained environment for attackers to break in to and play with. These Honeypots generally log what the user tries to do, capture files, and provide re-playable sessions.
• Mostly safe if done properly
• High Interaction
• These can be anything from entire servers left vulnerable to virtual machines sitting on a network. They generally allow all inbound and outbound connections and are full machine implementations.
• Dangerous, and illegal in some places, as you are knowingly running malware.

The first type of honeypot works well for system administrators that just want to keep an eye on global traffic and perhaps even characteristics of different botnets that have sprung up.

The second type (medium interaction) when implemented properly can be an excellent tool for studying the first part of many hacks, while providing the network relative security.

The third type of honeypot, which allows full connections in and out is incredibly dangerous and irresponsible to run, as any mistake done when implementing them, and even things not seen as mistakes (such as full blown outbound connections) may cause dangers to other servers on the Internet.

Kippo
Kippo is a medium interaction honeypot that is written in Python using the Twisted framework. It provides what appears to attackers to be a Unix/Linux system, and allows those who run it to easily add new "commands" or files to the system through a simple plugin system (beyond the scope of this article).

One of Kippo's greatest benefits is its extensive logging capabilities; entire sessions can be played back and studied at a later time, and all files downloaded by attackers are stored and saved so you can look through them at your leisure.

Kippo should not be run as root (obviously) to avoid any potential breaks in the program from being able to execute code as an administrator. It can still be set up in three easy steps however:

1. Download and extract kippo as a user (probably best if you create a new one for the kippo server)
2. Add a line like the following to your crontab, this will make sure kippo reboots when the server does:
   

   @reboot cd /home/username/kippo-0.5/; ./start.sh 

3. Port forward your SSH port to 2222 (where kippo lives)
   

   sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 22 -j REDIRECT --to-port 2222
   

4. Start kippo by running "start.sh" in the extracted directory
5. (Optional) Save your iptables configuration to be re-set up after reboot: http://www.debian-administration.org/articles/445