What and where credentials are logged when you connect to a network?

[flawl3ss]

Hello all,

I am not new to Backtrack, only new to the new forum. I have been pentesting my own network here at my office.

I am just curious, if someone else is using Backtrack (or any other OS) and is penetration testing my network, how could they be logged? My first thought was their MAC address in my router... good idea, right? unless someone knows how to use macchanger! Seems to me like if someone did that, broke my wpa key and got on my network I could never track them, other than trying to sniff credentials from input on sites they visited... Even then, that's only if I'm able to use ettercap or some other MITM monitoring software.

I'm not just real worried about it but now that I am involved in this site and I see how easy it is, one can only wonder...


Thanks!

[Archangel-Amael]

So let me get this straight. You have just downloaded BT and are playing around a bit at work and are wondering if someone can discover what you are doing, or if there is a way to keep people from finding out?
That's what it sounds like you are asking .

[clevers]

If you are worried about people "cracking your WPA" key on your office network then a couple of suggestions i) investigate a WPA Enterprise solution ii) if this is not viable pick a long password with lots of punctuations and don't use dictionary words. Granted your users might still share the key so see option 1.

In terms of seeing unauthorised activity on your network - there is a whole cottage industry in intrusion detection, google IDS.

[whitelisted]

Hello all,

I am not new to Backtrack, only new to the new forum. I have been pentesting my own network here at my office.

I am just curious, if someone else is using Backtrack (or any other OS) and is penetration testing my network, how could they be logged? My first thought was their MAC address in my router... good idea, right? unless someone knows how to use macchanger! Seems to me like if someone did that, broke my wpa key and got on my network I could never track them, other than trying to sniff credentials from input on sites they visited... Even then, that's only if I'm able to use ettercap or some other MITM monitoring software.

I'm not just real worried about it but now that I am involved in this site and I see how easy it is, one can only wonder...

Thanks!

Intrusion prevention systems are the first answer that spring to mind.

I have emboldened the only section of your post that hints that you're talking about a wireless network, not a wired one. This is very important information, and you should have specified that right at the beginning of your post if you wanted to get a useful answer from anyone.

If this is a business network, you should consider upgrading to WPA2 Enterprise.

[flawl3ss]

So let me get this straight. You have just downloaded BT and are playing around a bit at work and are wondering if someone can discover what you are doing, or if there is a way to keep people from finding out?
That's what it sounds like you are asking .

I am the only one that would discover what I am doing... I am THE network admin here at work. If I wanted to access my server, I'd simply login to it.
To sum up: what I am asking is exactly what I asked in the first post of this thread.
My server contains very confidential info, and I wanted to know if there was a way to detect someone unauthorized on my network (wired or wireless.) I was simply stating that I am worried because I see now, how easy it is to exploit a system.

Forgive me for not bowing down..

[Archangel-Amael]

I am the only one that would discover what I am doing... I am THE network admin here at work. If I wanted to access my server, I'd simply login to it.
To sum up: what I am asking is exactly what I asked in the first post of this thread.
My server contains very confidential info, and I wanted to know if there was a way to detect someone unauthorized on my network (wired or wireless.) I was simply stating that I am worried because I see now, how easy it is to exploit a system.

Forgive me for not bowing down..

I will forgive your ignorant first post, since it is you that asked a question that raised suspicion.
I will also do you one better.
google intrusion detection systems, and start reading. There is tons of material around.

[100%digital]

Hello,

If you're worried about someone accessing resources on your network;

assuming you work within a windows framework, enable/change your "audit policy" (mmc, secpol.msc, audit policy, etc...) enable all attributes for audit, and you'll be able to log all IP's that access resources within that machine (or domain, if you change the audit policy -forest/domain wide...)

...as some have suggested, don't use WPA PSK... it's not much setup to rock 802.1x (EAP-TLS) certificate based crypto

install a protocol analyzer on the box in question, log all traffic to/from core resource, review your logs...

some have suggested IDS, IPS opposed to IDS is the way to go, but if you're after a free solution (software based) IDS might be more appropriate.

best,

J

[flawl3ss]

Thanks for the input fellas i'll check up on IDS, all I really needed was a kick in the right direction.

[roybatty]

My server contains very confidential info, and I wanted to know if there was a way to detect someone unauthorized on my network (wired or wireless.)

Short answer: yes, multiple ways. From arpwatch to IPS/IDS systems.

[Encrypted_Soldier]

As said before IDS's and maybe have a list of clients connected that you can consult to find intruders. Also beefing up security isn't a bad idea either.