I'm currently trying to enter the field of information security and I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? I only have a couple of devices (Android, Microsoft, Apple, Netgear, etc.) and I would like to do some rudimentary pentests. This is primarily an academic exercise. Are there any agreements (with device manufacturers), laws, or ethical codes I would be violating if I set up a private network specifically for this purpose? What do white-hat hackers in the field do to test Android and Windows for example?
Add a comment
|
3 Answers
There is nothing hindering you from testing within your own network. To get a rudimentary understanding of what is involved with testing, I suggest you familiarize yourself with the Penetration Testing Execution Standard, OSSTMM, and other similar pentesting frameworks. Once you begin establishing the who, what, when, where and why, it will make things easier for you to set up your own environment. For testing I never set up anything in my network (there is no trying to mimic a client) because I can never know what patch levels they have, what software is installed, and so forth. Rather than re-invent wheels, there are plenty of "hackable" virtualized instances you could download. I suggest NetInVM. But to answer your question, what you do in your private network is not bound by any of the common USC (US law) computer related laws.
It's perfectly legal to attack a machine or network as long as you have the explicit permission of the owner. Since it's your network, you can do whatever you would like.*
There are other laws you may still bump into. For example, you can't change your WiFi access points to transmit on an unlicensed frequency. If you install a virus "for testing purposes" but it escapes and propagates outside of your house, you are probably violating the law.
For practicing attacks and analyzing malware, most 'hats use "virtual machines". These are whole computers that are run as a program inside a physical computer. Virtual Machines (VMs) can also have their virtual network adapters configured to isolate them, so you don't risk a virus escaping. Their "disk image" is stored as a file on the host computer. So if you infect a virtual computer with a virus to test your ability to detect it, when you're done you can just delete the disk image and it's gone. You can also find plenty of other training or practice systems to attack, such as WebGoat from OWASP.
* If you break your network such that Netflix no longer works, the rest of your family might be really unhappy. But it's still legal.
answered Jun 24, 2016 at 17:13
I was just wondering if there was anything barring me from testing my own network for security vulnerabilities?
Yes. Some ISPs may have terms that prohibit certain activities which appear to be attacks. To thwart this issue, you could use your own equipment to attack. So, instead of having your firewall be plugged into your "modem" (e.g., cable modem, or DSL modem), you could have your firewall be plugged into a laptop that performs attacks. (Or, if your modem has a free LAN port, you might be able to treat the modem like a switch.) Then, you're still not effectively testing your modem's ability to withstand attacks, but you can effectively test the security of all of your other devices on the inside.
In theory, you could do things from outside the network by using a VPN, although when you do that, the network traffic you generate probably won't resemble actual attacks extremely closely.
This is primarily an academic exercise.
This exercise is probably not worth getting barred from using your ISP.
Most ISP's probably don't really care that much. However, if they do use electronic monitoring, then chances of getting caught could be quite high, even for a "small" attack.
I only have a couple of devices (Android, Microsoft, Apple, Netgear, etc.) and I would like to do some rudimentary pentest.
Are there any agreements (with device manufacturers), laws, or ethical codes I would be violating if I set up a private network specifically for this purpose?
Device manufacturers? Nah. Not that I'm aware of. You're fine there. I think. Although, I should note that it feels like the general trend of major manufacturers (for devices and commercial software) is to try to take over the experiences of end users, and expect customers to just simply trust them about matters like security. If this trend continues (or if it has already continued far enough), some agreements could be written to prevent people from doing such things.
laws? Maybe. First of all, laws vary. For instance, I'm not very aware of North Korean or Chinese law. Based on laws that I am aware of, you ought to be just fine to test your own equipment. However, you didn't say these were your devices. You just said the devices are on your network. If these devices belong to family members (or anyone else other than yourself), you may be committing electronic "trespassing". So, yes, this may well be illegal (in that case).
What do white-hat hackers in the field do to test Android and Windows for example?
Some of them put their machine between the Internet connectivity device (e.g., the "modem") and the rest of their network. Some of them use ISPs that don't forbid attacks on your own equipment. Some of them just violate the ISP's rules and typically don't get caught, and just trust that market competitiveness will prevent their ISP from responding too harshly after a first incident. Some of the so-called "white-hat" hackers, who don't actually attack anyone, aren't really all that honest, and they don't actually perform tests nearly as thoroughly as they pretend to.
