- Introduction
- Classes of Attack
- Mitigating Network Threats
- Chapter Summary
- Apply Your Knowledge
This chapter is from the book
This chapter is from the book
This chapter is from the book
Classes of Attack
Objective:
- Describe today's increasing network security threats and explain the need to implement a comprehensive security policy to mitigate the threats
Any number of motives could inspire an attacker; two motives that we touched on already are financial gain and gathering intelligence. A hacker may also simply enjoy the thrill of successfully breaking into someone's network. There are documented cases of hackers who intentionally attacked government systems simply to prove that it could be done and therefore gain notoriety.
This section discusses three classes of attack that are commonly found in today's network environment:
- Access attacks
- Reconnaissance attacks
- Denial of service (DoS) attacks
Each class has various more-specific subcategories of attack methods that will be covered in greater detail.
Access Attacks
An access attack is just what it sounds like: an attempt to access another user account or network device through improper means. If proper security measures are not in place, the network may be left vulnerable to intrusion. A network administrator is responsible for ensuring that only authorized users access the network. Unauthorized attacks are attempted via four means, all of which try to bypass some facet of the authentication process: password attacks, trust exploitation, port redirection, and man-in-the-middle attacks.
Password Attacks
Nowadays, it seems as if you need a password for everything. I have so many passwords that I find it hard to keep track. Although it might sound like a good idea to keep your passwords simple or to write them down, both practices are highly discouraged. The goal is to make it harder for someone to find or guess your password; therefore, password integrity is necessary. That being said, an attacker might attempt a login with false credentials. It is also important to note that not all attackers are external users. Many recorded instances of attempted and/or successful attacks have come from internal company employees.
There are alternatives to passwords, such as Terminal Access Controller Access Control System (TACACS) or Remote Authentication Dial-In User Service (RADIUS), both of which manage access to network hardware. Passwords are fast becoming as obsolete as rabbit-ear antennas or dialup Internet connections.
Cisco equipment is shipped from the factory with a standard configuration. When the device is turned on, the setup program prompts for a password and leaves all but the enable secret password in plain text. It is the responsibility of the recipient to update the password information before deploying the device on a network. Changing passwords every time an employee leaves the company or in a given time period (every 90 days) would also help protect login credentials.
Trust Exploitation
Trust exploitation can occur in one of two ways:
- Reliance on the trust a client has in a server
- Reliance on the trust the server has in the client
For example, most companies have a part of their network that lies between the wide-open Internet and the corporate internal network. This in-between part of the network is called the demilitarized zone (DMZ). Servers that communicate from the DMZ and the internal network may have a trust relationship established. The internal devices may be set up to trust information that is received from a DMZ server. An attacker can then compromise the DMZ server and initiate a connection to the internal network. This is an example of phishing. When the trust that the server has in a client is exploited, this is an example of session hijacking.
Port Redirection
Port redirection is a form of trust exploitation in which the untrustworthy source uses a machine with access to the internal network to pass traffic through a port on the firewall or access control list (ACL). The port in question normally denies traffic, but with redirection the attacker can bypass security measures and open a tunnel for communication.
Man-in-the-Middle Attacks
A man-in-the-middle attack happens when a hacker eavesdrops or listens for network traffic and intercepts a data transmission. After the transmission is intercepted, the untrustworthy host can position itself between the two communicating hosts, interpret the data, and steal information from the packets sent. The hacker can also take over the session and reformat the packets to send information to either or both communicating parties. In this situation, it is possible for the hacker to capture credentials, hijack a session, or instigate a DoS attack.
Data sessions are more vulnerable when the packets are left in clear-text format and can be read without additional decryption by the human eye. Proper data encryption, with the use of an encryption protocol, makes the captured data useless.
Reconnaissance Attacks
When I hear the word reconnaissance, I think of a military reconnaissance mission. The soldier is sent out to gather important information about an area of interest. The same holds true for a reconnaissance attack on a computer network. The hacker surveys a network and collects data for a future attack. Important information that can be compiled during a reconnaissance attack includes the following:
- Ports open on a server
- Ports open on a firewall
- IP addresses on the host network
- Hostnames associated with the IP addresses
As with access attacks, there are four main subcategories or methods for gathering network data:
- Packet sniffers (also known as network monitors)
- Ping sweeps
- Port scans
- Information queries
Packet Sniffers
A packet sniffer may also be called a network analyzer, packet analyzer, or Ethernet sniffer. The packet sniffer may be either a software program or a piece of hardware with software installed in it that captures traffic sent over the network, which is then decoded and analyzed by the sniffer. Network administrators install monitors on dedicated machines or on their workstations when needed. A common software program available today is Wireshark, formerly known as Ethereal.
Ping Sweeps
As you may recall, ping enables you to validate that an IP address exists and can accept requests by sending an echo request and then waiting for an echo reply. A ping sweep tool can send an echo request to numerous host IP addresses at the same time to see which host(s) respond(s) with an echo reply.
Port Scans
A port scanner is a software program that surveys a host network for open ports. Because ports are associated with applications, the hacker can use the port and application information to determine a way to attack the network. As mentioned, these programs can be used by a third party to audit a network as well as being used by a hacker for malicious intent.
As mentioned in Chapter 1, it is extremely important that you know the prevalent applications and their matching port numbers. Table 4.1 reviews the applications that use TCP, and Table 4.2 reviews UDP-based applications.
Table 4.1. Applications Using TCP
|
Application |
Port Number(s) |
|
FTP |
20, 21 |
|
Telnet |
23 |
|
SMTP |
25 |
|
DNS (zone transfers) |
53 |
|
HTTP |
80 |
|
POP3 |
110 |
|
NNTP |
119 |
|
HTTPS |
443 |
Table 4.2. Applications Using UDP
|
Application |
Port Number(s) |
|
DHCP |
67, 68 |
|
DNS (name resolution) |
53 |
|
TFTP |
69 |
|
NTP |
123 |
|
SNMP |
161 |
Information Queries
Information queries can be sent via the Internet to resolve hostnames from IP addresses or vice versa. One of the most commonly used queries is nslookup. You can use nslookup by opening a Windows or Linux command prompt (CMD) window on your computer and entering nslookup followed by the IP address or hostname that you are attempting to resolve.
Here are a couple sample CMD commands:
C: nslookup www.cisco.com C: nslookup 198.133.219.25
A multitude of websites offer an nslookup tool.
Denial of Service (DoS) Attacks
DoS attacks are often implemented by a hacker as a means of denying a service that is normally available to a user or organization. For example, users might be denied access to email as the result of a successful DoS attack. IP spoofing can be used as part of a DoS attack or man-in-the-middle attack and occurs when a valid host IP address is assumed by an attacking system. This provides a way to bypass the trust a machine has in another machine.
Although it has long since been patched, a DoS attack called the ping of death occurred when an ICMP echo request packet larger than 65,535 bytes was sent to a target destination, causing it to overflow, crash, and/or reboot. A current example of a DoS attack is a teardrop, which can cause a system to crash by running the CPU up to 100%. Teardrop sends in thousands of tiny fragments with overlapping offsets.
DoS can also be in the form of a distributed DoS (DDoS) attack, TCP SYN attack, or smurf attack.
Distributed DoS (DDoS)
With distributed DoS, multiple systems are compromised to send a DoS attack to a specific target. The compromised systems are commonly called zombies or slaves. As a result of the attack, the targeted system denies service to valid users. Figure 4.1 illustrates a DDoS attack.
)
Figure 4.1 DDoS attack.
TCP SYN
You may recall from Chapter 1 that a TCP session is established with the use of a three-way handshake, which involves the following steps:
- A "connection agreement" segment is sent to the recipient, asking to synchronize systems. This step is associated with the bit name SYN.
- The second and third segments acknowledge the request to connect and determine the rules of engagement. Sequencing synchronization is requested of the receiving device. A two-way connection is established. This step is associated with the bit name SYN-ACK.
- A final segment is sent as an acknowledgment that the rules have been accepted and a connection has been formed. This step is associated with the bit name ACK.
Figure 4.2 illustrates a proper TCP session.
)
Figure 4.2 TCP session establishment.
In a TCP SYN attack, a SYN request is sent to a device with a spoofed source IP address. The attacking system does not acknowledge the resulting SYN-ACK, which causes the session connection queues to fill up and stop taking new connection requests. TCP intercept can be configured on a router to block a TCP SYN attack. This enables the router to terminate any sessions that have not been established within an allotted time frame.
Smurf Attack
With a smurf attack, multiple broadcast ping requests are sent to a single target from a spoofed IP address. Figure 4.3 illustrates a smurf attack. Adding the no ip directed-broadcast command to a router might help mitigate a potential smurf attack.
)
Figure 4.3 Smurf attack.