Sniffing – Spoofing - Session Hijacking Isbat Uzzin Nadhori Informatical Engineering PENS-ITS Edited by Irwan AK

Sniffing Sniffing merupakan usaha untuk membaca dan menganalisa paket yang lewat di jaringan menggunakan program packet sniffing

Packet sniffing is listening (with SW) to the raw network device for data packets that fit certain criteria. A “Packet Sniffer” is needed to collect those data packets. It must be capable of working with the type of network interface supported by the OS. Packets are all in binary format. A “Protocol Analyzer” helps making sense of it all. It recognizes which bits belong to header fields of protocols in which data is embedded. It can be useful to debug, at bit level, an application that sends and receives messages through a TCP/IP connection.  Ethereal: runs on all popular platforms, including Unix, Linux and Windows. It is a powerful protocol analyzer. Open source.  tcpdump, Natas (Windows), nfswatch and Web Packet Sniffer (Unix) are other examples of free sniffers.  LanWatch, Etherpeek, Sniff’em are examples of commercial sniffers. Packet Sniffing What is packet sniffing? Available Tools

Ethreal Now known as Wireshark Install wireshark on GNU/Linux. #apt-get install wireshark...damn it so easy install wireshark on GNU Linux.

Wireshark

Packet Sniffing (2.1) Introduction to Ethereal Click this button to show available interfacesClick “Capture” to start

Packet Sniffing (2.2) Introduction to Ethereal While the sniffer is running, this window shows how many packets, belonging to each different protocol, are being captured. Click “Stop” to finish the capture and analyze the results

Packet Sniffing List of captured packetsProtocol AnalyzerPacket in binary format The selected packet is analyzed below The selected piece of the packet is highlighted below (2.3) Introduction to Ethereal

Packet Sniffing (5.1) Example: Analysis of packets exchanged between an LLRP Reader (IP: ) and a Client (IP: ) TCP connection establishment: Step 1: Client initiates connection [SYN flag set] and informs about its initial Sequence Number. Step 2: Reader accepts, acknowledges the previous message and informs about the initial Sequence Number chosen for the reverse direction [SYN, ACK flags set]. Step 3: Client acknowledges the previous message [ACK flag set]. Once the connection is established, LLRP data transfer can take place. ClientReader SYN, Seq=X SYN, ACK, Seq=Y, Ack=X+1 ACK, Seq=X, Ack=Y+1 LLRP data transfer

Wait … what is LLRP Low Level Reader Protocol (LLRP) Standard Is protocol for an interface between RFID Readers and Clients. The interface protocol is called low-level because it provides control of RFID air protocol operation timing and access to air protocol command parameters. The design of this interface recognizes that in some RFID systems, there is a requirement for explicit knowledge of RFID air protocols and the ability to control Readers that implement RFID air protocol communications. It also recognizes that coupling control to the physical layers of an RFID infrastructure may be useful for the purpose of mitigating RFID interference.

RFID RFID (bahasa Inggris: Radio Frequency Identification) atau Identifikasi Frekuensi Radio adalah sebuah metode identifikasi dengan menggunakan sarana yang disebut label RFID atau transponder untuk menyimpan dan mengambil data jarak jauh. Label atau kartu RFID adalah sebuah benda yang bisa dipasang atau dimasukkan di dalam sebuah produk, hewan atau bahkan manusia dengan tujuan untuk identifikasi menggunakan gelombang radio. Label RFID terdiri atas mikrochip silikon dan antena. Label yang pasif tidak membutuhkan sumber tenaga, sedangkan label yang aktif membutuhkan sumber tenaga untuk dapat berfungsi. D

Question.. Masih inget dengan TCP/UDP ? Masih inget dengan Connection Oriented dan Connection Less Oriented ? TCP ? UDP ?

Packet Sniffing (5.2) Example: TCP Connection Establishment. Step 1. IP ( ) requests a connection [SYN] to IP ( )

Packet Sniffing (5.3) Example: TCP Connection Establishment. Step 2. IP ( ) accepts the connection [SYN, ACK]

Packet Sniffing (5.4) Example: TCP Connection Establishment. Step 3. IP ( ) acknowledges the last message [ACK] so that connection is established

Link Layer Protocol: Ethernet. Protocol’s header contains source and destination MAC addresses Network Layer Protocol: IP. Protocol’s header contains source and destination IP addresses Transport Layer Protocol: TCP. Protocol’s header contains source and destination ports. Sequence and Acknowledgement numbers are useful to follow the order in which messages were sent. In TCP protocol, first sequence number is randomly generated. To make it easier to follow, Ethereal displays relative numbers, that is, as if the first one would be zero. These are the data bits sent by the application Packet Sniffing (5.5) Example: LLRP data transfer.

Question... Masih inget dengan TCP layer dan OSI Layer ?

Packet Sniffing (5.6) Example: LLRP data transfer. Client sends to the Reader GET_READER_CAPABILITIES LLRP message b Application Data: Rsvd = 000Ver = 0 01Message Type = = “1”Message Length [31:16] = Message Length [15:0] = = “11”Message ID [31:16] = Message ID [15:0] = Requested Data = According to LLRP binary encoding:

Session Hijacking Session Hijacking adalah mengambil alih sebuah session pada satu koneksi jaringan. Tipe : – Active session hijacking attacker mengambil alih sebuah session yang terjadi dengan cara memutuskan sebuah komunikasi yang terjadi. Attacker bertindak sebagai man-in-the-middle dan aktif dalam komunikasi antara client dengan server. Serangan ini membutuhkan keahlian untuk menebak nomer sequence (SEQ) dari server, sebelum client dapat merespon server. Passive session hijacking Attacker hanya melihat lalu lintas packet. Biasa disebut sbg sniffing Bisa memberikan informasi penting misal : id user dan password dari client yang sedang melakukan login ke server, sehingga dapat digunakan oleh attacker untuk melakukan login pada lain waktu

Spoofing In spoofing (fooling, deceiving), an attacker impersonates someone else. This allows him/her to exploit the access privileges of the spoofed.

Type of Spoofing ARP Spoofing Attacker change MAC address client with MAC Address Attacker IP spoofing Attacker uses IP address of another computer to acquire information or gain access spoofing Attacker sends but makes it appear to come from someone else Web spoofing Attacker tricks web browser into communicating with a different web server than the user intended.\ Non-network (social engineering)

IP Spoofing IP spoofing is the creation of TCP/IP packets with somebody else's IP address in the header. Routers use the destination IP address to forward packets, but ignore the source IP address. The source IP address is used only by the destination machine, when it responds back to the source. When an attacker spoofs someone’s IP address, the victim’s reply goes back to that address. Since the attacker does not receive packets back, this is called a one-way attack or blind spoofing.

Spoofing  3 Basic way to perform : – Aliasing – Modify mail client – Telnet to port 25

Spoofing One simple form of spoofing is to create a valid account (on yahoo or hotmail) and put someone else’s name in the alias field. In mail relaying, an attacker uses a mail server to send mail to someone in a different domain When is sent by a user, the From: address is not validated.

Web Spoofing One way to lure people to a malicious site is to give it a URL that is similar to that of a legitimate site, e.g., wwwFirstNationalBank.com Another way is for the attacker to provide HTML with a mislabeled link to another page, e.g., in an . Example: American Red Cross

MitM Attacks ‘Man-in-the-Middle’ refers to a machine that is set up so that traffic between two other machines must pass through the MitM machine. Difficult to setup, especially over the Internet. Not so difficult in a LAN environment. Provides no additional advantages over a ‘sniffer’ – is actually just a way to implement a sniffer. Defense: Encryption – however, MitM can refer to an intermediate encrypter Strong perimeter security for Internet MitM attacks. Only secure as the weakest link – the MitM can attack from either end. So, even if you have strong security, but your partner does not, the MitM is possible from the other end.

Countermeasure IP Spoofing Protect against with good firewall rules – keep your machines from launching a spoofed IP – router filters Limit configuration access on machines Programs like arpwatch that keep track of IP/MAC pairings The best way to protect against source routing spoofing is to simply disable source routing at your routers. Spoofing Most servers today do not allow relaying. They only allow s to be sent to/from their range of IP addresses. They insure that the recipient’s domain is the same domain as the mail server. The attacker can run his own server, but then he is easier to trace. Defense - Do not allow relaying on your STMP servers Web Spoofing Use a ‘server-side certificate’. Still, users should Examine the browser location/status line Examine links in HTML source code. Disable “active” content (Java, JavaScript, Active X) in the browser. Ensure that your browser starts on a “secure page” (a local HTML page)