Attack Methods Chapter 4 Corporate IT Security Copyright 2002 Prentice-Hall

2 Figure 4-1: Targeted System Penetration (Break-In Attacks) Unobtrusive Information Collection  Do research before sending any packets into the network Use in social engineering attacks Use as background for packet attacks  Corporate website  Trade press (often online and searchable)  Securities and Exchange Commission (SEC) web-enabled Internet financial database (Figure 4-2)

3 Figure 4-2: Securities and Exchange Commission's Edgar Service

4 Figure 4-1: Targeted System Penetration (Break-In Attacks) Unobtrusive Information Collection  Whois database (Figure 4-3) Information about responsible person Information about IP addresses of DNS servers, to find firm’s IP address block Easy if assigned a classful address block (Figure 4-4) Difficult is CIDR address block or a block of ISP addresses

5 Registrant: Panko, Ray (PUKANUI-DOM)PUKANUI-DOM 1000 Pukanui St. Honolulu, HI US Domain Name: PUKANUI.COM Administrative Contact: Panko, Ray 1000 Pukanui St. Honolulu, HI US (808) Figure 4-3: Whois Entry for Pukanui.Com (from

6 Registrant: Technical Contact: VeriSign, Inc. (HOST-ORG) VeriSign, Inc Ridgetop Circle Dulles, VA US fax: - Record expires on 07-Jul-2003 Record created on 07-Jul-2001 Database last updated on 7-Jun :07:22 EDT. Domain servers in listed order: NS76.WORLDNIC.COM NS75.WORLDNIC.COM Figure 4-3: Whois Entry for Pukanui.Com (from DNS Servers

7 Figure 4-4: Classful IP Address Allocations Example  Suppose DNS server is  Must be a Class B address block (from table lookup)  Therefore, the network part is 16 bits:  Address block must be to ClassInitial IP Address in Class Last IP Address in Class Size or Network Part Addresses in Block Allocated to Firm A ,777,214 B ,534 C

8 Figure 4-1: Targeted System Penetration (Break-In Attacks) IP Address Spoofing (Figure 3-17)  Put false IP addresses in outgoing attack packets Attacker is blind to replies  Use series of attack platforms (Figure 4-5)

9 Figure 4-5: Using a Chain of Attack Hosts Attacker Victim Compromised Host Compromised Host Attack Replies Allows Reading of Replies Without Exposing Attacker

10 Figure 4-5: Using a Chain of Attack Hosts Subsequent Trace Back Successful Connection Broken Connection Broken Compromised Host Compromised Host Attacker Victim

11 Figure 4-1: Targeted System Penetration (Break-In Attacks) Host Scanning  To identify IP addresses of potential victims  Ping individual hosts (Figure 4-6)  Ping all IP addresses in block for live IP addresses (Figure 4-7)

12 Figure 4-6: Ping at the Windows Command Prompt

13 Figure 4-7: Ping Scanning With Ping Sweep