1. Scanning, Sniffing, Spoofing and Man-in-the-middle Attacks
Lesson 13

2. Scanning Ping Sweeps Port Scanners Application Scanning
Operating System Scanning
SNMP scanning
Vulnerability Scanning

3. Ping Sweep PING (Packet INternet Groper)
A utility designed to determine whether or not a remote system is accessible.
Using PING, attackers can send an ICMP echo request to every address within a range to determine which systems are “up and running”
Every system that is up will respond with an echo reply, providing a list of potential targets

4. PING Sweeps Unused Address 10.1.1.9 Attacker 10.1.1.10 Target List
Echo Request
Attacker
Echo Request
Echo Reply
Echo Request
Target List
Unused Address

5. PING Sweeps Less effective today than in the past
Recent rise in DoS attacks which also use ICMP have resulted in administrators setting their systems to drop inbound ICMP echo requests.
Can still be effective for insiders or attackers who have been able to penetrate at least one system.
There are a number of different packages that can be downloaded that accomplish this type of scan.

6. Port Scanning
A Port Scanner is a program that checks a computer’s TCP/IP stack for ports that are in the LISTEN state.
There are 65,535 possible ports
are considered “well known”
are called “registered ports”
,535 are dynamic or private ports
RFC 793 defines how TCP will react to FIN, ACK, and SYN packets.

7. RFC 793
If the state is CLOSED (that is, Transmission Control Block does not exist) then all data in the incoming segment is discarded. An incoming segment containing a RESET (RST) is discarded. An incoming segment not containing a RST causes a RST to be sent in response. The acknowledgment and sequence field values are selected to make the reset sequence acceptable to the TCP that sent the offending segment.
If the state is LISTEN then first check for an RST, An incoming RST should be ignored. Second check for an ACK. Any acknowledgment is bad if it arrives on a connection still in the LISTEN state. An acceptable reset segment should be formed for any arriving ACK-bearing segment. Third check for a SYN, if the SYN bit is set, check the security. IF the security/compartment on the incoming segment does not exactly match the security/compartment in the TCB then send a reset and return.

8. Some Well-known ports Port Number Network Service
20 File Transfer Protocol (FTP) Data
21 File Transfer Protocol (FTP) Control
23 Telnet
25 Simple Mail Transfer Protocol (SMTP)
53 Domain Name Server (DNS)
79 Finger
80 World Wide Web (HTTP)
110 Post Office Protocol – Version 3
443 HTTPS

9. Port Scanning
In a Port Scan, the system will attempt to connect to specific (or all) ports on the remote system to see which respond.
Responding ports are considered “open” and the attacker can then attempt to exploit (especially known services on well-known ports).
Large number of tools available to perform port scanning. nmap is one of the most popular tools that can perform a port scan.

10. Port Scanning
Attacker 79 80 80 81 82
Web server
Services List
HTTP

11. Types of Port Scanning
TCP SYN Scanning – “half open” scanning. Sends a SYN packet to each remote port. Open ports respond with a SYN/ACK packet. Closed ports usually respond with an RST packet.
TCP FIN Scanning – Sends a FIN packet (normally sent to clear connection when conversation is finished). Closed ports usually respond with an RST packet. Open ports usually ignore FIN packets.
UDP Scanning – often more difficult than TCP since UDP services may not respond. If a ICMP “port unreachable” message is received, however, it is an indication the service is NOT running.
Fragmentation Scanning – break scan up into several smaller packets. This may result in being able to hide the scan from firewalls and IDS.
Relay or bounce scanning – send scan through another system (proxy or forwarding gateway), may confuse/hide origin of attack
Decoy scanning – send a large number of spoofed packets along with your real one so they hide the real scan.

12. nmap

13. nmap ping sweep

14. nmap host scan

15. Super Scan

16. Vulnerability Scanning
One approach to vulnerability scanning is to
Use a port-scanning tool such as nmap to identify the OS and to log all listening ports
May return something like
Linux Kernel 2.2 with ports 21, 25, 53, 80 listening
What the ports are and what vulnerabilities that may exist in them is an exercise left up to the user.
The purpose of a vulnerability scanner is to detect the presence of specific vulnerabilities
Common components for vulnerability scanners
Vulnerability data – information about known vulnerabilities, how knowledgeable is the tool?
Scanning mechanism – the “guts” of the scanner, how accurate is the tool?
Reporting mechanism – interface with user

17. Types of vulnerability scanners
Commercial scanners: developed and sold by companies (e.g. ISS and Cisco).
Due to development time, often lag freeware scanners.
Freeware scanners: developed and released “in the community”
General-purpose scanners: look for a wide range of vulnerabilities on a large number of operating systems and applications. Often used in a security audit.
Application scanners: written to examine a specific application for vulnerabilities associated with it.
Service scanners: Scanning tool used to examine a specific network service, such as WWW, for common vulnerabilities associated with that service.
Specific vulnerability scanners: written to only check for a specific vulnerability.

18. Whisker

19. SNMP

20. Share Sniffer

21. Share Sniffer

22. Share Sniffer

23. Possible information from scanning
Which systems are active
What services are available/listening
What operating system is in use
Which version of an application is running
Which users have an account on the system and which are active
What the security configuration/settings are
Whether certain patches have been installed
Information about specific vulnerabilities
Possibly whether a specific exploit will be successful

24. Ways to recognize scanning
System log file analysis – look for multiple, short duration connections or connection attempts.
Network traffic – monitor the volume of inbound and outbound network traffic. If you have established a profile of what is normal activity you will be able to recognize spikes in the activity level which may indicate scanning activity.
Firewall and router logs – look for multiple rejections or access violations coming from the same source or group of sources.
Intrusion detection systems – most IDS contain built-in methods for examining traffic to detect scanning attempts.

25. Defending against Scanning and its effects
Block ports at your router/firewall.
Block ICMP, including echo
Create a DMZ
Use bastion hosts/proxy servers
Use NAT to hide private, internal IP addresses
Remove default/sample materials
Remove unnecessary services
Restrict permissions
Change default headers associated with services
Keep applications and operating systems patched
Establish a “Honeypot” to trap attackers

26. Scanning Your Own Network
Will provide you with “hackers view” into your network
Will illustrate the most visible vulnerabilities
Scan from both “internal” and “external” vantage points

27. New Target – Wireless Ethernet
802.11b
WEP (Wired Equivalent Privacy)
40-bit encryption key and 24-bit Initialization Vector (64-bit encryption)
104-bit key plus the 24-bit Initialization Vector (128-bit encryption)
Most Access Points are deployed with no encryption, or with default keys

29. Resources http://packetstormsecurity.org/ Whisker
nmap
Share Sniffer
SuperScan

30. Resources (cont.) Portsentry http://www.psionic.com/abacus/portsentry
Pandora (Netware)
802.11b (wardrive, thcrut)
802.11b (Network Stumbler)

31. Sniffing
Sniffers are programs or HW devices that monitor (“listen in to”) traffic flowing across a network.
They can pull in all packets or be selective and only grab packets destined for certain addresses or that carry a certain type of traffic
For a sniffer to work correctly, it needs to view all of the traffic going across a network. Thus, it must be on an internal network or on a main connection into/out of a network.

32. Computer Network Monitoring
Port Scanning
Keystroke Monitoring
Packet sniffers
takes advantage of “friendly” nature of net.
Grabs packets not destined for system
used by
hackers
sysadmins
Law enforcement agencies

33. IP Packet 4 8 16 19 32 Version Length Type of Srvc Total Length
Version
Length
Type of Srvc
Total Length
Identification
Flags
Fragment Offset
Time to live
Protocol
Header Checksum
Source Address
Destination Address
Version: format of header (usually ‘4) Length: header-only length Type of Service: quality of service desired, e.g. high or low delay, normal or high reliability, normal or high throughput… Identification: uniquely identifies this packet so that it can be distinguished from other packets Flags: whether this packet is fragmented and whether this is last fragment Fragment Offset: offset from the start of the original packet, used to rebuild the full message once all fragments received Time to live: how long the datagram will be stored on the network before it is destroyed. Protocol: specifies next level of protocol used in the data portion of the datagram e.g. 1 = Internet Control Message = Internet Group Management
6 = Transmission Control Header Checksum: used to provide error checking on the header itself. Source Address: IP address of the source host on the internet Destination Address: IP address of the destination host on the internet.
Options
Data

34. SnifferPro

35. SnifferPro
my machine
gateway
DNS

36. SnifferPro

37. SnifferPro

38. NetXray

39. TCP packet 4 8 16 32 Source Port Destination Port Sequence Number
Source Port
Destination Port
Sequence Number
Acknowledgement Number
Data
offset
Unused
U A P R S F
R C S S Y I
G K H T NN
Window
Checksum
Urgent Pointer
Options Padding
Data

40. NetXray

41. Van Eck reception
Relies on the fact that electronic equipment radiates electromagnetic signals which can be intercepted
With the proper equipment signals can be recreated up to 1 kilometer away

42. Seizing the Signals Eavesdropping on conversations Traffic analysis
“listening in”, the content
Traffic analysis
data about the signals themselves

43. Eavesdropping Cellular Intercepts Pager Intercepts
extremely vulnerable to interception
Pager Intercepts
also fairly simple
Law Enforcement Wiretaps
generally require court order with probable cause
Foreign Intelligence Intercepts
US and others have VERY active program in this arena

44. Defeating Sniffer Attacks
Detecting and Eliminating Sniffers
Possible on a single box if you have control of the system
Difficult (depending on OS) to impossible (if somebody splices network and adds hardware) from network perspective
Safer Topologies
Sniffers capture data from network segment they are attached to, so – create segments
Encryption
If you sniff encrypted packets, who cares?
(outside of traffic analysis, of course)

45. Traffic Analysis Looks at activity, not contents
Pen Registers and Trap & Trace
pen registers provide access to the numbers that are dialed from a phone
trap & trace provides incoming numbers
Location Tracking
possible with cellular phones
can work even when phone not in use

46. Spoofing
“a sophisticated technique of authenticating one machine to another by forging packets from a trusted source address.”

47. IP Spoofing
This may simply consist of forging the from address in an IP packet so it appears to have come from somewhere else.
Often used to trick target machine into believing packet is coming from a host it trusts, thus getting the target machine to perform some task.
To do appropriately it may involve sniffing, spoofing, and DoS attack

48. Two themes present in these definitions
Trust
“the relationship between machines that are authorized to connect to one another.”
Authentication
“the process those machines use to identify each other.”
Generally these two have an inverse relationship:
If a high degree of trust exists between two machines, the amount of authentication is low.
If little trusts exists between the machines, a great deal of authentication is required.

49. Authentication and Trust
Most common method of authentication is the userid/password combination.
If a user on a local network wants to access another system on the local network, having to supply the password to log on is a nuisance. Consequently, a trusted relationship may be established where one local system will trust the other to have authenticated the user originally and will thus not require additional authentication.
An example of this is the UNIX .rhosts and hosts.equiv files.

50. Trusted relationships in UNIX
.rhosts file is used to establish a trusted relationship between machines. Used by rlogin, rsh, and rcp to determine which remote hosts and users are considered “trusted” and are allowed to access the host without supplying a password.
rlogin (remote login), rsh (remote shell), rcp (remote copy)
File consists of
A host name, indicating that this user is trusted when accessing the system from the specified host, or
A host name followed by a login name, which indicates that the listed login name is trusted when accessing the system from the specified host

51. .rhosts example
If user1 had the following .rhosts file in their home directory (/home/user1/.rhosts)
system2 system4 system5 user2 system2 user5
It would mean
user1 could log in from system2 as user1
user1 could log in from system4 as user1
user1 could log in from system5 as user2
user1 could also log in from system2 as user5

52. /etc/hosts.equiv file example
/etc/hosts.equiv are essentially equivalent to a system-wide .rhosts file and contain lines with hostnames. If system1 contained the /etc/hosts.equiv file:
system2 system4 system5
It would indicate that any user on system2, system4, or system5 could log into system1 without having to supply a password.
This assumes that an equivalent username exists on system1 as the one being used on the accessing system (i.e. system2, system4, or system5).
A + in the /etc/hosts.equiv file says all systems trusted.

53. Authentication and UNIX Trusted relationships
UNIX will base its trust decision, using the .rhosts or hosts.equiv files, on the IP address of the connecting system.
But…. The IP address (and most other fields) of an IP header can be forged!!!

54. IP Spoofing on LAN Trusted System 2 Trusted System 1 OK, here it is...
Huh? I didn’t ask for that...
This is System 1,
Please send file A
Attacker
Attacker

55. IP Spoofing on LAN Trusted System 2 Trusted System 1 OK, here it is...
Attacker uses
sniffer to grab
file
This is System 1,
Please send file A
DoS attack
launched
Attacker
Attacker

56. IP Spoofing across the Internet
Trusted System 2
Trusted System 1
OK, I’ve done it
Login as
user X
This is System 1,
Please add user X
to your password file
DoS attack
launched
Attacker
Attacker

57. Spoofing
In the preceding slides, the actions represented by the “OK, I’ve done it” or the “OK, here it is” lines may actually consist of a series of messages with appropriate responses.
The attacker knows what the responses should be, so the attacker can send them, timed appropriately, to ensure the connection is maintained.

58. Blind spoofing
In non-blind spoofing the response sent by the target machine can be observed (sniffed).
In blind spoofing, the target’s responses can not be observed.

59. The steps of a spoofing attack
Identify the target of the attack (a system with a trusted relationship with another).
“Eliminate” (DOS attack) the host you wish to spoof.
Forge the address of the host being spoofed in your packet to be sent to the target.
Send the spoofed packet to the target
Keep the connection active by guessing the correct sequence number used by the target machine.

60. Sequence numbers Used to acknowledge receipt of data.
Remember 3-way handshake process
Client sends TCP packet with an initial sequence number.
Server responds with it’s own sequence number and an acknowledgement (ACK).
The client acknowledges receipt by sending packet with server’s number plus one.

61. Guessing the sequence number
For non-blind spoofing, no problem as you can see the responses.
For blind spoofing:
Contact the target and attempt several connections
Target will respond with a sequence number for each
Analyze the responses to determine the pattern the target uses for incrementing

62. Once you’ve succeeded…
Attempt to secure a better connection
Modify password file
Modify hosts.equiv or .rhosts file
Shut down spoofed connection (stop the DOS attack). Now log into the target host using new account or based on trusted relationship.

63. Spoofing Prevention Tips
General rule of thumb: Don’t have any trusted relationships if you can help it.
Don’t accept packets from outside of your network that claim to be originating from inside of your network.

64. Man-in-the-Middle Attacks
Name given to a type of spoofing attack where the intruder assumes a position between the two legitimate users and
Simply listens in (thus really just sniffing)
Relays information, thus can substitute appropriate public key to convince the legitimate users that their communication is secret, when it isn’t.

65. Man-in-the-middle attack
Public Key
Repository
What is System B’s
Public Key?
Here it is
Message sent using
System B’s public key
System B
System A

66. Man-in-the-middle attack
Public Key
Repository
What is System A’s
Public Key?
Here it is
What is System B’s
Public Key?
Hi, I’m System B,
Here is my new Public key
Here it is
What is System A’s
Public Key?
What is System B’s
Public Key?
Hi, I’m System A,
Here is my new Public key
Here it is
Here it is
Quick DoS
On System A
Quick DoS
On System B
Message sent using New
System B’s public key
Message sent using
System A’s public key
Message sent using New
System A’s public key
Message sent using
System B’s public key
System B
System A

67. Summary What is the Importance and Significance of this material?
How does this topic fit into the subject of “Voice and Data Security”?