Network Security

Packet Sniffing

In sniffing attacks, attackers can eavesdrop on a physical network, wired or wireless and capture packets transmitted over the network

NIC is a physical or logical link between a machine and a network

When a frame arrives via the medium, it is copied to memory inside NIA and checks the MAC address, after which it is copied to kernel using DMA. The card then raises Interrupt Request (IRQ) to the CPU to inform about the packet. CPU copies all the packets from buffer to a queue. Based on the protocol, different handler functions are invoked by the kernel to process the data.

Promiscuous Mode

Frames that are not destined to a given NIC are discarded rather than being passed to CPU processing, making it impossible to sniff. This allows to pass the packets to kernel, regardless of whether the mac address matches.

Packet Spoofing

Sending packets under false identity

If we want to send a TCP packet out with both SYN and FIN bits turned on, we cannot achieve that via the typical socket programming, because these two bits are never set at the same time in normal TCP packets

Function Name	Description
socket()	Create a socket
bind(), connect()	Assign a socket to IP address and port
send(), recv(), write(), read()	Tx and Rx to and from the socket

Common Security Attacks

• Finding a way into they network
• Exploiting software bugs, buffer overflows
• Denial of Service
• Packet Sniffing

Denial of Service

Make a network service unusable by overloading the network / server

SYN flooding attack

• Send SYN packets with bogus source IP address
• Server responds with SYN-ACK and keeps the state half open

Smurf

• Source IP address of a broadcast ping is forged
• Large number of machines respond back to victim, overloading it
• ICMP ECHO

TCP Reset Attack

• Break an existing connection between two victim host
• Closing TCP connections - TCP FIN protocol
• Success is sensitive to sequence number

Fork Bomb (Rabbit virus)

Continuous forking, depleting resources of the system

• Prevention - limit the maximum number of process that a single user may own

Denial of Service

• Distributed Denial of Service

Types of DDos Attacks

• Volume-based attacks - ICMP, UDP and spoofed packet flood attacks, size of the volume is measured in bits per second
• Protocol or network layer based - SYN floods, SMURF DDoS
• Application-layer attacks* - Flooding applications with crafted packets - requests / second

Techniques

• Spoofing
• Reflection
• Amplification

Mitigate DDoS Attack

• Rate limiting
• Port blocking
• Traffic signatures for IDS
• Intelligence

Botnet

Group of computers infected with malware under the control of bot master.

Reflection Attack

• Attacker forges the source address of the request, pretending to be the victim
• Server are unable to distinguish legit packets from spoofed when UDP is used

NTP Reflection Attack

• Monlist contains list of hosts that recently interacted with the server
• A single monlist request of 250 bytes can cause the server to send back several kB of data.

Amplification Attack

• Attacker’s goal is to make the abused server produce as much as response data as possible. The ration between the sizes of response and the request is called amplification factor.

Memcached Server

• Memcached servers allow applications that need to access a lot of data from an external database to cache some of the data in the memory
• They can be some times exposed to open internet

SNMP Reflection / Amplification Attack

• SNMP - A common network management protocol used for configuring and collecting information from network devices like servers, hubs, switches, routers and printers. The amplification ratio is around 30.

DNS Amplification Attack

The attackers uses a compromised endpoint to send UDP packets with spoofed IP addresses to a DNS recursor, often passing an arguement “ANY”.

ARP Protocol

ARP protocol is used to get the mac-address of a system, given that the IP address is known.

Steps

• Source checks cache
• Source generates ARP request
• Source broadcasts ARP request
• Local Devices process ARP request
• Destination Device generates ARP reply
• Destination updates ARP cache
• Destination sends ARP reply
• Source Processes ARP reply
• Source updates ARP Cache

ARP Spoofing

• Attacker must have access to internet
• The forged responses advertise that the correct MAC address for both IP addresses, belonging to the router and workstation is the attacker’s MAC address.
• The two devices update their ARP cache entries.

Possible Attacks

• Sniff the packets
• Perform session hijacking
• Alter communication
• DOS
• DNS poisoning

Port Scanning / Reconnaissance

• To discover serves that can be exploited to break into systems.

Ports

• Ports are software abstraction, used to distinguish between multiple services.
• Reserved ports and Ephemeral ports

Port States

• Open - An application is actively TCP connections or UDP packets
• Closed - A closed is accessible, but there is no application listening to it
• Filtered - Cannot determine whether the port is open because packet filtering prevents its probes from reaching the port

Ambiguity

• Unfiltered
• Open | Filtered
• Closed | Filtered

TCP Scan

• TCP connect scan - completes a three-way handshake
• TCP SYN scan - Half-opening scanning
• TCP-FIN scan - Scanner sends a FIN packet
  • Closed ports reply with RST packet
  • Open ports ignores the packet

TCP ACK

• It never determines open
• Unfiltered systems send RST packet, whereas the ones that do not respond is classified as filtered

TCP Window Scan

• Exactly the same as ACK scan
• Rather than always printing unfiltered when a RST is returned, it checks the TCP Window field
• If positive → Open
• If zero → Closed

TCP FIN Scan

Send a FIN packet without SYN to bypass the SYN loggers or when the root privilege is required to create raw TCP packet

FIN may be dropped by firewall/pass through

TCP NULL, FIN, Xmas Scans

Scan Type	Flags Set	Typical Response (Open Port)	Typical Response (Closed Port)
Null	None	No Response	RST
FIN	FIN	No Response	RST
Xmas	FIN, PSH, URG	No Response	RST
When RST packet is received → Closed
No response → Open	Filtered
ICMP unreachable → Filtered

TCP Maimon Scan

• Probe is FIN/ACK
• Flaw in TCP
  • A RST packet should be generated in response to such a probe, but many BSD derived systems just drop it if the port is open

TCP Idle Scan

• Complete blind port scanning

• Attackers can scan the target without sending a single packet to the target from their own IP address. Instead a clever side-channel attack allows for the scan to be bounced off a dumb zombie

• Stealth scan

• Used to defeat certain packet filtering firewalls and routers

UDP Scan

• In order to find UDP ports, the attackers generally sends empty UDP datagrams.
• If the port is listening → error or ignore the datagram
• ICMP Port Unreachable → Closed

Vertical and Horizontal Scan

• Vertical Scan - Scan multiple ports on a single machine
• Horizontal Scan - Scan the same port on multiple machines

DNS Query and Reply

DNS Cache Poisoning

Act of entering false information into a DNS cache

Checks at Name-server

• Port checking
• Query ID checking
• Bailiwick checking (Additional and Authority sections should have the same domain as the query domain)

DNS Cache

DNS resolvers save responses in their cache for as long as the TTL associated with that IP address allows them to.

Probe Type	Open Port Response	Closed Port Response	Filtered (Firewall) Response
SYN	SYN/ACK	RST	No Response or ICMP
FIN / NULL / Xmas	No Response	RST	No Response or ICMP
UDP	No Response (usually)	ICMP Unreachable	No Response or ICMP
ACK	RST	RST	No Response or ICMP