Network Infrastructure Attacks
Jerry Grugin
Legacy Protocols and Services
When we are talking about network infrastructure attacks involving legacy protocols and services, what we are really talking about is a lot of older UNIX programs, programs that have been around for quite a while. These programs have been around for so long that there are many people out there who are experts at exploiting the vulnerabilities in these services. So, what we are talking about is using newer versions of these protocols or services or replacing them altogether in order to mitigate attacks. For example, instead of using TELNET, we might want to focus on using SSH which encrypts data traffic which goes between the client and the server. SSH is really creating a virtual private network tunnel. In another example, instead of using http, we might want to use SSL/TLS. In yet another example, instead of using NTP, we might want to consider using NTP v3 which has some authentication integrity built into it. Instead of using SNMP, we might want to consider using SNMP v3 which allows us to use things like 3DES and AES encryption.
TCP/IP Hijacking and Man-In-The-Middle Attack
TCP/IP Hijacking and Man-In-The-Middle Attack go hand-in-hand. We need a definition of Man-in-the-middle attack first. A Man-In-The-Middle Attack, the attacker is going to place himself somewhere between two communicating network devices. The attacker could place himself between a client and a server. Once the attacker has access, he is going to attempt to trick, fool, or spoof both sides of the communications. So, if we have Alice and Bob on both sides trying to communicate with each other, the attacker is going to try to make Bob believe that the attacker is Alice , and is going to try to make Alice
Null Sessions
Null sessions are arguably one of the most vulnerable Windows vulnerabilities of all time. Null sessions are a kind of Windows server message block SMB communication for file and print sharing. Null sessions give attackers the ability to connect to unsecured IPC$ share. Once communications is established in the null session, many tools can be used against the Windows systems. Windows XP, VISTA , 2003, and 2008 are safe. Unpatched Windows NT/2000 machines are vulnerable. There are a whole lot of Windows 2000 machines still out there. Persons using Windows 2000 machines need the most recent updates or they need to upgrade.
Spoofing
Spoofing can occur at many layers of the OSI model. ARP Spoofing occurs at layer 2. IP Address Spoofing occurs at layer 3. Spoofing is essentially using a false source address. Attackers use the face address to hide their identity and the attack is blamed on something or somebody else. Spoofing is just pretending to be an IP or MAC address with the goal of injecting false information.
Replay attacks
A replay attack is when a malicious user gets data from a network with a packet sniffer. For example, ethereal on a wired network or Aeropeak on a wireless network. For example, an attacker might capture authentication data or credentials of a user logging onto a network and then, later on, reusing that data to be able to log on themselves. Once they impersonate the user, they may try to escalate privileges. CHAPv2 will mitigate against replay attacks. IPSEC implementation can also mitigate against replay attacks.
DOS and DDOS
Denial of Service and Distributed Denial of Service attacks are attacks against availability. It causes failures of systems and services. It includes BOTNETS, DOS, DDOS, TCP SYN, and ICMP floods.
Domain Kiting
This term was coined by the president of GoDaddy.com, Bob Parsons. Domain Name Kiting is a scam involving a few domain name registrars who purchase many well-indexed expired domains. Temporary web sites host these domains loaded up with advertisements and paid links. Domains are then dropped before the 5 day grace period. Domains are perpetually trapped in scheme and unavailable to the public. ICANN presently allows the practice.
DNS Poisoning
DNS Poisoning is Domain Name System Poisoning. This has been a problem since the early days of DNS. Another name for it is DNS Cache poisoning. Basically, this is taking buffers in memory or caches in memory and filling them with bad information by redirection, inputting bad information, or other methodologies.
Passwords
Strong passwords have these characteristics:
- 10 or more characters
- Uses all 4 character types - upper case, lower case, numbers, and symbols
- Using group policy, if someone attempts to log in three times unsuccessfully, we will lock them out
- Also going to enforce password history. Going to make sure that someone does not use the same password again.
Back doors redirect people who are during searches. For example, when people search for something on google and they click on the link, they will be redirected to some other site.
Default Account Vulnerability
Many times, default accounts have vulnerabilities.
Conclusion
In this blog, we looked at network infrastructure attacks and how to protect the network infrastructure from a wide array of a variety of attacks. This blog on infrastructure attacks covered the following: Legacy Protocols, TCP/IP Hijacking, Null Sessions, Spoofing, Man-In-The-Middle Attacks, Replay, DOS, DDOS, Domain Name Kiting, DNS Poisoning, ARP Poisoning, Weak Passwords, Back Doors, and Default Accounts.
No comments:
Post a Comment