Network Attacks - Part 1
Before going to attacks you need to understand difference
between Hacker and a Cracker?
Hacker: Eric
Raymond, compiler of The New Hacker's Dictionary, defines a hacker as a clever
programmer. A "good hack" is a clever solution to a programming
problem and "hacking" is the act of doing it. Raymond lists five
possible characteristics that qualify one as a hacker, which we paraphrase
here:
A person who enjoys learning details of a programming
language or system
- A
person who enjoys actually doing the programming rather than just
theorizing about it
- A
person capable of appreciating someone else's hacking
- A
person who picks up programming quickly
- A
person who is an expert at a particular programming language or system, as
in "UNIX hacker"
Cracker: A
cracker is someone who breaks into someone else's computer system, often on a
network; bypasses passwords or licenses in computer programs; or in other ways
intentionally breaches computer security.
Introduction:
A network attack occurs when an attacker or cracker uses
certain methods or technologies to maliciously attempt to compromise the
security of a network. Crackers attack corporate networks to use data for
financial gain or for industrial espionage, to illegally use user accounts and
privileges, to run code to damage and corrupt data, to steal data and software,
to prevent legitimate authorized users from accessing network services, and for
a number of other reasons.
External attacks are performed by individuals who are
external to the target network or organization. External threats are usually
performed by using a predefined plan and the skills of the attacker(s). One of
the main characteristics of external threats is that they usually involve
scanning and gathering information.
Three Generalized category of Attacks on basis of origin:
Structured external threats originate from crackers and are
usually initiated by attackers that have a premeditated thought on the actual
damages and losses which they want to cause. Possible motives for structured
external threats include greed, politics, terrorism, racism and criminal
payoffs. Criminal hackers are highly skilled on network design, the methods on
avoiding security measures, Intrusion Detection Systems (IDSs), access
procedures, and hacking tools.
Unstructured external threats originate from an inexperienced
attacker, typically from a script kiddie. A script kiddie is an inexperienced
attacker who uses cracking or scripted tools readily available on the Internet,
to perform a network attack.
Remote external attacks are usually aimed at the services
which an organization offers to the public. Remote external attacks can also be
aimed at the services available for internal users, aimed at locating modems to
access the corporate network, and attempts to brute force password
authenticated systems. Local external attacks originate from situations where
computing facilities are shared, and access to the system can be obtained.
Internal threats originate from dissatisfied or unhappy
internal employees or contractors. Internal attackers have some form of access
to the system and usually try to hide their attack as a normal process.
Basic steps used by a cracker (Pre-Attack):
Footprinting:
It is the initial step in hacking a corporate network. The purpose of
footprinting is to create a map of the network to determine what operating
systems, applications and address ranges are being utilized.
Port scanning:
It is done when a cracker collects information on the network services on a
target network. The cracker attempts to find open ports on the target system.
Enumeration:
A cracker might use Enumeration to collect information on applications and
hosts on the network, and on the user accounts utilized on the network.
Enumeration is particularly successful in networks that contain unprotected
network resources and services. A network attacker can launch an Access attack
to exploit a security weakness in order to gain access to a system or the
network. The programs generally used are:
a.) Trojan horses: capable of creating backdoors. For
e.g.. Trojan program named as "Beast"
b.) Password hacking programs: Typically used to
obtain system access. When access is obtained, the intruder is able to modify
or delete data and add, modify or remove network resources. Unauthorized
privilege escalation is another common type of attack. For e.g.. tools like
"John the ripper", Cain and Abel"
Privilege escalation:
It occurs when an intruder attempts to obtain a higher level of access such as
administrative privileges to gain control of the network system. A cracker can
also implement a mechanism such as some form of access granting code with the
intent of using it at some future stage. Backdoors are installed by attackers
so that they can easily access the system at some later date. After a system is
compromised, you can remove any installed backdoors by reinstalling the system
from a backup which is secure.This step is a post-attack activity.
Common types of network attacks initiated by Crackers are
listed here:
Eavesdropping attack:
It occurs when an attacker monitors or listens to network traffic in transit,
and then interprets all unprotected data. Hackers only need a sniffer
technology to eavesdrop on a Internet Protocol (IP) based network to capture
traffic in transit.
IP address spoofing:
It occurs when an attacker assumes the source IP address of IP packets to make
it appear as though the packet originated from a valid IP address. The aim of
an IP address spoofing attack is to identify computers on a network.
Sniffing: It
occurs when attackers capture and analyze network traffic. The tools used for
sniffing are called sniffers or protocol analyzers. A Sniffer attack occurs
when hackers use Sniffers to monitor, capture and obtain specific network
information, such as passwords and valuable customer information.
Password attacks:
It are aimed at guessing the password for a system until the correct password
is determined. Network attackers can obtain user ID and password information
and can then pose as authorized users and attack the corporate network.
Attackers can utilize attacks such as dictionary attacks or brute force attacks
to obtain access to resources with the same rights as the authorized user.
Brute force attack:
attacker attempts to decode a cipher by attempting each possible key to find
the correct one. This type of network attack systematically utilizes all
possible alpha, numeric, and special character key combinations to discover a
password that is valid for a user account. Brute force attacks are also
typically used to compromise networks that utilize Simple Mail Transfer
Protocol (SNMP).
Denial of Service (DoS) attack: It is aimed at preventing authorized, legitimate users
from accessing services on the network. A DoS attack can be initiated by
sending invalid data to applications or network services until the server hangs
or simply crashes. The most common form of a DoS attack is TCP attacks.
A network attacker can increase the enormity of a DoS attack
by initiating the attack against a single network from multiple computers or
systems. This type of attack is known as a distributed denial of service (DDoS)
attack. Network administrators can experience great difficulty in fending off
DDoS attacks, simply because blocking all the attacking computers, can also
result in blocking authorized users.
Man-in-the-middle (MITM) attack: It occurs when a cracker eavesdrops on a secure
communication session and monitors, captures and controls the data being sent
between the two parties communicating. The attacker attempts to obtain
information so that he/she can impersonate the receiver and sender.
Distributed Denial of Service (DDoS)
attack: It is also a form of DoS attack
but in this scenario attacker is not one individual, Multiple attackers launch
DoS simultaneously at a common victim.
Network Attacks - Part 2
INTRODUCTION:
This is the second part to the network attacks. Here i will
be talking about a technique named as "Scanning" which is very
important for attacker as the result obtained by conducting scans he/she
decides the way to attack on the network.
Port scanning is the process of connecting to TCP and UDP
ports for the purpose of finding what services and applications are open on the
target device. Once open, applications or services can be discovered. At this
point, further information is typically gathered to determine how best to
target any vulnerabilities and weaknesses in the system.
Port Scanning is one of the most popular reconnaisance techniques
crackers use to discover services they can break into. A potential victim
computer runs many 'services' that listen at well-known 'ports'. By scanning
which ports are available on the victim, the hacker finds potential weaknesses
that can be exploited.
PORT SCANNING TYPES:
1.) TCP Connect/ Full Open Scan:
•TCP Connect is the most reliable form of TCP Scans. TCP
Connect will check whether a Port is open or closed by using TCP protocol
flags.
•If the port is open then the connect() command will work
whereas, if the port is closed then the connect will be unreachable.
Note: The Operating System provides the connect system call
which is used by TCP Connect method to check whether the port is open or
closed.
2.) SYN Stealth/ Half Open Scan:
•SYN/Stealth scan is also known as half open scan because it
does not establish a full connection with the Target system.
•During this Scan, The Attacked will first send the SYN
packet to a particular port of the Target as a Request to Create a New
Connection and then wait for a reply.
•If that port replies back with a SYN/ACK flag set, this
would confirm that the Port is open and being used.
•However, if we receive a RST Flag Set then this would mean
that the port is closed.
•One Advantage of this Particular Scan is that, in many
Services and Systems, Unsuccessful Connections are not Logged, which means that
the scan would go un-detected.
3.) FIN Stealth Scan:
•During a FIN Stealth scan, The Attacker will send a FIN
flag set Data Packet.
•If that port is open it would not send any data packet
back, while if it is closed it will reply you back with Fin Packet.
•Advantage: It is also seen that some application or
services do not reply to SYN request during TCP connect( ) Scan, So during this
Scenario, It will be beneficial to use FIN Stealth Scan.
4.) FTP Bounce Scan:
•This type of port scanning is only possible when there is a
Bounce Attack vulnerability on the FTP Server.
•Bounce Attack Vulnerability allows the attacker to use the
FTP Server to Port Scan the Target System acting as a sort of Proxy in between.
This type of scan provides anonymity to the attacker and is hard to trace back
comparatively.
5.) SYN/FIN Scanning - IP fragments
•During a SYN/FIN scan the TCP headers are split into
various fragments.
•SYN/Fin is type of scan which is not a new but instead it
is a combination of SYN stealth scan and FIN stealth Scan.
6.) UDP Scanning:
•This scanning process simply uses the UDP protocol instead
of the TCP protocol which has been mentioned in the previous examples.
•The scanning process is much more complicated then TCP
Scanning, since UDP is a connection less protocol.
Note: During UDP scans. open ports do not send any
acknowledgement in reply to our request, while, closed ports send a
ICMP_PORT_UNREACH error when we send a request to a closed UDP port.
7.) ICMP Scanning:
•ICMP scanning is a type of scanning methods which sends
ICMP packets to all machines on the network to determine active hosts on the
network.
•In order to quickly complete the process, ICMP Packets are
sent to multiple nodes at the same time.
•Time can be further reduced by altering the timeout value
of the Scan.
8.) Reverse Ident Scanning:
•Reverse Ident scans help attacker in identifying the user
who own the process i.e. it determines the username of the owner of any process
connected via TCP.
•Please note that it can work in the reverse manner as well.
The Server can also run a Ident query on the user connecting to it.
9.) Idle Scan:
Idle scan is a blind port scanning technique. The Attacker
can create a botnet of zombies which in turn Scan the ports of the target
machines. Intrusion Detection Systems, if they are installed on the target
machines, will point to the innocent zombies as Attackers. So, basically
attackers scan a large target network without sending a single packet to the
target network, themselves. This provides high degree of Stealth.
10.) OS Fingerprinting:
OS fingerprinting is a technique of scanning which is used
to determine the Operating System on the Target System. There are various
methods by which one can detect the underlying operating system. Banner
grabbing the ftp, ssh, http server, by evaluation the TTL value in the ICMP
packets, or even by TCP and UDP response behavior. OS fingerprinting can be
classified as:
1. Passive Fingerprinting:
In Passive Fingerprinting, Attacker do not directly scan the
ports of the target machine, instead of that attacker sniff the data packets
being transferred to and from target the machine. During passive fingerprinting
all attacker need to do is, capture the data packets and then analyze them to
determine the operating system of the target machine.
In Passive fingerprinting , attacker analyze and identify
operating System’s captured data for IP stack Analysis to identify the
operating system of the target.
2. Active Fingerprinting:
Active fingerprinting is based on the usage of a Intelligent
Database of General Operating System Reponses to particular Malformed Data
Packets. During Active OS Fingerprinting, attacker will send malformed packets
to the target machine and predict the operating system after analyzing the
Responses to determine the type of Operating System on the target machine.
11.) Ping Sweep:
•Ping sweep is a process which is used to enlist live hosts
in the network. It consists of ICMP ECHO requests sent to multiple hosts. If a
system is live, it will send back a ICMP ECHO reply.
•Ping utility is often used to check if a network device is
functioning or not.
•To disable ping sweeps on a network, administrators can
block ICMP ECHO requests using firewalls.
12.) Wardialing:
•Wardialing is a technique of using a modem to automatically
scan a list of telephone numbers, segregating between Telephone numbers which
are connected to a Computer and Regular Phone connections which are being
answered by Humans and Answering Machines.
•Once a List of Active Computer System (on the Phone
Network) is obtained, Attackers can use many techniques to hack into the
System.
These are the some scanning method
used by attacker to scan the network for gathering the information about the
network.
