Computer Security and Penetration

Testing

Chapter 3
Scanning Tools
 Objectives
• Comprehend the functioning of scanners
• Trace the development of scanners
• Identify various types of scanning
• Identify different scanners

Computer Security and Penetration Testing 2

 Scanning Tools

• Scanners
– Find and fix vulnerabilities in remote machines on a
network
– Software tool that examines and reports about
vulnerabilities on local and remote hosts
• Port scanner
– Examines and reports the condition (open or closed)
of a port
• And the application listening on that port, if possible

Computer Security and Penetration Testing 3

 Evolution of Scanners
• Scanners first appeared even before ARPANET
– To monitor connections between mainframes and
dumb terminals
• The Internet was launched in the 1970s
• The early UNIX-like languages had no security at all
• Legitimate network users would connect to remote
UNIX servers
– By having their modem dial specific telephone
numbers
– Led to the invention of a new tool, the war dialer

Computer Security and Penetration Testing 4

 Evolution of Scanners (continued)
• War dialer
– Script that tells the modem to dial a range of phone
numbers defined by the user
• And then identifies those numbers that connect to
remote computers
– A form of automated scanner
• In the early 1980s, the majority of servers ran on
UNIX platforms
– System administrators created shell scripts that let
them check security weaknesses of their networks
• And avoid hacking activities

Computer Security and Penetration Testing 5

 Evolution of Scanners (continued)
• As the Internet increased in availability and
popularity
– More computers and networks became connected
• Today, scanners are available for several popular
platforms

Computer Security and Penetration Testing 6

 How Scanners Work
• Scanners automate the process of examining
network weaknesses
• Scanners are not heuristic
• Functions
– Connects to a target host(s)
– Examines the target host for the services running on it
– Examines each service for any known vulnerability

Computer Security and Penetration Testing 7

 Types of Scanning
• TCP Connect Scanning
– Attempts to make TCP connections with all of the
ports on a remote system
– Target host transmits connection-succeeded
messages for active ports
– User does not need root privileges to perform TCP
connect scanning
– Almost all IDSs recognize the scanning
• Half-Open Scanning
– A TCP connection scanning that does not complete
the connections
Computer Security and Penetration Testing 8
 Types of Scanning (continued)
• Half-Open Scanning (continued)
– Only the SYN message is sent from the scanner
– Reply signal may be a SYN/ACK, indicating the port is
open
• Attacker replies with an RST flag to avoid detection
– Some IDSs can be configured to log all network
activities
– Root or system administrator privileges are required to
perform half-open scanning

Computer Security and Penetration Testing 9

 Types of Scanning (continued)
• UDP Scanning
– Examines the status of UDP ports on a target system
– Scanner sends a 0-byte UDP packet to all the ports on
a target host
• If port is closed, the target host replies with an ICMP
unreachable message
– Most operating systems generate UDP messages very
slowly
• Makes UDP scanning impractical

Computer Security and Penetration Testing 10

 Types of Scanning (continued)
• IP Protocol Scanning
– Examines a target host for supported IP protocols
– Scanner transmits IP packets to each protocol on the
target host
– If target host replies with an ICMP unreachable
message to the scanner
• Then the target host does not use that protocol

Computer Security and Penetration Testing 11

 Types of Scanning (continued)
• Ping scanning
– Demonstrates whether a remote host is active by
sending ICMP echo request packets to that host

Computer Security and Penetration Testing 12

 Types of Scanning (continued)

Computer Security and Penetration Testing 13

 Types of Scanning (continued)
• Stealth Scanning
– Lets you examine hosts behind firewalls and packet
filters
– Most stealth scanners do not allow target hosts to log
the scanning activities

Computer Security and Penetration Testing 14

 Review of Scanner Technology

Computer Security and Penetration Testing 15

 Review of Scanner Technology
• Discovery
- Nmap:
- Unicornscan: An open-source tool designed to
identify information related TCP flags and banners.

Computer Security and Penetration Testing 16

 Review of Scanner Technology

Computer Security and Penetration Testing 17

 Review of Scanner Technology

Computer Security and Penetration Testing 18

 Review of Scanner Technology
• Reconnaissance
- Fierce: Perl-based tool that focuses on particular
targets using pattern matching.
- Maltego: Java based tool, offered in both
community and commercial versions and is
marketed as a forensic tool.
- PassiveRecon: A Firefox add-on that allows users
to visit a target Web site and gather a variety of
publically available information useful in the
enumeration or reconnaissance phase of a
penetration test.
Computer Security and Penetration Testing 19
 Review of Scanner Technology

Computer Security and Penetration Testing 20

 Review of Scanner Technology

Computer Security and Penetration Testing 21

 Review of Scanner Technology
• Reconnaissane
- Tcpdump: An open-source command-line packet
analyzer.
- Wireshark: Similar to tcpdump but contains a GUI
interface.

Computer Security and Penetration Testing 22

 Review of Scanner Technology

Computer Security and Penetration Testing 23

 Review of Scanner Technology

Computer Security and Penetration Testing 24

 Review of Scanner Technology
• Vulnerability Identification
- Nessus: A remote security scanner designed to be
run on linux, BSD, Solaris, and other versions of
Unix.
- NeXpose: A commercial enterprise Vulnerability
testing tool.
- Nipper: A commercial software using C++ that is
both open source and sold by license by Titania.
- OpenVAS: Open-source version of Nessus.

Computer Security and Penetration Testing 25

 Review of Scanner Technology

Computer Security and Penetration Testing 26

 Review of Scanner Technology

Computer Security and Penetration Testing 27

 Review of Scanner Technology

Computer Security and Penetration Testing 28

 Review of Scanner Technology

Computer Security and Penetration Testing 29

 Review of Scanner Technology
• Vulnerability Identification
- QualysGuard (SaaS): vulnerability tool that is
designed to support penetration testing and
includes features for discovery and enforcement of
policies.
- SAINT: Security Administrator’s Integrated
Network Tool

Computer Security and Penetration Testing 30

 Review of Scanner Technology

Computer Security and Penetration Testing 31

 Review of Scanner Technology

Computer Security and Penetration Testing 32

 Review of Scanner Technology
• Exploitation
- CORE Impact: full-service commercial vulnerability
testing and penetration tool.
- MetaSploit: network vulnerability tool that, like
CORE Impact, offers a wide range of functions.
- Live Linux Distros: BackTrack Linux

Computer Security and Penetration Testing 33

 Review of Scanner Technology

Computer Security and Penetration Testing 34

 Review of Scanner Technology

Computer Security and Penetration Testing 35

 Review of Scanner Technology

Computer Security and Penetration Testing 36

 Summary
• Scanning permits hackers to learn the vulnerabilities
of the target system
• The most popular scanners are open source or
freeware, made freely available across the Internet
• In the early days of computing, security
vulnerabilities, while abundant, were not well known
• When hackers wanted to crack a system in the
1970s, they would examine the target system for all
known vulnerabilities

Computer Security and Penetration Testing 37

 Summary (continued)
• As students and hobbyists started playing with
scanning applications, new vulnerabilities were
discovered
• In the early 1980s, most servers ran on UNIX
platforms
– System administrators created shell scripts that let
them check security weaknesses
• Scanners automate the process of examining network
weaknesses, and check only for known vulnerabilities
and open ports

Computer Security and Penetration Testing 38

 Summary (continued)
• Scanners can be set to target a single IP address or a
range of addresses
• Scanners are available on UNIX, Windows, and
Macintosh platforms

Computer Security and Penetration Testing 39

Computer Security and Penetration
Testing

Chapter 4
Sniffers
 Objectives

Identify sniffers

Recognize types of sniffers

Discover the workings of sniffers

Appreciate the functions that sniffers use on a network

Computer Security and Penetration Testing 41

 Objectives (continued)

List types of sniffer programs

Implement methods used in spotting sniffers

List the techniques used to protect networks from sniffers

Computer Security and Penetration Testing 42

 Sniffers


Sniffer, or packet sniffer

Application that monitors, filters, and captures data packets
transferred over a network

Sniffers are nearly impossible to detect in operation

And can be implemented from nearly any computer

Types of sniffer

Bundled

Commercial

Free

Computer Security and Penetration Testing 43

 Bundled Sniffers

Come bundled with specific operating systems

Examples

Network Monitor comes bundled with Windows

Tcpdump comes with many open source UNIX-like operating
systems, like Linux

Snoop is bundled with the Solaris operating systems

nettl and netfmt packet-sniffing utilities are bundled with the
HP-UX operating system

Computer Security and Penetration Testing 44

 Bundled Sniffers (continued)

Computer Security and Penetration Testing 45

 Commercial Sniffers

Observe, monitor, and maintain information on a network

Some companies use sniffer programs to detect network
problems

Can be used for both

Fault analysis, which detects network problems

Performance analysis, which detects bottlenecks

Computer Security and Penetration Testing 46

 Free Sniffers

Used to observe, monitor, and maintain information on a
network

Can also be used for both fault analysis and performance
analysis

Differences between commercial and free sniffers

Commercial sniffers generally cost money, but typically come
with support

Support on free sniffers is minimal

Computer Security and Penetration Testing 47

 Sniffer Operation

Sniffer must work with the type of network interface

Supported by your operating system

Sniffers look only at the traffic passing through the network
interface adapter

On the machine where the application is resident

You can read the traffic on the network segment upon which
your computer resides

Computer Security and Penetration Testing 48

 Components of a Sniffer

Hardware

NIC is the hardware most needed

Capture Driver

Captures the network traffic from the Ethernet connection

Filters out the information that you don’t want

And then stores the filtered traffic information in a buffer

Buffer

Dynamic area of RAM that holds specified data

Computer Security and Penetration Testing 49

Computer Security and Penetration Testing 50
 Components of a Sniffer (continued)

Buffer (continued)

Methods of storing captured data

Stored until the buffer is full with information

Round-robin method

Decoder

Interprets binary information and then displays it in a readable
format

Packet Analysis

Sniffers usually provide real-time analysis of captured packets

Computer Security and Penetration Testing 51

 Components of a Sniffer (continued)

Computer Security and Penetration Testing 52

 Placement of a Sniffer

A sniffer can be implemented anywhere in a network

Sniffer is best strategically placed in a location where only the
required data will be captured

Sniffers are normally placed on:

Computers

Cable connections

Routers

Network segments connected to the Internet

Network segments connected to servers that receive passwords

Computer Security and Penetration Testing 53

 Placement of a Sniffer (continued)

Computer Security and Penetration Testing 54

 MAC Addresses

Media Access Control (MAC) address

A unique identifier assigned to a computer

Associated with the NIC attached to most networking
equipment

Distinguishes a computer from the other computers on the
network

Computer Security and Penetration Testing 55

 MAC Addresses (continued)

Computer Security and Penetration Testing 56

 Data Transfer over a Network

If a data packet is sent from Alice to Bob

It must pass through many routers

Routers first examine the destination Internet Protocol (IP)
address

To direct the data packet to Bob

Alice has the information about the first router and the IP
address of Bob’s PC

Alice’s computer employs an Ethernet frame to communicate
with that router

Computer Security and Penetration Testing 57

 Data Transfer over a Network
(continued)

Computer Security and Penetration Testing 58

 Data Transfer over a Network
(continued)

Computer Security and Penetration Testing 59

 Data Transfer over a Network
(continued)

Computer Security and Penetration Testing 60

 Data Transfer over a Network
(continued)

Transmission Control Protocol/Internet Protocol (TCP/IP) stack
in Alice’s computer

Generates a frame to transmit the data packet to Bob in
Houston

TCP/IP stack then transfers it to the Ethernet module

Ethernet information is added

Data is sent so that the TCP/IP stack at the opposite end is able
to process the frame

CRC checks to verify that the Ethernet frame reaches the
destination without being corrupted

Computer Security and Penetration Testing 61

 Data Transfer over a Network
(continued)

Frame is sent to the Ethernet cabling within the network or the
private LAN

All hardware adapters on the LAN can view the frame

Every adapter then compares the destination MAC address in
the frame with its own MAC address

Computer Security and Penetration Testing 62

 The Role of a Sniffer on a Network

Promiscuous mode

A NIC can retrieve any data packet being transferred
throughout the Ethernet network segment

A sniffer on any node on the network can record all the traffic
that travels

By using the NIC’s built-in ability to examine packets

A sniffer puts a network card into the promiscuous mode by
using a programmatic interface

Interface can bypass the TCP/IP stack operating systems

Computer Security and Penetration Testing 63

 The Role of a Sniffer on a Network
(continued)

Computer Security and Penetration Testing 64

 Sniffer Programs

Some sniffer programs are used for monitoring purposes

Others are written specifically for capturing authentication
information

Partially functioned sniffers have fallen out of favor

Computer Security and Penetration Testing 65

 Wireshark (Ethereal)

Probably the best-known and most powerful free network
protocol analyzer

For UNIX/Linux and Windows

Allows you to capture packets from a live network and save
them to a capture file on disk

Data can be captured off the wire from a network connection

And can be read from Ethernet, FDDI, PPP, token-ring, or
X.25 interfaces

Computer Security and Penetration Testing 66

Computer Security and Penetration Testing 67
Computer Security and Penetration Testing 68
 Tcpdump/Windump

Most commonly bundled sniffer with Linux distros

Widely used as a free network diagnostic and analytic tool

Configurable to allow for packet data collection based on
specific strings or regular expressions

Can decode and monitor the header data of

Internet Protocol (IP)

Transmission Control Protocol (TCP)

User Datagram Protocol (UDP)

Internet Control Message Protocol (ICMP)

Computer Security and Penetration Testing 69

 Tcpdump/Windump (continued)

Monitors and decodes application-layer data

Can be used for

Tracking network problems, detecting ping attacks, or
monitoring network activities

Commands

tcpdump (for Linux)

windump (for Windows)

Computer Security and Penetration Testing 70

 Tcpdump/Windump (continued)

Computer Security and Penetration Testing 71

 Tcpdump/Windump (continued)

Computer Security and Penetration Testing 72

 Snort

Can be used as a packet sniffer, packet logger, or network
intrusion detection system

Logs packets into either binary or ASCII format

Functions include

Performing real-time traffic analysis

Performing packet logging on IP networks

Debugging network traffic

Analyzing protocol

Searching and matching content

Detecting attacks, such as buffer overflows

Computer Security and Penetration Testing 73

 Snort (continued)

Snort works on the following platforms:

Linux

Solaris

Windows NT

Windows 2000

Sun

IRIX

Computer Security and Penetration Testing 74

Computer Security and Penetration Testing 75
 Network Monitor

Part of the Microsoft Windows NT, Windows 2000 Server, and
Windows 2003 Server

Functions

Captures network traffic and translates it into a readable
format

Supports a wide range of protocols

Maintains the history of each network connection

Supports high-speed as well as wireless networks

Provides advanced filtering capabilities

Computer Security and Penetration Testing 76

 Cain and Abel

Cracking encrypted passwords using brute force, dictionary,
and cryptanalysis techniques.

Recording VoIP conversations

Recording network keys

Uncovering cached passwords

Analyzing network protocols

Computer Security and Penetration Testing 77

 Cain and Abel

Computer Security and Penetration Testing 78

 Kismet


Kismet is a wireless sniffer that detects networks through
passive sniffing .

Computer Security and Penetration Testing 79

 Fluke Networks Protocol Analyzers

Fluke Networks is a provider of network tools

Its focus is on selling physical tools for network analysis rather
than selling only software

Advantage of using an appliance

Impossible to mishandle the installation of the software if it is
on a dedicated appliance

With only one purpose or user

Disadvantage of using an appliance

Locks you into the appliance designer’s architecture and vision

Computer Security and Penetration Testing 80

 Detecting a Sniffer

Since sniffer technology is passive

It is difficult to detect sniffers

You can only detect whether or not the suspect is running his or
her NIC in promiscuous mode

Tools available to check for sniffers

AntiSniff

SniffDet

Check Promiscuous Mode (cpm)

Neped.c

Ifstatus

Computer Security and Penetration Testing 81

 DNS Test

Some sniffers perform DNS lookups

In order to replace IP addresses in their logs with fully qualified
host names

Many tools exist to detect sniffers using this method

Computer Security and Penetration Testing 82

 Network Latency Tests

Several methods use the delay in network latency to determine a
host’s likely sniffer activity

It is possible to “measure” which of the machines are working
harder

“Hard workers” are potential sniffer hosts

Computer Security and Penetration Testing 83

 Ping Test

Use AntiSniff to perform this test

Antisniff can send a packet that contains a legitimate IP address,
but a fake MAC address

If a host responds to a ping with a fake MAC address, it must
mean that that host is in promiscuous mode

Computer Security and Penetration Testing 84

 ARP Test

When in promiscuous mode, the Windows driver for the network
card

Examines only the first octet of the MAC address to determine
whether it is a broadcast packet

Antisniff can send a packet with a MAC address of
ff:00:00:00:00:00 and the correct destination IP address of the
host

Causing the Microsoft OS to respond while in promiscuous
mode

Computer Security and Penetration Testing 85

 Source-Route Method

Uses a technique known as the loose-source route

To locate sniffers on nearby network segments

Adds the source-route information inside the IP header of packets

Routers ignore the destination IP address

And forward the packet to the next IP address in the source-
route option

Computer Security and Penetration Testing 86

 Decoy Method

Involves setting up a client and a server on either side of a
network

Server is configured with accounts that do not have rights or
privileges

Or the server is virtual

Client runs a script to log on to the server by using the Telnet,
POP, or IMAP protocol

Hackers can grab the usernames and passwords from the Ethernet

And attempt to log on to the server

Computer Security and Penetration Testing 87

 Commands

Check if you are running in promiscuous mode
– ifconfig -a

Check if you are running a sniffer on your own computer
– ps aux

Computer Security and Penetration Testing 88

 Commands (continued)

Computer Security and Penetration Testing 89

 Time Domain Reflectometers (TDR)
Method

Sends an electrical pulse in the wire and creates a graph based on
the reflections that emanate

Provides distance information in a numerical format

TDR can detect hardware packet sniffers attached to the network
that are otherwise silent

Computer Security and Penetration Testing 90

 Protecting Against a Sniffer

The heart of defense against a sniffer is to make the data
inconvenient to use

Encourage the use of applications that use standards-based
encryption, such as:

Secure Sockets Layer (SSL)

Pretty Good Privacy (PGP) and Secure/Multipurpose Internet
Mail Extensions (S/MIME)

Secure Shell (SSH)

Computer Security and Penetration Testing 91

 Secure Socket Layer (SSL)

Designed by Netscape

Provides data security between application protocols

Secure Sockets Layer, or SSL

Nonproprietary protocol providing data encryption, server
authentication, message integrity, and client authentication for a
TCP/IP connection

SSL is built as a security standard into all Web browsers and
servers

SSL comes in two forms, 40-bit and 128-bit

Computer Security and Penetration Testing 92

 Pretty Good Privacy (PGP) and
Secure/Multipurpose Internet Mail
Extensions (S/MIME)

E-mail messages can be sniffed at various points

Basic requirements for securing e-mail messages

Privacy

Authentication

Methods that ensure the security of e-mail messages

PGP

S/MIME

Computer Security and Penetration Testing 93

 Secure Shell (SSH)


Secure alternative to Telnet

SSH protects against:

IP spoofing

Spoof attacks on the local network

IP source routing

DNS spoofing

Interception of cleartext password

Man-in-the-middle attacks

Computer Security and Penetration Testing 94

 More Protection

At OSI layer-2

Enable port security on a switch

Enforce static ARP

At OSI layer-3

IPSEC paired with secure, authenticated naming services
(DNSSEC)

Firewalls can be a mixed blessing

Sniffers are most effective behind a firewall, where legacy
cleartext protocols are often allowed by corporate security
policy

Computer Security and Penetration Testing 95

 Summary

A sniffer, or packet sniffer, is an application that monitors,
filters, and captures data packets transferred over a network

Bundled sniffers come built into operating systems

Nonbundled sniffers are either commercial sniffers with a cost of
ownership or free sniffers

The components of a sniffer are hardware, capture driver, buffer,
decoder, and packet analysis

Sniffers need to be placed where they will get the smallest
aggregate network traffic

Computer Security and Penetration Testing 96

 Summary (continued)

The standard behavior in a TCP/IP network that sniffers exploit is
that all packets are passed to all the nodes in the subnet

Sniffers change the NIC operation mode to promiscuous mode

Wireshark (Ethereal),Tcpdump/Windump, Snort, and Network
Monitor are all modern packet sniffers

Sniffit works on SunOS, Solaris, UNIX, and IRIX

Sniffer Pro, EtherPeek NX, and Fluke Networks Protocol
Analyzers are examples of commercial packet sniffers

Computer Security and Penetration Testing 97

 Summary (continued)

Several tools exist, or have existed, to detect a sniffer

All tools for protecting your network from a packet sniffer
involve some level of encryption

Computer Security and Penetration Testing 98

Computer Security and Penetration
Testing

Chapter 5
TCP/IP Vulnerabilities
 Objectives

Give a definition of TCP/IP

Know the steps of TCP/IP communication

Recognize weaknesses in TCP/IP

Identify steps in protecting information from vulnerabilities in
TCP/IP

Computer Security and Penetration Testing 101

 TCP/IP Vulnerabilities

Transmission Control Protocol/Internet Protocol (TCP/IP)

Suite of protocols that underlie the Internet

Comprises many protocols and applications

Common language of networked computers

Makes transferring information fast and efficient

IP has tools to correctly rout packets

TCP is responsible for safe and reliable data transfer between
host computers

Computer Security and Penetration Testing 102

 TCP/IP Vulnerabilities (continued)


Illegitimate users take advantage of TCP/IP vulnerabilities

By exploiting the “three-way handshake”

Unauthorized users may launch a denial-of-service attack on
the destination computer

Floods network with so many additional requests that regular
traffic is slowed or completely interrupted

Computer Security and Penetration Testing 103

 TCP/IP Vulnerabilities (continued)

Computer Security and Penetration Testing 104

 Data Encapsulation

Data encapsulation

Enclosing higher-level protocol information in lower-level
protocol information

Also called data hiding

Implementation details of a class are hidden from user

Computer Security and Penetration Testing 105

 Data Encapsulation (continued)

Computer Security and Penetration Testing 106

 IP (Internet Protocol)

Internet Protocol (IP)

Transmits data from source to final destination

Network protocol operating at layer 3 of the OSI Model

And layer 2 or 3 of the TCP/IP Model

IP is connectionless

No guarantee of delivery of packets to the destination

IP routes packets over network hardware

Computer Security and Penetration Testing 107

 IP (Internet Protocol) (continued)

IP addresses formats

IPv4 (32-bit address)

Usually written as a dotted-decimal, e.g., 192.168.100

IPv6 (128-bit address)

Usually written as eight groups of four hex digits, e.g.,
2001:0db8:85a3:08d3:1319:8a2e:0370:7334

IP address exhaustion date

Approximately the beginning of 2011

Computer Security and Penetration Testing 108

 IP (Internet Protocol) (continued)

IP packets often arrive out of sequence

Vulnerability that attackers can exploit

When a large IP packet is sent over a network, it is broken down

Called fragmentation

Computer Security and Penetration Testing 109

 IP (Internet Protocol) (continued)

Computer Security and Penetration Testing 110

 IP (Internet Protocol) (continued)

Computer Security and Penetration Testing 111

Computer Security and Penetration Testing 112
 TCP

Uses a connection-oriented design

Participants in a TCP session must create connection

Connection is called the three-way handshake

Provides connection-oriented services between a source and
destination computer

And guarantees delivery of packets

Packets reach the application layer in the right order

TCP identifies and assembles packets based on sequence
numbers

Computer Security and Penetration Testing 113

 TCP (continued)

Source and destination computers exchange the initial sequence
number (ISN)

When a connection is made

Packets are accepted within a particular range

Specified during the establishment of a connection

Computer Security and Penetration Testing 114

 TCP (continued)

Computer Security and Penetration Testing 115

 TCP (continued)

Computer Security and Penetration Testing 116

 TCP (continued)

Computer Security and Penetration Testing 117

 Connection Setup and Release

Three-way handshake sets up and releases a connection

TCP packet flags: URG,ACK, PSH,RST,SYN, and FIN

Packets can have more than one flag set

Normally a packet will have only one flag sent, except with
SYN/ACK or FIN/ACK

Three packets in a TCP connection:
SYN --> SYN/ACK --> ACK

Computer Security and Penetration Testing 118

 Connection Setup and Release
(continued)

Connection Setup

Source computer delivers a SYN packet to the destination
computer

Packet has the initial sequence number (ISN)

ISN is indicated by whether the SYN bit is “set”

Receiving computer transmits a SYN with an
acknowledgment, ACK

Source computer sends an ACK to the destination computer as
a response

With an “in-range” sequence number

Computer Security and Penetration Testing 119

Computer Security and Penetration Testing 120
 Connection Setup and Release
(continued)

Connection Release

Source computer sends a FIN packet to the destination
computer

Destination computer then sends a FIN/ACK packet

Source computer sends an ACK packet

Either computer could send an RST and close the session
(reset) immediately

Computer Security and Penetration Testing 121

 TCP Timers

All TCP sessions are tracked with timers built into the TCP
protocol

Timers used by TCP/IP

Connection establishment

A session will not be established if it takes longer than 75
seconds for the destination server to respond

FIN_WAIT

Waits for FIN packets. Its default value is 10 minutes

Computer Security and Penetration Testing 122

 TCP Timers (continued)

Timers used by TCP/IP (continued)

TIME_WAIT

Default value for this timer is two minutes

Waits for packets to arrive at the destination computer

KEEP_ALIVE

Checks to see if the destination computer is active

Computer may send a test packet every two hours to verify
whether the other computer is alive and idle

Computer Security and Penetration Testing 123

 Vulnerabilities in TCP/IP

During the development of TCP/IP in the 1980s

Security was not a priority

Since 1990, security has become a serious problem

Some of the vulnerabilities

IP spoofing

Connection hijacking

ICMP attacks

TCP SYN attacks

RIP attacks

Computer Security and Penetration Testing 124

 IP Spoofing

Steps

Attackers send packets to the victim or target computer with a
false source address

Victim accepts the packet and sends a response “back” to the
indicated source computer

Attacker must guess the proper sequence numbers to send the
final ACK packet

Hacker may have a connection to victim’s machine

And hold it as long as the computer remains active

Computer Security and Penetration Testing 125

 IP Spoofing (continued)

Sequence Guessing

Hacker sends a few connections to the victim

Learns how quickly sequence number is incrementing

Attacker then sends a spoofed ACK packet with a “best guess”
victim’s sequence number

Hacker can guess the sequence number because the number is
generated using a global counter

And is incremented in fixed units

Computer Security and Penetration Testing 126

 IP Spoofing (continued)

Source Routing

Sender using source routing can specify return path

Through which the destination computer sends its reply

Attacker looks for an intermediate computer or router

That could forward packets to the target computer

Most newer routers and firewalls are configured to drop
source-routed packets

Computer Security and Penetration Testing 127

 Connection Hijacking

Connection hijacking

Allows an attacker to control an existing connection

Steps

An attacker desynchronizes a series of packets between the
source and destination computer

Extra packets sent to one of the victims force the victim to
choose which packet to accept

If the victim chooses to discard the authentic packets and
interacts with the spoofed packets

The attacker has hijacked the connections

Computer Security and Penetration Testing 128

 ICMP Attacks

Packets are used to send fraudulent or deceptive connection
information among computers

ICMP is used to test for connectivity using utilities such as the
ping command

Denial-of-service (DoS) attacks can be formulated by using
ICMP packets

Destination Unreachable and Time to Live Exceeded

Attackers transmitting spoofed packets can successfully reset
existing connections

Computer Security and Penetration Testing 129

 TCP SYN Attacks

Exploits host implementation of three-way handshake

When Host B receives the SYN request from A, it must keep
track of the partially opened connection

In a queue for at least 75 seconds

Most systems are limited and can keep track of only a small
number of connections

An attacker can overflow the listen queue by sending more SYN
requests than the queue can handle

SYN flooding

Computer Security and Penetration Testing 130

 RIP Attacks

Take advantage of RIP (Routing Information Protocol)

RIP

Essential component in a TCP/IP network

Distribution of routing information within networks

RIP packet is often used without verification

Attacks on RIP change the destination of data

Once the router is modified, it transmits all of the packets to the
hacker computer

Computer Security and Penetration Testing 131

 Securing TCP/IP

Data in packets is not encrypted or authenticated

Packet sniffer can observe contents of the packets

Attackers can send spoofed packets from any computer

Must employ many methods simultaneously to achieve success
in this area

Computer Security and Penetration Testing 132

 Securing TCP/IP (continued)

Methods to decrease vulnerabilities in TCP/IP

Modify default timer values

Increase the number of simultaneous connections that a
computer can handle

Reduce the time limit used to listen for replies to the
SYN/ACK in the three-way handshake

Change method used to generate sequence numbers

Firewall rules that block spoofed packets

Computer Security and Penetration Testing 133

 Securing TCP/IP (continued)

Methods to decrease vulnerabilities in TCP/IP (continued)

Avoid using the source address authentication

If an operator allows outside connections from trusted hosts,
enable encryption sessions at the router

Packets can be encrypted or sent via encrypted VPN

Computer Security and Penetration Testing 134

 IP Security Architecture (IPSec)

IP Security Architecture (IPSec)

Collection of Internet Engineering Task Force (IETF)
standards

Defines an architecture at the Internet Protocol (IP) layer that
protects IP traffic

By using various security services

Computer Security and Penetration Testing 135

 IP Security Architecture (IPSec)
(continued)

Computer Security and Penetration Testing 136

 IP Security Architecture (IPSec)
(continued)

Computer Security and Penetration Testing 137

 IP Security Architecture (IPSec)
(continued)

IPSec provides:

Encryption of user data for privacy

Authentication of the integrity of a message

Protection against certain types of security attacks, such as
replay attacks

Ability for devices to negotiate security algorithms and keys
required for secure authenticated connections

Two security modes, tunnel and transport, to meet different
network needs

Computer Security and Penetration Testing 138

 Summary

Internet Protocol (IP) is responsible for sending data from a
source computer to a destination computer

TCP guarantees the delivery of packets

Some of the timers that are important for TCP/IP security are
Connection Establishment, FIN_WAIT,TIME_WAIT, and
KEEP_ALIVE

Vulnerabilities in TCP/IP include TCP SYN attacks, IP
spoofing, connection hijacking, RIP attacks, and ICMP attacks

Computer Security and Penetration Testing 139

 Summary (continued)

Vulnerabilities in TCP/IP can be decreased by modifying the
default timer values, generating random sequence numbers,
properly configured firewalls, TCP wrappers on UNIX and Linux
boxes, authentication, or encryption

IP Security Architecture (IPSec) is a collection of Internet
Engineering Task Force (IETF) standards

Defines an architecture at Internet Protocol (IP) layer that
protects IP traffic by using various security services

Computer Security and Penetration Testing 140

 Summary (continued)

IPSec provides

Encryption of user data

Authentication of message integrity

Protection against certain types of security attacks, such as
replay attacks

Ability for devices to negotiate security algorithms and keys
required for secure authenticated connections

Two security modes, tunnel and transport, to meet different
network needs

Computer Security and Penetration Testing 141