Attacks on IP Networks

References

 Secure Internet Programming: Home Page
 IP Spoofing Information - AIS, UNC-CH
Webmonkey: backend: Living with Insecurities
JavaSoft FUD
Practical UNIX and Internet Security, 2nd Edition,  Simson Garfinkel and Gene Spafford, O'Reilly and Associates, 1998.
http://java.sun.com/docs/white/langenv/Security.doc.html

Sniffing

A sniffer program or device operates by putting the NIC into promiscuous mode. The NIC then takes every frame sent on the network and makes it available to the sniffer software.  In UNIX superuser privilege is required to put the NIC into promiscuous mode, though if you have console access gaining super user privilege is trivial. In Windows there is no hurdle at all.

Attacks by sniffing depend on getting to the data link layer frames. This in turn depends on the data link layer used, the media, and the speed.

LANs

The fact that Ethernet and Token Ring technologies use a broadcast design leaves users of IP in a LAN vulnerable. Copper media are easier to tap and sniff than fiber optic, but note that an open environment such as a university or a comapny campus is likely to have ready-made tap points available (i.e. the network ports).

Less vulnerable due to the fact that the link is point-to-point, so only one user at a time can be sniffed.

Anybody with access to the cable can watch the frames go by. Usually designed in a tree, so the higher up the tree you can tap, the more users you can monitor.

Inherently broadcast so sniffing just means being within range.

IP Spoofing

Exploitation of behavior common in routers
Most will forward packets with bad source addresses. A bad source address is one which is on the same "side" as the destination address.
Exploitation of TCP limitation
TCP sequence numbers are very easy to guess.
Confused use of IP address as authentication, not simply identification. For example, trusting hosts with certain IP addresses for special access (e.g. rsh).

Bad guy's machine sends a legit packet for a legit service to victim machine. Receives response containing TCP sequence number. Uses this response to guess at next sequence number that will be used.

Bad guy sends a request packet to a sensitive service like rsh with a forged source IP address. The forged address is that of a machine the victim machine trusts, call it X. This is where the router forwarding bogus packets comes in. The trusted host X is likely on the same side of the router as the victim machine.

The victim machine responds to the forged request by sending packets to X. X is confused as it did not make a request to which it is now getting responses. Bad guy distracts X with some ill-formed packets.

Bad guy continues talking with victim machine "in the blind" to do some evil thing through the sensitive service. This is where the guessable sequence number comes in, since the bad guy can't see the responses from the victim, it must guess at what they contain. The sequence number is the only real unknown, and it is easy to guess.

Reverse name lookups can help detect attacks. The server does a reverse lookup to map the incoming IP to a host name. If the server authenticates based on hostname, then this detects IP spoofing attacks.

Routers don't forward bogus packets (those with bogus source addresses).

TCP sequence numbers are made harder to guess. This problem was first pointed out publicly in 1985.

Don't do authentication based on IP address (like rsh does).

Denial of Service

ICMP flooding