PPIT Lecture 20
Download as PPT, PDF0 likes443 views
The document discusses several modes and types of hacker attacks, including spoofing, denial of service attacks, session hijacking, and buffer overflow attacks. Spoofing involves altering one's identity to masquerade as another user or system. Specific types of spoofing covered include IP, email, and web spoofing. Denial of service attacks aim to overload systems to render them unusable. Session hijacking involves taking over an active session between another user and a server. Buffer overflow attacks exploit program vulnerabilities to overwrite memory and execute malicious code.
PPIT Lecture 20
- 2. âą Over the Internet âą Over LAN âą Locally âą Offline âą Theft âą Deception Modes of Hacker Attack
- 3. Definition: An attacker alters his identity so that some one thinks he is some one else â Email, User ID, IP Address, ⊠â Attacker exploits trust relation between user and networked machines to gain access to machines Types of Spoofing: 1. IP Spoofing: 2. Email Spoofing 3. Web Spoofing Spoofing
- 4. Definition: Attacker uses IP address of another computer to acquire information or gain access IP Spoofing â Flying-Blind Attack Replies sent back to 10.10.20.30 Spoofed Address 10.10.20.30 Attacker 10.10.50.50 John 10.10.5.5 From Address: 10.10.20.30 To Address: 10.10.5.5 âą Attacker changes his own IP address to spoofed address âą Attacker can send messages to a machine masquerading as spoofed machine âą Attacker can not receive messages from that machine
- 5. Definition: Attacker spoofs the address of another machine and inserts itself between the attacked machine and the spoofed machine to intercept replies IP Spoofing â Source Routing Replies sent back to 10.10.20.30 Spoofed Address 10.10.20.30 Attacker 10.10.50.50 John 10.10.5.5 From Address: 10.10.20.30 To Address: 10.10.5.5 âą The path a packet may change can vary over time âą To ensure that he stays in the loop the attacker uses source routing to ensure that the packet passes through certain nodes on the network Attacker intercepts packets as they go to 10.10.20.30
- 6. Definition: Attacker sends messages masquerading as some one else What can be the repercussions? Types of Email Spoofing: 1. Create an account with similar email address â Sanjaygoel@yahoo.com: A message from this account can perplex the students 1. Modify a mail client â Attacker can put in any return address he wants to in the mail he sends 1. Telnet to port 25 â Most mail servers use port 25 for mails. Attacker logs on to this port and composes a message for the user. Email Spoofing
- 7. âą Basic â Attacker registers a web address matching an entity e.g. votebush.com, geproducts.com, gesucks.com âą Man-in-the-Middle Attack â Attacker acts as a proxy between the web server and the client â Attacker has to compromise the router or a node through which the relevant traffic flows âą URL Rewriting â Attacker redirects web traffic to another site that is controlled by the attacker â Attacker writes his own web site address before the legitimate link âą Tracking State â When a user logs on to a site a persistent authentication is maintained â This authentication can be stolen for masquerading as the user Web Spoofing
- 8. âą Web Site maintains authentication so that the user does not have to authenticate repeatedly âą Three types of tracking methods are used: 1. Cookies: Line of text with ID on the users cookie file â Attacker can read the ID from users cookie file 1. URL Session Tracking: An id is appended to all the links in the website web pages. â Attacker can guess or read this id and masquerade as user 1. Hidden Form Elements â ID is hidden in form elements which are not visible to user â Hacker can modify these to masquerade as another user Web Spoofing â Tracking State
- 9. Definition: Process of taking over an existing active session Modus Operandi: 1. User makes a connection to the server by authenticating using his user ID and password. 2. After the users authenticate, they have access to the server as long as the session lasts. 3. Hacker takes the user offline by denial of service 4. Hacker gains access to the user by impersonating the user Session Hijacking
- 10. âą Attacker can â monitor the session â periodically inject commands into session â launch passive and active attacks from the session Session Hijacking Bob telnets to Server Bob authenticates to Server Bob Attacker Server Die! Hi! I am Bob
- 11. âą Attackers exploit sequence numbers to hijack sessions âą Sequence numbers are 32-bit counters used to: â tell receiving machines the correct order of packets â Tell sender which packets are received and which are lost âą Receiver and Sender have their own sequence numbers âą When two parties communicate the following are needed: â IP addresses â Port Numbers â Sequence Number âą IP addresses and port numbers are easily available so once the attacker gets the server to accept his guesses sequence number he can hijack the session. Session Hijacking â How Does it Work?
- 12. Definition: Attack through which a person can render a system unusable or significantly slow down the system for legitimate users by overloading the system so that no one else can use it. Types: 1. Crashing the system or network â Send the victim data or packets which will cause system to crash or reboot. 1. Exhausting the resources by flooding the system or network with information â Since all resources are exhausted others are denied access to the resources 1. Distributed DOS attacks are coordinated denial of service attacks involving several people and/or machines to launch attacks Denial of Service (DOS) Attack
- 13. Types: 1. Ping of Death 2. SSPing 3. Land 4. Smurf 5. SYN Flood 6. CPU Hog 7. Win Nuke 8. RPC Locator 9. Jolt2 10. Bubonic 11. Microsoft Incomplete TCP/IP Packet Vulnerability 12. HP Openview Node Manager SNMP DOS Vulneability 13. Netscreen Firewall DOS Vulnerability 14. Checkpoint Firewall DOS Vulnerability Denial of Service (DOS) Attack
- 14. âą This attack takes advantage of the way in which information is stored by computer programs âą An attacker tries to store more information on the stack than the size of the buffer How does it work? Buffer Overflow Attacks âą Buffer 2 Local Variable 2 Buffer 1 Local Variable 1 Return Pointer Function Call Arguments âą Fill Direction Bottom of Memory Top of Memory Normal Stack âą Buffer 2 Local Variable 2 Machine Code: execve(/bin/sh) New Pointer to Exec Code Function Call Arguments âą Fill Direction Bottom of Memory Top of Memory Smashed Stack Return Pointer Overwritten Buffer 1 Space Overwritten
- 15. âą Programs which do not do not have a rigorous memory check in the code are vulnerable to this attack âą Simple weaknesses can be exploited â If memory allocated for name is 50 characters, someone can break the system by sending a fictitious name of more than 50 characters âą Can be used for espionage, denial of service or compromising the integrity of the data Examples â NetMeeting Buffer Overflow â Outlook Buffer Overflow â AOL Instant Messenger Buffer Overflow â SQL Server 2000 Extended Stored Procedure Buffer Overflow Buffer Overflow Attacks
Editor's Notes
- #3: Get some stories about hackings
- #4: 1. Normally users log on to one machine and have access to a number of computers.
- #5: 1. Normally users log on to one machine and have access to a number of computers.
- #6: 1. Normally users log on to one machine and have access to a number of computers.
- #7: Repercussions:
- #8: Potential Damages: 1. Change orders placed by the client (Instead of 500 widgets he can make the order 50,000 widgets) 2. Change meeting venues to send people on wild goose chases
- #9: Potential Damages: 1. Change orders placed by the client (Instead of 500 widgets he can make the order 50,000 widgets) 2. Change meeting venues to send people on wild goose chases
- #10: Session Hijacking allows hackers to bypass the authentication process of the computer and gain access to the machine. After users authenticate and log on to a machine the authentication is valid for as long as the session lasts. After the users authenticate they have
- #11: Session Hijacking allows hackers to bypass the authentication process of the computer and gain access to the machine. After users authenticate and log on to a machine the authentication is valid for as long as the session lasts. After the users authenticate they have
- #12: Session Hijacking allows hackers to bypass the authentication process of the computer and gain access to the machine. After users authenticate and log on to a machine the authentication is valid for as long as the session lasts. After the users authenticate they have
- #13: Session Hijacking allows hackers to bypass the authentication process of the computer and gain access to the machine. After users authenticate and log on to a machine the authentication is valid for as long as the session lasts. After the users authenticate they have
- #14: Session Hijacking allows hackers to bypass the authentication process of the computer and gain access to the machine. After users authenticate and log on to a machine the authentication is valid for as long as the session lasts. After the users authenticate they have
- #15: Page 245 (Chapter 7 â Hackers Beware by Eric Cole) When a program calls a subroutine, the function variables and the subroutine return address pointers are stored in a logical data structure known as a stack. A stack is a portion of memory that stores information the current program needs. A return pointer contains the address of the point in the program to return to after the subroutine has completed execution. The variable space is filled LIFO I.e. higher address to lower address. When variable space is exceeded the data goes to neighboring variable space. To cause code to be executed an attacker takes advantage of this by precisely tuning the amount and content of data necessary to cause the buffer to over flow and the operating system stack to crash. The data that the attacker sends usually consists of machine specific byte code to execute a command, plus a new address of the return pointer. This address points back into the address space of the stack, causing the program to run the attackerâs instructions when it attempts to return from the subroutine. The attackers code will run at whatever privileges the host code is running. So normally hackers try to use programs which run with root privileges.