Protecting Against an IP Spoofing Attack

The following approaches can be used to mitigate IP spoofing attacks:



¦ Use access control lists (ACL) on router interfaces. As traffic comes into a router from

an outside network, an ACL could be used to deny any outside traffic claiming to be

addressed with IP addressing used internally on the local network. Conversely, ACLs

should be used to prevent traffic leaving the local network from participating in a

DDoS attack. Therefore, an ACL could deny any traffic leaving the local network that

claimed to have a source address that was different from the internal network’s IP

address space.



¦ Encrypt traffic between devices (for example, between two routers, or between an end

system and a router) via an IPsec tunnel. In Figure 1-7, notice that the topology is now

protected with an IPsec tunnel. Even though the attacker can still capture packets via

his rogue hub, the captured packets are unreadable, because the traffic is encrypted

inside the IPsec tunnel.



Figure 1-7 Protecting Traffic in a Tunnel

The Mind-set of a Hacker

Hackers can use a variety of tools and techniques to “hack” into a system (that is, gain

unauthorized access to a system). Although these methods vary, the following steps illustrate one example of a hacker’s methodical process for hacking into a system:

Step 1 Learn more about the system by performing reconnaissance. In this step, also known as “footprinting,” the hacker learns all he can about the system. For example, he might learn the target company’s domain names and the range of IP addresses it uses. He might perform a port scan to see what ports are open on a target system.

Step 2 Identify applications on the system, as well as the system’s operating system. Hackers can use various tools to attempt to connect to a system, and the prompt they receive (for example, an FTP login prompt or a default web page) could provide insight into the system’s operating system. Also, the previously mentioned port scan can help identify applications running on a system.

Step 3 Gain access to the system. Social engineering is one of the more popular ways to obtain login credentials. For example, public DNS records provide contact information for a company’s domain name. A hacker might be able to use this information to convince the domain administrator to reveal information about the system. For example, the hacker could pretend to be a representative of the service provider or a government agency. This approach is called pretexting .

Step 4 Log in with obtained user credentials, and escalate the hacker’s privileges. For example, a hacker could introduce a Trojan horse (a piece of software that appears to be a legitimate application but that also performs some unseen malicious function) to escalate his privileges.

Step 5 Gather additional usernames and passwords. With appropriate privileges, hackers can run utilities to create reports of usernames and/or passwords.

Step 6 Configure a “back door.” Accessing a system via a regular username/ password might not be how a hacker wants to repeatedly gain access to a system. Passwords can expire, and logins can be logged. Therefore, hackers might install a back door, which is a method of gaining access to a system that bypasses normal security measures.

Step 7 Use the system. After a hacker gains control of a system, he might gather protected information from that system. Alternatively, he might manipulate the system’s data or use the system to launch attacks against other systems with which the system might have an established trust relationship.

Potential Attackers

Another element of defending your data is identifying potential attackers who might want to steal or manipulate that data. For example, a company might need to protect its data from corporate competitors, terrorists, employees, and hackers, to name just a few.

The term “hacker” is often used very generically to describe attackers. However, not all hackers have malicious intent.

Table : lists various types of “hackers.”

Type of “Hacker”	Description
White hat hacker	A white hat hacker has the skills to break into computer systems and do damage. However, he uses his skills to help organizations. For example, a white hat hacker might work for a company to test the security of its network.
Black hat hacker	A black hat hacker, also known as a “cracker,” uses his skills for unethical reasons (for example, to steal funds).
Gray hat hacker	A gray hat hacker can be thought of as a white hat hacker who occasionally strays and acts unethically. For example, a gray hat hacker might be employed as a legitimate network security tester. However, in the course of his ethical duties, he finds an opportunity for personal gain and acts unethically to obtain that personal gain.
Phreaker	A phreaker is a hacker of a telecommunications system. For example, a phreaker known as “Captain Crunch” used a toy whistle he found in a box of Captain Crunch cereal (which generated a 2600-Hz tone) to trick phone systems into letting him place free long distance calls. Convincing a telecommunications carrier to permit free long distance calls in this manner is an example of “phreaking.”
Script kiddy	A script kiddy is a user who lacks the skills of a typical hacker. Rather, he downloads hacking utilities and uses those utilities to launch attacks, rather than writing his own programs.
Hacktivist	A hacktivist is a hacker with political motivations, such as someone who defaces the website of a political candidate.
Computer security hacker	A computer security hacker is knowledgeable about the technical aspects of computer and network security systems. For example, this person might attempt to attack a system protected by an IPS by fragmenting malicious traffic in a way that would go undetected by the
Academic hacker	An academic hacker typically is an employee or student at an institution of higher education. The academic hacker uses the institution’s computing resources to write “clever” programs. Typically, these hackers use their real names (unlike the pseudonyms often used by computer security hackers), and they tend to focus on open-standards-based software and operating systems (for example, Linux).
Hobby hacker	A hobby hacker tends to focus on home computing. He might modify existing hardware or software to, for example, use software without a legitimate license. For example, code that “unlocks” an Apple iPhone might be the work of a hobby hacker.

As shown in Table , “hackers” come in many flavors, which leads to the question, “What motivates a hacker?” Some hackers might work for governments to try to gather intelligence from other governments. Some attackers seek financial gain through their attacks. Other hackers simply enjoy the challenge of compromising a protected information system.

However, at this point, you should be familiar with five broad categories of attacks:

¦ Passive: A passive attack is difficult to detect, because the attacker isn’t actively sending traffic (malicious or otherwise). An example of a passive attack is an attacker capturing packets from the network and attempting to decrypt them (if the traffic was encrypted originally).

¦ Active: An active attack is easier to detect, because the attacker is actively sending traffic that can be detected. An attacker might launch an active attack in an attempt to access classified information or to modify data on a system.

¦ Close-in: A close-in attack, as the name implies, occurs when the attacker is in close physical proximity with the target system. For example, an attacker can bypass password protection on some routers, switches, and servers if he gains physical access to those devices.

¦ Insider: An insider attack occurs when legitimate network users leverage their credentials and knowledge of the network in a malicious fashion.

¦ Distribution: Distribution attacks intentionally introduce “back doors” to hardware or software systems at the point of manufacture. After these systems have been distributed to a variety of customers, the attacker can use his knowledge of the implanted back door to, for example, access protected data, manipulate data, or make the target system unusable by legitimate users.

Basic - OSI (Open Systems Interconnect) Layers

L1 Physical

L2 Data Link

L3 Network

L4 Transport

L5 Session

L6 Presentation

L7 Application

The advantages of OSI standardization are:

• Standardization
• Interoperability ? Before OSI vendors used to do their own separate thing
• Well documented

Basic - TCP/IP Layers

-- Network Access

-- Transport

-- Internet

-- Application

The TCP/IP layers are mainly concerned with L4 and L4 of the OSI model.

• L1, L2 & L3 = Network Access
• L6, L7 = Application

Basic - MAC Address

Stands for Media Address Control

It is 48 bits long.

0260.8c01.1234

The first ?0260.8c01? is the vendor ID (a.k.a. Organization Unit Identifier)