Table Of ContentIPA R T IPART PART
T
R P
A A
P R
T
T
R P
PA ART
T P
R A
AP TR
TRAPTRAP TR A P TRAP
Gaining Access and Securing
the Gateway
6 IP Spoofing and Sniffing.........................................................257
7 How to Build a Firewall.........................................................317
8 SATAN and the Internet Inferno............................................ 429
9 Kerberos.................................................................................535
p1vPHCP/tr2 Internet Security Pro Ref 557-7 dc 1-23-96 Parts LP#2
257
IP Spoofing and Sniffing
C HAPTER
6HAPTER CHAPTE
C R
ER CH
T A
P P
A T
H RE
C
C
R H
ETPAHCRETPAH C RETPA
IP Spoofing and Sniffing
S
niffing and spoofing are security threats that target the
lower layers of the networking infrastructure supporting
applications that use the Internet. Users do not interact
directly with these lower layers and are typically
completely unaware that they exist. Without a deliber-
ate consideration of these threats, it is impossible to
build effective security into the higher levels.
Sniffing is a passive security attack in which a machine
separate from the intended destination reads data on a
network. The term “sniffing” comes from the notion of
“sniffing the ether” in an Ethernet network and is a
bad pun on the two meanings of the word “ether.”
Passive security attacks are those that do not alter the
normal flow of data on a communication link or inject
data into the link.
p1vPHCP/nhb1 Internet Security Pro Ref 577-7 Gina 1-27-96 CH06 LP#3
258
Part II: Gaining Access and Securing the Gateway
Spoofing is an active security attack in which one machine on the network masquerades as a
different machine. As an active attack, it disrupts the normal flow of data and may involve
injecting data into the communications link between other machines. This masquerade aims to
fool other machines on the network into accepting the impostor as an original, either to lure
the other machines into sending it data or to allow it to alter data. The meaning of “spoof”
here is not “a lighthearted parody,” but rather “a deception intended to trick one into accept-
ing as genuine something that is actually false.” Such deception can have grave consequences
because notions of trust are central to many networking systems. Sniffing may seem innocuous
(depending on just how sensitive and confidential you consider the information on your
network), some network security attacks use sniffing as a prelude to spoofing. Sniffing gathers
sufficient information to make the deception believable.
Sniffing
Sniffing is the use of a network interface to receive data not intended for the machine in which
the interface resides. A variety of types of machines need to have this capability. A token-ring
bridge, for example, typically has two network interfaces that normally receive all packets
traveling on the media on one interface and retransmit some, but not all, of these packets on
the other interface. Another example of a device that incorporates sniffing is one typically
marketed as a “network analyzer.” A network analyzer helps network administrators diagnose a
variety of obscure problems that may not be visible on any one particular host. These problems
can involve unusual interactions between more than just one or two machines and sometimes
involve a variety of protocols interacting in strange ways.
Devices that incorporate sniffing are useful and necessary. However, their very existence
implies that a malicious person could use such a device or modify an existing machine to snoop
on network traffic. Sniffing programs could be used to gather passwords, read inter-machine
e-mail, and examine client-server database records in transit. Besides these high-level data, low-
level information might be used to mount an active attack on data in another computer
system.
Sniffing: How It Is Done
In a shared media network, such as Ethernet, all network interfaces on a network segment have
access to all of the data that travels on the media. Each network interface has a hardware-layer
address that should differ from all hardware-layer addresses of all other network interfaces on
the network. Each network also has at least one broadcast address that corresponds not to an
individual network interface, but to the set of all network interfaces. Normally, a network
interface will only respond to a data frame carrying either its own hardware-layer address in
the frame’s destination field or the “broadcast address” in the destination field. It responds to
these frames by generating a hardware interrupt to the CPU. This interrupt gets the attention
of the operating system, and passes the data in the frame to the operating system for further
processing.
p1vPHCP/nhb1 Internet Security Pro Ref 577-7 Gina 1-27-96 CH06 LP#3
259
IP Spoofing and Sniffing
Note The term “broadcast address” is somewhat misleading. When the sender wants to
get the attention of the operating systems of all hosts on the network, he or she uses
the “broadcast address.” Most network interfaces are capable of being put into a
“promiscuous mode.” In promiscuous mode, network interfaces generate a hard-
ware interrupt to the CPU for every frame they encounter, not just the ones with
their own address or the “broadcast address.” The term “shared media” indicates to
the reader that such networks broadcast all frames—the frames travel on all the
physical media that make up the network.
At times, you may hear network administrators talk about their networking trouble spots—
when they observe failures in a localized area. They will say a particular area of the Ethernet is
busier than other areas of the Ethernet where there are no problems. All of the packets travel
through all parts of the Ethernet segment. Interconnection devices that do not pass all the
frames from one side of the device to the other form the boundaries of a segment. Bridges,
switches, and routers divide segments from each other, but low-level devices that operate on
one bit at a time, such as repeaters and hubs, do not divide segments from each other. If only
low-level devices separate two parts of the network, both are part of a single segment. All
frames traveling in one part of the segment also travel in the other part.
The broadcast nature of shared media networks affects network performance and reliability so
greatly that networking professionals use a network analyzer, or sniffer, to troubleshoot
problems. A sniffer puts a network interface in promiscuous mode so that the sniffer can
monitor each data packet on the network segment. In the hands of an experienced system
administrator, a sniffer is an invaluable aid in determining why a network is behaving (or
misbehaving) the way it is. With an analyzer, you can determine how much of the traffic is due
to which network protocols, which hosts are the source of most of the traffic, and which hosts
are the destination of most of the traffic. You can also examine data traveling between a
particular pair of hosts and categorize it by protocol and store it for later analysis offline. With
a sufficiently powerful CPU, you can also do the analysis in real time.
Most commercial network sniffers are rather expensive, costing thousands of dollars. When
you examine these closely, you notice that they are nothing more than a portable computer
with an Ethernet card and some special software. The only item that differentiates a sniffer
from an ordinary computer is software. It is also easy to download shareware and freeware
sniffing software from the Internet or various bulletin board systems.
The ease of access to sniffing software is great for network administrators because this type of
software helps them become better network troubleshooters. However, the availability of this
software also means that malicious computer users with access to a network can capture all the
data flowing through the network. The sniffer can capture all the data for a short period of
time or selected portions of the data for a fairly long period of time. Eventually, the malicious
user will run out of space to store the data—the network I use often has 1000 packets per
second flowing on it. Just capturing the first 64 bytes of data from each packet fills up my
system’s local disk space within the hour.
p1vPHCP/nhb1 Internet Security Pro Ref 577-7 Gina 1-27-96 CH06 LP#3
260
Part II: Gaining Access and Securing the Gateway
Note Esniff.c is a simple 300-line C language program that works on SunOS 4.x. When
run by the root user on a Sun workstation, Esniff captures the first 300 bytes of each
TCP/IP connection on the local network. It is quite effective at capturing all
usernames and passwords entered by users for telnet, rlogin, and FTP.
TCPDump 3.0.2 is a common, more sophisticated, and more portable Unix sniffing
program written by Van Jacobson, a famous developer of high-quality TCP/IP
software. It uses the libpcap library for portably interfacing with promiscuous mode
network interfaces. The most recent version is available via anonymous FTP to
ftp.ee.lbl.gov.
NetMan contains a more sophisticated, portable Unix sniffer in several programs in
its network management suite. The latest version of NetMan is available via
anonymous FTP to ftp.cs.curtin.edu.au in the directory /pub/netman.
EthDump is a sniffer that runs under DOS and can be obtained via anonymous FTP
from ftp.eu.germany.net in the directory /pub/networking/inet/ethernet/.
Warning
On some Unix systems, TCPDump comes bundled with the vendor OS. When
run by an ordinary, unprivileged user, it does not put the network interface into
promiscuous mode. With this command available, a user can only see data being
sent to the Unix host, but is not limited to seeing data sent to processes owned by
the user. Systems administrators concerned about sniffing should remove user
execution privileges from this program.
Sniffing: How It Threatens Security
Sniffing data from the network leads to loss of privacy of several kinds of information that
should be private for a computer network to be secure. These kinds of information include the
following:
n Passwords
n Financial account numbers
n Private data
n Low-level protocol information
The following subsections are intended to provide examples of these kinds.
p1vPHCP/nhb1 Internet Security Pro Ref 577-7 Gina 1-27-96 CH06 LP#3
261
IP Spoofing and Sniffing
Sniffing Passwords
Perhaps the most common loss of computer privacy is the loss of passwords. Typical users type
a password at least once a day. Data is often thought of as secure because access to it requires a
password. Users usually are very careful about guarding their password by not sharing it with
anyone and not writing it down anywhere.
Passwords are used not only to authenticate users for access to the files they keep in their
private accounts but other passwords are often employed within multilevel secure database
systems. When the user types any of these passwords, the system does not echo them to the
computer screen to ensure that no one will see them. After jealously guarding these passwords
and having the computer system reinforce the notion that they are private, a setup that sends
each character in a password across the network is extremely easy for any Ethernet sniffer to
see. End users do not realize just how easily these passwords can be found by someone using a
simple and common piece of software.
Sniffing Financial Account Numbers
Most users are uneasy about sending financial account numbers, such as credit card numbers
and checking account numbers, over the Internet. This apprehension may be partly because of
the carelessness most retailers display when tearing up or returning carbons of credit card
receipts. The privacy of each user’s credit card numbers is important. Although the Internet is
by no means bulletproof, the most likely location for the loss of privacy to occur is at the
endpoints of the transmission. Presumably, businesses making electronic transactions are as
fastidious about security as those that make paper transactions, so the highest risk probably
comes from the same local network in which the users are typing passwords.
However, much larger potential losses exist for businesses that conduct electronic funds
transfer or electronic document interchange over a computer network. These transactions
involve the transmission of account numbers that a sniffer could pick up; the thief could then
transfer funds into his or her own account or order goods paid for by a corporate account.
Most credit card fraud of this kind involves only a few thousand dollars per incident.
Sniffing Private Data
Loss of privacy is also common in e-mail transactions. Many e-mail messages have been
publicized without the permission of the sender or receiver. Remember the Iran-Contra affair
in which President Reagan’s secretary of defense, Caspar Weinberger, was convicted. A crucial
piece of evidence was backup tapes of PROFS e-mail on a National Security Agency computer.
The e-mail was not intercepted in transit, but in a typical networked system, it could have
been. It is not at all uncommon for e-mail to contain confidential business information or
personal information. Even routine memos can be embarrassing when they fall into the wrong
hands.
p1vPHCP/nhb1 Internet Security Pro Ref 577-7 Gina 1-27-96 CH06 LP#3
262
Part II: Gaining Access and Securing the Gateway
Sniffing Low-Level Protocol Information
Information network protocols send between computers includes hardware addresses of local
network interfaces, the IP addresses of remote network interfaces, IP routing information, and
sequence numbers assigned to bytes on a TCP connection. Knowledge of any of this informa-
tion can be misused by someone interested in attacking the security of machines on the
network. See the second part of this chapter for more information on how these data can pose
risks for the security of a network. A sniffer can obtain any of these data. After an attacker has
this kind of information, he or she is in a position to turn a passive attack into an active attack
with even greater potential for damage.
Protocol Sniffing: A Case Study
At one point in time, all user access to computing facilities in the organization under study
(the university at which the author is employed) was done via terminals. It was not practical to
hardwire each terminal to the host, and users needed to use more than one host. To solve these
two problems, Central Computing used a switch (an AT&T ISN switch) between the termi-
nals and the hosts. The terminals connected to the switch so that the user had a choice of
hosts. When the user chose a host the switch connected the terminal to the chosen host via a
very real, physical connection. The switch had several thousand ports and was, in theory,
capable of setting up connections between any pair of ports. In practice, however, some ports
attached to terminals and other ports attached to hosts. Figure 6.1 illustrates this setup.
Figure 6.1
Case study system ~2500 Input
before networking. ~400 Output
IBM Mainframe
DEC Vax
[SN Switcher]
Multiplexor
DEC Vax
To make the system more flexible, the central computing facility was changed to a new system
that uses a set of (DEC 550) Ethernet terminal servers with ports connected to the switch,
rather than the old system, which used a fixed number of switch ports connected to each host.
The new terminal servers are on an Ethernet segment shared by the hosts in the central
machine room.
p1vPHCP/nhb1 Internet Security Pro Ref 577-7 Gina 1-27-96 CH06 LP#3
263
IP Spoofing and Sniffing
Offices have a cable running from a wallplate to a wiring closet punchdown block. The punch-
down block has cables running to multiplexers which in turn connect to the switch. The
multiplexers serve to decrease the number of cables that need to be long. With this arrange-
ment sniffing or other forms of security problems are not an issue. No two offices share any
media. The switch mediates all interaction between computers, isolating the flow of data away
from the physical location of the end users (see fig. 6.2).
Figure 6.2
Case study system after
networking of machine
Terminal(cid:13)
~2500 Input Server room but before
~400 Output networking of user areas.
IBM Mainframe
Ethernet(cid:13)
Terminal(cid:13) Hub
Server
DEC Vax
[SN Switcher]
Multiplexor
Terminal(cid:13) DEC Vax
Server
Rather than using simple terminals, however, most computer users have a computer on their
desktop that they use in addition to the Central Computing computers. The switch services
these computers as well as simple terminals. The number of computer users, however, has
grown rapidly over the past decade and the switch is no longer adequate. Terminal ports are in
short supply, host ports are in even shorter supply, and the switch does not supply particularly
high-speed connections.
To phase out the switch, Central Computing installed an Ethernet hub in the basement of
each building next to the punchdown block used to support both the switch multiplexer and
the telephone lines. The hubs in the basements connect to the central facility using fiber-optic
cables to prevent signal degradation over long distances. Hubs also were placed in the wiring
closets on each floor of each building that connected to the basement hub. Now the cables
leading to the wallplates in the offices are being moved from the punchdown block that leads
to the multiplexer to a punchdown block that leads to one of these hubs. The new wiring
scheme neatly parallels the old and was changed relatively inexpensively. Figure 6.3 illustrates
the system after the networking of user areas. Figure 6.4 shows the user area networking detail.
p1vPHCP/nhb1 Internet Security Pro Ref 577-7 Gina 1-27-96 CH06 LP#3
264
Part II: Gaining Access and Securing the Gateway
Figure 6.3
Case study system after
networking of user areas.
Ethernet Hub IBM Mainframe
Ethernet(cid:13)
Hub
Ethernet Hub
DEC Vax
Router
Ethernet Hub
DEC Vax
Figure 6.4 Punch Block
Case study user area
networking detail.
Mac OS
NFS Server
MS Windows
Hubs NetWare (cid:13)
Server
Hub
Unix
Staff Offices Departmental(cid:13)
Machine Room
Although the new wiring scheme neatly parallels the old, the data traveling on the new wiring
scheme does not neatly parallel its previous path. From a logical standpoint, it can get to the
same places, but the data can and does go to many other places as well. Under this scheme, any
office can sniff on all the data flowing to Central Computing from all of the other offices in
the building. Different departments are located in the same building. These departments
compete for resources allocated by upper management and are not above spying on one
another. Ordinary staff, the managers that supervise them, and middle management all are
located in the same building. A fair amount of potential exists for employees to want to know
what other people are sending in e-mail messages, storing in personnel files, and storing in
project planning files.
In addition to nosiness and competition, a variety of people sharing the same physical media in
the new wiring scheme, could easily misuse the network. Since all occupants of a building
p1vPHCP/nhb1 Internet Security Pro Ref 577-7 Gina 1-27-96 CH06 LP#3
265
IP Spoofing and Sniffing
share a single set of Ethernet hubs, they broadcast all of their network traffic to every network
interface in the entire building. Any sensitive information that they transmit is no longer
limited to a direct path between the user’s machine and the final destination, anyone in the
building can intercept the information with a sniffer. However, some careful planning of
network installation or a redesign of an existing network should include security considerations
(as well as performance issues) to avoid the risks inherent in shared media networking.
The network in the case study fails miserably in the prevention of sniffing. Any computer in a
building is capable of sniffing the network traffic to or from any other computer in the
building. The following section describes how to design a network that limits the sharing of
media to prevent sniffing by untrustworthy machines.
Sniffing: How to Prevent It
To be able to prevent a sniffing attack, you first need to understand the network segments and
trust between computer systems.
Network Segmentation
A network segment consists of a set of machines that share low-level devices and wiring and see
the same set of data on their network interfaces. The wires on both sides of a repeater are
clearly in the same network segment because a repeater simply copies bits from one wire to the
other wire. An ordinary hub is essentially a multiport repeater; all the wires attached to it are
part of the same segment.
In higher-level devices, such as bridges, something different happens. The wires on opposite
sides of a bridge are not part of the same segment because the bridge filters out some of the
packets flowing through it. The same data is not flowing on both sides of the bridge. Some
packets flow through the bridge, but not all. The two segments are still part of the same
physical network. Any device on one side of the bridge can still send packets to any device on
the other side of the bridge. However, the exact same sets of data packets do not exist on both
sides of the bridge. Just as bridges can be used to set up boundaries between segments, so can
switches. Switches are essentially multiport bridges. Because they limit the flow of all data, a
careful introduction of bridges and switches can be used to limit the flow of sensitive informa-
tion and prevent sniffing on untrustworthy machines.
The introduction of switches and bridges into a network is traditionally motivated by factors
other than security. They enhance performance by reducing the collision rate of segments,
which is much higher without these components. Switches and bridges overcome the time
delay problems that occur when wires are too long or when simple repeaters or hubs introduce
additional time delay. As one is planning the network infrastructure one should keep these
other factors in mind as well. One can use these factors to sell the introduction of additional
hardware to parties less concerned with security.
p1vPHCP/nhb1 Internet Security Pro Ref 577-7 Gina 1-27-96 CH06 LP#3
Description:Part II: Gaining Access and Securing the Gateway . fastidious about security as those that make paper transactions, so the highest risk probably.
