This article describes the various attacks likely to affect a network and the systems that make it up. With the spread of the Internet and modern means of communication, a new form of insecurity has spread, one that relies on the use of computer code to disrupt or penetrate networks and computers.
Attacks generally affect the following three components of a system: the network layer, in charge of connecting the system to the network; the operating system, in charge of offering the system a core of functions; and the application layer, in charge of offering specific services.
All these components of a system constitute so many means of penetration for attacks of every kind.
The first part draws up a classification of network-oriented attacks, whether they directly target network systems such as routers (and the protocols they manage), switches (in order to bypass virtual networks), wireless access points (in order to enter the corporate network without physical access to it) or critical services such as the naming service, or DNS (Domain Name Service).
The intrusion methods and techniques that make it possible to take control of a system will be covered in detail further on. These attacks rely on the security weaknesses of the operating systems of network equipment.
Some attacks can indirectly affect the network, even if that is not their initial aim. Such is the case of the distributed denial of service caused by computer worms, but also, on a smaller scale, by viruses. These indirect attacks on the network will also be described.
A typology of network attacks
Network attacks are so numerous today that it would be illusory to claim to describe them all
It is however possible to draw up a typology of security weaknesses in order to better grasp these attacks, whose common point is to exploit security weaknesses.
The aim here is to present the weaknesses most commonly exploited by attacks and to detail the mechanisms of these attacks. It is important that you understand the dangers that threaten networks, not that we arouse in you a vocation for hacking, which remains punishable by law.
Network protocols are still young, and none of them was designed to take security problems into account. The IP protocol, for example, has no security layer. Most of the protocols used in a network, such as SNMP (Simple Network Management Protocol) for monitoring or BGP (Border Gateway Protocol) for routing, do not implement a real security layer and are exposed to various attacks, such as fragmentation attacks, denials of service, and so on.
Likewise, network protocols have not provided for any real authentication mechanism and are subject to attacks that rely on these authentication weaknesses, such as spoofing, man-in-the-middle attacks, and so on.
As every effect has a cause, network attacks rely on various types of weaknesses, which can be classified by category.
Implementation weaknesses, or program bugs (operating system, routing application, etc.), expose systems to other attacks, by far the most numerous. The reason for this is that the development of software and network stacks is done faster and faster and without strict rules. Among the countless attacks that make use of poor implementations or programming errors, we can mention SYN flooding and ping-of-death attacks.
The configuration weaknesses of network equipment can stem from a poor configuration of a firewall, letting through traffic not authorized by the security policy, or of a piece of network equipment, allowing an attacker to access it, etc.
By relying on these weaknesses, the hacker can launch a set of attacks that make it possible to influence the behavior of the network or to gather important information.
Network attacks can be launched directly, the hacker attacking the victim and thereby exposing their identity.
Network attacks can also be launched indirectly through a bounce system in order to hide the identity (IP address) of the hacker and to use the resources of the intermediate system. In this case the attack packets are sent to the intermediate system, which relays the attack toward the target system.
Some attacks known as indirect-by-response attacks offer the hacker the same advantages as bounce attacks. Instead of sending the attack to the intermediate system so that it relays it, the attacker sends it a request, and it is the response to this request that is sent to the target system.
Let us keep in mind that a network is the component of several networks, coming from different operators (Internet, public infrastructures, etc.), in principle untrustworthy.
This part will describe a set of attacks classified according to the hackers' objectives and relying on protocol, authentication or implementation weaknesses.
Knowing that the version that succeeds IPv4 is IPv6 (already implemented by some operators), we will describe where necessary the projection of IPv4 attacks into an IPv6 world.
Attacks that reveal the network
Network mapping attack
Attacks aimed at establishing the map of a network have the goal of laying out the communication arteries of the future target systems. To do so they resort to diagnostic tools such as Traceroute, which makes it possible to visualize the path followed by an IP packet from one host to another.
Traceroute uses the time-to-live option, or TTL (Time To Live), of the IP packet to trigger an ICMP time_exceeded message for each router it crosses. Knowing that every router that handles a packet decrements the TTL field, this field becomes a true hop counter and makes it possible to determine the precise route followed by IP packets toward a target system.
Traceroute creates a packet with the source and destination addresses and an initial time-to-live value TTL (number of gateways crossed) equal to 1. This packet therefore stops at the first router encountered, and the router sends an ICMP error message (time_exceeded). Traceroute records this information and creates a new packet with a TTL of 2.
Crossing a first router sets the TTL to 1. The packet generates an error on the second router. As before, the second router sends an ICMP error message with its address, which is stored by Traceroute. Once the target system is reached, an ICMP error is generated by that target system, and Traceroute displays the list of gateways crossed as well as the RTT (Round Trip Time) for each of them.
In the most frequent case, the hacker rather uses the scanning technique to build the picture of the network, because it provides information more quickly.
More to come....