Seven Deadliest Network Attacks

Stacy Prowell, Rob Kraus, Mike Borkin

• Publisher: Syngress
• Year: 2010
• Print ISBN: 9781597495493
• eBook ISBN: 9781597495509
• Topic: Business
• Subtopic: Information Management
• Index: Business

Seven Deadliest Network Attacks identifies seven classes of network attacks and discusses how the attack works, including tools to accomplish the attack, the risks of the attack, and how to defend against the attack. This book pinpoints the most dangerous hacks and exploits specific to networks, laying out the anatomy of these attacks including how to make your system more secure. You will discover the best ways to defend against these vicious hacks with step-by-step instruction and learn techniques to make your computer and network impenetrable.The book consists of seven chapters that deal with the following attacks: denial of service; war dialing; penetration testing; protocol tunneling; spanning tree attacks; man-in-the-middle; and password replay. These attacks are not mutually exclusive and were chosen because they help illustrate different aspects of network security. The principles on which they rely are unlikely to vanish any time soon, and they allow for the possibility of gaining something of interest to the attacker, from money to high-value data. This book is intended to provide practical, usable information. However, the world of network security is evolving very rapidly, and the attack that works today may (hopefully) not work tomorrow. It is more important, then, to understand the principles on which the attacks and exploits are based in order to properly plan either a network attack or a network defense.Seven Deadliest Network Attacks will appeal to information security professionals of all levels, network admins, and recreational hackers.- Knowledge is power, find out about the most dominant attacks currently waging war on computers and networks globally- Discover the best ways to defend against these vicious attacks; step-by-step instruction shows you how- Institute countermeasures, don't be caught defenseless again, and learn techniques to make your computer and network impenetrable

CHAPTER

Denial of Service

1

INFORMATION IN THIS CHAPTER

How Denial of Service Works

Dangers of Denial of Service

Defense against Denial of Service

The Future of Denial of Service

On April 26, 2007, the nation of Estonia was hit with a denial-of-service (DoS) attack. The attack lasted, off and on, until May 18th of the same year. The attack effectively cut off Internet access for much of the country. Members of the Parliament could not access their e-mail, people were unable to access their online banking accounts, Estonian news agencies could not communicate outside the country’s borders, ATMs ceased to work, and citizens traveling abroad discovered their debit cards no longer worked.¹

Estonia was not overcome because of outdated infrastructure. It was (and is) one of the most “wired” countries in Europe, thanks to their Tiigrihüpe (Tiger’s Leap) project. In Estonia, as in France and Greece, Internet access is regarded as a basic human right, and the Estonian government has invested heavily in information technology (IT).

One might also be tempted to dismiss an Internet outage as nothing serious. Of course, if your business depends on the Internet, you may feel differently. Estonia’s largest bank, Hansabank, is estimated to have lost around $1 million as the result of the attack. Banks are increasingly dependent on Internet banking and foreign money transfers, and thus an “always on” Internet. If the Internet is your business, as with Amazon.com and eBay, the effect can be disastrous.

Was this attack the result of careful planning by a foreign government? It now seems likely that the attack was organized and coordinated by one man: a 22-year-old Russian named Konstantin Goloskokov. He apparently carried out the attack in protest of the Estonian government’s decision to move the Bronze Soldier, a war monument in Tallinn erected by the Soviet Union in 1947. At the time of writing, the Estonian government has arrested and convicted just one person: Dmitri Galushkevich, who took part in the attack working from his laptop.

DoS attacks are on the rise and can be perpetrated by large-state actors, experienced hackers, or even by novices (“script kiddies”) following any of the “how-to” manuals found on the Internet. DoS attacks can be launched for any number of reasons, from political protest to espionage and even extortion. These attacks can be intentional, like the one just described, or unintentional, like the “Slashdot” effect.

As an example of unintentional DoS, suppose several aggregators, including Slashdot^A and Digg,^B pick up your essay on why Data was the best acting captain in Star Trek history. Now, thousands of people are visiting your site every minute, and the bandwidth allocated to you by your Internet service provider (ISP) is quickly used up. Now nobody can get to your site, not even you. Worst of all, you can’t post the adorable video of your cats dressed as the crew of the enterprise. You’ve been the victim of unintentional DoS. You may even get a bill from your ISP for the extra bandwidth.

This chapter will focus on intentional DoS – a denial-of-service attack. DoS attacks can be launched for a number of reasons; the Estonia case was a sort of protest but they can be used to damage competitors for financial gain. In 2004, businessman Saad “Jay” Echouafni allegedly hired computer hackers to launch a DoS attack on three of his competitors. Another application of DoS attacks for financial gain is extortion. A company receives a threat that they will be subjected to a DoS attack unless they wire money to an offshore account. In many cases, the company will simply pay. In 2004, Carnegie Mellon University surveyed 100 companies. They found that 17% of medium-size businesses had been the target of some form of cyber-extortion.^C

HOW DENIAL OF SERVICE WORKS

DoS requires two elements: a resource of finite capacity, and the means to acquire or “use up” the resource faster than it can be replenished. Although we generally think of these attacks in terms of computers, DoS attacks do not have to be network-based. It is possible to have “real-world” DoS attacks, provided you have the above two elements.

Real-world examples include the practice of “land blocking” where a company purchases the land around a store to prevent competitors from opening nearby, and many of the methods used by DeBeers to control the diamond market in the twentieth century.^D These are examples of a single entity that is powerful enough to consume enough of the available resources (land, diamond production, or any resource your competition needs) to disrupt or starve others. In general, this requires deep pockets or significant resources, which makes it much less likely to occur than DoS attacks in the virtual world.

Distributed Denial of Service

To conduct a successful DoS attack, you usually need a lot of help. This is the origin of the distributed denial of service attack (DDoS). As an example of a DDoS attack for the physical world, consider the following: you admire the cool-headed reasoned approach of Captain Picard over the random cowboy style of Captain Kirk, and decide that what the world needs is a statue of Picard in San Francisco, the (future) home of Starfleet. To this end, you start a campaign to raise money, and people begin sending you checks.

Sadly your “friend” Mike does not agree and makes his mission to stop you. He recruits friends to send you hate mail, and soon your mailbox is stuffed with angry letters about why Kirk is better than Picard. Sorting through the mail takes longer and longer, and you only find a few checks in every batch of letters. Soon you’ve got friends involved to sort the mail, but sending the same angry letter multiple times is easier (and cheaper) than sending a new check, so the volume of hate mail far outstrips the volume of checks. You need more and more time to sort the mail, for fewer payoffs.

Everyday your mailbox is stuffed full. The post office begins to hold your mail because it cannot deliver it. Now you must drive to the post office to collect boxes of (mostly) photocopied hate mail, and you have to open every letter because you can’t easily tell which ones contain checks. Ultimately you may have to abandon your quest, noble though it may be.

Although a DDoS attack is hard to pull off in the physical world, DDoS is the most common – and disturbing – form of DoS attack in the virtual one. Utilizing DDoS techniques and the Internet, small groups (or even a single individual) can conduct massive DoS attacks. The rest of this chapter will focus solely on DDoS attacks.

Overview of a Denial of Service Attack

Suppose you want to conduct a network DDoS attack against a particular victim. You are taking the role commonly called the intruder. To conduct a DDoS attack, you need to be able to “use up” some resource needed by the victim. You can target any resource likely to interrupt your target. For instance, if you are targeting an online retailer, you might do any of the following.

• Overload the Web servers.

• Overload any network link.

• Crash servers.

• Attack a dependency.

In the last case you don’t attack the victim directly, but you might attack their bank, their credit card clearing company, their accounting firm, or one of their suppliers, making it impossible for them to conduct business.

It is likely that your target, especially if it is a bank or online retailer, has a lot of capacity you must use up before you are successful. Your computer just cannot generate enough network traffic to launch a successful DDoS attack. You need help.

In some cases, it may be possible to use social engineering to accomplish your goal. For example, if you can start a successful Internet rumor about your victim, you may be able to get others to do your work for you. For example, you might post a long and official-looking “news” story about how your “friend” Mike was caught raising Dalmatian puppies for their fur. Soon activists are calling him at all hours, filling his mailbox with hate mail, and even stopping by his house. Mike can no longer go to the store, let alone continue his DDoS attack against you. Sadly, his friends may carry on in his absence.

Most often you will instead attempt to gain control of a large number of computers from which to conduct the attack. During the 1990s, you might have targeted universities because they had large numbers of always-connected machines with fast connections and (typically) low security. Today, university networks are better protected and monitored, but the rapid growth of the Internet means you can find a large number of always-connected machines with reasonably fast connections and low security in peoples’ homes and small businesses. If you can compromise enou...

Table of contents

• Cover
• Copyright
• About the Authors
• Introduction
• Chapter 1 Denial of Service
• Chapter 2 War Dialing
• Chapter 3 Penetration “Testing”
• Chapter 4 Protocol Tunneling
• Chapter 5 Spanning Tree Attacks
• Chapter 6 Man-in-the-Middle
• Chapter 7 Password Replay
• Index