NETWORK ACCESS AND SECURITY
1 IP SPOOFING AND SNIFFING 1 2 HOW TO BUILD A FIREWALL 61 3 SATAN AND THE INTERNET INFERNO 172 4 KERBEROS 278 CONTENT IP SPOOFING AND SNIFFING S NIFFING AND SPOOFING ARE SECURITY THREATS THAT TARGET THE LOWER LAYERS OF THE NETWORKING INFRASTRUCTURE SUPPORTING APPLICATIONS THAT USE THE INTERNET USERS DO NOT INTERACT DIRECTLY WITH THESE LOWER LAYERS AND ARE TYPICALLY COMPLETELY UNAWARE THAT THEY EXIST WITHOUT A DELIBER ATE CONSIDERATION OF THESE THREATS IT IS IMPOSSIBLE TO BUILD EFFECTIVE SECURITY INTO THE HIGHER LEVELS SNIFFING IS A PASSIVE SECURITY ATTACK IN WHICH A MACHINE SEPARATE FROM THE INTENDED DESTINATION READS DATA ON A NETWORK THE TERM SNIFFING COMES FROM THE NOTION OF SNIFFING THE ETHER IN AN ETHERNET NETWORK AND IS A BAD PUN ON THE TWO MEANINGS OF THE WORD ETHER PASSIVE SECURITY ATTACKS ARE THOSE THAT DO NOT ALTER THE NORMAL FLOW OF DATA ON A COMMUNICATION LINK OR INJECT DATA INTO THE LINK 1 1 SPOOFING IS AN ACTIVE SECURITY ATTACK IN WHICH ONE MACHINE ON THE NETWORK MASQUERADES AS A DIFFERENT MACHINE AS AN ACTIVE ATTACK IT DISRUPTS THE NORMAL FLOW OF DATA AND MAY INVOLVE INJECTING DATA INTO THE COMMUNICATIONS LINK BETWEEN OTHER MACHINES THIS MASQUERADE AIMS TO FOOL OTHER MACHINES ON THE NETWORK INTO ACCEPTING THE IMPOSTOR AS AN ORIGINAL EITHER TO LURE THE OTHER MACHINES INTO SENDING IT DATA OR TO ALLOW IT TO ALTER DATA THE MEANING OF SPOOF HERE IS NOT A LIGHTHEARTED PARODY BUT RATHER A DECEPTION INTENDED TO TRICK ONE INTO ACCEPT ING AS GENUINE SOMETHING THAT IS ACTUALLY FALSE SUCH DECEPTION CAN HAVE GRAVE CONSEQUENCES BECAUSE NOTIONS OF TRUST ARE CENTRAL TO MANY NETWORKING SYSTEMS SNIFFING MAY SEEM INNOCUOUS DEPENDING ON JUST HOW SENSITIVE AND CONFIDENTIAL YOU CONSIDER THE INFORMATION ON YOUR NETWORK SOME NETWORK SECURITY ATTACKS USE SNIFFING AS A PRELUDE TO SPOOFING SNIFFING GATHERS SUFFICIENT INFORMATION TO MAKE THE DECEPTION BELIEVABLE SNIFFING SNIFFING IS THE USE OF A NETWORK INTERFACE TO RECEIVE DATA NOT INTENDED FOR THE MACHINE IN WHICH THE INTERFACE RESIDES A VARIETY OF TYPES OF MACHINES NEED TO HAVE THIS CAPABILITY A TOKEN RING BRIDGE FOR EXAMPLE TYPICALLY HAS TWO NETWORK INTERFACES THAT NORMALLY RECEIVE ALL PACKETS TRAVELING ON THE MEDIA ON ONE INTERFACE AND RETRANSMIT SOME BUT NOT ALL OF THESE PACKETS ON THE OTHER INTERFACE ANOTHER EXAMPLE OF A DEVICE THAT INCORPORATES SNIFFING IS ONE TYPICALLY MARKETED AS A NETWORK ANALYZER A NETWORK ANALYZER HELPS NETWORK ADMINISTRATORS DIAGNOSE A VARIETY OF OBSCURE PROBLEMS THAT MAY NOT BE VISIBLE ON ANY ONE PARTICULAR HOST THESE PROBLEMS CAN INVOLVE UNUSUAL INTERACTIONS BETWEEN MORE THAN JUST ONE OR TWO MACHINES AND SOMETIMES INVOLVE A VARIETY OF PROTOCOLS INTERACTING IN STRANGE WAYS DEVICES THAT INCORPORATE SNIFFING ARE USEFUL AND NECESSARY HOWEVER THEIR VERY EXISTENCE IMPLIES THAT A MALICIOUS PERSON COULD USE SUCH A DEVICE OR MODIFY AN EXISTING MACHINE TO SNOOP ON NETWORK TRAFFIC SNIFFING PROGRAMS COULD BE USED TO GATHER PASSWORDS READ INTER MACHINE E MAIL AND EXAMINE CLIENT SERVER DATABASE RECORDS IN TRANSIT BESIDES THESE HIGH LEVEL DATA LOW LEVEL INFORMATION MIGHT BE USED TO MOUNT AN ACTIVE ATTACK ON DATA IN ANOTHER COMPUTER SYSTEM SNIFFING HOW IT IS DONE IN A SHARED MEDIA NETWORK SUCH AS ETHERNET ALL NETWORK INTERFACES ON A NETWORK SEGMENT HAVE ACCESS TO ALL OF THE DATA THAT TRAVELS ON THE MEDIA EACH NETWORK INTERFACE HAS A HARDWARE LAYER ADDRESS THAT SHOULD DIFFER FROM ALL HARDWARE LAYER ADDRESSES OF ALL OTHER NETWORK INTERFACES ON THE NETWORK EACH NETWORK ALSO HAS AT LEAST ONE BROADCAST ADDRESS THAT CORRESPONDS NOT TO AN INDIVIDUAL NETWORK INTERFACE BUT TO THE SET OF ALL NETWORK INTERFACES NORMALLY A NETWORK INTERFACE WILL ONLY RESPOND TO A DATA FRAME CARRYING EITHER ITS OWN HARDWARE LAYER ADDRESS IN THE FRAME S DESTINATION FIELD OR THE BROADCAST ADDRESS IN THE DESTINATION FIELD IT RESPONDS TO THESE FRAMES BY GENERATING A HARDWARE INTERRUPT TO THE CPU THIS INTERRUPT GETS THE ATTENTION OF THE OPERATING SYSTEM AND PASSES THE DATA IN THE FRAME TO THE OPERATING SYSTEM FOR FURTHER PROCESSING GAINING ACCESS AND SECURING THE GATEWAY 2 NOTE THE TERM BROADCAST ADDRESS IS SOMEWHAT MISLEADING WHEN THE SENDER WANTS TO GET THE ATTENTION OF THE OPERATING SYSTEMS OF ALL HOSTS ON THE NETWORK HE OR SHE USES THE BROADCAST ADDRESS MOST NETWORK INTERFACES ARE CAPABLE OF BEING PUT INTO A PROMISCUOUS MODE IN PROMISCUOUS MODE NETWORK INTERFACES GENERATE A HARD WARE INTERRUPT TO THE CPU FOR EVERY FRAME THEY ENCOUNTER NOT JUST THE ONES WITH THEIR OWN ADDRESS OR THE BROADCAST ADDRESS THE TERM SHARED MEDIA INDICATES TO THE READER THAT SUCH NETWORKS BROADCAST ALL FRAMES THE FRAMES TRAVEL ON ALL THE PHYSICAL MEDIA THAT MAKE UP THE NETWORK AT TIMES YOU MAY HEAR NETWORK ADMINISTRATORS TALK ABOUT THEIR NETWORKING TROUBLE SPOTS WHEN THEY OBSERVE FAILURES IN A LOCALIZED AREA THEY WILL SAY A PARTICULAR AREA OF THE ETHERNET IS BUSIER THAN OTHER AREAS OF THE ETHERNET WHERE THERE ARE NO PROBLEMS ALL OF THE PACKETS TRAVEL THROUGH ALL PARTS OF THE ETHERNET SEGMENT INTERCONNECTION DEVICES THAT DO NOT PASS ALL THE FRAMES FROM ONE SIDE OF THE DEVICE TO THE OTHER FORM THE BOUNDARIES OF A SEGMENT BRIDGES SWITCHES AND ROUTERS DIVIDE SEGMENTS FROM EACH OTHER BUT LOW LEVEL DEVICES THAT OPERATE ON ONE BIT AT A TIME SUCH AS REPEATERS AND HUBS DO NOT DIVIDE SEGMENTS FROM EACH OTHER IF ONLY LOW LEVEL DEVICES SEPARATE TWO PARTS OF THE NETWORK BOTH ARE PART OF A SINGLE SEGMENT ALL FRAMES TRAVELING IN ONE PART OF THE SEGMENT ALSO TRAVEL IN THE OTHER PART THE BROADCAST NATURE OF SHARED MEDIA NETWORKS AFFECTS NETWORK PERFORMANCE AND RELIABILITY SO GREATLY THAT NETWORKING PROFESSIONALS USE A NETWORK ANALYZER OR SNIFFER TO TROUBLESHOOT PROBLEMS A SNIFFER PUTS A NETWORK INTERFACE IN PROMISCUOUS MODE SO THAT THE SNIFFER CAN MONITOR EACH DATA PACKET ON THE NETWORK SEGMENT IN THE HANDS OF AN EXPERIENCED SYSTEM ADMINISTRATOR A SNIFFER IS AN INVALUABLE AID IN DETERMINING WHY A NETWORK IS BEHAVING OR MISBEHAVING THE WAY IT IS WITH AN ANALYZER YOU CAN DETERMINE HOW MUCH OF THE TRAFFIC IS DUE TO WHICH NETWORK PROTOCOLS WHICH HOSTS ARE THE SOURCE OF MOST OF THE TRAFFIC AND WHICH HOSTS ARE THE DESTINATION OF MOST OF THE TRAFFIC YOU CAN ALSO EXAMINE DATA TRAVELING BETWEEN A PARTICULAR PAIR OF HOSTS AND CATEGORIZE IT BY PROTOCOL AND STORE IT FOR LATER ANALYSIS OFFLINE WITH A SUFFICIENTLY POWERFUL CPU YOU CAN ALSO DO THE ANALYSIS IN REAL TIME MOST COMMERCIAL NETWORK SNIFFERS ARE RATHER EXPENSIVE COSTING THOUSANDS OF DOLLARS WHEN YOU EXAMINE THESE CLOSELY YOU NOTICE THAT THEY ARE NOTHING MORE THAN A PORTABLE COMPUTER WITH AN ETHERNET CARD AND SOME SPECIAL SOFTWARE THE ONLY ITEM THAT DIFFERENTIATES A SNIFFER FROM AN ORDINARY COMPUTER IS SOFTWARE IT IS ALSO EASY TO DOWNLOAD SHAREWARE AND FREEWARE SNIFFING SOFTWARE FROM THE INTERNET OR VARIOUS BULLETIN BOARD SYSTEMS THE EASE OF ACCESS TO SNIFFING SOFTWARE IS GREAT FOR NETWORK ADMINISTRATORS BECAUSE THIS TYPE OF SOFTWARE HELPS THEM BECOME BETTER NETWORK TROUBLESHOOTERS HOWEVER THE AVAILABILITY OF THIS SOFTWARE ALSO MEANS THAT MALICIOUS COMPUTER USERS WITH ACCESS TO A NETWORK CAN CAPTURE ALL THE DATA FLOWING THROUGH THE NETWORK THE SNIFFER CAN CAPTURE ALL THE DATA FOR A SHORT PERIOD OF TIME OR SELECTED PORTIONS OF THE DATA FOR A FAIRLY LONG PERIOD OF TIME EVENTUALLY THE MALICIOUS USER WILL RUN OUT OF SPACE TO STORE THE DATA THE NETWORK I USE OFTEN HAS 1000 PACKETS PER SECOND FLOWING ON IT JUST CAPTURING THE FIRST 64 BYTES OF DATA FROM EACH PACKET FILLS UP MY SYSTEM S LOCAL DISK SPACE WITHIN THE HOUR GAINING ACCESS AND SECURING THE GATEWAY 3