The Attack and Defense of Computers

1
Network Architecture:

2
TCP/IP Protocol Suite

3
IP Header [networksorcery]

Specifies the length of the IP packet

header in 32 bit words. The minimum
value for a valid header is 5.

4
Classes of IP addresses

Class A: 1.0.0.0 ~ 127.255.255.255

Class B: 128.0.0.0 ~ 191.255.255.255
Class C: 192.0.0.0 ~ 223.255.255.255
Class D: 224.0.0.0 ~ 239.255.255.255

5
Private Network
In Internet terminology, a private network is a network that uses RFC
1918 IP address space.
Computers may be allocated addresses from this address space when
it's necessary for them to communicate with other computing devices
on an internal (non-Internet) network but not directly with the Internet.

6
ICMP Header

7
Function of ICMP
ICMP messages are sent in several situations:
for example,
• when a datagram cannot reach its destination
• when the gateway does not have the buffering capacity to
forward a datagram
• when the gateway can direct the host to send traffic on a
shorter route
The Internet Protocol is not designed to be
absolutely reliable. The purpose of these control
messages is to provide feedback about problems in
the communication environment, not to make IP
reliable.
8
Properties of ICMP Packets
There are still no guarantees that a datagram will
be delivered or a ICMP control message will be
returned.
Some datagrams may still be undelivered without
any report of their loss. The higher level protocols
that use IP must implement their own reliability
procedures if reliable communication is required.
The ICMP messages typically report errors in the
processing of datagrams. To avoid the infinite
regress of messages about messages etc., no
ICMP messages are sent about ICMP messages.
9
ICMP Types

10
Routing Table
Router Interface
eth1 eth0 card
180.2.3.*
180.2.3.9 172.16.55.100

172.16.55.0 Internet
R
172.16.55.36

172.16.55.1
172.16.50.0 R

H
172.16.50.12
R : Router
H : Host 172.16.55.3
11
 A Routing Table Used in the
Previous Slide
Destination Gateway Genmask Flags Metric Ref Use I_face
172.16.55.3 0.0.0.0 255.255.255.255 UH eth0
172.16.55.0 0.0.0.0 255.255.255.0 U eth0
172.16.50.0 172.16.55.36 255.255.255.0 UG eth0
180.2.3.0 0.0.0.0 255.255.255.0 U eth1
127.0.0.0 0.0.0.0 255.0.0.0 U lo
0.0.0.0 172.16.55.1 0.0.0.0 UG eth0
U : useful
default Flag H : to a single host
G : to a gateway

•A destination IP performs and operation with the Genmask and

compares the result with the Destination field. The first
interface matching will be used to transfer the packet.

12
UDP Header Format

The length in bytes of the UDP header and

the encapsulated data. The minimum value
for this field is 8.

13
TCP Header Format

14
Control Bits in a TCP Header

15
TCP Sliding Windows
For each TCP connection each hosts keep two
Sliding Windows,
send sliding window, and
receive sliding window
to make sure the correct transmission of Traffic
between the send and receiver.
Each byte sent from the sender to the receiver has
a unique sequence number associated with it.

16
Three-way Handshaking
Client Server

SYN (seq# = x)

SYN / ACK

ack# = x+1
seq# = y

ACK (seq# = x ; ack# = y+1)

17
Making a TCP Connection through
a Socket
Server Client

Socket () Socket ()

Bind () Connection ()

Listen () Write ()
Data request
Accept () Read ()
Block until connection
request from client

Read () Data reply

Process request
Write () 18
TCP Session Hijacking

19
TCP Session Hijacking
TCP session hijacking is when a hacker
takes over a TCP session between two
machines.
Since most authentication only occurs at the
start of a TCP session, this allows the
hacker to gain access to a machine.

20
Categories of TCP Session Hijacking
Based on the anticipation of sequence
numbers there are two types of TCP
hijacking:
Man-in-the-middle (MITM)
Blind Hijack

21
Man-in-the-middle (MITM)
A hacker can also be "inline" between B
and C using a sniffing program to watch
the sequence numbers and acknowledge
numbers in the IP packets transmitted
between B and C. And then hijack the
connection.
This is known as a "man-in-the-middle
attack".

22
Man in the Middle Attack Using
Packet Sniffers
This technique involves using a packet
sniffer to intercept the communication
between client and the server.
Packet sniffer comes in two categories:
Active sniffers
Passive sniffers.

23
Passive Sniffers
Passive sniffers monitors and sniffs packet
from a network having same collision
domain (i.e. network with a hub, as all
packets are broadcasted on each port of
hub.)

24
Active Sniffers
One way of doing so is to change the default
gateway of the client’s machine so that it will
route its packets via the hijacker’s machine.
This can be done by ARP spoofing (i.e. by
sending malicious ARP packets mapping its MAC
address to the default gateways IP address so as to
update the ARP cache on the client, to redirect the
traffic to hijacker).

25
Blind Hijacking [Shray Kapoor]
If you are NOT able to sniff the packets and
guess the correct sequence number expected
by server, you have to implement “Blind
Session Hijacking.’’
You have to brute force 4 billion
combinations of sequence number which
will be an unreliable task.

26
Ways to Suppress a Hijacked Host to
Send Packets
A common way is to execute a Denial-of-Service
(DoS) attack against one end-point to stop it from
responding.
This attack can be either
• against the machine to force it to crash
or
• against the network connection to force heavy packet loss.

Send packets with commands that request the

recipient not to send back response.

27
MIMT Simulation

28
 TCP Session Hijacking
a 100

b
Host A Host B
c
600
d

f
g
Sending window
h
Receiving window

29
 TCP Session Hijacking
a

b
Host A Host B
c

f
g
Sending window
h
Receiving window

30
 TCP Session Hijacking
a

b
Host A Host B
c

f
g
attacker Sending window
h
Receiving window

31
 TCP Session Hijacking
a

b
Host A Host B
c

f
g
attacker Sending window
h
Receiving window

32
 TCP Session Hijacking
a

b RST
Host A Host B
c

f
g
attacker Sending window
h
Receiving window
Host A closes its socket due to receiving strange response
from Host B
33
 TCP Session Hijacking
a

b
Host A Host B
c Simulated Host B’s
sending window
d

f
Simulated Host A’s
sending window
g
Sending window
h
Receiving window
attacker
34
 TCP Session Hijacking:
Send forged packets to both end hosts and suppress end hosts
to create output and change both hosts’ receiving windows

b
Host A Host B
c
No change
No change
d

f
g
Sending window
h
Receiving window
attacker
35
 TCP Session Hijacking:
Then attackers take care of packets sent by both hosts.

b
Host A Host B
c
Simulated A’s
Receiving window
d
Simulated B’s
e Receiving window

f
g
Sending window
h
Receiving window
attacker
36
 TCP Session Hijacking:
However Host B will receive packets from Host A with
ACK number larger than its sending window.

b
Host A Host B
c

f
g
Sending window
h
Receiving window
attacker
37
TCP Session Hijacking Tools
T-Sight
Hunt
Juggernaut
… and so on.

38
TCP ACK Packet Storms
Assume that the attacker has forged the correct packet
information (headers, sequence numbers, and so on) at
some point during the session.
When the attacker sends to the server-injected session data, the
server will acknowledge the receipt of the data by sending to the
real client an ACK packet.
• This packet will most likely contain a sequence number that the client
is not expecting, so when the client receives this packet, it will try to
resynchronize the TCP session with the server by sending it an ACK
packet with the sequence number that it is expecting.
• This ACK packet will in turn contain a sequence number that the
server is not expecting, and so the server will resend its last ACK
packet.
• This cycle goes on and on and on, and this rapid passing back and
forth of ACK packets creates an ACK storm.

39
ACK Storm

40
Countermeasures - Encryption
The most effective is encryption such as IPSec.
Internet Protocol Security has the ability to encrypt your IP
packets based on a Pre-Shared Key or with more complex systems
like a Public Key Infrastructure PKI.
This will also defend against many other attack vectors such as
sniffing.
The attacker may be able to passively monitor your connection,
but they will not be able to read any data as it is all encrypted.
There might be actions an attacker could take against an IPSec
enabled network, depending on if they use IKE-PSK or PKI to
manage the encryption keys, but this would require an experienced
hacker.
• Don’t think that IPSec is the panacea to all your ills, there are IPSec
cracking tools available on the internet that will attempt to guess the
PSK and decrypt packets.

41
Countermeasures – Encrypted
Application
Other countermeasures include encrypted applications like
ssh (Secure SHell, an encrypted telnet) or ssl
(Secure Sockets Layer, HTTPS traffic).
Again this reflects back to using encryption, but a subtle
difference being that you are using the encryption within an
application.
Be aware though that there are known attacks against ssh and
ssl.
OWA, Outlook Web Access uses ssl to encrypt data between an
internet client browser and the Exchange mail server, but tools like
Cain & Abel can spoof the ssl certificate and mount a Man-
In-The-Middle (MITM) attack and decrypt everything!

42
ARP
The Address Resolution Protocol is used by each host on
an IP network to map local IP addresses to hardware
addresses or MAC addresses.
Here is a quick look at how this protocol works.
Say that Host A (IP address 192.168.1. 100) wants to send data to
Host B (IP address 192.168.1.250). No prior communications
have occurred between Hosts A and B, so the ARP table entries
for Host B on Host A are empty.
Host A broadcasts an ARP request packet indicating that the
owner of the IP address 192.168.1.250 should respond to Host A
at 192.168.1.100 with its MAC address. The broadcast packet is
sent to every machine in the network segment, and only the true
owner of the IP address 192.168.1.250 should respond.
All other hosts discard this request packet, but Host A receives an
ARP reply packet from Host B indicating that its MAC address is
BB:BB:BB:BB:BB:BB. Host A updates its ARP table, and can
now send data to Host B.
43
Finding the Owner of a MAC
Address

44
ARP Table Modifications
However Host A doesn’t know that Host B really
did send the ARP reply.
In the previous example, attackers could spoof an
ARP reply to Host A before Host B responded,
indicating that the hardware address
E0:E0:E0:E0:E0:E0 corresponds to Host B's
IP address.
Host A would then send any traffic intended for Host B
to the attacker, and the attacker could choose to forward
that data (probably after some tampering) to Host B.

45
Spoofed Reply

46
Handling TCP ACK Storms
Attackers can also use ARP packet manipulation to quiet
TCP ACK storms, which are noisy and easily detected by
devices such as intrusion detection system (IDS) sensors.
Session hijacking tools such as hunt accomplish this by
sending unsolicited ARP replies. Most systems will accept
these packets and update their ARP tables with whatever
information is provided.
In our Host A/Host B example, an attacker could send Host A a
spoofed ARP reply indicating that Host B's MAC address is
something nonexistent (like C0:C0:C0:C0:C0:C0), and send
Host B another spoofed ARP reply indicating that Host A's MAC
address is also something nonexistent (such as
D0:D0:D0:D0:D0:D0). Any ACK packets between Host A and
Host B that could cause a TCP ACK storm during a network-level
session hijacking attack are sent to invalid MAC addresses and lost.
47
Stopping a TCP ACK Storm

48