INTERNET PROTOCOL SPOOFING
What is an Internet Protocol?
I am sure people would have come across this term called Internet Protocol very often. Just to start with i will just brief about these basic terminologies before we get into the crux. An Internet Protocol (IP) is nothing but a numerical label assigned to each device. The main purpose of using this IP is for communication. There are two main functions assigned to this IP address.
1. It helps to identify the host.
2.It is used for location addressing.
There are two main types of IP address. They are IPv4 and IPv6. The IPv4 which is still being used is a 32 bit number. The IPv6 uses a 128 bit number. An IP address is a binary number but it is stored in text files and displayed in human readable notations such as 172.16.254.1 (for IPv4), and 2001:db8:0:1234:0:567:8:1 (for IPv6). There are a lot more concepts associated with the Internet Protocol but these are the basic things that are meant to be known.
What is IP Spoofing?
IP address spoofing is the creation of Internet Protocol (IP) packets with a forged source IP address, with the purpose of concealing the identity of the sender or impersonating another computing system. This eventually helps in getting unauthorized access. This attack is based on the fact that the communication between distant computers is handled by routers which examines the destination address but ignores the origin address. In the spoofing attack, the middle man sends a message to the computer and tries to indicate that the message has come from a trusted source. First, the middle man must have identified the Internet Protocol address of the trusted system so that he can modify the packet headers and create an illusion that they are really coming from a trusted system. If the destination system is fooled by the middle man he can easily gain root access to the host and he can create a backdoor path to attack the system eventually.
Some attacks involving IP Spoofing:
Man in the middle attack:
This is a very common attack that everyone of us are aware. Let me just brief you about this attack with the typical example.
1. Alice sends a message to Bob, which is intercepted by Mallory:
Alice "Hi Bob, it's Alice. Give me your key"--> Mallory Bob
2. Mallory relays this message to Bob; Bob cannot tell it is not really from Alice:
Alice Mallory "Hi Bob, it's Alice. Give me your key"--> Bob
3. Bob responds with his encryption key:
Alice Mallory <--[Bob's_key] Bob
4. Mallory replaces Bob's key with her own, and relays this to Alice, claiming that it is Bob's key:
Alice <--[Mallory's_key] Mallory Bob
5. Alice encrypts a message with what she believes to be Bob's key, thinking that only Bob can read it:
Alice "Meet me at the bus stop!"[encrypted with Mallory's key]--> Mallory Bob
6. However, because it was actually encrypted with Mallory's key, Mallory can decrypt it, read it, modify it (if desired), re-encrypt with Bob's key, and forward it to Bob:
Alice Mallory "Meet me at 22nd Ave!"[encrypted with Bob's key]--> Bob
7. Bob thinks that this message is a secure communication from Alice.
Router re-direct:
It is almost a part of the man in the middle attack. Here the routing information is redirected from the original host to the hacker's host.
Source routing:
It allows a sender of a packet to partially or completely specify the route the packet takes through the network.
Blind spoofing:
Attackers usually send several packets to a target in order to predict sequence numbers. Most sequence numbers are randomly generated, so Blind Spoofing is typically only effective if a sequence number is compromised. There is very less chance of an immediate feedback.
Flooding:
A SYN flood is a form of DOS attack in which an attacker sends a succession of
SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.Basic things to be done:
- The victim must be selected first.
- The attacker must make sure that he is considered to be a trusted source.
- The trusted host must be disabled and the victim's TCP sequence numbers are sampled.
- The sequence numbers are forged and the trusted source is pretended to be.
- A connection is to be made where there is no username or password authentication. If the connection is successful, the backdoor is created.
Gaining the root access is the main crux of IP spoofing. Only if the root access is gained in the victim's system can be played with by installing Trojans, modifying some existing data etc..
Why is IP Spoofing called 'BLIND'?
In one line, it is called blind because the victim assumes the middle man to be a trusted source. The IP data grams containing the forged IP addresses will reach the victim with no issues because IP is basically a connection-less protocol which does not need any handshaking. However the datagrams sent from the victim's system ends up in the bit stack which the middle man cannot see. Once the datagrams are routed the message gets demultiplexed in the protocol stack and it will get discarded on reaching the TCP. [The attacker cannot “see” what the target host sends, but based on the handshaking procedure, an attacker can predict what the target host will send in response. Knowing both what has been sent and what the response will be eliminates the need to actually “see” the response. This allows the attacker to work in the “blind” and manipulate the system].
Host disabling:
To pretend to be the trusted host, the middle man must first disable the host and make sure that no traffic goes to the trusted host. The common method used to do this is SYN Flooding. The attacking host sends multiple SYN requests to the target (in this instance the trusted host) to load up the TCP queue with pending connections. The attacking host must also ensure that the source IP-address is spoofed and select a different, currently unreachable host, as this is where the target TCP will be sending it’s response. The reason that it must be unreachable is to prevent any host from receiving the SYN/ACKS sent by the system under attack. This would result in a RST (resend) being sent back to the system under attack, foiling the attack. The target responds with SYN/ACKS to the spoofed IP address and once the queue limit is reached, all other requests to this TCP port will be ignored. This effectively disables the “trusted host” and allows the attacker to proceed with impersonating the “trusted host”.
Packet Sequence Sampling:
The attacker must next determine where in the 32 bit sequence number space the targets TCP is located. The attacker then connects to a TCP port on the target just prior to starting an attack and completes the three-way handshake, making sure that the initial sequence number is recorded. This process is repeated several times to determine the Round Trip Time and the final ISN retained. The RTT is necessary to predict the next ISN.
Pretending to be the Trusted Host:
If the intial steps are correct and all the response favours the middle man then the SYN/ACK will be dropped by the incapacitated “trusted” host. The attacker must then wait to give the “trusted” host
time to send the SYN/ACK. Then the attacker sends an ACK to the target server with the predicted
sequence number (plus one, to accommodate the ACK). If the calculations are correct, the target server will accept the ACK.
The target has been compromised.
References:
Bing, Wikipedia.
No comments:
Post a Comment