Network Security

Network Attacks and Mitigation

張晃崚 CCIE #13673, CCSI #31340

區域銷售事業處 副處長
麟瑞科技
Types of Network
Attacks
Types of Network Attacks

Attacks that require less intelligence about the target network:

• Reconnaissance
• Access attacks
• DoS and distributed DoS
Types of Network Attacks (Cont.)

Attacks that typically require

more intelligence or insider
access:
• Worms, viruses, and Trojan horses
• Application layer attacks
• Threats to management protocols
Reconnaissance
Attacks and Mitigation
Reconnaissance Attacks and Mitigation

• Reconnaissance refers to the overall act of learning

information about a target network by using readily available
information and applications.
• Reconnaissance attacks include:
– Packet sniffers
– Port scans
– Ping sweeps
– Internet information queries
Packet Sniffers

• A packet sniffer is a software application that uses a network adapter card in promiscuous
mode to capture all network packets.
• Packet sniffers:
– Exploit information passed in plaintext. Protocols that pass information in plaintext are
Telnet, FTP, SNMP, POP, and HTTP.
– Must be on the same collision domain.
– Used legitimately, or can be designed specifically for attack.
Packet Sniffer Mitigation

The mitigation techniques and tools include:

• Authentication
• Cryptography
• Antisniffer tools
• Switched infrastructure
Port Scans and Ping Sweeps

Port scans and ping

sweeps attempt to
identify:
• All services
• All hosts and devices
• The operating systems
• Vulnerabilities
Port Scan and Ping Sweep Mitigation

• Port scans and ping sweeps cannot be prevented without

compromising network capabilities.
• However, damage can be mitigated using intrusion
prevention systems at network and host levels.
 Internet Information Queries

Sample IP address query

• Attackers can use Internet tools

such as “WHOIS” as weapons.
Access Attacks and
Mitigation
Access Attacks

• Intruders use access attacks on networks or systems for these reasons:

– Retrieve data
– Gain access
– Escalate their access privileges
• Access attacks include:
– Password attacks
– Trust exploitation
– Port redirection
– Man-in-the-middle attacks
– Buffer overflow
Password Attacks

Hackers implement
password attacks using
the following:
• Brute-force attacks
• Trojan horse programs
• IP spoofing
• Packet sniffers
 Password Attack Example

• L0phtCrack takes
the hashes of
passwords and
generates the
plaintext passwords
from them.
• Passwords are
compromised using
one of two methods:
– Dictionary
cracking
– Brute-force
computation
Password Attack Mitigation

Password attack mitigation techniques:

• Do not allow users to use the same password on multiple
systems.
• Disable accounts after a certain number of unsuccessful
login attempts.
• Do not use plaintext passwords.
• Use “strong” passwords. (Use “mY8!Rthd8y” rather than
“mybirthday”)
Trust Exploitation

• A hacker leverages existing trust relationships.

• Several trust models exist:
– Windows:
• Domains
• Active directory
– Linux and UNIX:
• NIS
• NIS+
Trust Exploitation Attack Mitigation
Port Redirection
Man-in-the-Middle Attacks
and Their Mitigation

• A man-in-the-middle attack requires that the hacker have access to network packets
that come across a network.
• A man-in-the-middle attack is implemented using the following:
– Network packet sniffers
– Routing and transport protocols
• Man-in-the-middle attacks can be effectively mitigated only through the use of
cryptographic encryption.
DoS Attacks and
Mitigation
DoS Attacks and Mitigation

• A DoS attack damages or corrupts your computer system or

denies you and others access to your networks, systems, or
services.
• Distributed DoS technique performs simultanous attacks
from many distributed sources.
• DoS and Distributed DoS attacks can use IP spoofing.
Distributed DoS Attacks

• DoS and distributed DoS attacks focus on making a service

unavailable for normal use.
• DoS and distributed DoS attacks have these characteristics:
– Generally not targeted at gaining access to your network
or the information on your network
– Require very little effort to execute
– Difficult to eliminate, but their damage can be minimized
Distributed DoS Example
DoS and Distributed DoS Attack Mitigation

The threat of DoS attacks can be reduced using:

• Anti-spoof features on routers and firewalls
• Anti-DoS features on routers and firewalls
• Traffic rate limiting at the ISP level
IP Spoofing in DoS and Distributed DoS

• IP spoofing occurs when a hacker inside or outside a network

impersonates the conversations of a trusted computer.
• IP spoofing can use either a trusted IP address in the network
or a trusted external IP address.
• Uses for IP spoofing include:
– Injecting malicious data or commands into an existing data
stream
– Diverting all network packets to the hacker who can then
reply as a trusted user by changing the routing tables
• IP spoofing may only be one step in a larger attack.
IP Spoofing Attack Mitigation

The threat of IP spoofing can be reduced, but not

eliminated, using these measures:
• Access control configuration
• Encryption
• RFC 3704 filtering
• Additional authentication requirement that does not use IP
address-based authentication; examples are:
– Cryptographic (recommended)
– Strong, two-factor, one-time passwords
Management
Protocols and
Vulnerabilities
Configuration Management

• Configuration management protocols include SSH, SSL, and

Telnet.
• Telnet issues include:
– The data within a Telnet session is sent as plaintext.
– The data may include sensitive information.
Configuration Management
Recommendations

These practices are recommended:

• Use IPSec, SSH, SSL, or any other encrypted and
authenticated transport.
• ACLs should be configured to allow only management
servers to connect to the device. All attempts from other IP
addresses should be denied and logged.
• RFC 3704 filtering at the perimeter router should be used to
mitigate the chance of an outside attacker spoofing the
addresses of the management hosts.
Management Protocols

These management protocols can be compromised:

• SNMP: The community string information for simple
authentication is sent in plaintext.
• syslog: Data is sent as plaintext between the managed
device and the management host.
• TFTP: Data is sent as plaintext between the requesting host
and the TFTP server.
• NTP: Many NTP servers on the Internet do not require any
authentication of peers.
Management Protocol Best Practices

Management
Recommendations
Protocol
SNMP • Configure SNMP with only read-only community strings.
• Set up access control on the device you wish to manage.
• Use SNMP version 3.
Syslog • Encrypt syslog traffic within an IPsec tunnel.
• Implement RFC 3704 filtering.
• Set up access control on the firewall.
TFTP • Encrypt TFTP traffic within an IPsec tunnel.
NTP • Implement your own master clock.
• Use NTP version 3 or above.
• Set up access control that specifies which network devices
are allowed to synchronize with other network devices.
Determining
Vulnerabilities and
Threats
Determining Vulnerabilities and Threats

The following tools are useful when determining

general network vulnerabilities:
• Blue’s PortScanner
• Ethereal
• Microsoft Baseline Security Analyzer
• Nmap
 Blue’s Port Scanner and Ethereal

Blue’s
PortScanner

Ethereal
Microsoft Baseline Security Analyzer
Vulnerable Router
Services and
Interfaces
Vulnerable Router Services and Interfaces

• Cisco IOS routers can be used as:

– Edge devices
– Firewalls
– Internal routers
• Default services that create potential vulnerabilities (e.g., BOOTP, CDP, FTP, TFTP, NTP, Finger,
SNMP, TCP/UDP minor services, IP source routing, and proxy ARP).
• Vulnerabilities can be exploited independently of the router placement.
Vulnerable Router Services

• Disable unnecessary services and interfaces (BOOTP, CDP,

FTP, TFTP, NTP, PAD, and TCP/UDP minor services)
• Disable commonly configured management services (SNMP,
HTTP, and DNS)
• Ensure path integrity (ICMP redirects and IP source routing)
• Disable probes and scans (finger, ICMP unreachables, and
ICMP mask replies)
• Ensure terminal access security (ident and TCP keepalives)
• Disable gratuitous and proxy ARP
• Disable IP directed broadcast
Router Hardening Considerations

• Attackers can exploit unused router services and interfaces.

• Administrators do not need to know how to exploit the
services, but they should know how to disable them.
• It is tedious to disable the services individually.
• An automated method is needed to speed up the hardening
process.
Minimizing Service Loss and Data Theft in a Campus Network

Understanding Switch Security Issues

Overview of Switch Security
Rogue Access Points

• Rogue network
devices can be:
– Wireless hubs
– Wireless routers
– Access switches
– Hubs
• These devices are
typically connected
at access level
switches.
Switch Attack Categories

• MAC layer attacks

• VLAN attacks
• Spoofing attacks
• Attacks on switch devices
MAC Flooding Attack
Port Security

Port security restricts port access by MAC address.

 802.1x Port-Based Authentication

Network access through switch requires authentication.

Minimizing Service Loss and Data Theft in a Campus Network

Protecting Against Spoof Attacks

DHCP Spoof Attacks

• Attacker activates DHCP

server on VLAN.
• Attacker replies to valid
client DHCP requests.
• Attacker assigns IP
configuration information
that establishes rogue
device as client default
gateway.
• Attacker establishes “man-
in-the-middle” attack.
DHCP Snooping

• DHCP snooping allows

the configuration of
ports as trusted or
untrusted.
• Untrusted ports cannot
process DHCP replies.
• Configure DHCP
snooping on uplinks to a
DHCP server.
• Do not configure DHCP
snooping on client ports.
IP Source Guard

IP source guard is configured on

untrusted L2 interfaces
ARP Spoofing
 Dynamic ARP Inspection

• DAI associates each interface

with a trusted state or an
untrusted state.
• Trusted interfaces bypass all
DAI.
• Untrusted interfaces undergo
DAI validation.
Protection from ARP Spoofing

• Configure to protect
against rogue DHCP
servers.
• Configure for dynamic
ARP inspection.