Bảo mật hệ thống mạng part ppt

CHAPTER
2
Types of Attacks
15
Copyright 2001 The McGraw-Hill Companies, Inc. Click Here for Terms of Use.
B
ad things can happen to an organization’s information or computer systems in
many ways. Some of these bad things are done on purpose (maliciously) and others
occur by accident. No matter why the event occurs, damage is done to the organiza
-
tion. Because of this, we will call all of these events “attacks” regardless of whether there
was malicious intent or not.
There are four primary categories of attacks:
▼
Access
■
Modification
■
Denial of service
▲
Repudiation
We will cover each of these in detail in the following sections.
Attacks may occur through technical means (a vulnerability in a computer system) or
they may occur through social engineering. Social engineering is simply the use of
non-technical means to gain unauthorized access—for example, making phone calls or
walking into a facility and pretending to be an employee. Social engineering attacks may
be the most devastating.
Attacks against information in electronic form have another interesting characteristic:
information can be copied but it is normally not stolen. In other words, an attacker may
gain access to information, but the original owner of that information has not lost it. It just
now resides in both the original owner’s and the attacker’s hands. This is not to say that

damage is not done; however, it may be much harder to detect since the original owner is
not deprived of the information.
ACCESS ATTACKS
An access attack is an attempt to gain information that the attacker is unauthorized to see.
This attack can occur wherever the information resides or may exist during transmission
(see Figure 2-1). This type of attack is an attack against the confidentiality of the information.
Snooping
Snooping is looking through information files in the hopes of finding something interest
-
ing. If the files are on paper, an attacker may do this by opening a filing cabinet or file
drawer and searching through files. If the files are on a computer system, an attacker may
attempt to open one file after another until information is found.
Eavesdropping
When someone listens in on a conversation that they are not a part of, that is eavesdrop
-
ping. To gain unauthorized access to information, an attacker must position himself at a
16
Network Security: A Beginner’s Guide
location where information of interest is likely to pass by. This is most often done elec
-
tronically (see Figure 2-2).
Interception
Unlike eavesdropping, interception is an active attack against the information. When an
attacker intercepts information, she is inserting herself in the path of the information and
capturing it before it reaches its destination. After examining the information, the at
-
tacker may allow the information to continue to its destination or not (see Figure 2-3).
Chapter 2: Types of Attacks
17
Communications tower

Information in transit
over the Internet or
phone lines
Desktop computer
Fax
City
Information coming
off fax machines or
printers
Information on
local hard drives
Information on
file servers
Information stored on
media and left in the
office or on backups
taken off-site
Information on
paper in the office
Mainframe
Figure 2-1.
Places where access attacks can occur
18
Network Security: A Beginner’s Guide
How Access Attacks Are Accomplished
Access attacks take different forms depending on whether the information is stored on
paper or electronically in a computer system.
Information on Paper
If the information the attacker wishes to access exists in physical form on paper, he needs
to gain access to the paper. Paper records and information are likely to be found in the fol

-
lowing locations:
▼
In filing cabinets
■
In desk file drawers
■
On desktops
■
In fax machines
■
In printers
■
In the trash
▲
In long term storage
In order to snoop around the locations, the attacker needs physical access to them. If he’s
an employee, he may have access to rooms or offices that hold filing cabinets. Desk file draw
-
Figure 2-2.
Eavesdropping
ers may be in cubes or in unlocked offices. Fax machines and printers tend to be in public ar-
eas and people tend to leave paper on these devices. Even if offices are locked, trash and
recycling cans tend to be left in the hallways after business hours so they can be emptied.
Long-term storage may pose a more difficult problem, especially if the records are stored
off-site. Gaining access to the other site may not be possible if the site is owned by a vendor.
Precautions such as locks on filing cabinets may stop some snooping but a deter
-
mined attacker might look for an opportunity such as a cabinet left unlocked over lunch.
The locks on filing cabinets and desks are relatively simple locks and may be picked by

someone with knowledge of locks.
Physical access is the key to gaining access to physical records. Good site security may
prevent an outsider from accessing physical records but will likely not prevent an em
-
ployee or insider from gaining access.
Electronic Information
Electronic information may be stored:
▼
In desktop machines
■
In servers
■
On portable computers
Chapter 2: Types of Attacks
19
Desktop computer
Mainframe
Attacker’s computer
The attacker’s system sits in the
path of the traffic and captures it.
The attacker may choose to allow
the traffic to continue or not.
Traffic from the desktop to
the mainframe travels over
the local area network.
Figure 2-3.
Interception
■
On floppy disks
■

On CD-ROMs
▲
On backup tapes
In some of these cases, access can be achieved by physically stealing the storage media
(a floppy disk, CD-ROM, backup tape, or portable computer). It may be easier to do this
than to gain electronic access to the file at the organization’s facility.
If the files in question are on a system to which the attacker has legitimate access, the
files may be examined by simply opening them. If access control permissions are set
properly, the unauthorized individual should be denied access (and these attempts
should be logged). Correct permissions will prevent most casual snooping. However, a
determined attacker will attempt to either elevate his permissions so he can see the file or
to reduce the access controls on the file. There are many vulnerabilities on systems that
will allow this type of behavior to succeed.
Information in transit can be accessed by eavesdropping on the transmission. On lo
-
cal area networks, an attacker does this by installing a sniffer on a computer system con
-
nected to the network. A sniffer is a computer that is configured to capture all the traffic on
the network (not just traffic that is addressed to that computer). A sniffer can be installed
after an attacker has increased her privileges on a system or if the attacker is allowed
to connect her own system to the network (see Figure 2-2). Sniffers can be configured
to capture any information that travels over the network. Most often they are configured to
capture user IDs and passwords.
Eavesdropping can also occur on wide area networks (such as leased lines and
phone connections). However, this type of eavesdropping requires more knowledge
and equipment. In this case, the most likely location for the “tap” would be in the wir-
ing closet of the facility. Even fiber-optic transmission lines can be tapped. Tapping a
fiber-optic line requires even more specialized equipment and is not normally performed
by run-of-the-mill attackers.
Information access using interception is another difficult option for an attacker. To be

successful, the attacker must insert his system in the communication path between the
sender and the receiver of the information. On the Internet, this could be done by causing
a name resolution change (this would cause a computer name to resolve to an incorrect
address—see Figure 2-4). The traffic is then sent on to the attacker’s system instead of to
the real destination. If the attacker configures his system correctly, the sender or origina
-
tor of the traffic may never know that he was not talking to the real destination.
Interception can also be accomplished by an attacker taking over or capturing a ses
-
sion already in progress. This type of attack is best performed against interactive traffic
such as telnet. In this case, the attacker must be on the same network segment as either the
client or the server. The attacker allows the legitimate user to begin the session with the
server and then uses specialized software to take over the session already in progress.
This type of attack gives the attacker the same privileges on the server as the victim.
20
Network Security: A Beginner’s Guide
TEAMFLY

Team-Fly
®

Chapter 2: Types of Attacks
21
MODIFICATION ATTACKS
A modification attack is an attempt to modify information that an attacker is not autho
-
rized to modify. This attack can occur wherever the information resides. It may also be at
-
tempted against information in transit. This type of attack is an attack against the
integrity of the information.
Changes
One type of modification attack is to change existing information, such as an attacker
changing an existing employee’s salary. The information already existed in the organiza
-
tion but it is now incorrect. Change attacks can be targeted at sensitive information or
public information.
Figure 2-4.
Interception using incorrect name resolution information