How do attackers use "IP address spoofing" to break through firewall systems?
General access control is mainly configured in the firewall, with some security policies set up: for example, resources on the internal LAN are not allowed to be used by users on external networks; the unprotected zone (also called the demilitarized zone) may belong to the internal or external LAN, and the resources in it are allowed to be used by users on the external network to a limited extent; external users may be allowed to access the WEB server in the demilitarized zone (DMZ), and so on. By analyzing and studying firewall technology in depth and making use of loopholes in firewall configuration and implementation, it is possible to attack it. Usually, effective attacks are carried out from related subnets, because those addresses are trusted by the firewall. Although whether it succeeds still depends on luck and other factors, it is well worth a try for an attacker.
The most commonly used method for breaking through firewall systems is IP address spoofing, and it is also the basis of a whole series of other attack methods. The reason this method is used is because of IP's own shortcomings. The IP protocol sends IP packets according to the destination address field in the IP header. If the destination address is an address within the local network, that IP packet is sent directly to the destination. If the destination address is not within the local network, the IP packet is sent to the gateway, and the gateway then decides where to send it. This is how IP routes IP packets. When routing IP packets, IP does not perform any checking on the IP source address provided in the IP header, and assumes that the IP source address in the IP header is the IP address of the machine that sent the packet. When the destination host that receives the packet needs to communicate with the source host, it uses the IP source address in the IP header of the received packet as the destination address of the IP packet it sends, in order to carry out data communication with the source host. Although this method of data communication in IP is very simple and efficient, it is also a security risk in IP. Many network security incidents are caused by this shortcoming of IP.
Hackers or intruders use forged IP sending addresses to generate fake data packets, disguising themselves as packet filters from internal sites. This type of attack is extremely dangerous. All signs that might indicate whether the packets involved are truly internal packets or external packets made to look like internal ones are lost completely. As long as the system finds that the sending address is within its own range, it treats the packet as internal communication and lets it pass.
Normally, a TCP connection from host A to host B (with or without a firewall in between) is established by host A making a request to host B, while the acknowledgments between A and B are based only on the Initial Sequence Number, ISN, generated by host A and verified by host B. Specifically, it is divided into three steps:
Host A generates its ISN and sends it to host B, requesting that a connection be established; after B receives the ISN with the SYN flag from A, it returns its own ISN together with the acknowledgment information ACK to A; A then returns the ISN and acknowledgment information ACK sent by B back to B. At this point, under normal circumstances, the TCP connection between host A and B is established.
B ---- SYN ----> A
B A
Suppose C is trying to attack A. Since A and B trust each other, if C already knows B, which is trusted by A, then it must find some way to cripple B's network functions and prevent anything else from interfering with its own attack. What is commonly used here is SYN flood. The attacker sends many TCP-SYN packets to the target host. The source address of these TCP-SYN packets is not the IP address of the attacker's own host, but an IP address filled in by the attacker himself. After the target host receives the TCP-SYN packets sent by the attacker, it allocates certain resources for a TCP connection, and uses the source address in the received packet (that is, the forged IP address filled in by the attacker) as the destination address to send a TCP-(SYN+ACK) response packet to the destination host. Since the IP address forged by the attacker is certain to be a carefully chosen nonexistent address, the target host can never receive a reply to the TCP-(SYN+ACK) packet it sent out, and thus the TCP state machine of the target host remains in a waiting state. If the TCP state machine of the target host has timeout control, the resources allocated for that connection will not be reclaimed until the timeout occurs. Therefore, if the attacker sends enough TCP-SYN packets to the target host, and fast enough, the TCP module of the target host will certainly enter a denial-of-service state because it cannot allocate system resources for new TCP connections. Moreover, even if the administrator of the network where the target host is located monitors the attacker's packets, it is still impossible to determine who the attacker is from the source address information in the IP header.
When B's network function is temporarily crippled, C must now somehow determine A's current ISN. First connect to port 25, because SMTP has no security verification mechanism. It is similar to what was described above, except that this time A's ISN must be recorded, as well as the approximate RTT (round trip time) from C to A. This step must be repeated many times in order to calculate the average RTT. Once C knows the base value of A's ISN and its pattern of increase, it can calculate the time needed for RTT/2 from C to A. Then it must immediately move into the attack, otherwise if some other host connects to A in the meantime, the ISN will be greater than expected.
C sends a data segment with the SYN flag to A requesting a connection, except that the source IP is changed to B. A sends a SYN+ACK segment back to B. B is already unable to respond, and B's TCP layer simply discards the returned segment from A. At this point C needs to pause briefly, giving A enough time to send SYN+ACK, because C cannot see that packet. Then C again pretends to be B and sends ACK to A; this time the sent data segment carries Z's predicted A ISN+1. If the prediction is accurate, the connection is established and data transmission begins. The problem is that even if the connection is established, A still sends data to B, not C. C still cannot see the segments that A sends to B. C must blindly impersonate B and send commands to A according to the protocol standard, and thus the attack is completed. If the prediction is inaccurate, A sends a data segment with the RST flag and abnormally terminates the connection, and C can only start over from the beginning. By constantly correcting the predicted ISN, the attacker will eventually establish a session with the target host. In this way, the attacker logs in to the target host as a legitimate user without needing further verification. If repeated trials make it possible for the target host to accept ROOT logins from the network, then the entire network can be completely controlled.
C(B) ---- SYN ----> A
B A
C(B) ---- PSH ----> A
IP spoofing attacks take advantage of the fact that RPC servers rely only on the source IP address for security verification. The most difficult part of the attack lies in predicting A's ISN. The attack is fairly difficult, but the possibility of success is also quite high. C must accurately foresee what information A might send to B, and what acknowledgment information A expects from B, which requires the attacker to be quite familiar with the protocol itself. At the same time, it should be understood that this kind of attack simply cannot be completed in an interactive state; a program must be written to carry it out. Of course, in the preparation stage, tools such as netxray can be used for protocol analysis.
Although IP spoofing attacks are quite difficult, we should clearly realize that this kind of attack is very widespread, and intrusion often starts here. Preventing this kind of attack is still relatively easy. The security risks caused by IP's own flaws cannot currently be fundamentally eliminated. We can only take some compensating measures to reduce the harm it causes to the minimum possible extent. The most ideal method of defense against this kind of attack is this: before each gateway or router connected to a LAN decides whether to allow external IP packets to enter the LAN, it first checks the external IP packets. If the IP source address of such a packet is an IP address within the LAN it is trying to enter, the packet is rejected by the gateway or router and is not allowed to enter the LAN. Although this method can solve the problem quite well, considering that some Ethernet cards receive packets sent by themselves, and that in practical applications trust relationships are often needed between LANs as well in order to share resources, this solution does not have very good practical value. Another relatively ideal defense method is to check the IP source address when IP packets leave the LAN. That is, before each gateway or router connected to a LAN decides whether to allow IP packets from within the LAN to leave the LAN, it first checks the IP source address of that IP packet. If the IP source address of the packet is not an IP address within the LAN it belongs to, the packet is rejected by the gateway or router and is not allowed to leave the LAN. In this way, an attacker must at least use an IP address within the LAN where he is located in order to pass through the gateway or router connected to that LAN. If the attacker launches an attack, it will then be easy to find who carried out the attack based on the IP source address of the IP packets he sends. Therefore it is recommended that every ISP or LAN gateway router inspect and filter the IP source addresses of outgoing IP packets. If every gateway router does this, IP source address spoofing will basically become ineffective. Under current conditions, where not every gateway and router can do this, network administrators can only keep the networks they manage under the tightest possible surveillance in order to guard against possible attacks.
General access control is mainly configured in the firewall, with some security policies set up: for example, resources on the internal LAN are not allowed to be used by users on external networks; the unprotected zone (also called the demilitarized zone) may belong to the internal or external LAN, and the resources in it are allowed to be used by users on the external network to a limited extent; external users may be allowed to access the WEB server in the demilitarized zone (DMZ), and so on. By analyzing and studying firewall technology in depth and making use of loopholes in firewall configuration and implementation, it is possible to attack it. Usually, effective attacks are carried out from related subnets, because those addresses are trusted by the firewall. Although whether it succeeds still depends on luck and other factors, it is well worth a try for an attacker.
The most commonly used method for breaking through firewall systems is IP address spoofing, and it is also the basis of a whole series of other attack methods. The reason this method is used is because of IP's own shortcomings. The IP protocol sends IP packets according to the destination address field in the IP header. If the destination address is an address within the local network, that IP packet is sent directly to the destination. If the destination address is not within the local network, the IP packet is sent to the gateway, and the gateway then decides where to send it. This is how IP routes IP packets. When routing IP packets, IP does not perform any checking on the IP source address provided in the IP header, and assumes that the IP source address in the IP header is the IP address of the machine that sent the packet. When the destination host that receives the packet needs to communicate with the source host, it uses the IP source address in the IP header of the received packet as the destination address of the IP packet it sends, in order to carry out data communication with the source host. Although this method of data communication in IP is very simple and efficient, it is also a security risk in IP. Many network security incidents are caused by this shortcoming of IP.
Hackers or intruders use forged IP sending addresses to generate fake data packets, disguising themselves as packet filters from internal sites. This type of attack is extremely dangerous. All signs that might indicate whether the packets involved are truly internal packets or external packets made to look like internal ones are lost completely. As long as the system finds that the sending address is within its own range, it treats the packet as internal communication and lets it pass.
Normally, a TCP connection from host A to host B (with or without a firewall in between) is established by host A making a request to host B, while the acknowledgments between A and B are based only on the Initial Sequence Number, ISN, generated by host A and verified by host B. Specifically, it is divided into three steps:
Host A generates its ISN and sends it to host B, requesting that a connection be established; after B receives the ISN with the SYN flag from A, it returns its own ISN together with the acknowledgment information ACK to A; A then returns the ISN and acknowledgment information ACK sent by B back to B. At this point, under normal circumstances, the TCP connection between host A and B is established.
B ---- SYN ----> A
B A
Suppose C is trying to attack A. Since A and B trust each other, if C already knows B, which is trusted by A, then it must find some way to cripple B's network functions and prevent anything else from interfering with its own attack. What is commonly used here is SYN flood. The attacker sends many TCP-SYN packets to the target host. The source address of these TCP-SYN packets is not the IP address of the attacker's own host, but an IP address filled in by the attacker himself. After the target host receives the TCP-SYN packets sent by the attacker, it allocates certain resources for a TCP connection, and uses the source address in the received packet (that is, the forged IP address filled in by the attacker) as the destination address to send a TCP-(SYN+ACK) response packet to the destination host. Since the IP address forged by the attacker is certain to be a carefully chosen nonexistent address, the target host can never receive a reply to the TCP-(SYN+ACK) packet it sent out, and thus the TCP state machine of the target host remains in a waiting state. If the TCP state machine of the target host has timeout control, the resources allocated for that connection will not be reclaimed until the timeout occurs. Therefore, if the attacker sends enough TCP-SYN packets to the target host, and fast enough, the TCP module of the target host will certainly enter a denial-of-service state because it cannot allocate system resources for new TCP connections. Moreover, even if the administrator of the network where the target host is located monitors the attacker's packets, it is still impossible to determine who the attacker is from the source address information in the IP header.
When B's network function is temporarily crippled, C must now somehow determine A's current ISN. First connect to port 25, because SMTP has no security verification mechanism. It is similar to what was described above, except that this time A's ISN must be recorded, as well as the approximate RTT (round trip time) from C to A. This step must be repeated many times in order to calculate the average RTT. Once C knows the base value of A's ISN and its pattern of increase, it can calculate the time needed for RTT/2 from C to A. Then it must immediately move into the attack, otherwise if some other host connects to A in the meantime, the ISN will be greater than expected.
C sends a data segment with the SYN flag to A requesting a connection, except that the source IP is changed to B. A sends a SYN+ACK segment back to B. B is already unable to respond, and B's TCP layer simply discards the returned segment from A. At this point C needs to pause briefly, giving A enough time to send SYN+ACK, because C cannot see that packet. Then C again pretends to be B and sends ACK to A; this time the sent data segment carries Z's predicted A ISN+1. If the prediction is accurate, the connection is established and data transmission begins. The problem is that even if the connection is established, A still sends data to B, not C. C still cannot see the segments that A sends to B. C must blindly impersonate B and send commands to A according to the protocol standard, and thus the attack is completed. If the prediction is inaccurate, A sends a data segment with the RST flag and abnormally terminates the connection, and C can only start over from the beginning. By constantly correcting the predicted ISN, the attacker will eventually establish a session with the target host. In this way, the attacker logs in to the target host as a legitimate user without needing further verification. If repeated trials make it possible for the target host to accept ROOT logins from the network, then the entire network can be completely controlled.
C(B) ---- SYN ----> A
B A
C(B) ---- PSH ----> A
IP spoofing attacks take advantage of the fact that RPC servers rely only on the source IP address for security verification. The most difficult part of the attack lies in predicting A's ISN. The attack is fairly difficult, but the possibility of success is also quite high. C must accurately foresee what information A might send to B, and what acknowledgment information A expects from B, which requires the attacker to be quite familiar with the protocol itself. At the same time, it should be understood that this kind of attack simply cannot be completed in an interactive state; a program must be written to carry it out. Of course, in the preparation stage, tools such as netxray can be used for protocol analysis.
Although IP spoofing attacks are quite difficult, we should clearly realize that this kind of attack is very widespread, and intrusion often starts here. Preventing this kind of attack is still relatively easy. The security risks caused by IP's own flaws cannot currently be fundamentally eliminated. We can only take some compensating measures to reduce the harm it causes to the minimum possible extent. The most ideal method of defense against this kind of attack is this: before each gateway or router connected to a LAN decides whether to allow external IP packets to enter the LAN, it first checks the external IP packets. If the IP source address of such a packet is an IP address within the LAN it is trying to enter, the packet is rejected by the gateway or router and is not allowed to enter the LAN. Although this method can solve the problem quite well, considering that some Ethernet cards receive packets sent by themselves, and that in practical applications trust relationships are often needed between LANs as well in order to share resources, this solution does not have very good practical value. Another relatively ideal defense method is to check the IP source address when IP packets leave the LAN. That is, before each gateway or router connected to a LAN decides whether to allow IP packets from within the LAN to leave the LAN, it first checks the IP source address of that IP packet. If the IP source address of the packet is not an IP address within the LAN it belongs to, the packet is rejected by the gateway or router and is not allowed to leave the LAN. In this way, an attacker must at least use an IP address within the LAN where he is located in order to pass through the gateway or router connected to that LAN. If the attacker launches an attack, it will then be easy to find who carried out the attack based on the IP source address of the IP packets he sends. Therefore it is recommended that every ISP or LAN gateway router inspect and filter the IP source addresses of outgoing IP packets. If every gateway router does this, IP source address spoofing will basically become ineffective. Under current conditions, where not every gateway and router can do this, network administrators can only keep the networks they manage under the tightest possible surveillance in order to guard against possible attacks.
C++C++C++C++C++C++C++C++C++C++C++C++C++C++C++
C++ ☆☆☆ 中国ＤＯＳ联盟成员 ☆☆☆ C++
C++ ★★★ 爱提问的红色狂想 ★★★ C++
C++C++C++C++C++C++C++C++C++C++C++C++C++C++C++
C++ ☆☆☆ 中国ＤＯＳ联盟成员 ☆☆☆ C++
C++ ★★★ 爱提问的红色狂想 ★★★ C++
C++C++C++C++C++C++C++C++C++C++C++C++C++C++C++