§1.6Networks Under Attack

Malware

We attach devices to the Internet because we want to send and receive data. Along with everything useful, malware malware Simple Harmful software that enters your device from the Internet and does damage. Precise Malicious software that can enter and infect a device over the Internet, then delete files, install spyware that collects private information, or enrol the host in a botnet. Much malware is self-replicating and therefore spreads exponentially fast. introduced in ch. 1 — open in glossary can arrive and infect those devices.

Once it does, it can delete files. It can install spyware that collects private information — passwords, keystrokes, identification numbers — and sends it back over the Internet to the attacker. Your compromised host may also be enrolled into a botnet botnet Simple A large group of infected computers that one attacker controls together. Precise A network of thousands of similarly compromised devices which attackers control and leverage for spam e-mail distribution or distributed denial-of-service attacks against targeted hosts. introduced in ch. 1 — open in glossary . That is thousands of similarly compromised devices, controlled together by the attacker and used for spam distribution or for the distributed attacks described below.

Attacks on servers and network infrastructure

A DoS (Denial of Service) Denial of Service An attack that makes a network, host or service unusable by legitimate users. introduced in ch. 1 attack denial-of-service attack Simple An attack that floods or crashes a service so that real users cannot use it. Precise An attack that renders a network, host, or other piece of infrastructure unusable by legitimate users. Most fall into three categories: vulnerability attack, bandwidth flooding, and connection flooding. introduced in ch. 1 — open in glossary renders a network, host or other piece of infrastructure unusable by legitimate users. Web servers, e-mail servers, DNS (Domain Name System) Domain Name System Translates a human-friendly name such as www.ietf.org into a network address. introduced in ch. 1 servers and whole institutional networks can all be targets.

Most fall into one of three categories.

Why flooding became distributed

Look more closely at bandwidth flooding. If the victim’s server has an access rate of $R$ bits per second, the attacker must send traffic at about $R$ to cause damage.

That creates two problems for a single attacker:

• If $R$ is large, one attacking machine may simply be unable to generate enough traffic.
• If all the traffic comes from one source, an upstream router may detect the attack and block that source before the traffic gets near the server.

to clog the link, arriving traffic ≈ R
machines needed = R / rate per machine
                = 10.0 Gbps / 5.00 Mbps
                = 2,000 machines
no single source suffices, and traffic from 2,000 different addresses is far harder to tell from real users

Both problems disappear if the traffic comes from many machines at once.

Notice what the attacker’s own machine does in that diagram: it sends a short command, and nothing else. It never contacts the victim at all.

The book asks a question here and leaves it open for the whole book: what can network designers do to defend against these attacks? The answer differs for all three kinds, which is why the table above separates them.

Sniffing

Many people reach the Internet over WiFi (IEEE 802.11 wireless LAN) IEEE 802.11 wireless LAN Wireless LAN access; a user must be within a few tens of metres of the access point. WiFi is a trade name, not an abbreviation. introduced in ch. 1 or a cellular connection. That convenience creates a security problem, because radio is broadcast: placing a passive receiver near a wireless transmitter is enough to obtain a copy of every packet transmitted.

Those packets can contain passwords, identification numbers, trade secrets and private messages.

A passive receiver that records a copy of every packet that flies by is a packet sniffer packet sniffer Simple A passive listener that quietly copies every packet it can hear. Precise A passive receiver that records a copy of every packet that flies by, in a wireless channel or a wired broadcast environment such as an Ethernet LAN or a cable access network. Because sniffers do not inject packets, they are difficult to detect. introduced in ch. 1 — open in glossary .

Sniffers work in wired settings too. In wired broadcast environments — as in many Ethernet LAN (Local Area Network) Local Area Network A network covering one building, campus or home. introduced in ch. 1 s — a sniffer can obtain copies of the broadcast packets. Cable access technologies also broadcast packets, and are vulnerable in the same way. An attacker who reaches an institution’s access router or access link can do worse still. They may plant a sniffer that copies every packet going to and from the whole organisation, to be analysed later.

The Wireshark labs in this book use exactly this kind of packet sniffer, turned to a legitimate purpose: watching your own traffic so that you can understand the protocols.

Masquerading

It is surprisingly easy to create a packet with any source address, any content and any destination address. You can then transmit that hand-crafted packet into the Internet, and the Internet will dutifully forward it.

Now imagine the receiver. It might be an Internet router. It takes the false source address as truthful, and performs some command embedded in the packet’s contents — modifying its forwarding table, for example.

The ability to inject packets with a false source address is IP spoofing ip spoofing Simple Sending a packet with a fake sender address, to pretend to be someone else. Precise The ability to inject packets into the Internet with a false source address, in order to masquerade as another user. The defence is end-point authentication. introduced in ch. 1 — open in glossary , and it is only one of many ways for one user to masquerade as another.

The fix is end-point authentication end-point authentication Simple Proving that a message really came from the sender it claims to come from. Precise A mechanism that allows a receiver to determine with certainty whether a message originates from where it appears to originate. introduced in ch. 1 — open in glossary : a mechanism that lets us determine with certainty whether a message originates from where we think it does. Chapter 8 explores how.

Why the Internet is like this

It is worth asking how the Internet became such an insecure place to begin with.

Many aspects of the original architecture still reflect that assumption:

• The ability for one user to send a packet to any other user is the default, rather than a capability that must be requested and granted.
• User identity is taken at declared face value, rather than being authenticated by default.

Today’s Internet plainly does not consist of mutually trusting users. And yet today’s users still need to communicate when they do not trust one another. They may wish to communicate anonymously. They may communicate indirectly through third parties — Web caches in chapter 2, mobility agents in chapter 7. They may distrust the hardware, the software, and even the air through which they communicate.

Keep the closing line in mind for the rest of the book: communication among mutually trusted users is the exception, not the rule.

Check yourself