Passive sniffing works when the traffic you wish to observe and the station that will do the sniffing are in the same collision domain. Passive sniffing works when a device known as a hub is in use. This is the key feature that makes this setup work. Think of the way a hub functions: traffic that is sent to one port on a hub is automatically sent to all ports on the hub. Because any station can transmit at any time, collisions can and do happen and can lead to a collision domain. When this type of situation exists, it is possible to listen in on traffic on the network quite easily because every station shares the same logical transmission area. What thwarts passive sniffing is a switch that separates the networks into multiple collision domains, therefore creating a situation in which stations do not transmit in the same logical area. Basically, passive sniffing is effective when the observer and the victim exist so that each can see each other's actions.

The key to getting the most from passive sniffing is to plan carefully. Look for those locations on the network that will act as chokepoints for traffic, or those locations that the traffic that you are looking for will pass. Placing a sniffer on a collision domain different from the one that is to be observed will not yield the results that you desire, so placement must always be considered.

Some points to remember about passive sniffing:

So what happens if a network is broken into different collision domains using the power of switches? It would seem in these situations that the target is out of reach, but this problem can be overcome with the power of active sniffing. Because a switch limits the traffic, a sniffer can see the traffic that is specifically addressed to a system. Active sniffing is necessary to see the traffic that is not addressed to that system.

Active sniffing involves sniffing when a switch is present on the network. This technique is employed in environments where sniffing using passive methods would be ineffectual due to the presence of switches. Active sniffing requires the introduction of traffic onto the network and as such can be detected relatively easily.

In order to use active sniffing, an understanding of two techniques is necessary, both of which are used to get around the limitations that switches put in place. These techniques are known as media access control (MAC) flooding and Address Resolution Protocol (ARP) poisoning, both of which are valuable tools in your arsenal.

Address Resolution Protocol (ARP) Poisoning

The other method of bypassing a switch to perform sniffing is via Address Resolution Protocol (ARP) poisoning. Here are some key points:

• Address Resolution Protocol (ARP) is a protocol defined at the network layer which is used to resolve an IP address to a physical or MAC address.

• In order to locate a physical address, the requesting host will broadcast an ARP request to the network.

• The host that has the IP address that is sought after will return its corresponding physical address.

  Note

  If you are still unclear about the ARP process, refer to Chapter 2 and the discussion on ARP and the OSI reference model.

• ARP resolves logical addresses to the physical address of an interface.

• ARP packets can be spoofed or custom crafted to redirect traffic to another system such as the attacker's.

• ARP poisoning can be used to intercept and redirect traffic between two systems on the network.

• MAC flooding can clog and overwhelm a switch's CAM, forcing it into what is known as forwarding mode.

Figure 12-1. ARP poisoning in practice.

With knowledge of the ARP process in hand, it is very easy to understand the mechanics of ARP poisoning or ARP spoofing. ARP poisoning works by sending out bogus ARP requests to any requesting device and the switch. The idea is to force traffic to a location other than the intended target and therefore sniff what is being sent and received. When the bogus requests are sent out, the switch stores them. Other clients will then automatically send traffic to the new target, as they will check their cache first where the bogus entry has been stored.

Figure 12-1 illustrates ARP poisoning in practice.

Here are the steps in the process:

1. Attackers send out a broadcast stating that a given IP address (such as a router or gateway) maps to their own MAC address.

2. A victim on the network initiates a communication that requires exiting the network or subnet.

3. When the traffic is transmitted, the ARP mapping shows that the router's IP address maps to a specific MAC address, so traffic is forwarded to the attacker instead.

4. To complete the sequence and avoid arousing suspicion, the attacker forwards traffic to the real destination (in this case, the router).

Note

Not forwarding traffic on to the original destination would arouse suspicion that would tip off the network administrator to the attacker's presence.

Here are some points to remember about ARP poisoning:

• Anyone can download malicious software used to run ARP spoofing attacks from the Internet.

• Attackers can use bogus ARP messages to redirect traffic.

• It is possible to run DoS attacks with this technique.

• It can be used to intercept and read data.

• It can be used to intercept credentials such as usernames and passwords.

• It can be used to alter data in transmission.

• It can be used to tap voice over IP (VoIP) phone calls.

Several utilities in your security professional toolbox are specifically designed to carry out ARP spoofing, no matter what your OS of choice may be. The following list details some of the options available to you:

• Arpspoof—Designed to redirect traffic in the form of packets from a victim's system. Performs redirection by forging ARP replies. This utility is part of the popular Dsniff suite of utilities.

• Cain—The "Swiss army knife" of tools; can perform ARP poisoning, enumeration of Windows systems, sniffing, and password cracking

• Ettercap—An old but very capable protocol analyzer that can perform ARP poisoning, passive sniffing, protocol decoding, and as a packet capture

• Internal Revenue Service (IRS)—Not a port scanner; it is a "valid source IP address" scanner for a given service. Combines ARP poisoning and half-scan processes and attempts TCP connections to a specific victim.

• ARPWorks—Utility for creating customized packets over the network that perform the ARP announce feature

• Nemesis—Can perform some ARP spoofing

Several very capable sniffing tools are available, including the popular ones in the following list:

With this powerful technique, an attacker can reveal a wealth of information that can be used against you as a defender, but this information does not have to be accessible to an attacker, because it takes just a little care to take the teeth from these attacks. In this section you will learn some of the techniques that can be used to limit or block the effects of sniffing.

To defeat sniffing, a number of countermeasures can be employed, including the following:

When considering network security and thwarting the power of sniffing, you should consider which protective measures are appropriate and which are not. In the case of encryption, for example, not all traffic needs to be encrypted because not all network traffic is of a sensitive nature. Always consider the exact nature of the traffic, too. Remember, just because you can do something does not mean you should.

Earlier, when sniffing was discussed, the process was that of observing traffic on the network. Session hijacking builds on this process and refines it. Session hijacking adds the goal of not only observing the traffic and sessions currently active on the network but also taking over one of these sessions that has authenticated access to the resource you want to interact with. For a session hijack to be successful, the attacker must locate and identify a suitable session for hijacking. It sounds like a simple process until factors such as different network segments, switches, and encryption come into play. If you factor in the very real issue of having to uncover sequence numbers on packets in order to properly take control of a session, the challenges mount significantly. But they are not insurmountable. Remember that while the challenges are not small, what is on the line is the ability to interact with and execute commands against authenticated resources.

Consider some of the challenges standing in the way of successful session hijacking:

Take a look at the sequence number problem. Let's review the steps involved in session hijacking once again:

Look at Step 3—this step is easy on a network on which you can see both parties. On these types of networks you can sniff the traffic passively and read the sequence numbers off of the packets themselves. On a switched network, it becomes much more of an issue because you cannot see the other party(ies) so you must use techniques to guess the sequence number correctly (you can't just stumble in with whatever number you want). In this situation, you will send several packets to the victim or target in order to solicit a response with the sequence numbers on it.

Sequence numbers are a cornerstone of TCP that makes a number of features that you may take for granted possible. In TCP every piece or byte of data must have a sequence number assigned to it to track the data, assemble it with its fellow packets, and perform flow control. So where and when do the sequence numbers get assigned? During the three-way handshake, which is illustrated in Figure 12-2.

Figure 12-2. Three-way handshake.

Here are some points to bear in mind about sequence number prediction:

Once an attacker has determined the correct sequence numbers, the next move is to inject packets into the network. Of course, this is easier said than done, and just injecting packets into the network is not useful in every case because a few details must be in place first. Consider the two extremes of the session: the beginning and the end. At the beginning of the session, the process of authentication takes place, and injecting packets into the network and taking over the session here would be worthless if done prior to the authentication process (after all, you want an authenticated session). On the other hand, injecting packets too late, such as when the session is getting torn down or closed, will mean that the session you want to hijack is no longer present.

With the proper sequence numbers predicted and known the attack can move to the next phase which is to unplug one of the parties, such as a server if one is present. The goal at this stage is to knock out or remove one of the parties from the communication in order to get them out of the way. The removal can be performed by any method the attacker chooses, from a simple DoS to sending a connection reset request to the victim.

At this point, the attacker now has control of a session and can move toward carrying out dirty work, whatever it may be. The trick for the attacker is to keep the session maintained and active because as long as this connection is maintained and kept alive, the attacker has an authenticated connection to their intended target.

In order to perform session hijacking you can use a number of different tools, each having its own advantages and disadvantages. Each of the tools on this list has seen widespread use by hackers and will offer you the ability to perform session hijacking quite easily. Each of these tools is essentially a packet sniffer with the enhanced capability needed to perform session hijacking.

Session hijacking is dangerous. But you can limit its impact to a great degree through the proper application of your two best lines of defense: being proactive and looking for the signs of an attack. One of your tools for this is something you read about earlier: encryption. After all, it is hard for troublemakers to hijack a session if they can't see what is being transmitted. Other measures you can use include configuring routers to block spoofed traffic from outside the protected network. Additionally, you can use counter-measures such as an intrusion detection system (IDS) that can watch for suspicious activity and alert you to it, or even actively block this traffic automatically.

DoS attacks are not all the same. They can be broken down into three broad categories based on how they carry out their goal of denying the service to legitimate uses and users:

There are plenty of tools available to the hacker to perform a DoS attack, including:

As you can readily imagine, a distributed attack, involving many compromised machines, is a more devastatingly effective way to commit a denial of service attack than simply using one machine to attack another. Here are some specifics you should know:

A DDoS is an "upgraded" and advanced version of the DoS. The DDoS has the same goal as the DoS, which is to shut a system down by consuming resources, but does so through sheer force of numbers. This type of attack generally tends to occur in two waves designed to position and carry out the attack.

In the first wave, the attack is staged, and the targets that will be the "foot soldiers" are infected with the implements that will be used to attack the final victim. Targets for infection in this phase include systems that have high-speed connections, poorly defended home and business networks, and poorly patched systems. What is infecting these systems can and will vary, but it could include software such as the ones mentioned previously for a traditional DoS.

Wave 2 is the attack itself. Foot soldiers form the army of systems that will collectively attack a designated target. These infected systems can number in the thousands, hundreds of thousands, or even millions awaiting the instruction that will turn their collective attention toward a target (these infected systems are called "zombies"). These are the steps of the attack itself:

A DDoS attack like this sounds simple, but in practice it is not, because it takes quite a bit of planning and knowledge to set up, not to mention a good amount of patience. To set this type of attack up, two components are needed: a software component and a hardware component.

On the software side, two items are needed to make the attack happen:

The second requirement that is essential is the hardware; more specifically, these are the systems that will be components of the attack:

You may be wondering whether, all things considered, a DDoS is unstoppable.

DDoS attacks rely on locating and using vulnerable hosts that are connected to the Internet. These systems are then targeted for these known vulnerabilities and taken over. Once the attack is initiated and the command sent out to the attackers, the DDoS is nearly impossible to stop.

Routers and firewalls may be configured to block the attack, but the attack can overwhelm these devices and shut down the connection anyway. The sheer volume of attackers involved in DDoS attacks makes them difficult to stop.

To initiate a DDoS requires the proper tools, and there are a number available. The tool or tools you use will ultimately depend on what your preferences are as well as other factors such as platform, but the following list is a sampling of these tools: