Home / Network Equipment

Main Vulnerabilities and Cyber ​​Attack Methods

1.1.1.2. System security history

There are several events that mark malicious activities on the network, which give rise to system security requirements as follows:

- 1988: A program appeared on the Internet that replicated itself on all computers on the Internet. These programs were called "worms". Although its level of danger was not great, it posed problems for administrators regarding system access rights, as well as software errors.

- 1990: Virus transmission via email addresses appeared commonly on the Internet.

- 1991: Trojan programs discovered.

Maybe you are interested!

At the same time, the development of Web services and related technologies such as Java, Javascipts has had many related security error messages such as: vulnerabilities that allow reading the content of user data files, some vulnerabilities allow DoS attacks, spam mail causing service interruption.

- 1998: The Melisa virus spread on the Internet through Microsoft's email programs, causing significant economic damage.

- 2000: A series of large Web Sites such as yahoo.com and ebay.com were paralyzed and stopped providing services for many hours due to DoS attacks.

1.1.2. Main vulnerabilities and network attack methods

1.1.2.1. Vulnerabilities

As presented above, security vulnerabilities on a system are weaknesses that can cause service disruption, add rights to users or allow unauthorized access to the system. Vulnerabilities can also be found in services such as sendmail, web, ftp... In addition, vulnerabilities also exist in the operating system itself such as Windows NT, Windows 95, UNIX or in applications that users frequently use such as word processing, database systems...

There are many different organizations that classify specific types of vulnerabilities. According to the US Department of Defense classification, security vulnerabilities on a system are divided as follows:

- Type C vulnerabilities: these vulnerabilities allow DoS (Denial of Service) attacks to be carried out. The level of danger is low, only affecting the quality of service, can cause system interruption and suspension; does not damage data or gain illegal access.

- Type B vulnerabilities: Vulnerabilities that allow users to gain additional rights on the system without performing validation checks, which can lead to loss or disclosure of security-required information. Medium risk level. These vulnerabilities are often found in applications on the system.

- Type A vulnerabilities: These vulnerabilities allow outside users to access the system illegally. This vulnerability is very dangerous and can destroy the entire system.

The following figure illustrates the risk levels and corresponding vulnerability types:



Figure 6.1: Types of security vulnerabilities and their severity


Below we will analyze some security vulnerabilities that commonly appear on networks and systems.

a) Class C vulnerabilities

Vulnerabilities of this type allow for DoS attacks.

DoS is a form of attack that uses Internet layer protocols in the TCP/IP protocol suite to cause the system to stall, leading to a situation of denying legitimate users access or use of the system. A large number of packets are sent to the server in a continuous period of time, causing the system to become overloaded, resulting in the server responding slowly or being unable to respond to requests sent from clients.

Services with vulnerabilities that allow DoS attacks can be upgraded or fixed with newer versions from service providers. Currently, there is no comprehensive solution to fix these vulnerabilities.

This type of vulnerability exists because the design of the Internet layer protocol (IP) in particular and the TCP/IP protocol suite itself contains the potential risks of these vulnerabilities.

Typical examples of DoS attacks are attacks on some large Web sites that cause their operations to be suspended, such as: www.ebay.com and www.yahoo.com.

However, the danger level of these types of vulnerabilities is classified as C, which is less dangerous because they only interrupt the system's service provision for a period of time without harming data and attackers do not gain illegal access to the system.

Another common type C vulnerability is a service vulnerability that allows an attack to crash the end user's system. This attack is mainly done using Web services. Suppose a Web Server has Web pages that contain Java or JavaScripts, which can crash the system of a Netscape Web browser user by following these steps:

- Write code to identify Web Browsers using Netscape.

- If you use Netscape, it will create an infinite loop, spawning countless windows, each of which connects to different Web Servers.

With this simple attack, the system can hang for 40 seconds (for a client with 64 MB RAM). This is also a DoS attack. The user in this case can only reboot the system.

Another common type C vulnerability in mail systems is the lack of anti-relay mechanisms that allow spam mail to be performed. As we know, the mechanism of email service is to save and forward. Some mail systems do not have authentication when users send mail, leading to the situation where attackers take advantage of these mail servers to perform spam mail. Spam mail is an action to paralyze the system's mail service by sending a large number of messages to an unknown address, because the mail server always has to spend energy to find unreal addresses, leading to service interruption. Messages can be generated from mail bomb programs that are very popular on the Internet.

b) Type B vulnerabilities:

This type of vulnerability is more dangerous than a type C vulnerability, allowing internal users to gain higher privileges or gain unauthorized access.

For example, in Figure 12, a type B vulnerability could exist for a UNIX system where the /etc/passwd file is in plaintext; without using the UNIX password masking mechanism (using the /etc/shadow file).

These types of vulnerabilities often appear in services on the system. A local user is understood as someone who has access to the system with certain permissions.

A class of program permission issues on UNIX also often cause type B vulnerabilities. Because on UNIX systems a program can be executed in two ways:

- The owner of that program activates it to run.

- The owner of the file has the rights to run it.

Another type of type B vulnerability occurs in programs written in C. C programs often use a buffer—a region of memory used to store data before it is processed. Programmers often use a buffer in memory before allocating a block of memory for each block of data. For example, a user might write a program that requires a user name field to be 20 characters long. So they would declare:

char first_name [20];

This declaration will allow the user to enter up to 20 characters. When entering data, the data is first stored in a buffer; if the user enters 35 characters, the buffer overflow will occur and the result is 15 extra characters will be in an uncontrolled location in memory. For attackers, this vulnerability can be exploited to enter special characters, to execute some special commands on the system. Usually, this vulnerability is often exploited by users on the system to gain invalid root privileges.

Tight control over system configuration and programs will limit type B vulnerabilities.

c) Type A vulnerabilities:

Type A vulnerabilities are very dangerous, threatening the integrity and security of the system. These vulnerabilities often appear in weakly managed systems or uncontrolled network configurations.

A common example is on many systems using Web Server is Apache, For this Web Server, the default directory to run scripts is often configured as cgi-bin; in which there is a pre-written Scripts to test the operation of Apache is test-cgi. For older versions of Apache (before version 1.1), there is the following line in the test-cgi file:

echo QUERY_STRING = $QUERY_STRING

The QUERY_STRING environment variable is not set with quotes, so when the client makes a request in which the sent string includes some special characters; for example the character "*", the web server will return the contents of the entire current directory (which are directories containing cgi scripts). The user can see the entire contents of the files in the current directory on the server system.

Another example is similar for Web servers running on Novell operating systems: these web servers have a script called convert.bas, running this script allows reading the entire content of files on the system.

These types of vulnerabilities are extremely dangerous because they already exist in the software used. If administrators do not have a deep understanding of the service and software used, they may overlook these weaknesses.

For older systems, it is often necessary to check the announcements of security newsgroups on the Internet to detect these types of vulnerabilities. A series of commonly used old versions of programs have type A vulnerabilities such as: FTP, Gopher, Telnet, Sendmail, ARP, finger...

1.1.2.2. Some common cyber attack methods

a) Scanner

Scanner is a program that automatically scans and detects security vulnerabilities on a local or remote workstation. With this function, a malicious user using the Scanner program can detect security vulnerabilities on a remote server.

Scanner programs usually have a common mechanism of scanning and detecting TCP/UDP ports used on a system to be attacked, thereby detecting the services used on that system. Then the scanner programs record the responses on the remote system corresponding to the services it detects. Based on this information, attackers can find weaknesses in the system.

The elements for a Scanner program to work are as follows:

- System and device requirements: A Scanner program can work if the environment supports TCP/IP (regardless of whether the system is UNIX, IBM-compatible, or Macintosh).

- The system must be connected to the Internet.

However, it is not simple to build a Scanner program, the attackers need to have deep knowledge of TCP/IP, knowledge of C programming, PERL and some shell programming languages. In addition, the programmer (or user) needs to have knowledge of socket programming, the operation method of client/server applications.

Scanner programs play an important role in a security system, as they are able to detect weaknesses in a network system. For network administrators, this information is extremely useful and necessary; for saboteurs, this information is extremely dangerous.

b) Password Cracker

A password cracker is a program that can decrypt an encrypted password or can disable the password protection of a system.

To understand how password cracking programs work, we need to understand how encryption is used to generate passwords. Most password encryption is created using an encryption method. Encryption programs use encryption algorithms to encrypt passwords.

The working process of the cracking programs is illustrated in the following figure:


Figure 6.2: How jailbreak programs work


According to the above diagram, a list of words is generated and encrypted for each word. After each encryption, the program will compare it with the encrypted password that needs to be cracked. If there is no match, the process is repeated. This cracking method is called brute-force.

Hardware factor: In the figure above, the computer that executes the cracking programs is a 66MHz or higher PC. In practice, very powerful hardware is required for professional crackers. An alternative method is to perform the cracking on a distributed system; thus reducing the hardware requirements compared to the single-machine method.

The principles of some cracking programs may be different. Some programs create a list of limited words, apply some encryption algorithms, from the results compare with the encrypted password that needs to be cracked to create another list according to the logic of the program, this method is not standard but quite fast because based on the principle when setting passwords, users often follow some rules for convenience when using.

In the final stage, if it matches the encrypted password, the cracker will have the plain text password. In the image above, the plain text password is written to a file.

To evaluate the success rate of cracking programs, we have the following formula:

P = L x R /S

In there:

P: Probability of success

L: Lifetime of a password R: Test speed

S: Password space = A M (M is password length)


For example, on UNIX systems it has been proven that if the password is longer than 8 characters, the probability of cracking is almost = 0. Specifically as follows:

If using about 92 possible password characters, the possible password space is S = 92 8

With a test speed of 1000 passwords per second, R = 1000/s, the life time of a password is 1 year.

We have the probability of success is:

P = 1x 365 x 86400 x 1000/92 8 = 1/1,000,000

So password cracking is impossible because it would take about 100 years to find the correct password.

Usually, cracking programs often combine some other information in the password detection process such as:

- Information in the /etc/passwd file

- Some dictionaries

- Repeated words and sequentially listed words, changing the pronunciation of a word...

The remedy for this type of attack is to establish a proper password protection policy.

c) Trojans

Based on the ancient Greek myth of the Trojan Horse, Trojans are programs that run on a system in a way that looks like a legitimate program. These programs perform functions that are not intended or legitimate by the system's users. Typically, Trojans are run because legitimate programs have had their code modified with illegal code.

Virus programs are a typical type of Trojans. Virus programs hide code within legitimate programs.

When these programs are activated, hidden codes are executed to perform certain functions without the user's knowledge.

A standard definition of Trojans is as follows: a trojan is a program that performs a task without the user's prior knowledge, such as stealing passwords or copying files without the user's knowledge.

The authors of trojan programs build a plan. In terms of Internet security, a trojan program will do one of the following:

- Perform some functions or help programmers detect important or personal information on a system or some components of that system

- Hide some functions or help programmers detect important or personal information on a system or some components of that system

Some trojans can perform both of these functions. In addition, some trojans can also destroy the system by corrupting information on the hard drive (for example, the case of the Melissa virus spread through e-mail).

Nowadays with many new techniques, these types of trojan programs are easily detected and are not able to take effect. However, in UNIX, the development of trojan programs is still very popular.

Trojan programs can spread through many methods, operating on many different operating system environments (from Unix to Windows, DOS). In particular, trojans often spread through some popular services such as Mail, FTP... or through free utilities and programs on the Internet.

It is difficult to assess the impact of trojans. In some cases, it is as simple as affecting customer access, such as trojans that steal the contents of passwd files and send emails to the attacker. The simplest fix is ​​to replace the entire contents of the programs that are affected by the trojans and replace the passwords of system users.

However, in more serious cases, attackers create security holes through trojans programs. For example, attackers gain root access to the system and exploit it to destroy all or part of the system. They use root access to change logfiles, install other trojans programs that the administrator cannot detect. In this case, the level of impact is serious and the system administrator has no choice but to reinstall the entire system.

d) Sniffer

For system security, sniffers are understood as tools (can be hardware or software) that "capture" information flowing on the network and from

Comment


Agree Privacy Policy *