Page 150 - StudyBook.pdf

134 Chapter 3 • Communication Security: Remote Access and Messaging

Vulnerabilities

So far, we have discussed the vulnerabilities specific to the different types of RAS;
however, there are also many vulnerabilities that are common to all methods. Some
of the more common types are eavesdropping (sniffing), data modification, identity
spoofing, and user error.

Eavesdropping

Eavesdropping\ is simply attaching to a network in a manner that allows you to
“hear” all the traffic being passed over the wire.This is known as a passive attack,
since data is observed but not modified.
A sniffer can be attached to a network to pick up information that is passed in
cleartext. Protocols such as Telnet, rlogin, and Post Office Protocol 3 (POP3) are
often victim to sniffing, because usernames and passwords are sent in cleartext.
Sniffing is also considered a passive attack, because the data is observed but not
modified.

Data Modification
Data modification is just as it sounds. Data is intercepted by a third party, modified,
and sent to the party originally intended to receive it.This type of attack is known
as a man-in-the-middle (MITM) attack.A good example of this is a program called
sshmitm. Sshmitm implements a MITM attack against SSH-secured traffic by lis-
tening to traffic between a client and host. Sshmitm intercepts the requests from
the client and replies with a fake server response. It then takes the original request
from the client and forwards it to the host, and then intercepts the response from
the host.At this point, the attacker has the ability to send messages to the client and
server as if they were from the expected originator.
As discussed in the section on IPSec, digital signatures can be used to remedy
data modification because they offer nonrepudiation. Nonrepudiation is a way to
guarantee that senders cannot deny they sent a message. Nonrepudiation also means
that recipients cannot deny receiving a message.Additional details regarding nonre-
pudiation are found in Chapter 9.

Identity Spoofing

Since information about senders and receivers is stored in IP packet headers, it is
easy to construct packets to look like they came from a different sender. Normally,
hackers will listen on a public network (such as the Internet) and examine packets

www.syngress.com