Computer Security and Penetration

Testing

Chapter 7
Spoofing
 Objectives
• Understand the mechanics of spoofing
• Describe the consequences of spoofing
• Define various types of spoofing
• List and describe some spoofing tools
• Learn how to defend against spoofing

Computer Security and Penetration Testing 2

 Spoofing
• Spoofing
– A sophisticated way to authenticate one machine to
another by using forged packets
– Misrepresenting the sender of a message to cause
the human recipient to behave a certain way
• Two critical issues for internetworked systems
– Trust
– Authentication

Computer Security and Penetration Testing 3

 Spoofing (continued)

Computer Security and Penetration Testing 4

 Spoofing (continued)
• Authentication is less critical when there is more
trust
– A computer can be authenticated by its IP address, IP
host address, or MAC address
• TCP/IP has a basic flaw that allows IP spoofing
– Trust and authentication have an inverse relationship
– Initial authentication is based on the source address
in trust relationships
– Most fields in a TCP header can be changed (forged)

Computer Security and Penetration Testing 5

 The Process of an IP Spoofing Attack
• A successful attack requires more than simply
forging a single header
– Requires sustained dialogue between the machines
for a minimum of three packets
• IP takes care of the transport between machines
– But IP is unreliable
– TCP is more reliable and has features for checking
received packets
• TCP uses an indexing system to keep track of
packets and put them in the right order

Computer Security and Penetration Testing 6

 The Process of an IP Spoofing Attack
(continued)

Computer Security and Penetration Testing 7

 The Process of an IP Spoofing Attack
(continued)
• To spoof a trusted machine relationship, the
attacker must:
– Identify the target pair of trusted machines
– Anesthetize the host the attacker intends to
impersonate
– Forge the address of the host the attacker is
pretending to be
– Connect to the target as the assumed identity
– Accurately guess the correct sequence

Computer Security and Penetration Testing 8

 The Process of an IP Spoofing Attack
(continued)
• You can use any network protocol analyzer to
monitor your LAN
• You can anesthetize, or stun, the host that you want
to impersonate
– By performing a SYN flood (or SYN attack), Ping of
Death, or some other denial-of-service attack

Computer Security and Penetration Testing 9

 The Process of an IP Spoofing Attack
(continued)

Computer Security and Penetration Testing 10

 The Process of an IP Spoofing Attack
(continued)

Computer Security and Penetration Testing 11

Computer Security and Penetration Testing 12
 The Process of an IP Spoofing Attack
(continued)
• Forging the address of the stunned host could be
done with the same utility
– Used to stun the trusted machine
• Big problem is guessing something close to the
correct incremented victim-side sequence number
– ISNs are not random, so the guess is not random
• Sequence numbers start at 1 when the machine is
booted up and incremented by fixed values
– See Table 7-2

Computer Security and Penetration Testing 13

 The Process of an IP Spoofing Attack
(continued)

Computer Security and Penetration Testing 14

 The Process of an IP Spoofing Attack
(continued)

Computer Security and Penetration Testing 15

 The Process of an IP Spoofing Attack
(continued)
• Once the hacker has put the trusted machine to sleep
with a SYN attack
– Sends a SYN packet to the victim machine
• Hacker should connect to the victim machine several
times on port 23 or 25
– To get an idea of how quickly the ISN advances
• Attacker also needs to deduce the packet’s round-trip
time (RTT)
• When the attack is done, the trusted machine must
be released and returned to normal

Computer Security and Penetration Testing 16

Computer Security and Penetration Testing 17
Computer Security and Penetration Testing 18
 Costs of Spoofing

• Costs to the victims of successful spoofing attacks

– Are tied to the amount of information that was copied
and the sensitivity of the data
• Tangible and intangible losses
• Successful spoof attacker usually leaves back door
– To get back in later

Computer Security and Penetration Testing 19

 Kinds of Tangible Costs

• Economic Loss
– May occur when valuable data is lost or duplicated
– Surreptitious nature of a successful spoofing attack
• Company might not know what happened or when
• Strategic Loss
– Loss of strategic data that outlines events planned for
the future
– Could lead to loss of both money and goodwill for the
spoofed company

Computer Security and Penetration Testing 20

 Kinds of Tangible Costs (continued)

• General Data Loss

– Usually has less of an impact than the first two
categories of losses
– Comes from unsecured documents used by
employees
• Working on various projects or engaged in the day-to-
day business of the company

Computer Security and Penetration Testing 21

 Types of Spoofing
• Main categories of spoofing include the following:
– Blind spoofing
– Active spoofing
– IP spoofing
– ARP (Address Resolution Protocol) spoofing
– Web spoofing
– DNS (Domain Name System) spoofing

Computer Security and Penetration Testing 22

 Blind Spoofing
• Any kind of spoofing where only one side of the
relationship under attack is in view
• Hacker is not aware of all network conditions
– But uses various means to gain access to the network

Computer Security and Penetration Testing 23

Computer Security and Penetration Testing 24
 Active Spoofing
• Hacker can see both parties, observe the responses
from the target computer, and respond accordingly
• Hacker can perform various exploits, such as
– Sniffing data, corrupting data, changing the contents
of a packet, and even deleting some packets

Computer Security and Penetration Testing 25

 IP Spoofing
• Consists of a hacker accessing a target disguised as
a trusted third party
• Can be performed by hackers through either blind or
active methods of spoofing

Computer Security and Penetration Testing 26

 ARP Spoofing
• Modifying the Address Resolution Protocol (ARP)
table for hacking purposes
• ARP table stores the IP address and the
corresponding Media Access Control (MAC) address
• Router searches the ARP table for the destination
computer’s MAC address
• ARP spoofing attack involves detecting broadcasts,
faking the IP address
– And then responding with the MAC address of the
hacker’s computer

Computer Security and Penetration Testing 27

 ARP Spoofing (continued)

Computer Security and Penetration Testing 28

 Web Spoofing
• Hacker spoofs an IP address through a Web site
• Hacker can transfer information or get information
• Hacker can spoof using a strategy
– That ensures that all communication between the Web
site and the user is directed to the hacker’s computer
• Hacker may also falsely acquire a certificate used by
a Web site

Computer Security and Penetration Testing 29

 DNS Spoofing
• Hacker changes a Web site’s IP address to the IP
address of the hacker’s computer
• Altering the IP address directs the user to the
hacker’s computer
• User is accessing the hacker’s computer
– Under the impression that he or she is accessing a
different, legitimate, site

Computer Security and Penetration Testing 30

Computer Security and Penetration Testing 31
 Spoofing Tools
• This section covers the following spoofing tools and
their uses:
– Apsend
– Ettercap
– Arpspoof

Computer Security and Penetration Testing 32

 Apsend
• Supported protocols: TCP, IP, UDP, and ICMP
• Used to test firewalls and other network applications
• Can perform the following spoofing attacks
– SYN flood attack
– DoS attack against tcpdump on a UNIX-based system
– UDP flood attack,
– ping flood attack
– Socket functions
– Time-to-live (TTL) attack
– Type-of-service (ToS) attack

Computer Security and Penetration Testing 33

 Apsend (continued)

Computer Security and Penetration Testing 34

 Ettercap
• Provides a list of options that can be used to perform
various spoofing operations
– See Table 7-3
• Hacker selects the action to perform from multiple
options, including
– ARP poisoning
– Viewing interface
– Packet filtering/dropping

Computer Security and Penetration Testing 35

Computer Security and Penetration Testing 36
 Ettercap (continued)

Computer Security and Penetration Testing 37

 Ettercap (continued)
• Ettercap works on the following platforms:
– Linux 2.0.x - 2.4.x
– FreeBSD 4.x
– OpenBSD 2. [789] 3.0
– NetBSD 1.5
– Mac OS X (Darwin 1.3. 1.4 5.1)

Computer Security and Penetration Testing 38

 Arpspoof
• Part of the dsniff suite
• Can be used to spoof ARP tables
• General syntax
– arpspoof [-i interface] [-t target] host
• Changes the MAC address specified for the IP
address of the destination computer
– In the ARP table of the source computer

Computer Security and Penetration Testing 39

 Prevention and Mitigation
• To avoid or defend against IP spoofing:
– Wherever possible, avoid trust relationships that rely upon
IP address only
– On Windows systems—If you cannot remove it, change
the permissions on the $systemroot$\hosts file to allow
read only access
– On Linux systems—Use TCP wrappers to allow access
only from certain systems
– Install a firewall or filtering rules
– Use encrypted and secured protocols like IPSec
– Use random ISNs

Computer Security and Penetration Testing 40

 Prevention and Mitigation (continued)
• To avoid or defend against ARP poisoning:
– Use methods to deny changes without proper
authorization to the ARP table
– Employ static ARP tables
– Log changes to the ARP table

Computer Security and Penetration Testing 41

 Summary
• Spoofing definitions
• Trust and authentication are at the heart of
internetworking
• A successful IP spoofing attack requires a complete,
sustained dialogue between the machines for a
minimum of three packets
• Steps to spoof a trusted machine relationship
• The costs to the victims of successful spoofing
attacks are tied to the amount of information that was
copied and the sensitivity of the data

Computer Security and Penetration Testing 42

 Summary (continued)
• Types of spoofing: blind spoofing, active spoofing, IP
spoofing, ARP spoofing, Web spoofing, and DNS
spoofing
• Apsend, Ettercap, and Arpspoof are three common
spoofing tools
• To avoid or defend against IP spoofing, avoid IP-
address-based trust relationships, install a firewall,
use encrypted protocols, and use random ISNs

Computer Security and Penetration Testing 43

 Summary (continued)
• To avoid or defend against ARP poisoning, use
methods to deny changes without proper
authorization to the ARP table, employ static ARP
tables, and log changes to the ARP table

Computer Security and Penetration Testing 44