IT Security and Penetration Testing

Chapter 5
TCP/IP Vulnerabilities
 Objectives
• Give a definition of TCP/IP
• Know the steps of TCP/IP communication
• Recognize weaknesses in TCP/IP
• Identify steps in protecting information from
vulnerabilities in TCP/IP

Computer Security and Penetration Testing 2

 TCP/IP Vulnerabilities
• Transmission Control Protocol/Internet Protocol
(TCP/IP)
– Suite of protocols that underlie the Internet
– Comprises many protocols and applications
– Common language of networked computers
– Makes transferring information fast and efficient
• IP has tools to correctly rout packets
• TCP is responsible for safe and reliable data
transfer between host computers

Computer Security and Penetration Testing 3

 TCP/IP Vulnerabilities (continued)

• Illegitimate users take advantage of TCP/IP

vulnerabilities
– By exploiting the “three-way handshake”
• Unauthorized users may launch a denial-of-service
attack on the destination computer
– Floods network with so many additional requests that
regular traffic is slowed or completely interrupted

Computer Security and Penetration Testing 4

 TCP/IP Vulnerabilities (continued)

Computer Security and Penetration Testing 5

 Data Encapsulation
• Data encapsulation
– Enclosing higher-level protocol information in lower-
level protocol information
– Also called data hiding
– Implementation details of a class are hidden from user

Computer Security and Penetration Testing 6

 Data Encapsulation (continued)

Computer Security and Penetration Testing 7

 IP (Internet Protocol)
• Internet Protocol (IP)
– Transmits data from source to final destination
– Network protocol operating at layer 3 of the OSI Model
• And layer 2 or 3 of the TCP/IP Model
– IP is connectionless
• No guarantee of delivery of packets to the destination
• IP routes packets over network hardware

Computer Security and Penetration Testing 8

 IP (Internet Protocol) (continued)
• IP addresses formats
– IPv4 (32-bit address)
• Usually written as a dotted-decimal, e.g., 192.168.100
– IPv6 (128-bit address)
• Usually written as eight groups of four hex digits, e.g.,
2001:0db8:85a3:08d3:1319:8a2e:0370:7334
• IP address exhaustion date
– Approximately the beginning of 2011

Computer Security and Penetration Testing 9

 IP (Internet Protocol) (continued)
• IP packets often arrive out of sequence
– Vulnerability that attackers can exploit
• When a large IP packet is sent over a network, it is
broken down
– Called fragmentation

Computer Security and Penetration Testing 10

 IP (Internet Protocol) (continued)

Computer Security and Penetration Testing 11

 IP (Internet Protocol) (continued)

Computer Security and Penetration Testing 12

Computer Security and Penetration Testing 13
 TCP
• Uses a connection-oriented design
– Participants in a TCP session must create connection
• Connection is called the three-way handshake
• Provides connection-oriented services between a
source and destination computer
– And guarantees delivery of packets
• Packets reach the application layer in the right order
– TCP identifies and assembles packets based on
sequence numbers

Computer Security and Penetration Testing 14

 TCP (continued)
• Source and destination computers exchange the
initial sequence number (ISN)
– When a connection is made
• Packets are accepted within a particular range
– Specified during the establishment of a connection

Computer Security and Penetration Testing 15

 TCP (continued)

Computer Security and Penetration Testing 16

 TCP (continued)

Computer Security and Penetration Testing 17

 TCP (continued)

Computer Security and Penetration Testing 18

 Connection Setup and Release
• Three-way handshake sets up and releases a
connection
• TCP packet flags: URG,ACK, PSH,RST,SYN, and
FIN
• Packets can have more than one flag set
– Normally a packet will have only one flag sent, except
with SYN/ACK or FIN/ACK
• Three packets in a TCP connection:
SYN --> SYN/ACK --> ACK

Computer Security and Penetration Testing 19

 Connection Setup and Release
(continued)
• Connection Setup
– Source computer delivers a SYN packet to the
destination computer
• Packet has the initial sequence number (ISN)
• ISN is indicated by whether the SYN bit is “set”
– Receiving computer transmits a SYN with an
acknowledgment, ACK
– Source computer sends an ACK to the destination
computer as a response
• With an “in-range” sequence number

Computer Security and Penetration Testing 20

Computer Security and Penetration Testing 21
 Connection Setup and Release
(continued)
• Connection Release
– Source computer sends a FIN packet to the
destination computer
– Destination computer then sends a FIN/ACK packet
– Source computer sends an ACK packet
– Either computer could send an RST and close the
session (reset) immediately

Computer Security and Penetration Testing 22

 TCP Timers
• All TCP sessions are tracked with timers built into
the TCP protocol
• Timers used by TCP/IP
– Connection establishment
• A session will not be established if it takes longer than
75 seconds for the destination server to respond
– FIN_WAIT
• Waits for FIN packets. Its default value is 10 minutes

Computer Security and Penetration Testing 23

 TCP Timers (continued)
• Timers used by TCP/IP (continued)
– TIME_WAIT
• Default value for this timer is two minutes
• Waits for packets to arrive at the destination computer
– KEEP_ALIVE
• Checks to see if the destination computer is active
• Computer may send a test packet every two hours to
verify whether the other computer is alive and idle

Computer Security and Penetration Testing 24

 Vulnerabilities in TCP/IP
• During the development of TCP/IP in the 1980s
– Security was not a priority
• Since 1990, security has become a serious problem
• Some of the vulnerabilities
– IP spoofing
– Connection hijacking
– ICMP attacks
– TCP SYN attacks
– RIP attacks

Computer Security and Penetration Testing 25

 IP Spoofing
• Steps
– Attackers send packets to the victim or target
computer with a false source address
– Victim accepts the packet and sends a response
“back” to the indicated source computer
– Attacker must guess the proper sequence numbers to
send the final ACK packet
• Hacker may have a connection to victim’s machine
– And hold it as long as the computer remains active

Computer Security and Penetration Testing 26

 IP Spoofing (continued)
• Sequence Guessing
– Hacker sends a few connections to the victim
• Learns how quickly sequence number is incrementing
– Attacker then sends a spoofed ACK packet with a
“best guess” victim’s sequence number
– Hacker can guess the sequence number because the
number is generated using a global counter
• And is incremented in fixed units

Computer Security and Penetration Testing 27

 IP Spoofing (continued)
• Source Routing
– Sender using source routing can specify return path
• Through which the destination computer sends its reply
– Attacker looks for an intermediate computer or router
• That could forward packets to the target computer
– Most newer routers and firewalls are configured to
drop source-routed packets

Computer Security and Penetration Testing 28

 Connection Hijacking
• Connection hijacking
– Allows an attacker to control an existing connection
• Steps
– An attacker desynchronizes a series of packets
between the source and destination computer
– Extra packets sent to one of the victims force the
victim to choose which packet to accept
– If the victim chooses to discard the authentic packets
and interacts with the spoofed packets
• The attacker has hijacked the connections

Computer Security and Penetration Testing 29

 ICMP Attacks
• Packets are used to send fraudulent or deceptive
connection information among computers
• ICMP is used to test for connectivity using utilities such
as the ping command
• Denial-of-service (DoS) attacks can be formulated by
using ICMP packets
– Destination Unreachable and Time to Live Exceeded
• Attackers transmitting spoofed packets can successfully
reset existing connections

Computer Security and Penetration Testing 30

 TCP SYN Attacks
• Exploits host implementation of three-way handshake
• When Host B receives the SYN request from A, it
must keep track of the partially opened connection
– In a queue for at least 75 seconds
• Most systems are limited and can keep track of only
a small number of connections
• An attacker can overflow the listen queue by sending
more SYN requests than the queue can handle
– SYN flooding

Computer Security and Penetration Testing 31

 RIP Attacks
• Take advantage of RIP (Routing Information Protocol)
• RIP
– Essential component in a TCP/IP network
– Distribution of routing information within networks
• RIP packet is often used without verification
– Attacks on RIP change the destination of data
• Once the router is modified, it transmits all of the
packets to the hacker computer

Computer Security and Penetration Testing 32

 Securing TCP/IP
• Data in packets is not encrypted or authenticated
• Packet sniffer can observe contents of the packets
• Attackers can send spoofed packets from any
computer
• Must employ many methods simultaneously to
achieve success in this area

Computer Security and Penetration Testing 33

 Securing TCP/IP (continued)
• Methods to decrease vulnerabilities in TCP/IP
– Modify default timer values
– Increase the number of simultaneous connections
that a computer can handle
– Reduce the time limit used to listen for replies to the
SYN/ACK in the three-way handshake
– Change method used to generate sequence numbers
– Firewall rules that block spoofed packets

Computer Security and Penetration Testing 34

 Securing TCP/IP (continued)
• Methods to decrease vulnerabilities in TCP/IP
(continued)
– Avoid using the source address authentication
– If an operator allows outside connections from trusted
hosts, enable encryption sessions at the router
– Packets can be encrypted or sent via encrypted VPN

Computer Security and Penetration Testing 35

 IP Security Architecture (IPSec)
• IP Security Architecture (IPSec)
– Collection of Internet Engineering Task Force (IETF)
standards
– Defines an architecture at the Internet Protocol (IP)
layer that protects IP traffic
• By using various security services

Computer Security and Penetration Testing 36

 IP Security Architecture (IPSec)
(continued)

Computer Security and Penetration Testing 37

 IP Security Architecture (IPSec)
(continued)

Computer Security and Penetration Testing 38

 IP Security Architecture (IPSec)
(continued)
• IPSec provides:
– Encryption of user data for privacy
– Authentication of the integrity of a message
– Protection against certain types of security attacks,
such as replay attacks
– Ability for devices to negotiate security algorithms and
keys required for secure authenticated connections
– Two security modes, tunnel and transport, to meet
different network needs

Computer Security and Penetration Testing 39

 Summary
• Internet Protocol (IP) is responsible for sending data
from a source computer to a destination computer
• TCP guarantees the delivery of packets
• Some of the timers that are important for TCP/IP
security are Connection Establishment,
FIN_WAIT,TIME_WAIT, and KEEP_ALIVE
• Vulnerabilities in TCP/IP include TCP SYN attacks,
IP spoofing, connection hijacking, RIP attacks, and
ICMP attacks

Computer Security and Penetration Testing 40

 Summary (continued)
• Vulnerabilities in TCP/IP can be decreased by
modifying the default timer values, generating random
sequence numbers, properly configured firewalls,
TCP wrappers on UNIX and Linux boxes,
authentication, or encryption
• IP Security Architecture (IPSec) is a collection of
Internet Engineering Task Force (IETF) standards
– Defines an architecture at Internet Protocol (IP) layer
that protects IP traffic by using various security services

Computer Security and Penetration Testing 41

 Summary (continued)
• IPSec provides
– Encryption of user data
– Authentication of message integrity
– Protection against certain types of security attacks,
such as replay attacks
– Ability for devices to negotiate security algorithms and
keys required for secure authenticated connections
– Two security modes, tunnel and transport, to meet
different network needs

Computer Security and Penetration Testing 42