Security Basics mailing list archives
RE: Attacking a machine on network.
From: "Mark Brunner" <kohi10 () rogers com>
Date: Wed, 30 May 2007 20:06:29 -0400
A system without services running is a brick. Doesn't do much. Can still be attacked by getting the user to do silly things, like open spam, click on attachments, surf to malicious sites, etc. The attack surface for a typical computer or network system is quite broad. You really need to plan your defenses strategically. That is how they are most likely to be attacked. Consider the types of attackers that would launch attacks against you, and what their motivations might be. Couple this with historical vulnerabilities, and you have a basic threat profile. Now consider what the assets are that you want to defend, and why. They usually have some dollar value that they bring or hold for the company. What are the key items that the business could not do without; what services must be present and available, and what can be considered expendable, or less critical? Add hardware, software, processes and services to this list. This is an asset catalog, or inventory. If you want to secure your assets properly, you need to consider all of the mechanisms for attack, and then evaluate the likelihood of each attack being realized. It is complicated and time consuming. Calculate the cost that might be incurred if each attack were to be successfully launched against your assets. Now you have a risk profile. Next step is to consider mitigation controls for each of the attacks that are likely to occur. Just list them at first, and don't worry about costs until you are reasonably sure you have considered as many options as you possibly can. Now examine the list for "low-hanging fruit", things that can be done through hardening, process improvement, procedural definitions, etc. Low or no cost improvements. Now start pricing out the other controls, the ones that will cost time and money for implementation and maintenance. This is your mitigation strategy. Compare the cost of defending an asset or group of assets versus the cost of breach or losing that asset. Striking the balance here provides your initial security strategy. DDoS is a tough nut to start with because the Internet and IP were not built for control, they were built for function. IP doesn't care who you are, where you are sending information, or what you are sending, as long as it can route to a destination, it will move happily along. DDoS mitigation usually involves process and procedures rather than technical solutions, unless you have deep pockets. It is virtually impossible to prevent, but can be responded to if planned for. This planning usually involves contacting your ISP, having them provide special services, such as data throttling, flow analysis, and redirection. Next, you need to figure out how to identify the REAL source of the problem, what is the target, is it spoofed traffic, does the source change, can it be localized (physically, logically or geographically), what are the characteristics of the traffic, etc. This information will aid in source identification and usually leads to upstream ISP contact to disconnect the attacking systems from yours. Could be a simple block to you from their ISP, or a disconnection of the attackers' internet connection completely by their ISP, though that is unlikely at present. Revenue is too precious and there is liability. Until we get rid of TCP/IP's current weaknesses, and replace it with a more security-aware protocol, this is what we are stuck with. This is all MY 2ยข, advice and opinion is free, and I don't guarantee your money's worth... Cheers! Mark -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of John Pluffum Sent: Wednesday, May 30, 2007 5:44 AM To: security-basics () securityfocus com Subject: Re: Attacking a machine on network. Paul Sebastian Ziegler wrote:
If someone doesn't run a service, this obviously leads me to the assumption that that particular machine could never be cracked ? Is this a right assumption ?Not really. Some attacks actually target the drivers of the network-interfaces. For example the WLAN drivers on MacOS X and some versions of Madwifi had issues. Since those drivers listen to the traffic anyway, it might be possible to trigger some sort of overflow without a single listening port. Also information leakage may occur no matter if the box is running any ports itself. Furthermore there are other techniques to communicate with boxes than just ports. Look up "portknocking" for that.
But one question that remains is that I have read lot of news these days (for e.g., Russia vs. Estonia) where they say they say that Russians have DDOS'ed Estonia so badly that it has left the government, corporate and academic systems totally crippled. If DDOS is so powerful form of attack, why hasn't there been some kind of filtering done that can essentially prevent all these kinds of nastiness ? Or is this something that is insanely costly/impossible ? Or of course, plain bureaucracy ? Thanks again for your insights.
Current thread:
- Attacking a machine on network. John Pluffum (May 29)
- Re: Attacking a machine on network. Jason Ross (May 29)
- Re: Attacking a machine on network. Paul Sebastian Ziegler (May 30)
- Re: Attacking a machine on network. John Pluffum (May 30)
- RE: Attacking a machine on network. Mark Brunner (May 30)
- Re: Attacking a machine on network. Ryan Chow (May 30)
- RE: Attacking a machine on network. Murda Mcloud (May 30)
- Re: Attacking a machine on network. John Pluffum (May 30)
- Re: Attacking a machine on network. Alexander Klimov (May 30)
- <Possible follow-ups>
- Re: Re: Attacking a machine on network. sandeep . sandhu . in (May 30)
- Re: Re: Attacking a machine on network. savagemp5 (May 31)